Community
Application Development and Automation Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Read only

Web Dispatcher permfile problem

Go to solution
Former Member

‎2009 Aug 19 2:27 PM

0 Likes
5,942

Hi all,

I have the same problem like someone posted before in this forum:

Unfortunately, the problem was not solved as such.

My goal is to restrict client access to the WebDispatcher to certain IP ranges.

For testing purposes I have an ABAP server and a Web Dispatcher running on the same Windows machine.

They both work fine together.

To restict access I would like to use the permfile option of the WD:

icm/HTTP/auth_0= PREFIX=/, PERMFILE=F:\usr\sap\WD1\SYS\profile\permfile

For testing I am using a permfile that does not contain any restrictions and is located in the WD profile directory:

P * * * * *

It does NOT contain blank rows.

With the default entry "icm/HTTP/auth_0= PREFIX=/, FILTER=SAP" everything works fine.

But as soon as I change anything in this parameter, my WD does not work anymore.

After the reboot the WD comes up again, but I donu00B4t even have access to the Web Administration Interface.

It just says:

_________________________________________________

403 Access denied

You do not have the permissions to access this resource

-

Error: -13

Version: 7000

Component: HTTP_AUTH

Date/Time: Wed Aug 19 14:14:36 2009

Module: http_auth.c

Line: 854

Server: saptest_WD1_01

Error Tag:

Detail: Permission denied: no entry for user ><

_________________________________________________

I thought it should promt for a User/PW, but it doesnu00B4t.

In my "icmauth.txt" I have created the standard-user "webadm" to login into the Web Administration Interface.

But this only works with the default settings...

I tried using the "FILTER" parameter set to "SAP" or to "System" without any effect, even without the "FILTER" parameter.

Did I forget something?

Thank you in advance!

Best Regards,

Heiko

1 ACCEPTED SOLUTION
Read only

Go to solution
Former Member

‎2009 Aug 20 2:24 PM

0 Likes
3,914

Hi,

Just a quick answer : I have a running productive web dispatcher running OK with a permfile.

In the profile file (sapwebdisp.pfl) i have the lines :

csi/SAP/csa_lib = sapcsa.dll
csi/enable = TRUE
icm/HTTP/auth_0 = PREFIX=/,PERMFILE=permfile.txt,FILTER=1

Try the FILTER=1 parameter. I don't remember why I had to set it to 1 but it works !

Regards,

Olivier

Hi all,

I have the same problem like someone posted before in this forum:

Unfortunately, the problem was not solved as such.

My goal is to restrict client access to the WebDispatcher to certain IP ranges.

For testing purposes I have an ABAP server and a Web Dispatcher running on the same Windows machine.

They both work fine together.

To restict access I would like to use the permfile option of the WD:

icm/HTTP/auth_0= PREFIX=/, PERMFILE=F:\usr\sap\WD1\SYS\profile\permfile

For testing I am using a permfile that does not contain any restrictions and is located in the WD profile directory:

P * * * * *

It does NOT contain blank rows.

With the default entry "icm/HTTP/auth_0= PREFIX=/, FILTER=SAP" everything works fine.

But as soon as I change anything in this parameter, my WD does not work anymore.

After the reboot the WD comes up again, but I donu00B4t even have access to the Web Administration Interface.

It just says:

_________________________________________________

403 Access denied

You do not have the permissions to access this resource

-

Error: -13

Version: 7000

Component: HTTP_AUTH

Date/Time: Wed Aug 19 14:14:36 2009

Module: http_auth.c

Line: 854

Server: saptest_WD1_01

Error Tag:

Detail: Permission denied: no entry for user ><

_________________________________________________

I thought it should promt for a User/PW, but it doesnu00B4t.

In my "icmauth.txt" I have created the standard-user "webadm" to login into the Web Administration Interface.

But this only works with the default settings...

I tried using the "FILTER" parameter set to "SAP" or to "System" without any effect, even without the "FILTER" parameter.

Did I forget something?

Thank you in advance!

Best Regards,

Heiko

Reply
5 REPLIES 5
Read only

Go to solution
Former Member

‎2009 Aug 20 2:24 PM

0 Likes
3,915

Hi,

Just a quick answer : I have a running productive web dispatcher running OK with a permfile.

In the profile file (sapwebdisp.pfl) i have the lines :

csi/SAP/csa_lib = sapcsa.dll
csi/enable = TRUE
icm/HTTP/auth_0 = PREFIX=/,PERMFILE=permfile.txt,FILTER=1

Try the FILTER=1 parameter. I don't remember why I had to set it to 1 but it works !

Regards,

Olivier

Read only

Go to solution
Former Member
In response to Former Member

‎2009 Aug 21 10:15 AM

0 Likes
3,914

Hi Olivier,

thank you for the csi-parameters.

I did not know them before.

Unfortunatlely this does not help me with the permfile problem.

It is still not recognized by my WD.

It tried the same configuration on a UNIX machine and it works fine.

There I just added the permfile path to the auth-parameter, created a permfile and after a WD reboot voila - it worked.

But it still does not work on my Windows machine.

Where does the WD look for the permfile by default? I mean when I just enter the permfile filename without the path.

"PERMFILE=permfile.txt"

I think I am also going to check if there is a newer version of the WD for Windows...

Kind Regards,

Heiko

Read only

Go to solution
Former Member
In response to Former Member

‎2009 Aug 21 5:49 PM

0 Likes
3,914

Hello Heiko,

I have sapwebdisp.exe, permfile.txt and sapwebdisp.pfl in the same directory.

That is why I dont give a path for permfile.txt

My productive running release of sapwebdisp.exe is 7.00 pl 94.

By the way, did you copy the needed DLLs in the directory ? sapcpp46.dll and sapcsa.dll ?

Check also in the dev_webdisp trace file if the sapcsa.dll is loaded.

Something like

[Thr 6264] CsiInit(): Initializing the Content Scan Interface

[Thr 6264] PC with Windows NT (mt,ascii,SAP_CHAR/size_t/void* = 8/64/64)

[Thr 6264] CsiInit(): CSA_LIB = "(NULL) => use environment variable CSA_LIB"

You may also have to setup CSA_LIB.

Regards,

Olivier

Read only

Go to solution
Former Member
In response to Former Member

‎2009 Sep 01 1:35 PM

0 Likes
3,914

Hello Olivier,

though it was much easier to configure - it just worked right away - I´m using Solaris for my tests.

I tried your hints but I they didn´t solve my problem with the permfile

Although the "filter" funktion seems to work now...

Anyway, thank you very much for your help!

Best Regards,

Heiko

Read only

Go to solution
Former Member
In response to Former Member

‎2014 Aug 13 7:11 PM

0 Likes
3,914

For those out there in AIX.

We had the same issue, our NWA screens /nwa  /ume etc came up blank.

Issue was at the SAP Router with the PermFile.txt

Files are located as noted for Web Dispatcher  (Where WPP is our SID) and W03 is choosen at install time.

/usr/sap/WPP/W03/sec/HTTPMOD/PermFile.txt

For SAP Portal in NW 7.3 we have these settings to block access outside the firewall to NWA screens. We use Portal in Biller Direct to access Security etc.

#SAPWBDISP Permission table for
ESS SWS

#DONOT CAUSE/LEAVE BLANKS!

# URI PATTERN : USER : GROUP :
ClientIP : ServerIP

D * administrator * * *

D * Administrator *

P /webdynpro/dispatcher/sap.com/tc~sec~ume~wd~enduser*

P /webdynpro/resources/sap.com/tc~sec~ume~wd~enduser*

P /irj*

P /webdynpro/resources/sap.com/tc~sec~ume~wd~enduser/UmeEnduserPortalApp*

  P /com*

  P /AFP*

  P /html*

  P /sap/*

  P /sws/*

  P /rtmf*

  P /logon_ui*

  P /webdynpro/resources/sap.com/pb*

  P /webdynpro/resources/sap.com/tc~wd~dispwda*

  D /webdynpro/resources/sap.com/tc~lm~itsam~ui~mainframe~wd/FloorPlanApp*

  D/webdynpro/dispatcher/sap.com/tc~sec~ume~wd~umeadmin/UmeAdminAp*

  D /webdynpro/*umeAdmin*

D /tshw*

  D /webdynpro/resources/sap.com/tc~sec~tools~tsh~wd/TCT*

  D /s*

  D /w*

  D /*/FloorPlan*

  D /nwa*

  D /useradmin*

  D /startPage*

  P /