Looking for sample code to decrypt MYSAPSSO2 session cookie

[Former Member]

Hello,

I am looking for a sample code to decrypt MYSAPSSO2 session cookie and get the username out of it.

[former_member698570]

Hi Roy,

if you just need the username the easiest way is to grab the Cookie and Decode it using Base64. The username is contained in cleartext.

e.g.

MYSAPSSO2 Ticket as fetched from Browser:

AjExMDAgABFwb3J0YWw6bXRyaWNhcmljb4gAE2Jhc2ljYXV0aGVudGljYXRpb24BAApNVFJJQ0FSSUNPAgADMDAwAwADRDAxBAAMMjAwODA3MjUwNTA3BQAEAAAACAoACk1UUklDQVJJQ0%2F%2FAQUwggEBBgkqhkiG9w0BBwKggfMwgfACAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHATGB0DCBzQIBATAiMB0xDDAKBgNVBAMTA0QwMTENMAsGA1UECxMESjJFRQIBADAJBgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDgwNzI1MDUwNzU5WjAjBgkqhkiG9w0BCQQxFgQUxUGK!5EDTrHQErPQCVJhEySzTBAwCQYHKoZIzjgEAwQvMC0CFQCD3K2A2hrgpNa5EceiDXjRN309ewIUTM3DJi8QTxmk%2FJez!rjnFlTM3BQ%3D

Decoded Ticket using Base64:

1100 uFFFD portal:mtricaricou02C6uFFFD basicauthentication uFFFD
MTRICARICO uFFFD 000 uFFFD D01 uFFFD 200807250507 uFFFD uFFFDuFFFDuFFFD 
.....

If you want to do it programmatically using any libraries to completely decode the ticket, check the validity and also access the certificate information inside the ticket you can use a SAP Extension called SAP SSOEXT (Goto service.sap.com/swdc and search for SSOEXT => The package also contains documentation and samples for various programming langauges such as JAVA).

This one needs dynamic libraries or shared libraries to be linked.

There also is a pure JAVA approach.

Have a look at this:

http://www.zope.org/Members/Dirk.Datzert/MySapSsoSupport/

But:

The approach of decrypting the cookie does not really make since when you are in a SAP system it is more intended for 3rd party systems in order to implement SSO.

Hope this helps

Cheers

[Former Member]

Thanks Marcel!

Helpful as always

[Benny]

Hi,

usually, this is done by the server for you. Read through the securioty guidelines to get details.

Regards,

Benny

[Former Member]

Hi Benny,

Any specific relevant one to point me to?

Rgds,

Roy

[Benny]

Well, it's called [SAP NetWeaver Security Guide|http://help.sap.com/saphelp_nw70/helpdata/EN/8c/2ec59131d7f84ea514a67d628925a9/frameset.htm] and it is part of the documentation....

But anyway, by the time you handle the cooky, it should be terminated already. If that did not happen I guess you have to check your security settings.

Regards,

Benny