Access to Web from Customer Exit? Not there unless authorized?

[Former Member]

In a custom subscreen exit, I have an SAP picture control.

If I pass the picture control a "file" URL, i.e. a URL that begins with "file://", then the picture control loads fine. So I know there's nothing wrong with the code.

But if I pass the picture control a true web URL, i.e. a URL that begins with "http://", then the picture control doesn't load - nothing appears in the container.

I assume that what's going on is an access authorization problem - that at this site, the SAP runtime is not authorized to access the external web on its own.

Is this generally true? Does it take special authorizations for the SAP runtime to be able to access the web?

Also, if what I'm experiencing is an access authorization problem, wouldn't you think the program would short-dump or at least display an error message, rather than just displaying nothing ????

Thanks for whatever time anyone can afford to spend considering these questions.

djh

[RichHeilman]

Hi David, I don't think there is any authorization isssue here, simply you may be using the wrong control. Instead of using a picture control for URLs from web, use an HTML control.

Regards,

RIch Heilman

[RichHeilman]

It would be as simple as doing pretty much the same as the picture control, but calling the SHOW_URL method of the class like so. See example program SAPHTML_DEMO1 for a complete example coding.

DATA: html_control TYPE REF TO cl_gui_html_viewer.
data: url(2048) type c.

url = 'http://www.sap.com'.


        CALL METHOD html_control->show_url
             EXPORTING
                  url =   url
             EXCEPTIONS
                  cnht_error_parameter = 1
                  OTHERS = 2.

REgards,

RIch Heilman

[former_member181923]

Rich -

I'm gonna hold off accepting that answer.

Reason is that BC412 manual specifically says in the picture control section that the URL you pass to cl_gui_picture->load_picture_with_url can be any one of the following:

1) a "file://" URL;

2) an "http://" URL;

3) an "ftp://" URL;

4) an MIME repository path.

I wouldn't think the manual would be so specific about these four types of URL's if they weren't all permissible.

Plus, of course, the HTML viewer doesn't give you zoom, stretch, center, and all the other features of the picture control.

Regards

djh

[RichHeilman]

Ok, I'm sold, if BC412 says that you can do it, then it must be correct. So, let's check authorizations, I assume that after the screen is display with an empty container, that you have used /nSU53 to check for authorizations?

Regards,

RIch Heilman

[former_member181923]

Hi aRs -

Not SAP_Picture_Demo, but something just as good.

I tested the URL using a Picture Control demo program that Uwe Schieferstein happened to write a few days ago (based on a BC412 example) when he was showing me the cl_bds_document_set->get_with_url method (the one that I wound up not being able to use.)

This program also loads a "file://" URL fine, but not an "http"//" URL.

Reason I think it's an access authorization problem is that my current customer places heavy restrictions on web access BY user id - e.g. non-salaried employees in the plants can't access the web.

So I think that to get web access, at least general web acess, the SAP runtime has to be "authorized" for this access - same as any other "user" at this site.

Regards

djh

[former_member181923]

Rich -

Good suggestion - I'll do the su53 first thing tomorrow. It occurred to me also, but I literally ran out of time - had to split and take the honey to the doctor.

Will try first thing in the morning, unless someone says something definitive tonight.

Thanks again.

Regards

djh

[RichHeilman]

I might be reaching a bit here, but do you think that the url object needs to be uploaded to SAP via transaction SMW0, so then you can get the internal URL to pass to the method?

Regards,

Rich Heilman

[RichHeilman]

Oh no, you already mentioned that the "file://" works just fine. I can't seem to get it to do it with "http://" either.

Regards,

Rich Heilman

[RichHeilman]

And nothing showing in SU53 for me. ;(

Regards,

RIch Heilman

[former_member181923]

Hey Rich -

Thanks for corroborating the problem.

I was thinking about su53 - if the problem is at the site's network security level, then it's completely outside SAP, so it makes sense that su53 would not show anything - no internal SAP authorization is being violated.

It's when SAP itself tries to access the web on behalf of the SAP user that network security steps in and says something like:

"SAPADM"? "SAPADM" has no authorization to surf the web.

(Or if not "SAPADM", then whatever name the network knows the SAP runtime as ...)

Regards

djh

[RichHeilman]

Let's test that theory. Copy and run this test program which uses an HTML control to display the SAP logo that you see at the top left of the SDN page. Can you see it?

report zrich_0001.

data: docking type ref to cl_gui_docking_container,
      html_control type ref to cl_gui_html_viewer,
      repid type syrepid,
      url(256) type c.

parameters: p_check type c.

start-of-selection.

at selection-screen output.

  repid = sy-repid.


  check docking is initial.

  create object docking
              exporting repid     = repid
                        dynnr     = sy-dynnr
                        side      = docking->dock_at_left
                        extension = 1500.

  create object html_control exporting parent = docking.


  url = 'https://www.sdn.sap.com/irj/portalapps/' &
        'com.sap.nw.wpc.cssservice/images/logo_header.gif'.

  call method html_control->show_url( exporting url = url ).

Regards,

Rich Heilman

[former_member181923]

Rich -

Thanks very much for providing a testbed.

No - nothing pops at all when I run your program.

Basis has informed me that if I give them the program, etc., they will research the connections and do whatever is necessary to open the firewall, etc.

So I'll leave this thread open and post back to it with progress reports on what they've done and whether it's working.

Thanks again for working this one for us (me and anyone else who's gotta do the same thing.)

djh

Dave

[RichHeilman]

Hi David, Sorry for the late reply, forums were hosed yesterday. Anyway, this program works fine for me, so I have to say that your internet access is being blocked somewhere. So I think you are on the right track.

Regards,

Rich Heilman

[former_member181923]

Hey Rich -

Thanks for getting back with confirmation of our suspicions.

Fortunately, the customer has realized that opening up the shop floors to the Web may cause future problems (even when the access is purely under program control.)

So they've agreed to restrict their GOS "URL" attachments in IW22 to "file" URLs, which as we have seen, are no problem for the picture control.

By the way, I have wound up using the HTML viewer <b>as well as</b> the Picture Control, for the following reason.

Since I have to "fit" ictures smaller to display three of them in the Picture Controls on the fifth subscreen of the custom IW22 tab, I've put in a click event on each picture control that will pass the URL to the HTML viewer, which will of course pop a full-size copy. (At this point in the code, I've always got a file URL for each attachment, because I've written any internal binary attachment to a drive for performance reasons - i.e. once I've accessed the internal binary once in SOFFDB, I write it to disk so that I never have to go into the DB again for that picture ...)

Thanks again for the guidance.

Regards

djh

[former_member181923]

Hey Rich -

Just thought you'd be interested to know that when I passed your program the URL of a jpg on the customer's <b>intranet</b>, the jpg popped fine.

QED.

Thanks again

djh

[former_member194669]

Hi,

Can you test your query using SAP_PICTURE_DEMO program

aRs