Unauthorised users accessing iviews through a direct URL

[Former Member]

Hi,

How do you prevent unauthorised users from accessing iviews through a direct URL? e.g. From the BeX Web Template on testing a query a URL is known, this URL can then be used by user who have no rights to view/ execute this report (after portal logon).

Can security zones be defined for the BeX iviews? If yes, how? Does setting the parameter Dcom.sap.nw.sz=true solve the problem?

Appreciate your input.

Many thanks,

Dharmi

[Former Member]

Hello,

Any ideas/ inputs?

Regards,

Dharmi

[Former Member]

Portal Catalog, open the iView editor and set the property 'Authentication Scheme' to required value.

I assume you have idea of portal role creation, assignment of Users groups with required permission.

Go to permission editor: 'System Administration' -> 'Permissions' -> 'Portal Permissions'.

folder: 'Security Zones' -> 'sap.com' -> 'NetWeaver.Portal' -> 'high_safety'

Cheers,

Bharath.

[Former Member]

Hi Bharath,

Thank you for the input.

Can you please be more specific as to which BW component ?

I navigated to

Go to permission editor: 'System Administration' -> 'Permissions' -> 'Portal Permissions'.

folder: 'Security Zones' -> 'sap.com' -> 'NetWeaver.Portal' -> 'high_safety'

There the rights are ok.

Best regards,

Dharmi

[Former Member]

Hi,

Setting the parameter -Dcom.sap.nw.sz=true does not help! Is this a kind of bug?

Regards,

Dharmi

[Former Member]

Hi,

This is the [problem|/message/8814902#8814902 [original link is broken]] we are experiencing, can somebody help in solving this issue from the portal side.

As, already mentioned in the earlier post , setting the parameter didn't help. The security zone for the BWReport is on Low_Safety, can that be changed to High_Saftey? How?

Thank you in advance.

Best regards,

Dharmi

[Former Member]

I guess you are going to have to give the users correct authority on the backend system...

What you could try to do it log the gateway in transaction SMGW and trap the program ID's. But I think that will mean a lot of hassle and maintenance and you will quickly have a headache trying to get it right at that level for many users.

Cheers,

Julius

[Former Member]

Thank you Julius. Do you have any idea how the problem could be solved from the portal side?

Regards,

Dharmi

[Former Member]

How Tou2026Configure Permissions for initial content in SAP NetWeaver Portal - helps in solving this issue.

[Former Member]

Hi

Try to have a look table HTTP_WHITELIST.

Perhaps this can resolve your issue