Block Anonymous access to files

[Former Member]

Hello,

Some how when we access to https://<host>/irj/portalapps/com.sap.portal.epcf.loader/support/epcfproxy.zip and https://<host>/irj/portalapps/com.sap.portal.epcf.loader/applet/epcf.jar we can access it without authentication. How can be block the anonymous access.

Regards,

Ann

[Former Member]

Thanks Praveen.

See below my web.xml , I don't see any reference for anonymous access to this files.

<web-app>

<display-name>The Java iView Runtime</display-name>

<listener>

<listener-class>

com.sapportals.portal.prt.session.HttpSessionHandler

</listener-class>

</listener>

<servlet>

<servlet-name>

gateway

</servlet-name>

<servlet-class>

com.sap.portal.navigation.Gateway

</servlet-class>

<load-on-startup>

0

</load-on-startup>

<init-param>

<param-name>

portal_entry_point

</param-name>

<param-value>

/servlet/prt/portal/prtroot/com.sap.portal.navigation.portallauncher.default

</param-value>

</init-param>

<init-param>

<param-name>

wsrp_producer_service

</param-name>

<param-value>

ProducerImpl

</param-value>

</init-param>

<init-param>

<param-name>

portal_anonymous_entry_point

</param-name>

<param-value>

/servlet/prt/portal/prtroot/com.sap.portal.navigation.portallauncher.anonymous

</param-value>

</init-param>

<init-param>

<param-name>

portal

</param-name>

<param-value>

anonymous=0,proxy=0,low_bandwidth=0,include_in_url=1,include_application_name_in_url=1

</param-value>

</init-param>

<init-param>

<param-name>

portal/light

</param-name>

<param-value>

anonymous=0,proxy=0,low_bandwidth=1,include_in_url=1,include_application_name_in_url=1

</param-value>

</init-param>

<init-param>

<param-name>

portal/anonymous

</param-name>

<param-value>

anonymous=1,proxy=0,low_bandwidth=0,include_in_url=1,include_application_name_in_url=1

</param-value>

</init-param>

</servlet>

<servlet>

<servlet-name>prt</servlet-name>

<servlet-class>com.sapportals.portal.prt.dispatcher.Dispatcher</servlet-class>

<load-on-startup>1</load-on-startup>

<init-param>

<param-name>

portal_context_root

</param-name>

<param-value>

/irj

</param-value>

</init-param>

</servlet>

<servlet-mapping>

<servlet-name>gateway</servlet-name>

<url-pattern>/portal/*</url-pattern>

</servlet-mapping>

<servlet-mapping>

<servlet-name>gateway</servlet-name>

<url-pattern>/wsrp/producer/resource/*</url-pattern>

</servlet-mapping>

<servlet-mapping>

<servlet-name>gateway</servlet-name>

<url-pattern>/wsrp/consumer/resource/*</url-pattern>

</servlet-mapping>

<servlet-mapping>

<servlet-name>prt</servlet-name>

<url-pattern>/irj/*</url-pattern>

</servlet-mapping>

<servlet-mapping>

<servlet-name>prt</servlet-name>

<url-pattern>/go/*</url-pattern>

</servlet-mapping>

<session-config>

<session-timeout>30</session-timeout>

</session-config>

<welcome-file-list>

<welcome-file>index.html</welcome-file>

<welcome-file>index.jsp</welcome-file>

</welcome-file-list>

</web-app>

Also the reason we need to change is because IT security doesnot allow any anonymous access to this jar files or zip files or any class files.

Regards

[praveenkumar_gudapati]

Hi,

These files are available on the public part of the portal application. So these will be available to all with out any restrictions. Why do you want to block Anonymous access to these files and why change the standard SAP portal application behaviour?

There are two ways to restrict access to these files:

1. Remove the files and place them under PORTAL-INF folder in the portal application. This will then check authentication before access.

2. Change the IRJ application, so that it does not allow access to public part of the portal application for Anonymous users. But this then a tricky thing as this may cause lot of applications to fail.

http://help.sap.com/saphelp_nw70/helpdata/EN/44/42c08f81ce2152e10000000a114a6b/frameset.htm

I would recommend not to make any changes to SAP standard portal applications as this may cause misbehaviour in your portal.

Regards,

Praveen Gudapati