Single-Sign-On (SSO) configuration on JAVA Stack through HTTP Header method

[Former Member]

Hello SDN community,

in the context of a Proof of Concept, we are testing the integration of Microsoft Sharepoint Portal with SAP Backend (addin) systems.

As the architecture impose use an external scenario (access from the internet), we couldn't use the Kerberos (SPNego) solution and thus we chosed the http header solution which in short uses an intermediary web server (in this case the IIS of the MOSS solution) which will act as authority.

I miss information on how the workflow works for this http header authentication method. Through the visual administrator of the addin JAVA stack, it is possible to configure each application with a customized authentication (a choice of security modules). But this all that I know.

My task is to configure SSO. From a sharepoint portal, the user should be able to access Web Dynpros and BSPs. I imagine that the very first call to a webdynpro or bsp (or maybe when we log on the sharepoint portal), the request to the WDP or BSP will first be forwareded by the intermediary server to the JAVA stack (or is it the SAP dispatcher that has to be configured).

Is there an application to be built on the java stack to deal with the authentication, modify http header?

What will the Java stack return? a sap long ticket? a token?

How will the redirect work (to by example a BSP which is in the ABAP stack)?

SAP preconise to secure with SSL the link between the intermediary web server and the JAVA stack, is IP restriction also a solution?

A lot of questions about how this SSO http header should work,

I would be very greatful for any help, or info,

Kind regards,

Tanguy Mezzano

[Former Member · Accepted solution]

Hi Tanguy,

sorry for my late reply. A restart of your AppServer should be more than fine. Did your changes take effect now??

I'm on workshops for the next three weeks but I'll try to reply as soon as possible.

Cheers

[Former Member · Accepted solution]

Hi Marcel,

I've set the domain relaxation to 1 as SAP supports tells me, but still nothing change. I the dispatcher http logs on the server I see that I still have .bbb.company.com as cookie domain.

I have of course restarted the sap j2ee server.

Is there another place where parameters influence domain relaxation?

Kind regards,

Tanguy

[Former Member · Accepted solution]

Hi again,

I really don't understand why this is not working. Maybe I'm not looking at the right place.

I have activated the logs, and I can see the http trace of the dispatcher, but even after restarting the engine, I see that the cookie delivered is still .bbbb.company.com with domain relaxation to 1.

Is there another part that might override this parameter? the descriptor of the servlet? a paramter in the dispatcher?

I'm sorry to insist but I'm really stuck.

Thanks anyway again for your interest,

Kind regards,

Tanguy

[Former Member · Accepted solution]

Hello Marcel,

just to say you that it's working now, I read again our thread and applied your answer from post Posted: Jul 10, 2008 1:46 PM.

Thanks again for your time and help, I see that you are really active on this forum, that's good for us!

Regards,

Tanguy