How to read user name - SAML2

[Former Member]

Hi,

I've get configured our NW Gateway system (NW 7.31) with external identity provider by SAML2, so our web apps (web dynpro and SAPUI5) are now accessible for people who don't have account in our SAP system, but have access to our other system (nonSAP). My question is how to read user name of this user authenticated and authorized on external server in ABAP code of our web apps?

Many thanks for answer Jiri.

[Former Member]

Hi Neuzil,

what do you mean by user name? The sy-uname gets filled just as with every other authentication method.

Regards,

Patrick

[Former Member]

Hi,

thanks for reply. I think in sy-uname will be some default communication user, but I need user name used for authentication on nonSAP portal. Scenario:

WD App on Gateway -> user click on logon -> redirected by SAML2 to nonSAP portal -> user log in by user name and password existing in nonSAP system -> redirected back and logged in to WD app on Gateway: I need the user name which user used for logging to nonSAP system.

Thx Jiri

[Former Member]

Hi Jiri,

just to get you right, in your approach, the users do not have any account on the backend (as in this case, you could just use trusted RFC)?

Maybe I misunderstand your question but my approach would be to add this field to the data model on the backend (if it is not allready there) and on the gateway system fill this field with the contents from sy-uname when doing the call to the backend.

BTW: I would suggest you ask this question over in the SAP NetWeaver Gateway forum, as there might be other options as well.

Regards,

Patrick

[Former Member]

Hi Patrick,

and do you know how can I retrieve this user name from SAML2 response directly on Gateway system?  - you are right that I can then save this user name to one field of the data model.

Or do you think I can create my own login screen on gateway (here I can save typed user name) and then perform SAML2 authentication by my own?

Thanks Jiri

[Former Member]

Hi Jiri,

I'm referring to the gateway system. If you do authenticate there via SAML2, the users need to be there as well, then you can retrieve this info via checking sy-uname. If this is not the case, for example beacuse the identity used to authenticate at the gateway system is allways the same, you are pretty much out of luck, as the ABAP system to my knowledge neither supports SAML2 attribute queries nor do I know how to access additional attributes which might be part of a SAML2 message in ABAP. The only thing you then could do is to add the info as part of the initial request for instance as parameters to the request.

Regards,

Patrick

[Former Member]

Hi Patrick,

I will try to describe situation:

we have configured SAML2 authorization agains our nonSAP portal for our gateway system. Then I created simple SAPUI5 application and in SICF t-code I selected SAML2 as authentication method. When the user open url with our SAPUI5 application he is automatically redirected to our nonSAP portal, where when is successfuly logged in is redirected back to SAPUI5 application on Gateway system. But here I have the problem, because I need user name used for logging in in nonSAP system for showing right data for actually logged user.

If I create users in Gateway system, where is the reason for SAML2? If I have users in gateway system, I can use std. SAP logon....

Many thanks Jiri

[Former Member]

Hi Jiri,

even with SAML2, you have to have a user in the system that matches the credentials provided by the SAML2 IdP, you just do not need to provide the username and password to the end user. So when you access a gateway system with authentication set to SAML2 via a SAPUI5 application, some user needs to be known to the gateway system.

You can customize, what information is provided by the IdP to determine the SAP user, this can be the email address of the user (which then would be the identifier contained in the SAML assertion). If you have a one to one relationship via user on the IdP and SAP user, you might be able to just revert this mapping via the info in the SAML2 mapping tables. In other cases, I do not know of any reliable method to determine the SAML assertion which lead to the creation of a session.

The gateway system can forward the info on the current user either in payload or via identity propagation (preferred based on your use case) to the backend system.

If you want to restrict access to data per user, I would recommend to use authorizations. In this case the recommendation would be to provision the users to the backend system as well and use identity propagation. Please keep in mind, the users not necessarily will be able to access the backend system, as long as you permit them to log in only via SSO and control the access via the SSO mechanisms.

The reason for using SAML2 is to achieve SSO between systems, also it allows the creation of users on demand, so you do not have to provision the users first but the user will be created when he authenticates via SAML2. For more information on SAML2, please see the SAML2 overview in the docs.

[Former Member]

Hi Patrick,

thru sec_diag_tool I'm able to see SAML2 response from my identity provider. I can see that in SAML2 attributes I have personal number which I have in external system - and I have same number in HR master data for each person in backend SAP system...so my question now is how to read these saml2 attributes in my ABAP code:

part of the SAML2 response:

     <saml:Attribute Name="https://whoami.cesnet.cz/attribute-def/tcsPersonalID"

                     NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

       <saml:AttributeValue xsi:type="xs:string">

       23060@vutbr.cz</saml:AttributeValue>

     </saml:Attribute>

Thanks Jiri

[Former Member]

unfortunatly you can't according to my informations. Only the diag tool is able to see the information for debugging purposes.

Regards,

Patrick

[mvoros]

Hi,

I assume that you have one service user that is used to execute gateway services and you map every external user to this user. I don't think that you will be able to get original user. I am not sure even if identity provider passes this info to service provider. I guess it issues authentication token for your service user only.

Cheers

[Former Member]

Hi,

yes, you are correct. We have Gateway, we have backend SAP system and we have user authenticated on our nonSAP portal by SAML2 - this scenario is working - but I need the user name from the portal - because every user has it's own data in backend system.

Many thanks Jiri

[mvoros]

Hi,

I haven't tested it but I don't think that email address is passed back to service provider. I assume that an identity provider just issues a logon ticket for a service user. So it's quite possible that service provider never gets an email address. You could verify this by sniffing SAML token.

I would strongly advise against creating custom logon screen that would capture email address. Security is not a good place for creative solution.

Maybe take a step back. You mentioned that you have a separate box for GW. Why can't you create those users on this box and do not use service user? As far as I know GW is licensed based on number of calls, not based on number of users. This might be different in your case. What's the reason for using one service user instead of multiple users? Is it just licensing or you don't have an easy way how to provision these users?

Cheers

[Former Member]

Hi Martin,

many thanks for your answer.

So there is no possibility how to get the user name on SAP system (backend or gateway) for users who are authenticated on nonSAP systems by SAML2? But every user (SAP or nonSAP) has it's own data - how can i distinguish between different SAML2 authenticated users?

Yes, maybe I can create users on gateway  - but the organization is public university - lot of students are gets fired everyday - we have to remove them from our study system and also from gateway - duplicate work. We want to create a set of SAPUI5 apps for students where they can see their payments for example...but I need student login name to show

Thanks Jiri

[Former Member]

Then create a function on the nonSAP portal which the backend can make a callback to and then either create the user, use ABAP logic which is free of AUTHORITY-CHECKS which are calling user specific or assign the user specific roles to the user.

SAP had something similar before with SU05 users. Problem is that it has massive functionality restraints if the runtime is a generic service user ID against which the checks are performed.

So... you need to explain how granular you need control on the backend. That will determine the best solution. Getting the user name and mapping it and reacting to it will not be a problem.

Cheers,

Julius

[mvoros]

Hi,

I think you can't distinguish directly because your identity provider maps every non sap user to one sap user. So for SAP system it always look like one account (service user). To confirm this assumption I would suggest to check what SAML messages are passed between client and SAP system.

You can't trust client. Hence you can't ask client what's his non sap account ID is. A workaround could be to have a non-sap system issue a HTTP cookie that is signed and contains non SAP user ID. You can get access to HTTP cookies in custom HTTP handler so that would allow you to get non sap ID. So the flow could be:

1. A user goes to non-SAP system and authenticates against it using SAML

2. Non-sap system issues a custom HTTP cookie that is signed and redirects to SAP system (the system must have common domain otherwise SAP system won't be able to read generated cookie)

3. SAP system uses SAML to authenticate user. A user is logged on as SAP service user

4. Custom HTTP handler reads the HTTP cookie, verifies signature and extract non-sap user ID (verification is important)

5. GW service is executed that uses non-sap ID extracted in step 4

As you can see the above solution is quite tricky. The proper solution to me seems to be automating user provisioning to your gateway system. You need to deploy some kind of identity management solution. There is SAP IdM but there are other solutions from other vendors. You could even build a custom for this specific case. I assume that you have LDAP server with all users. So building a script that dumps all students into a flat file and then using standard BAPIs to create/change users should not take too long to build. The customer solution is not going to be a future proof solution.

Cheers

[Former Member]

It seems the actual requirement is user specific authorizations on backend and authentication would be the correct means to that end, but there is an alternative:

After authentication of service user on the backend, perform a "call back" to get the user name from the RFC client system (there are ABAP functions for that, but you will need to provide an equivalent non-SAP function on your portal.

You won't be able to check auths, but could for example use business partner similar functionality as the user name is known.

Just a thought,

Julius

[Former Member]

Hi Julius,

to my understanding, the ABAP backend has info about persons which are not users in the system itself but users in an other system. If the users would also be present in the ABAP backend, one could just use identity propagation (Asssertion tickets, ...) or trusted RFC to authenticate at the backend instead of using a service user. But maybe Jiri can give us a more precise picture of the situation and the requirements, because this is also not clear enough for me.

Regards,

Patrick

[Former Member]

That is what I was thinking as well (the ABAP backend can have infos about the user without there necessarily being a SU01 user ID) so can be reused for access logic which is not associated with AUTHORITY-CHECK in the backend system, but rather some business partner access or similar.

But provisioning the user through does give lots for functional freedom and authorization granularity.

I think it is clear that Jiri wants to know the name of the caller as a minimum, but what is that name needed for? A simple mapping logic which a service could take care of, or a more complex scenario where authorization granularity beyond user name and a few attributes which the backend does not have without the support of authorizations (which 1 service user cannot support on it's own -> in which case Jiri should go for the scenario of the delayed login to migrate the user to the backend and authorize it correctly. This is quite a popolar requirement for IDM scenarios and workflows (using geographical attributes and approval workflow tasks).

Cheers,

Julius