HTTP system and login via POST

[#1]

Hi everybody,

I think that this is a stupid question and I’ve found a lot of threads about this problem but I get no solution.

I want to create an URL iView that shows a page of an external web site. To navigate to this page I must authenticate on external portal. In the home page I have the form with login and password and if I get the source of the page I can know that the action calls the url

/extportal/j_security_check with method POST and that the parameters are “j_user” and “j_pass”

So, I've created a new HTTP system with

Authentication method = POST

Authentication type = Server

Authentication USR = http://externalsite.com/extportal/j_security_check

URL param for password = j_pass

URL param for user name= j_user

I've created a new URL iview using my HTTP system

I've mapped the user

..it doesn’t work!

Where I’m wrong??

Thanks

Massimiliano

[Former Member]

If you are using a Microsoft browser you will not be able to do a URL username and password. This is because of a security patch in the browser that prevents it. This patch was issued about a year and a half ago.

[Former Member]

It doesn't work with

MS IE 6

MS IE 7

Mozilla Firefox

Opera Browser

Thanks!

[Former Member]

Yes, that is because of the security patch. The usernames and passwords were sent over HTTP in clear text and could be seen with any network sniffer.

[Former Member]

OK, that's could be the point but what's the solution?

When I directly access my external portal with the login form I put user and password and I send them in clear so I can accept that EP send them in clear text as well.

Thank you very much for reply.

Massimiliano

[Former Member]

The limitation only is including the user name and passwork in the URL address.

When you are going on to a log on page and fill in the user name and password that is being sent as data and not part of the URL.

[Former Member]

Hi Massimiliano,

Sorry for the late reaction, I've been kind of busy... A few answers:

-You can use Appintegrator in EP7 (you probably figured that out already)

-Authentication is done from the client. So the client browser sends the authentication data to the external site.

However, you can set this up using HTTP POST, in which case the credentials are passed in the request body, not in the url itself.

-Security patches mentioned earlier are only for basic authentication, which you are not using, because you are using HTTP POST. This is exactly the same as entering your credentials in the original logon form... FYI, before these patches it was possible to authenticate using something like http://username:[email protected] (this approach is also mentioned in the Howto document)

-You need to create a system in your portal system landscape, for which you can set the usermapping, and, optional, the base url for the external website.

-In the template url you have to use the url for the logon form submit action. In here you add the parameters username and password using the Authentication tag. The parameters itself go in the iview property for usermapping template.

-The alert you are getting has to do with the external website being in a different domain. You can disable the alert in System admin->Support->SAP Applications (or something similar).

Hope this helps...

Johan

[Former Member]

Ho Johan,

thanks you very much for your reply.

After a lot of test, now I think that the problem is site security.

I think that authentication works but I get an error from server.

I've tryied to create a jsp page with the same form of logon page but fixing the user and password parameters and calling the form.submit() on page load.

when I open this page it redirects me but I get this error:

"Invalid direct reference to form login page"

maybe the first page of the site I'm trying to reach creates a session or the logon page of the action check for session or referer. I don't know...

I have to ask to the external site developer (the site is runnong on tomcat).

Thanks again

Massimiliano

[Former Member]

Hi Massimiliano,

You should consider using the generic application integrator for this, instead of URL iView.

Check out the Howto document, which describes your scenarion:

http://help.sap.com/bp_epv260/EP_JA/documentation/How-to_Guides/25_HowToUseAppIntegrator_en.pdf

I have used this approach many times for similar scenarios.

Regards,

Johan

[Former Member]

Thanks!

The documentation refers to EP 6.0

I have EP 7.0, can I use application integrator with thi version of nw?

If yes where can I find it?

bye

Massimiliano

[holger_stumm2]

You need to set up a URL system in system administration-system configuration and have the user or admin personalize it.

Only then the juser and jpw are filled.

(oh - I've just seem you've done it)

[Former Member]

Hi Johan,

I've tryied using App.Int. on my EP 6 test environment.

I've followed the tutorial and the examples found in the forum.

Probably the connection works but I've got errors about sessions.

The message that I got from server is "connection timeout" but it appears immediately after the request.

Another question:

I don't want to create an iView that link the login page but I want to link another page. Using standard http server I though that the authentication is made by the server connection and not by the iview.

How can I do?

Thank you very much

Massimiliano