Implementing security(SSO SAML) for OData services

[former_member184739]

Dear Experts,

Can anyone help me on securing all OData services present at SAP Gateway . Currenly I have used Basic authentication in all the apps.

I think its not a secure way to do because all the codes are easily vulnerable and can be taken via chrome developer tools(F12).

Since we are using web apps(HTML5) and mobile apps we want to go with "Browser-based Security Assertion Markup Language (SAML) 2.0 authentication" as this is recommended by SAP for both web apps and mobile apps. I also read in SAP documentation

that SAP Fiori used SSO SAML 2.0 to implement security.

Q1:Can you provide any documentation/how-to-guides to achieve this from both backend(BASIS) and UI(SAPUI5) perspective.

Q2:What is the approximate estimated timeline to complete this and deploy it in customer base?

Q3:Is there any prerequisites/challenges/complexities involved in implementing this?

Regards

Prabaharan

[Former Member]

I would recommend looking in to OAuth2.0 for your mobile and web apps. I felt it was pretty easy to set up and everything is documented at .

[masa_139]

Hi Prabaharan,

Here are other reference documents.

• Using SAML 2.0 Authentication to Access Fiori Apps from the Public Internet
• Take the SAP Fiori Experience to a New Level with SAP Single Sign-On

Regards, Masa

SAP Customer Experience Group - CEG

[Former Member]

Dear Prabaharan,

SSO configuration is not application specific. Also, it is such a big topic that can't be explained on forum post. In simple, it is a generic configuration that is done between you application server and a SAML ticket provider, and on additional components like Web Dispatcher / Proxy.

Check this Wiki

http://wiki.scn.sap.com/wiki/display/Security/Single+Sign-On+with+SAML+2.0+and+ABAP+Systems+Supporti...

Br,

Nadh