Single Sign On trhough Java

[Former Member]

Hi Experts,

I am trying to pass the Windows Authenticated user credentials (the credentials of the user who has logged in to windows) to SAP EP 7.0 and to get the SAP Logon ticket from there using a stand alone java class/application.

I would be hghly obliged if you could help me out with some code examples on how to do the same.

Regards,

Amar

[Former Member]

If you want a non-SAP component to verify the logon ticket on it's own, then SAP provides an API for ticket verification which extracts only the user ID name from the ticket. Alternately you can use a web filter which does pretty much the same, but sends the user ID on as a header variable to the web server. See [SAP Note 442401|https://service.sap.com/sap/support/notes/442401] for more infos on the filters and search terms.

Cheers,

Julius

[tim_alsop]

Hi,

To use the credentials of user logged on to a domain at workstation, to create an SSO2 ticket, you need to use the HTTP negotiate protocol which is implemented in IE and Firefox and other browsers. This protocol requires that the web server also supports this type of authentication. In SAP NetWeaver Java stack you need to install/configure a login module which supports HTTP Negotiate. When done, the user can logon to windows, open browser and login to portal without being asked for userid and password. The login module can be obtained from SAP and it is called SPNEGOLoginModule, or you might want to consider a login module from a SAP Partner. To find what is available, I suggest you look in SAP EcoHub (http://ecohub.sap.com) and search for spnego.

Thanks,

Tim

[Former Member]

Thanks for the reply, but the SPNego is already setup in SAP EP, where it retrieves the User from the Active Directory and maps it to the UME user.

I think I wsa not clear in the question.

What I needed was actually how I could pass the User Credentials through a stand alone java class through a HTTP request to SAP EP and retrieve the SAP Logon ticket from EP.

I hope now it is clearer.

Thanks and best regards,

Amar

[tim_alsop]

Amar,

ok, so you are coding your own java client app and this app needs to authenticate to EP such that an sso2 ticket is issued ? If this is correct, when the sso2 ticket is issued by SAP, will your client app take care of this ticket for subsequent connections to the SAP system, so that user will not be authenticated every time a URL is accessed ? If I understand correctly, you want to replace the browser (used in my earlier description) with your own client app, such that the user of the client app gets an SSO experience ? Can you confirm if this is correct ?

Thanks,

Tim

[Former Member]

Tim,

Exactly. I am writing a Java class that gets the User credentials of the logged in user in the desktop and sends the same to the SAP EP to get the SAP Logon ticket, which then is used by the application that wants to call the SAP backend system. The calling system is a .NET application. For this we have set up the IIS Server filter.

Thanks,

Amar

[tim_alsop]

Amar,

Since you have already implmented an spnego login module on server, your java client can take advantage of this, but will need to implement the http negotiate protocol in order to securely use the credentials of logged on user. Effectively you would have to code the same as what is implemented in the browser, but it would be coded in java and run on each client machine along with your client app.

I notice you mentioned .net, so can I assume that your java code runs on .net server and the user accesses this app via a browser ? If so, then this could change the way you solve this problem. Please explain more about the .net involvement and whether a user runs your java app using browser or not. Previously I was thinking the java code was running on users workstation outside of the browser.

Thanks,

Tim

[Former Member]

Tim,

Presently, I am trying to just make a java application to retrieve the SAP Logon ticket from SAP EP user the user credentials. The .NET part would be done later by the .NET team.

The java code would run outside the browser, on the user's workstation. Presently i am doing a POC to show how a Java code can be written for getting the SAP Logon ticket from EP.

If you were talking about the Authentication by negotiation, then that is taken care of already.

Thanks,

Amar

[tim_alsop]

Amar,

The SAP CreateTicketLoginModule will not issue an SSO2 ticket unless a login module earlire in the JAAS stack has authenticated the user. This is why I was asking about authentication. Your java code woud have to authenticate to the SAP system using same approach that is used by the browser, and the Java engine will send your client code an SSO2 ticket just like it does if a browser is used.

In future releases of NetWeaver, the SSO2 propriatory ticket will be no longer used and instead SAML will be used. So, perhaps you need to think about using SAML if you are just working on a POC ?

Thanks,

Tim

[Former Member]

Tim,

Thanks. Do you have any idea how to authenticate my user against the SAP NW Java stack? When I logon to EP through the browser, no authentication details are asked for, because the browser setting are so and the SPnego is setup. What else do i have to do to get the SSO ticket?

I am also learning about SAML, but want to finish with the SSO2 POC before I go there. I can add the code I have made if you need to see it?

Amar

[tim_alsop]

Amar,

To authenticate to your java stack so that it will issue a ticket, since you have configured spnego login module, you would need to use gss-api, spnego and kerberos protocols in your jave code and follow the RFCs to make sure that you handle the authentication the same way that the browser does it - I can offer you a commercially supported product that woud do this for you and can be called by your java client code.

When your java code is running on .net server, you can use the spnego (e.g. integrated windows auth) capability included in the users browser, and make the .net server just pass these creds from users browser to the sap login module. Hopefully you can see that using java code on workstation outside of browser is much harder than if a real browser is involved.

Another thought ... perhaps you can add another login module to your jaas auth stack, e.g. http header ? Then you can authenticate the user from your java code by passing http header with user id and this user will be used to create the sso2 ticket and and return it to your code. This would be much easier for a POC, but perhaps not secure enough for after POC is complete.

Hope this helps ?

Thanks,

Tim

[Former Member]

Hi Tim,

Thanks for the explanation. Well, I tried to use GSS Api's in my code, but the GSSName is throwing an exception that : Exception = GSSException: Invalid name provided (Mechanism level: Could not load configuration file c:\winnt\krb5.ini (The system cannot find the path specified))

Now I have not worked on GSS APIs so I have no clue what this might mean. I am working on Win XP, not NT. So is that an issue, because the GSSName has only nametypes for NT?

Regards,

Amar

[tim_alsop]

Amar,

You are digging a hole which is very deep. Making gss-api work with SAP SPNEGO login module will be very hard if you are not using the correct protocols. The GSS token sent to server over HTTP needs to be wrapped in an SPNEGO token using ASN-1, so you need to have SPNEGO support in the GSS library you are using, you also need an ASN-1 encoding/decoder, and you also need the Kerberos infrasturcture used by the GSS library to access credentials from the MS LSA cache. If you are not clear on these things, I suggest you don't try because it will take you a very long time to get it working. THis is why I suggested earlier using commercially supported solution, or changing to use HTTP header instead of spnego for this POC.

Thanks,

Tim

[Former Member]

Tim,

How do I go for the commercially supported solution? Or what would I have to do for the http header. I am actually making a http call to the EP url and sending the credentials through the http header itself.

Thanks,

Amar

[tim_alsop]

Amar,

I explained how to find commerically supproted products that use spnego in one of my earlier posts. I will give you a hint - I work for such a company

Yes, you need to pass spnego credentials in http header encoded in asn-1 format and containing the gss security token which is created after initialising a security context using the logged on users Kerberos TGT. If you are happy to code this then feel free, but it will take a long time if you are not familiar with this kind of approach and the technology and interfaces involved. I know it looks simple, but it isn't.

For http header, you can store the SAP user id in a custom http header variable name, and then configure the SAP HTTP header login module in your JAAS stack to read this header variable and then create the sso2 ticket from the name found in this variable. Clearly there are security implications of using this approach because you don't want any user to be able to send a http header to SAP and be authenticated ... However, for a POC it might be ok. You can find more info on http header login to SAP portal in SAP help library, where it explains how to add the login module to JAAS stack.

THanks,

Tim

[Andre_Fischer]

Hi Amar,

I have published a sample code to retrieve the SAP Logon Ticket from a SAP NetWeaver portal with Windows Integrated Authentication using SPNego's Login Module.

Sample Application: SSO with a .NET-Based Web Service Client Using SAP Logon Tickets

The .NET client uses .NET libraries that do the heavy lifting of using Integrated Windows Authentication.

It sometimes occured that one should not use the URL

"http://sapportal.mycompany.com:/irj/portal"

but

a URL that points to an existing component such as an iView or a JSP page.

Best regards,

André Fischer

Edited by: Andre Fischer on Nov 2, 2009 4:16 PM

[Former Member]

Hi Andre,

I have been trying the application mentioned in the article that you gave. I am actually trying to just retrieve the SAP Logon ticket by hitting the URL of the SAP EP, which has the browser level SSO setup properly. Now when I try to retrieve the ticket, the response I get from the EP is 400: Bad Request.

I would be highly obliged if you could let me know what the issue might be.

I tried passing the Network Credentials explicitly, that does not help either.

Regards,

Amar

[Andre_Fischer]

Hi Amar,

please check SAP Note 1243347 - portal User Agents .

Does this solve your problem ?

Best regards,

André

[Former Member]

Hi Andre,

I wsa just wondering how to get the URL of a iView, because as far as I know, the URL of any iViews in the Portal would be the same as the portal itself.

Or do we have to get the PCD location of the iView? But I do not see how that would help.\

Regarding the Note, I think we shall get the 200 OK response, but do we get the SAP Logon Ticket thereafter?

Reagrds,

Amar

[Former Member]

Hi Andre,

I tried to use the URL of an iView instead of the EP itslef, and it is throwing the same exception.

Now the note is valid only for EP 7.0 SP17 and above, or atleast SP15 patch 3. We are running on EP SP15. Is there any other way to get rid of the error?

Regards,

Amar