Accessing the Logon User Exit from the Internet using an ITS Service

[Former Member]

I can access the Logon User Exit (EXIT_SAPLSUSF_001) from R/3, but not from the Web using an ITS service. What am I missing in order to access the Logon User Exit from the Web. The ITS service was created from an ABAP screen program.

Thanks

david yee

[Former Member]

The SAPGui logon exit is called after successfull authentication has been completed and after a SAPGui session has been attached.

If you logon via RFC, WebGui, ICM or the Wgate then this exit does not trigger.

What are you wanting to add to your code after the logon ?

An solution I have used is to create a wrapper RFC for a BAPI and create a webservice for the wrapper. Before calling the BAPI you can do whatever you want to from a security perspective.

But for that you need to have an appropriate BAPI...

Please explain what you want to do and what you would have wanted in the exit. Often there is a better way.

Cheers,

Julius

ps: I moved this to the security forum.

[Former Member]

Immediately after logon we want to delete a record from a custom database table, with the userid as the key. This record is created using a web application once the user proves authentic, as an added security. The user is then allowed to navigate freely among the multiple web applications for this session. Once the user logs off or closes the browser the user has to re-authenticate.

Thanks,

david yee

[Former Member]

Do I understand correctly?

=> So they first need to logon via SAPGui to activate the access to the web applications for the ITS.

=> If they use the ITS within a certain time after authenticating, then the "flag" should be removed to ensure that they can only use it once.

=> Subsequent attempts to use the ITS, will require to login once via SAPGui again to activate the "flag".

The other option is to write your own logon module for the ITS. This is possible (at least it is / was for the external ITS) but not as easy as a simple sales report with some columns...

However I am uncertain whether the effort is warranted, to be honest.

Cheers,

Julius

[Former Member]

I guess my previous reply was confusing. I will explain our process. We have a group of ITS services that can be accessed during one logon session. Some of these services display confidential information that we have added another security check. Whenever the user enters or re-enters these services the security check is requested, it's the same security check for these services. Our users are unhappy to have to repeat this security check, and have requested that the security check occurs only once per session. Our solution is to enter the user id in a custom table the first time the user passed the security check, then subsequent request for security check is bypassed if the user id is found in the table. When the user logs off or exit the browser the user must pass the security check again. Our solution is to remove the used id record on logon. Hope this is clearer.

Thanks

david