NWBC and SNC ?

[tim_alsop]

Hello,

I wondered if somebody could help me with NetWeaver Business Client Security question ? I know that with SAP GUI, SNC is used for external authentication - what happens when NWBC is used ? Is NWBC also able to use SNC ? I am trying to understand the user experience for somebody using NWBC - I assume it has a logon screen, so is this using same authentication that is used by SAP GUI ?

Thanks,

Tim

[Former Member]

Hi Tim,

You can connect it to a portal (Java stack only) and the config is within the ICM on the ABAP side, so I see only the options of HTTP and HTTPS protocols. At least for the initial authentication.

There is an option to use integrated SAPGui views within the Business Client, but for that you have to activate GUI-scripting in the backend and frontend which is not default or recommended config.

Can GUI-scripting still be used in combination with SNC? I would think so.

Cheers,

Julius

[tim_alsop]

Julius,

I found in SAP note 1310185 it explains how to configure NWBC to use configuration entries from saplogon.ini. This can be done so that user can logon using SNC auth, if SAP GUI is configured to use SNC auth for the system involved. This does not require a shortcut to be configured.

Why did you mention scripting ? Surely you are not suggesting that scripting is used to enter users password ?

Thanks,

Tim

[Former Member]

Bingo! It uses [SAP shortcuts|https://service.sap.com/sap/support/notes/1310185] .

Shortcuts support [SNC parameters|https://service.sap.com/sap/support/notes/103019] amongst several other features as well...

My personal recommendation would be to avoid it.

Cheers,

Julius

[tim_alsop]

Are you suggesting that NWBC is avoided ?

Surely this is the future as far as SAP are concerned since it offers performance improvements for webdynpro apps, and integrates web enabled apps and traditional SAP GUI enabled apps into one user interface. Anyway, this forum is not for discussing why NWBC is used by SAP customers - one of our customers wants to know how to use SSO with this product, and hence my reason for opening this thread.

Thanks,

Tim

[Former Member]

Hi Tim,

Of course I am not saying that the NWBC should be avoided.

What I meant was that the SAPGui scripting should be avioded, which by implication (see https://service.sap.com/sap/support/notes/1136338 ) means that SAPGui transaction "views" integrated into the Business Client need to be avoided as well.

From what I can make out, these transactions are started by the NWBC via shortcuts, if used.

Cheers,

Julius

[tim_alsop]

Julius,

if SAP GUI transaction views in NWBC should be avoided, doesn't this make NWBC into a web browser ? I thought one of the biggest reasons for using NWBC is that the user gets GUI and Web content in same window/tool.

For SSO, I can see that Web access to Integrated ITS services can be done using our TrustBroker Adapter product. for GUI it seems that NWBC can be configured to use saplogon.ini entries and will therefore use SNC auth. This is good, and very clear to me. I am not clear why scripting is being mentioned - surely to do this there is no scripting required, so why is it being discussed ?

Thanks,

Tim

[Former Member]

> For SSO, I can see that Web access to Integrated ITS services can be done using our TrustBroker Adapter product.

Yes, that is HTTP / HTTPS between the client and the ICM on the server side so I dont see the problem either and your adapter should work the same. Try it and let us know?

> I am not clear why scripting is being mentioned - surely to do this there is no scripting required, so why is it being discussed ?

The documentation and notes mention that if you want to use an "integrated SAPGUI" running on the client server and started from the NWBC, then you need to enable SAPGui user scripting on the server and the client side.

That is what I would avoid unless really necessary.

By default scripting is disabled. Try it with the default settings first. According to the above SAP Note 1136338 and [the documentation|http://help.sap.com/saphelp_nw70ehp1/helpdata/en/45/a6142e45db0d36e10000000a114a6b/content.htm] it won't work.

Cheers,

Julius

[tim_alsop]

Julius,

ok, thanks for explaining. I am clear now - still not sure why scripting would be required though. The note you listed doesn't give a reason either ...

I consider this question answered, and will pass on this info to my customer. Of course, if anybody else has anything to add, I will be interested to hear.

Regards,

Tim

[clinton_jones2]

One might use scripting to do regression test using a 3rd party testing tool or eCATT

[Former Member]

You don't need gui scripting activated to be able to run ecatts

[Former Member]

> ... regression test using a 3rd party testing tool or eCATT

A customer would normally not be doing this in a production system either.

Much like SCC4 and SE06, the parameter for gui scripting is a usefull high-level check against low-brainer tools in production.

If a solution forces you to leave the client open for changes or gui scripting enabled, then it is a design error in my opinion. Use at own risk.

Cheers,

Julius

[Former Member]

Hi Tim,

We are working with NWBC and our first authentication is with ABAP system.

I didn't understand if it is possbile to use SNC with NWBC ...

Also I tried what is suggested in note 1310185

but it didn't help me.

Please advise,

Dimitry

[tim_alsop]

Dimitry,

This thread is already closed and marked as answered. If you have a new question and want somebody to help, open a new thread. You can refer to this thread using the URL if you feel it is useful to mention another thread in SDN.

Thanks,

Tim