topic Re: SAML with MYSAPSSO2 cookie in Application Development and Automation Discussions

SAML with MYSAPSSO2 cookie

Former Member — Wed, 20 Feb 2008 17:14:36 GMT

Hi,

We are trying to setup SAML authentication with a J2EE engine (7.00). We are browsing to an application with a jsp page. On this application I put the SAMLLoginModule on. This jsp page does a redirect a bsp page on ABAP (/sap/bc/echo), with basic authentication the sso between the J2EE and ABAP works. But when I try to authenticate with SAML the SSO isn't working, I get a popup to authenticate in ABAP, also no MYSAPSSO2 cookie in the browser. Does anybody now how we need to configure the Login Modules for this application?

Current setup:

SAMLLoginModule sufficent {AcceptedAuthenticationMethods=*, Mode=Standalone}

CreateTicketLoginModule sufficent {ume.confiugration=true}

EvaluateTicketLoginModule sufficent {ume.confiugration=true}

BasicPasswordLoginModule requisite {}

CreateTicketLoginModule sufficent {ume.confiugration=true}

Thanks in advance

Steven

Re: SAML with MYSAPSSO2 cookie

tim_alsop — Wed, 20 Feb 2008 17:20:46 GMT

> SAMLLoginModule sufficent {AcceptedAuthenticationMethods=*, Mode=Standalone}

> CreateTicketLoginModule sufficent {ume.confiugration=true}

> EvaluateTicketLoginModule sufficent {ume.confiugration=true}

> BasicPasswordLoginModule requisite {}

> CreateTicketLoginModule sufficent {ume.confiugration=true}

Instead of above, I suggest you try:

EvaluateTicketLoginModule sufficent {ume.confiugration=true}

SAMLLoginModule optional {AcceptedAuthenticationMethods=*, Mode=Standalone}

CreateTicketLoginModule sufficent {ume.confiugration=true}

BasicPasswordLoginModule requisite {}

CreateTicketLoginModule optional {ume.confiugration=true}

Thanks,

Tim

Re: SAML with MYSAPSSO2 cookie

Former Member — Wed, 20 Feb 2008 19:51:17 GMT

Hi Tim,

Thanks for your help it's working now. Can you give some more info why it should be configured like this?

Steven

Re: SAML with MYSAPSSO2 cookie

tim_alsop — Wed, 20 Feb 2008 20:00:36 GMT

I am pleased I was able to help you.

The main issue with your previous login module stack was that you didn't have the EvaluateTicketLoginModule at the start, so if an SSO2 ticket was already issued and passed to J2EE Engine, it was not being recognising and was therefore trying to authenticate again. I also changed a few params to ensure that login tickets are created only after successful authentication, either using BasicPassword or SAML.

Thanks,

Tim