SSO Configuration between EP & IBM HTTP server

[Former Member]

Hi Expert,

How to achieve the SSO configuration between EP & IBM HTTP Server?.

Scenario:: BO Web Application server hosted on IBM HTTP Server, Users are logged in via EP-Portal

and access the reports of BO, which hosted in IBM HTTP Server. Any information on this is highly appreciated.

Thanks in advance.

Regards

Ahamed

[mvoros]

Hi,

you should check what authentication methods are supported by that application server. Usually, SSO in SAP environment you use SAP Logon Tickets but as you can see from the name it uses proprietary format. IBM might support it. SAML is a more open sulotion supported by many vendors but you need you check what is supported by your systems.

Cheers

[Former Member]

Hi Martin,

Thanks for you inputs, we have opened a OSS note with reference to this.

They are suggesting me to go with "SAPSSOEXT" , method to achieve this.

We would be trying this option shortly, if you can share any information related to this will be helpful.

Regards

Ahamed

[mvoros]

Hi,

I haven't seen that message but it looks like you need to write your own authentication module for your IBM system. EP will issue a logon ticket. SAPSSOEXT is a library which allows you validate logon ticket and extract data. So you need to export public key used for logon ticket and then on IBM side you need to read logon ticket, use this library to extract data, map SAP user to IBM user and log this user into the system. Don't forget to validate expiry date of logon cookie. You can download documentation for SAPSSOEXT from service.sap.com/swdc. It's part of the package for SAPSSOET.

Cheers

[Former Member]

Hi Martin,

Thanks for the valuable inputs, I need a clarification here.

With respect to the document for invoking the "ssosamp" command, there is a input file "<ticket_file>" (from where do we get t his file?, I have downloaded the verify.pse from portal and included the require libraries in my path (sapssoext & sapsecu).

Is this program "ssosamp" must be running in background on IBM server? kindly explain.

Regards

Ahamed

[mvoros]

Hi,

first, I guess you are not supposed to use this program directly. It should be just an example. Your web server needs to get MYSAPSSO2 cookie from user and validate it using SAPSSOEXT library. If everything is OK then it should create a session for that user. This needs to be developed and it depends on external product. That file which you need to pass to ssosamp needs to contains MYSAPSSO2 cookie. So if you want to test it then go to your portal, get cookie from IE (you can use Developer tools) and paste it to file and run ssosamp.

Cheers

[Former Member]

Hi Martin,

We are unable to recieve the cookie "MYSAPSSO2", from the pagesource of browser ("Firefox"), the EP is generating the

cookie but at the server side (JSP) we are not able to get this library.

Do we have to attach this cookie exclusively to an iview or any other settings we are missing here?

Thanks in advance.

Regards

Ahamed

[mvoros]

Hi,

so can you see cookie in Firefox? There are some add-ons which can help you to see what you get from EP. Do those two systems have same domain? [SAP documentation|http://help.sap.com/saphelp_nw70ehp1/helpdata/en/e0/fa984050a13354e10000000a1550b0/content.htm].

Cheers

[Former Member]

Hi Martin,

- We could see the MYSAPSSO2 cookie carrying the value of the ticket in our Firefox.

- Our EP server & BO server are in two different domain.

- Since our BO Application has been hosted on IBM Web Sphere application, no Webserver filter

are available, so I think the "Documentation " not applicable to our scenario, correct me If I am wrong.

thanks for your support.

Cheers

Ahamed

[mvoros]

Hi,

if a cookie is generated for a domain only connection to that domain can read those cookies. So it looks like that EP generates a valid cookie but browser does not send it to IBM HTTP server because domains don't match. But you can configure EP to generate multiple cookies for multiple domains. That's described in that linked documentation.

Cheers

[Former Member]

Hi Martin,

We have achieve the SSO between our SAP -EP & SAP-BO by using a token method refered in

SAP -Note# 1201982 - How to create a logon token using the .NET SDK for use in OpenDocument.

Thank you very much for your inputs on this issue.

Regards

Ahamed

[Former Member]

SAP -Note# 1201982 - How to create a logon token using the .NET SDK for use in OpenDocument.