User from Logon Ticket

[Former Member]

Hi,

Can anyone please let me know the process of getting the issuer name and portal user from the logon ticket using java program

Thanks in advance

Rgds

Satya

[Former Member]

Hi,

Can anyone please let me know the process of getting the issuer name and portal user from the logon ticket using java program

Thanks in advance

Rgds

Satya

[Wolfgang_Janzen]

You should not try to analyse the content of an SAP logon ticket. SAP logon tickets are to be handled by the <i>EvaluateTicketLoginModule</i> JAAS login module. As a result the security context is setup allowing to retrieve information on the current user (principal) and his assigned roles. That's all an application needs to know - they should not perform any framework tasks / services.

Regards, Wolfgang

[Former Member]

Hi Surisetty,

on a SAP Application server Java or a non SAP system ?

Kind regards,

Patrick

[Former Member]

Well i'm able to read the ticket using the Base64 class ...

Thanks ...

Satya

[Wolfgang_Janzen]

Well, of course you are - SAP logon tickets are not encrypted but digitally signed. However, you cannot go sure that the syntax is stable - it could be changed at any time. But there's an API for "ticket verifiers" (keyword "sapssoext"). That's why Patrick was asking you whether you want to analyse SAP logon tickets outside an NetWeaver Application Server.

I'm not sure whether you are aware of all the checks which need to be performed to validate SAP logon tickets:

1. parse ticket to retrieve digital signature (attached) and information on issuer (systemID and client, required for step 3)

2. verify digital signature (using SSF, sapseculib / sapcryptolib); determine subject name and issuer of the certificate (used by the ticket issuer to digitally sign the SAP logon ticket)

3. lookup ACL (for issuer systemID, client, certificate subject name and issuer); that ACL (access control list) needs to be implemented by you (unless using a NetWeaver Application Server)

4. check ticket validity

5. retrieve username

6. potentially: perform user mapping

7. check validity of user account (account validity, account lock, ...)

Just to parse the username out of a SAP logon ticket is not sufficient.

Regards, Wolfgang

[Former Member]

Hi Satya,

for non-SAP applications, a good start is in the <a href="http://help.sap.com/saphelp_nw2004s/helpdata/en/43/5c8e90dc2a5f8be10000000a1553f6/frameset.htm">Docs</a> where you can find some info on the options available. If you are inside an application running on a J2EE engine or inside ABAP you can get the information which user did authenticate using the appropriate APIs. For Java this is reading the iUser object and for ABAP I'm sure, Wolfgang has the answer.

Regards,

Patrick

[Wolfgang_Janzen]

ABAP offers the remote callable function module SUSR_CHECK_LOGON_DATA (see online documentation using transaction SE37) - as of SAP_BASIS 6.20. But: that function module does more than only parsing (and validating) the SAP logon ticket; it also checks whether the account is valid (=> validity timeframe) and not locked (by the admin).

Cheers, Wolfgang