topic Re: Web Dispatcher permfile problem in Application Development and Automation Discussions

Web Dispatcher permfile problem

Former Member — Wed, 19 Aug 2009 13:27:10 GMT

Hi all,

I have the same problem like someone posted before in this forum:

Unfortunately, the problem was not solved as such.

My goal is to restrict client access to the WebDispatcher to certain IP ranges.

For testing purposes I have an ABAP server and a Web Dispatcher running on the same Windows machine.

They both work fine together.

To restict access I would like to use the permfile option of the WD:

icm/HTTP/auth_0= PREFIX=/, PERMFILE=F:\usr\sap\WD1\SYS\profile\permfile

For testing I am using a permfile that does not contain any restrictions and is located in the WD profile directory:

P * * * * *

It does NOT contain blank rows.

With the default entry "icm/HTTP/auth_0= PREFIX=/, FILTER=SAP" everything works fine.

But as soon as I change anything in this parameter, my WD does not work anymore.

After the reboot the WD comes up again, but I donu00B4t even have access to the Web Administration Interface.

It just says:

_________________________________________________

403 Access denied

You do not have the permissions to access this resource

Error: -13

Version: 7000

Component: HTTP_AUTH

Date/Time: Wed Aug 19 14:14:36 2009

Module: http_auth.c

Line: 854

Server: saptest_WD1_01

Error Tag:

Detail: Permission denied: no entry for user ><

_________________________________________________

I thought it should promt for a User/PW, but it doesnu00B4t.

In my "icmauth.txt" I have created the standard-user "webadm" to login into the Web Administration Interface.

But this only works with the default settings...

I tried using the "FILTER" parameter set to "SAP" or to "System" without any effect, even without the "FILTER" parameter.

Did I forget something?

Thank you in advance!

Best Regards,

Heiko

Re: Web Dispatcher permfile problem

Former Member — Thu, 20 Aug 2009 13:24:34 GMT

Hi,

Just a quick answer : I have a running productive web dispatcher running OK with a permfile.

In the profile file (sapwebdisp.pfl) i have the lines :

csi/SAP/csa_lib = sapcsa.dll
csi/enable = TRUE
icm/HTTP/auth_0 = PREFIX=/,PERMFILE=permfile.txt,FILTER=1

Try the FILTER=1 parameter. I don't remember why I had to set it to 1 but it works !

Regards,

Olivier

Re: Web Dispatcher permfile problem

Former Member — Fri, 21 Aug 2009 09:15:39 GMT

Hi Olivier,

thank you for the csi-parameters.

I did not know them before.

Unfortunatlely this does not help me with the permfile problem.

It is still not recognized by my WD.

It tried the same configuration on a UNIX machine and it works fine.

There I just added the permfile path to the auth-parameter, created a permfile and after a WD reboot voila - it worked.

But it still does not work on my Windows machine.

Where does the WD look for the permfile by default? I mean when I just enter the permfile filename without the path.

"PERMFILE=permfile.txt"

I think I am also going to check if there is a newer version of the WD for Windows...

Kind Regards,

Heiko

Re: Web Dispatcher permfile problem

Former Member — Fri, 21 Aug 2009 16:49:06 GMT

Hello Heiko,

I have sapwebdisp.exe, permfile.txt and sapwebdisp.pfl in the same directory.

That is why I dont give a path for permfile.txt

My productive running release of sapwebdisp.exe is 7.00 pl 94.

By the way, did you copy the needed DLLs in the directory ? sapcpp46.dll and sapcsa.dll ?

Check also in the dev_webdisp trace file if the sapcsa.dll is loaded.

Something like

[Thr 6264] CsiInit(): Initializing the Content Scan Interface

[Thr 6264] PC with Windows NT (mt,ascii,SAP_CHAR/size_t/void* = 8/64/64)

[Thr 6264] CsiInit(): CSA_LIB = "(NULL) => use environment variable CSA_LIB"

You may also have to setup CSA_LIB.

Regards,

Olivier

Re: Web Dispatcher permfile problem

Former Member — Tue, 01 Sep 2009 12:35:50 GMT

Hello Olivier,

though it was much easier to configure - it just worked right away - I´m using Solaris for my tests.

I tried your hints but I they didn´t solve my problem with the permfile

Although the "filter" funktion seems to work now...

Anyway, thank you very much for your help!

Best Regards,

Heiko

Re: Web Dispatcher permfile problem

Former Member — Wed, 13 Aug 2014 18:11:41 GMT

For those out there in AIX.

We had the same issue, our NWA screens /nwa /ume etc came up blank.

Issue was at the SAP Router with the PermFile.txt

Files are located as noted for Web Dispatcher (Where WPP is our SID) and W03 is choosen at install time.

/usr/sap/WPP/W03/sec/HTTPMOD/PermFile.txt

For SAP Portal in NW 7.3 we have these settings to block access outside the firewall to NWA screens. We use Portal in Biller Direct to access Security etc.

#SAPWBDISP Permission table for
ESS SWS

#DONOT CAUSE/LEAVE BLANKS!

# URI PATTERN : USER : GROUP :
ClientIP : ServerIP

D * administrator * * *

D * Administrator *

P /webdynpro/dispatcher/sap.com/tc~sec~ume~wd~enduser*

P /webdynpro/resources/sap.com/tc~sec~ume~wd~enduser*

P /irj*

P /webdynpro/resources/sap.com/tc~sec~ume~wd~enduser/UmeEnduserPortalApp*

P /com*

P /AFP*

P /html*

P /sap/*

P /sws/*

P /rtmf*

P /logon_ui*

P /webdynpro/resources/sap.com/pb*

P /webdynpro/resources/sap.com/tc~wd~dispwda*

D /webdynpro/resources/sap.com/tc~lm~itsam~ui~mainframe~wd/FloorPlanApp*

D/webdynpro/dispatcher/sap.com/tc~sec~ume~wd~umeadmin/UmeAdminAp*

D /webdynpro/*umeAdmin*

D /tshw*

D /webdynpro/resources/sap.com/tc~sec~tools~tsh~wd/TCT*

D /s*

D /w*

D /*/FloorPlan*

D /nwa*

D /useradmin*

D /startPage*

P /