SICF set https as default

[AK31]

Hello,

does anyone know how to set https as the default protocol in SICF? I know how to setup SSL or change single services but I would like to change it for all services. For example, if I test a service in SICF, https should be called, not http. I tried to set the default_host node in SICF to SSL on the logon data tab but that did not help.

I am running a NW 7.x system.

Regards

Andreas

[AK31 · Accepted solution]

Hi guys,

I haven't found the solution to it yet (if there is any) but a workaround.

set Param icm/HTTP/redirect_0 in RZ11 to

PREFIX=/, FROM=*, FROMPROT=http, PROT=https, HOST=<hostname>, PORT=<SSL Port>

At first I tried without the port number, assuming the system would now the port by itself, but this didn't work. After adding the port number it worked fine.

Thank you all for your help.

Regards

Andreas

[petr_solberg]

Great thread all, just helped me solve a problem

Andy.

[ACE-SAP]

Hi

If you a re using SSO, have you tried setting parameter  login/ticket_only_by_https to 1

Check also the here under notes

1789344 - How to disable HTTP -> HTTPS switch for an ICF service

1531399 - Enabling SSL for Session Protection

Regards

[Former Member]

Try the first node, /sap that it is. ICF nodes use inheritance so it should be inherited to lower level nodes unless that is one setting that isn't inherited, not sure about that.

[AK31]

Hi Samuli,

tried it but it is not being propagated to the lower levels.

Thanks, though.

Andreas

[Former Member]

That's disappointing. Continuing on Yves's point: are you using SSO or form login? The standard system setting for form login is to redirect to HTTPS should it be available so I'm assuming you are using some sort of SSO. How are the URLs being generated? I mean it is one thing to force the system to always use HTTPS (eg. ICM redirect) but it is another one to have URLs always generated to use HTTPS. I'm not aware of any standard report for setting ICF node properties. The mass processing report RS_ICF_SERV_MASS_PROCESSING can only activate/deactivate nodes so at least you would be looking at creating a custom implementation for looping through all the nodes and setting the properties. Not that I would recommend to do it but the flag is stored in table ICFSERVICE, field PROTSEC. To force HTTPS you would set the flag to 'S'.