SAP Netweaver Portal Authentication

[#1]

Hi All,

Please can you help me with the topics below.

1. I am putting a SAP System password reset webdynpro application on the portal and I would like to know how we can via the IVIEW use a "Batch" UserID to unlock the applicable SAP account and reset the required password as the Users UserID is locked.

1.2. I would also like to know on the applicable Webdynpro that uses a "Batch" UserID, how we can get the applicable UserID that is logged onto the portal at that moment.

2. Can you switch off SSO on an IVIEW so that the user is always requested for a UserID and Password when accessing the applicable IVIEW.

Thanks

[Ivan-Mirisola · Accepted solution]

Hi Jashan,

1) Why would you need to create such an application. You can always leave the option for the end-user to set their own password. You need to assign the eu_core role to enable the "personalize" link. There you are able to select you credentials. All you need to do is assign the proper permissions for the end-user to set their own passwords. This works even if your LDAP connection is set for read-only. If your user persistence store is set to an ABAP stack, than this works as well.

For this feature, please take a look at the following documentation:

http://help.sap.com/saphelp_nw04s/helpdata/en/44/0b1d50ec732d2fe10000000a11466f/frameset.htm

If you want to enable end-users to really reset their own passwords - just as you have on public websites, you might want to have a look also at this documentation:

http://help.sap.com/saphelp_nw04s/helpdata/en/45/7e6313d8780dece10000000a11466f/frameset.htm

If you are really comfortable to have a custom development just for that, please take a look at the following:

http://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/6920

1.2) In order to get the currently logged on user in Webdynpro for Java, you may use the following code on JavaDocs:

http://help.sap.com/javadocs/NW04S/SPS09/wd/com/sap/tc/webdynpro/services/sal/um/api/WDClientUser.ht...

2) Yes you can! You need to create a system and set its authentication method to UIDPW. Then assign the iView to this system.

Take a look at the following documentation:

http://help.sap.com/saphelp_nw70/helpdata/de/59/12f73b7803b009e10000000a114084/frameset.htm

Hope this helps!

BR,

Ivan

[Former Member · Accepted solution]

Hi Ivan,

Thanks for the reply.

However the Password Reset function that we have developed is a ABAP Webdynpro application and it will not be used to reset the Users password on the portal but in the backend SAP production system that the portal is connected to.

The functionality noted below is for a user to manage his account on the portal, not in the backend SAP system.

The reason why I also need the Users Portal UserID is because when unlocking the userID in the backend, his userID is locked so I will not be able to use his UserID and that is why we will use a "Batch" UserID from the ABAP Webdynpro application to unlock and reset the Users password in the backend.

Is it possible to get the Users Portal UserID when using the above process?

Do you maybe have any further suggestions on how we can unlock and reset a Users UserID and Password in the SAP Backend System from the SAP Portal if we do not use the process above?

Thanks

[Ivan-Mirisola · Accepted solution]

Hi Jashan,

Now I understand your issue. Thanks for clarifying.

Do end-users need to be able to log in to SAP ABAP Stack using SAPGui?

If they just login via Portal and reach the back-end system using SSO, you don't need to have a password set for these users.

This should prevent their UserID's from being locked - either by password expiration or repetitive attempts to logon with invalid credentials. All you need is to go into SU01 and click on "Disable Password" button for those users. This will prevent them from login on via SAPGui. So make sure they only use Portal or NWBC as a central point of access to SAP systems.

On the other hand, if the same users indeed need to logon using SAPGui, then you will need to develop the mentioned application. I still do not understand what you mean by "batch". Could you please elaborate the whole process you intend on doing?

I believe that you would be in a "safer" place if you created a WD4J App to call an RFC. Since the Adaptive RFC Model references a JCO Destination. And for each destination you can safely use a "Service User" to call that RFC and pass the Portal User ID as parameter. The FM will then perform the unlocking code on the specified user. Since the RFC protocol is executed by the Java Stack and not by the end-user's browser, this is a safer approach. You can even apply SNC to the protocol for enhanced security if required.

If you create an ABAP Webdynpro, you will face more challenges. First, you need to remove the application authentication (which I'm not aware of how you may achieve that since I'm not an ABAP developer). Secondly, you need to call an ABAP Portal API in order to retrieve the Portal User ID (which I believe we do not have). Maybe you could create a Portal Application, feed the app's Data Bag with the user's ID, and make the WD4A app retrieve that information. Anyway, too much effort for an unsafe way of accomplishing a simple thing.

Even if you manage to disable the authentication on a WD4A App, I wouldn't recommend you to send the Portal User ID as parameter to the WD4A application because HTTP POST parameters can be easily tempered with browser plugins. That way you would end up with security issues like "hackers/power users" being able to unlock back-end users that were locked by administrators in the first place.

BR,

Ivan

[jmoors · Accepted solution]

Interesting problem, is your portal using the ABAP system as a datasource or are you just trying to create a tool to enable users to unlock their ECC passwords?

I think it's possible to set a service account via SICF, however there might be some license implications, and as Ivan mentioned I think you will need to consider the security implications..

[http://forums.sdn.sap.com/thread.jspa?threadID=1436753&tstart=8040]

Edited by: Jason Moors on Nov 9, 2011 1:47 AM

[Former Member · Accepted solution]

Hello Ivan,

Yes, users will have access to the portal and logon to the ABAP stack via the SAPGUI.

Sorry, but the "batch" UserID is a system UserID that the application on the portal will use to access the backend system and unlock the Users account in the backend as the actual Users ID will be locked.

My issue is how can I use the system ID to access the backend via the application, and then get the UserID that is logged onto the portal and then unlock that UserID in the backend.

Is there a parameter that we can get from the portal with the UserID and pass it to the application?

I would welcome any additional options of conducting the task above as the option of WD4A app was the first one chosen?

Thanks

[Ivan-Mirisola · Accepted solution]

As I mentioned before, I would abort the whole idea of developing an ABAP application for that.

The option for this ABAP development area is not recommended, since the useru2019s ID from the Portal would be sent to ABAP stack as open text.

I would recommend you to implement this feature on Java though.

All you need is to develop a simple Webdynpro for Java Application that calls an RFC to unlock the ABAP user.

This is easy to implement in Java, since we have all the API calls to retrieve the logged on Portal UserID and send it via parameter to the RFC.

The reason why I would do it this way is that the ABAP application is protected by the ABAP stack. To make it publically available you would need to make the ICF Service public.

Since you are dealing with security calls to the back-end via this Webdynpro, Iu2019d rather opt on more secure terms.

If you are still stuck with ABAP or have no choice other than that, the only option is to use Portalu2019s Application Integrator.

It is able to send the Portalu2019s UserID easily without any development whatsoever.

On the iView itself you can send an Application Parameter to the ABAP Webdynpro. This parameter would contain <User.UserID> as value that you can retrieve on the u201Cplugu201D of the ABAP component.

Since the Webdynpro is going to be protected by useru2019s credentials, you must set its iView to a System configured for UserMapping u2013 Iu2019d strongly recommend you to not do that.

In my experience this has caused nothing but trouble for end-users, because they do not know that there is a u201Cserviceu201D user (what you call u201CBatchu201D user) mapped for this system.

The first thing that comes to mind is that there is an issue with their own User on the Portal u2013 which to them it doesnu2019t make sense.

On the support POV, IT will be mad at you, because the issue will certainly reach Portal Support instead of ABAP.

But since this might be the only option for you, be my guest.

BR,

Ivan

[Former Member · Accepted solution]

Hi Ivan,

Thanks for the reply.I will definitely give it a try.

I am unfortunately stuck with the ABAP Webdynpro.Please can you let me know if you have any information on using u201Cplugsu201D on ABAP components.

Thanks

[Ivan-Mirisola · Accepted solution]

Jashan,

This documentation might help you:

URL Parameters in Webdynpro ABAP:

http://help.sap.com/saphelp_nw04s/helpdata/en/2f/e7574174c58547e10000000a1550b0/frameset.htm

Inbound Plugs:

http://help.sap.com/saphelp_nw70/helpdata/en/45/2233b60c21072ce10000000a155369/frameset.htm

BR,

Ivan

[Former Member · Accepted solution]

Hello Ivan,

Thanks.The plug configuration worked.

[Former Member · Accepted solution]

Hi Ivan,

We have picked up another issue.The plug configuration does work for users that are already locked on the backend system, then we can use the System user to unlock the UserID and reset the password, but now we have an issue where the user only wants to reset their password, so they have not yet been locked on the backend system.The application is picking up the users UserID and trying to use their UserID on the backend system to reset their password.The problem is that not all users have the authorization to reset their passwords on the backend system, therefore I would like to know if there is a way to configure the portal or backend system to always use the system user to reset the users password even if their UserID is not locked in the backend system.

Any help would be appreciated.

Thanks

Jashan

[Ivan-Mirisola · Accepted solution]

Hi Jashan,

This is a standard feature of Netweaver - you don't need to care about!

Please use the UME feature described on the the following documentation:

http://help.sap.com/erp2005_ehp_03/helpdata/en/45/7e6313d8780dece10000000a11466f/frameset.htm

This will enable Portal Users to reset their passwords based on their stored data and question/response challenge.

If this succeeds, the user will receive a new "initial" password via e-mail.

Of-course, you need to maintain the user's e-mails address on UME persistence database + the questions/responses if using a predefined set of questions.

Users can also maintain their own data like e-mail and password via "personalize" function of the Portal.

You can also let users define their own set of questions/responses.

BR,

Ivan

Edited by: Ivan Mirisola on Jan 31, 2012 8:40 PM

[Former Member · Accepted solution]

Hello Ivan,

Thanks for the information, but is this not to setup a password reset function for a users portal UserID, I need a reset function to be setup for the SAP backend system UserID?

So if the user has misplaced his SAP system password but is not yet locked on the SAP backend system, he will log into the portal and reset his SAP system password, but instead of using his own UserID to reset his password, we need the webdynpro application on the portal to always use the system user to reset his password.

Thanks

[Ivan-Mirisola · Accepted solution]

Hi Jashan,

I understand you, but how is your UME Persistence store configured.

If you have a Portal, you may configure it to authenticate against a Java System, an LDAP or an ABAP system.

If you have an ABAP system configured as UME Persistence Store, then you may use it for reseting the ABAP user.

Even if you are using an LDAP system, what works best for Portal users is to disable the user's password on the back-end and have it's user base synchronized with the LDAP.

An even better approach would be to have SAP-IdM and NW-SSO in place, so you have a central user repository as well as the means to treat password synchronization/reset, etc.

I highly recommend you to rethink the way you are deploying these developments. SAP has solutions to address these issues which are much more broad and stable than custom development.

If you still think this would be the only way, I would've checked BAPI_CHANGE_USER.

I don't know whether this could be executed with the current user or a system user.

Anyway, you might research about ICF Services (tx.: SICF) and how these services call webdynpros w.r.t. authentication.

BR,

Ivan

[Former Member · Accepted solution]

Hi Ivan,

We have solved the issue with regard to resetting the password when the user has not been locked, but we have picked up another issue that we need to fix before we can go live.

When the user has locked his UserID on the backend ECC6 SAP system and he logs into the SAP NetWeaver portal to unlock his UserID and reset his password a box appears with the following message "No switch to HTTPS occurred, so it is not secure to send a password" and "SSO logon not possible; logon tickets not activated on the server".There is a Log on button at the bottom and once you click the button then it takes you to the password reset application.

Do you know how we can stop this message from appearing and go straight to the application, this message only appears if the UserID is locked?

Any assistance would be appreciated.

Thanks

[Former Member]

Outstanding Issue

[Former Member]

A few outstanding Quetsions.