SAP.Net Connector & SAP Logon Ticket

[Former Member]

Iu2019m in the middle of building custom webpart for MOSS 2007 using Visual Studio 2005 which do the following things:

Accept the SAP URL web application from the end user and the SSO application name and render the web application after Single sign-on the user to the web application. The webpart is missing the impersonating section from the web application.

The web application will be SAP application not necessary to be the EP Portal it might be the internet service of the SAP Core system, BI system u2026etc.

How to achieve the impersonation from the SAP side? Is that by creating SAP Logon Ticket? How to do that using the SAP.Net Connector?

Actually I tried to do that using the following code without luck.

Just by creating the connection string and open it. How to force the displayed web application to redirect the web application to the system pages not the login page?

string connStr = "";

string ticket = SAP.Connector.SAPConnection.GetSAPSSOTicket(connStr, 2);

Destination dest = new Destination();

dest.MySAP_SSO2 = ticket;

dest.AppServerHost = "<host>";

dest.SystemNumber = 50;

dest.Client = 800;

string c = dest.ConnectionString;

SAPConnection conn2 = new SAPConnection(dest);

conn2.Open();

[Former Member · Accepted solution]

I'm trying to authenticate the SAP user by coding and I need to create the SAP Logon Ticket using .Net application or creating the ticket in non sap application.

How to acheive that? All information about the current user and servers are available and captured from the system and the configured SSO. (Note: Sharepoint SSO not SAP)

I need to create the ticket to authenticate the user from the sap side so the user shouldnot see the login page. the SAP system should directly autheinticate the user from the created Logon Ticket.

Which DLL I need to load in the .net application to do that? Can I use the .net connector dlls to do that without creating the proxy class?

[Andre_Fischer · Accepted solution]

Hi Deena,

there is no DLL that creates a SAP Logon Ticket for you. You need an SAP NW Application Server as an ticket issuing system.

In order to issue a ticket you have to authenticate against the SAP NW Application Server. There are different options to do this which depend whether you are dealing with a ABAP stack, a JAVA stack or a dual stack.

You can use the SAP connector for Microsoft .NET as described in the SAP Online Help to get a SAP Logon Ticket from an ABAP stack

http://help.sap.com/saphelp_nw2004s/helpdata/en/33/85923eadb13446e10000000a114084/content.htm

You would either have to provide username and password or use SSO via SNC

http://help.sap.com/erp2005_ehp_03/helpdata/EN/44/0ebf6c9b2b0d1ae10000000a114a6b/frameset.htm

As I already wrote you don't have to provide a SAP Logon Ticket if you want to access a double-stack system such as SAP NW BI if the JAVA stack is configured to support Integrated Windows Authentication using the SPNEGO Login Module.

Another approach would be to use X.509 certificates. I will discuss this approach in my SAP TechEd Session SIM208 in [Las Vegas |http://www.sapteched.com/usa/edu_sessions/session.htm?id=1189]and [Berlin|http://www.sapteched.com/emea/edu_sessions/session.htm?id=1189].

[Andre_Fischer]

Hi Ali,

if you are using a portal you can leverage the SPNEGO Login Module which provides support for Integrated Authentication.

Also in a dual stack installation (like in BW) it will be possible to achieve SSO using Integrated Windows Authentication. In a dual stack installation you would use the redirect feature where unauthenticated http requests (not web services calls !) are being redirected from the ABAP stack to the JAVA stack.

Best regards,

André

[adam_recktenwald]

Hi Deena,

The login page is usually only shown when the user is unknown. So, this would require the user to authenticate in order to get an SAP Login Ticket. There are several ways to do this, but generally speaking, they'll need to enter a username and password to obtain the ticket. Once you have the ticket you can then pass it down to whatever other system is configured to accept it.

You're most likely to find that once you enter some credentials in the login screen, you'll be directed to the view/page you're going for. If you don't want users to see this login page (assuming you've got some way to already know who they are), you're talking Single Sign-On at that point. Do you know if or how you have SSO working in your environment?

-Adam