cancel
Showing results for 
Search instead for 
Did you mean: 

SSOTicket Extraction from Portal Session

Former Member
0 Kudos

We have a mobile application that uses the SAP .Net Connector 3.0 to call Function Modules.  The .Net Connector uses the MYSAPSS02 cookie that we extract from our SAP Portal site after doing an HTTP POST request passing the username and password to establish a session.

So there are a few recurring issues with this logic that we are trying to overcome.  First is the null response we often receive from Portal.  The code POST’s the request, and looks for the MYSAPSS02 cookie in the response and very frequently the cookie is not found in the response.  We have yet to find a sound rhyme or reason as to why the response comes back null.  When checking the J2EE logs all we got was "Reason=[Authentication did not succeed.]#". Definitely was not a password issue because the .Net connector throws a completely different error if the wrong credentials are passed.

The other issue is that quite often, the SSO cookie sent in a response, that we store gets rejected by the backend.  Throwing an error to the effect of “the system is unable to interpret the SSO ticket received” which results in the loss of the current session forcing our users to have to re-authenticate.

So far this issue has gone unresolved and as the application user base grows, it has put more strain on the logic.  Just a few other areas of note, the application itself is hosted on a Windows Server 2008.  It does ultimately reside at the same sub domain level as our Portal Server(i.e. myportal.domain.com & mobileapps.domain.com).  After initially testing whether it was a routing issue, we pointed our application to 1 specific backend server, and 1 specific portal server and the result made no positive impact.  Hopefully someone can help shed some light on what may be causing this.

Accepted Solutions (0)

Answers (2)

Answers (2)

MarkusTolksdorf
Product and Topic Expert
Product and Topic Expert
0 Kudos

Hi Bernard,

are you using the latest patch version of the .NET Connector 3.0? It should actually not matter, but it's always a good idea to use the latest NCo patch level. How do you pass the SSO ticket to NCo? Did you implement your own variant of an IDestinationConfiguration? Or do you create custom destinations and set the SSO property? What do the backend logs tell you?

Best regards,

Markus

Former Member
0 Kudos

Hi Bernard,

Make sure you always use FQDN while using portal.

I think SSO ticket is not interpreted after a particular time due to SSO ticket timeout.

" Please set the timeout value for the security sessions (default 27h)

and the timeout value for the SSO ticket (default 8h) to the same value.

It should be a value that is higher than the maximum  working time of an employee, e.g. 16 hours. "

1.     Login.Ticket_Lifetime = 8h

2.     Session Expiration Period (SSO ticket time out)= 280000 msec = 8h

Can you please review Note 842635 .

Maintain your sessions according to this note.

Hope it helps.

Best regards,

Prem

Former Member
0 Kudos

Thanks for your reply.  We are currently using FQDN's for connection and our Ticket Lifetime and Session Expiration Period are already set to 8 hrs each.

Former Member
0 Kudos

Hi Bernard,

Check out the below link if it helps

http://scn.sap.com/community/web-dynpro-java/blog/2013/07/25/session-expiry-prob-in-sap-j2ee

Best Regards,

Prem