iview abap webdynpro error on web dispatcher (SSL Terminated)

[Former Member]

hi SAP Experts

Currently we are setting the SAP Web Dispatcher using SSL Terminated (see below)

Web Disptacher(HTTPS) <–> Enterprise Portal(HTTP) <–> ABAP Webdynpro for ESS/MSS component(HTTP)

Scenario :

When we open the ess page > personal information > personal profile (this page is not showing, the error stated javascript void(0)

let me know and thanks.

Regards,

Hariyono

[former_member250380]

I have resolved the issue. It was a combination of the WEB AS object 'WEBAS Path' and the port not being opened.

Thank you all for your suggestions.

Ron

[former_member232430]

Hi Fabrizio

We are trying to establish the same setup and I need to have some information provided in your profile. Is the SSL is configured at SAP web dispatcher or at SAP EP.

Thanks

jelani

[former_member250380]

Hi Guys,

I am trying to resolve the same error. When I click on the WDA application using the web dispatcher it doesn't do anything. When viewing the http watch it seems to be stopping on the following POST:

http://url.of.the.webdispatcher:1082/sap/bc/webdynpro/HRESS_A_MENU...

Here is my profile set up:

# SAP Web Dispatcher Ports

icm/server_port_0 = PROT=HTTPS,PORT=443, TIMEOUT=900

icm/server_port_1 = PROT=HTTP, PORT=1080

icm/server_port_2 = PROT=HTTP, PORT=1082

# Accessbility of systems and ports

wdisp/system_0 = SID=PRD,MSHOST=my.erp.host,MSPORT=8100,SRCSRV=*:1082

wdisp/system_1 = SID=EPP,MSHOST=my.ep.host,MSPORT=8101,SRCSRV=*.1080

The WDA application functions properly when not using the web dispatcher.

Can you please give me any suggestion?

Thank you,

Ron Fink

[Fabrizio_Irmici]

Hi Ron,

I show you my web dispatcher set up:

#-----------------------------------------------------------------------

#X.509-Based Logon to NetWeaver AS from SAP Web Dispatcher

#-----------------------------------------------------------------------

ssl/server_pse = /usr/sap/WDT/W00/sec/SAPSSLS.pse

ssl/client_pse = /usr/sap/WDT/W00/sec/SAPSSLC.pse

wdisp/ssl_encrypt=1

wdisp/ssl_auth=2

wdisp/ssl_cred = /usr/sap/WDT/W00/sec/SAPSSLC.pse

icm/HTTPS/forward_ccert_as_header = true

icm/HTTPS/verify_client=1

wdisp/add_clientprotocol_header = true

wdisp/ssl_certhost = <SAP Portal hostname>

#-----------------------------------------------------------------------

#Hostname in the certificate does not match the server name:

#-----------------------------------------------------------------------

wdisp/ssl_ignore_host_mismatch = 1

icm/HTTP/redirect_0 = PREFIX=/irj, FROM=/irj/*, FROMPROT=HTTP, PROT=HTTPS, HOST==<url of the web dispatcher>, PORT=443

icm/HTTP/redirect_1 = PREFIX=/, FROMPROT=HTTP, PROT=HTTPS, TO=/irj, PORT=443

icm/HTTP/redirect_2 = PREFIX=/, FROMPROT=HTTPS, PROT=HTTPS, TO=/irj, PORT=443

icm/HTTP/redirect_3 = PREFIX=/securelogin, FROM=/securelogin/*, FROMPROT=HTTP, PROT=HTTPS, HOST=<url of the web dispatcher>, PORT=443

#-----------------------------------------------------------------------

# Trace activation

#-----------------------------------------------------------------------

icm/trace_secured_data = 1

rdisp/TRACE = 3

#-----------------------

# One WD - Two Systems

#-----------------------

wdisp/system_conflict_resolution = 1

wdisp/system_0 = SID=TS8, MSHOST=<backend ECC hostname>, MSPORT=8114, SRCURL=/sap/;

wdisp/system_1 = SID=WDT, MSHOST=<SAP Portal hostname>, MSPORT=8100, SRCURL=/

I hope that it could be useful for you.

Fabrizio

[former_member250380]

Thank you Fabrizio. It is very similar to what I am trying. I will compare to what I have to make sure I haven't missed anything.

Ron

[rich_rendle]

Thanks for posting that configuration, very helpful.

Could you comment on whether its possible to follow that pattern with more than 2 systems?

I noticed that you are mapping based on URL prefixes and that / goes to Portal and /sap goes to  ECC.

In our case, we have about 7 systems that need to be connected but we are not having any luck. Since multiple backend system URLs start with /sap how would you accomplish? Is it possible?

Thanks in advance.

[Fabrizio_Irmici]

Hi guys,

I have exactly the same problem.

I configured Web Dispatcher for the ERP system too, but I've got always an error when I try to open the WDA.

I actually set a sfollows:

#-----------------------------------------------------------------------

# SAP Web Dispatcher Ports

#-----------------------------------------------------------------------

icm/server_port_0 = PROT=ROUTER,PORT=443,EXTBIND=1

icm/server_port_1 = PROT=HTTP,PORT=80,EXTBIND=1

icm/HTTP/redirect_0 = PREFIX=/irj, FROM=/irj/*, FROMPROT=HTTP, TO=/irj, PROT=HTTPS,

HOST=<URL of the web dispatcher>, PORT=443

icm/HTTP/redirect_1 = PREFIX=/sap, FROM=/sap/*, HOST=<URL of the web dispatcher>

wdisp/system_0 = SID=SPT, MSHOST=172.20.3.xxx, MSPORT=8100, SRCURL=/irj;/logon;/nwa

wdisp/system_1 = SID=TS8,  MSHOST=172.20.3.xxx, MSPORT=3214, SRCURL=/sap, SRCSRV=*:80

I obviously want that the Portal calls the ERP System passing through the dispatcher that redirects the call to the message server of the ERP System, because I can't directly call the ERP System (not exposed to the web for security reason)

How could set the Web Dispatcher parameters?

Thanks

Fabrizio

[Former Member]

In addition to Web Dispatcher configuration you need to configure the portal system landscape accordingly, the system object (WebAs, ITS) for the backend system must point to your Web Dispatcher.

[Fabrizio_Irmici]

Hi Samuli,

you're right, I have to configure the portal system landcape in order to point to my Web Dispatcher.

I completed this configuration, but now I have to distinguish the requets according to the target system (Portal or Backend)

I followed this link:

http://help.sap.com/saphelp_nw73/helpdata/en/c5/ec466f5544409982c7d3ca29ce1ad3/content.htm

I worked on the "Assignment using URL prefixes", but I need that all request go the Portal, except request starting with /sap/bc/webdynpro.

How caoul I set the parameters? Could you help me?

With the following configuration all the incoming request go the Portal...

wdisp/system_0 = SID=TS8, MSHOST=ms_erp_ip, MSPORT=8114, SRCURL=/sap/bc/webdynpro

wdisp/system_1 = SID=SPT, MSHOST=ms_portal_ip, MSPORT=8100, SRCSRV=*:*, SRCURL=/

wdisp/system_conflict_resolution = 2

Regards,

Fabrizio

[Former Member]

Setup individual DNS aliases for both the portal and the backend and configure destination determination accordingly based on the hostname.

[Fabrizio_Irmici]

Hi Samuli,

I followed your advise and I successfully installed the HTTP scenario, but I've got problems with HTTPS scenario, bacause I found this error in the SAP Portal log:

ERROR => IcmConnInitServerSSL: SapSSLSessionStart returned (-25): SSSLERR_NO_SSL_REQUEST [icxxconn_mt. 1689]

In my opinion there is a connection problem changing from HTTPS protocol (between Web Dispatcher and the Portal) to HTTP protocol (between Portal and the ERP backend system)

Regards,

Fabrizio

[Former Member]

You shouldn't run the portal in a mixed mode, users will get security warnings. Either terminate SSL in the Web Dispatcher and use HTTP from WD to portal and portal to backend or configure HTTPS all the way.

[Fabrizio_Irmici]

Hi Samuli,

I'm using X.509 Client Certificate as logon method, so I set an HTTPS connection between the client (user with a browser) and the SAP Portal (there is a Web Disptacher in the middle).

I don't understand if SSO can work with this mixed mode, maybe I should set another type of connection between the SAP Portal and the ERP backend system ABAP.

Regards,

Fabrizio

[Former Member]

Yes, you can pass the user certificate as a header variable to both AS JAVA and AS ABAP. See the attached link for details.

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/48/9ab5d73e6d062be10000000a42189d/frameset.htm

[Former Member]

Hello Samuli,

I  have installed standalone WD and mapped my ERP and BI system to it.

i can able to open the url via WD.

Issue is after entering the logon details if i click next logon button nothing happen.

below is my parameter profile and ptablefile please check and let me know do i need change any think.

#-----------------------------------------------------------------------

icm/server_port_5 = PROT=HTTP,HOST=DRSWDPD1,PORT=81$$

icm/server_port_0 = PROT=HTTP,HOST=DRSWDPD1,PORT=8188

icm/server_port_2 = PROT=HTTP,HOST=DRSWDPD1,PORT=8199

icm/server_port_3 = PROT=HTTP,HOST=DRSWDPD1,PORT=8177

icm/server_port_4 = PROT=HTTP,HOST=DRSWDPD1,PORT=8166

icm/server_port_1 = PROT=HTTP,HOST=localhost,PORT=81$$

icm/HTTP/admin_0 = PREFIX=/sap/admin,DOCROOT=$(DIR_DATA)$(DIR_SEP)icmandir,AUTHFILE=$(icm/authfile),PORT=81$$

ssl/ssl_lib = $(DIR_EXECUTABLE)$(DIR_SEP)$(FT_DLL_PREFIX)sapcrypto$(FT_DLL)

sec/libsapsecu = $(ssl/ssl_lib)

ssf/ssfapi_lib = $(ssl/ssl_lib)

#-----------------------------------------------------------------------

wdisp/system_0 = SID=SF1, MSHOST=sf1.sytec.passhe.edu, MSPORT=8102, SRCSRV=DRSWDPD1:8188

wdisp/system_1 = SID=SB1, MSHOST=sb1.sytec.passhe.edu, MSPORT=8132, SRCSRV=DRSWDPD1:8199

wdisp/system_2 = SID=DF1, MSHOST=df1.sytec.passhe.edu, MSPORT=8103, SRCSRV=DRSWDPD1:8177

wdisp/system_3 = SID=DB1, MSHOST=elm.sytec.passhe.edu, MSPORT=8133, SRCSRV=DRSWDPD1:8166

#icm/HTTP/mod_0 =PREFIX=/,FILE=/sapmnt/WD2/profile/icm_filter.txt

#icm/HTTP/auth_0 = PREFIX =/, PERMFILE=K:\usr\sap\DD1\ptabfile.txt

#icm/HTTP/auth_0= PREFIX=/, FILTER=SAP

wdisp/permission_table = K:\usr\sap\ptabfile.txt

PTABFILE

P    /sap/bc/webdynpro/sap/hress_a_rep_us_online_w2

P    /sap/public/bc/ur/Login/assets/*

D    *

Regards,

Manoj J

[former_member146669]

Dear Samuli,

""In addition to Web Dispatcher configuration you need to configure the portal system landscape accordingly, the system object (WebAs, ITS) for the backend system must point to your Web Dispatcher.""

I got a confuse of above.

Per my understanding, if I input "WDISP.domain.com:8000" the ITS host name or WebAS hostname, then all users accessing the iView (no matter from outside via WDisp or directly Internal Network) will go to WDISP URL? and that is not a good idea for office users..

I assume the above setting is talking above System Admin > System Config > System Landscape > System iView properties.

Plesae advise.

I also have the exactly same envirn and  problem ......  i.e. access WebDynpro ABAP portal iView will call directly to ERP ABAP backend directly (but not via WDISP) and failed.....

Many thanks!

Gary

[Former Member]

You understood correctly. One can use dynamic system resolution, multiple portals, multiple WDs, internal and external name resolution, etc. to overcome the problem. Create a new discussion thread if you need further help.

[Former Member]

Hi Hariyono,

Have you got it resolved.? I am facing the similar issue. Could you please share the fix.?

Thanks

[Former Member]

Have you setup Web Dispatcher also for your backend system? In case of WDA, the WDAs are accessed directly between the client and the backend system hosting the WDA.

Use HTTPWatch in your browser to make sure what URLs are being generated, they should all go through the Web Dispatcher.

[Former Member]

hi Samuli,

Yes, i have setup the web dispatcher to connect my enterprise portal, the web dispatcher profile follow the setting below :

SAPSYSTEMNAME = WDP

SAPGLOBALHOST = WRS-WEBDISP

SAPSYSTEM = 00

INSTANCE_NAME = W00

DIR_CT_RUN = $(DIR_EXE_ROOT)\$(OS_UNICODE)\NTAMD64

DIR_EXECUTABLE = $(DIR_CT_RUN)

DIR_PROFILE = $(DIR_INSTALL)\profile

_PF = $(DIR_PROFILE)\WDP_W00_WEBDISP

SETENV_00 = PATH=$(DIR_EXECUTABLE);%PATH%

#-----------------------------------------------------------------------

# Accesssability of Message Server

#-----------------------------------------------------------------------

rdisp/mshost = "dev ep server"

ms/http_port = 8101

#-----------------------------------------------------------------------

# Configuration for medium scenario

#-----------------------------------------------------------------------

icm/max_conn = 500

icm/max_sockets = 1024

icm/req_queue_len = 500

icm/min_threads = 10

icm/max_threads = 50

mpi/total_size_MB = 80

#-----------------------------------------------------------------------

# SAP Web Dispatcher Ports

#-----------------------------------------------------------------------

icm/server_port_0 = PROT=HTTP,HOST="web dispatcher server",PORT=81$$

icm/server_port_1 = PROT=HTTP,HOST=localhost,PORT=81$$

icm/server_port_2 = PROT=HTTPS, PORT=443, TIMEOUT=900, PROCTIMEOUT=900

icm/HTTP/admin_0 = PREFIX=/sap/admin,DOCROOT=$(DIR_DATA)$(DIR_SEP)icmandir,AUTHFILE=$(icm/authfile),PORT=81$$

#-----------------------------------------------------------------------

# Start webdispatcher

#-----------------------------------------------------------------------

_WD = $(DIR_EXECUTABLE)\sapwebdisp$(FT_EXE)

Start_Program_00 = local $(_WD) pf=$(_PF)

SETENV_01 = SECUDIR=$(DIR_INSTANCE)/sec

ssl/ssl_lib = $(DIR_EXECUTABLE)$(DIR_SEP)$(FT_DLL_PREFIX)sapcrypto$(FT_DLL)

sec/libsapsecu = $(ssl/ssl_lib)

ssf/ssfapi_lib = $(ssl/ssl_lib)

#SSL Terminated

wdisp/ssl_encrypt = 0

DIR_INSTANCE = C:\Program Files\SAP\SAPWebDisp

icm/HTTPS/verify_client = 0

ssl/ssl_lib = C:\Program Files\SAP\SAPWebDisp\sapcrypto.dll

ssl/server_pse = C:\Program Files\SAP\SAPWebDisp\sec\SAPSSLS.pse

icm/HTTP/redirect_0 = PREFIX=/, TO=/irj/portal, PROT=HTTPS, HOST="web dispatcher server", PORT=443

wdisp/handle_webdisp_ap_header = 1

wdisp/add_clientprotocol_header = 1

beside that i also check the httpwatch, when i open the ess page, the url showing the link is pointing to the ecc abap server on http protocol.

Regards,

Hariyono

[Former Member]

I asked have you configured Web Dispatcher to connect to your backend server, meaning the ERP system. Looking at your configuration, you haven't. See the attached link on how to configure Web Dispatcher for multiple systems.

http://help.sap.com/saphelp_nw73/helpdata/en/c5/ec466f5544409982c7d3ca29ce1ad3/frameset.htm

[Former Member]

hi Samuli,

the webdispatcher doesn't connect to ERP System, it was only connect to the Enterprise Portal Server, the abap webdynpro is opened via Portal iview.

Regards,

Hariyono.

[Former Member]

You need to start reading and understanding what people write to you.

In order to access any WDA application from an ERP system, you will have to configure Web Dispatcher also for that ERP system. Having the WDA inside a portal iView doesn't change anything, the access will still be between the client and the ERP backend system.