Application-to-Application SSO web dispatcher HANA

[former_member241674]

Hi,

We have an SSO setup using SAML on our HANA box. The HANA services are exposed via an SAP Web-Dispatcher. Web dispatcher is a public exposed proxy system. HANA xs requests are redirected to ADFS for login and the authentication works well.

Hana: http:myinternalHostForHANA.com/XSProject => Works

Web Dispatcher: https://myExternalHost.com/XSProject => Works

Since the internal host is not exposed externally it cannot be used as destination in SAP Cloud. Also, the other option via cloud connector is being worked on, it as it's own issues.

Web Dispatcher in Cloud destination: https://myExternalHost.com/XSProject => Doesn't Work.

Error in webide: Internal Server Error 500: StatusCode in ResponseMessage != OK; please refer to the database trace for more information

Error in HANA: XSSessionLifecycle.cpp(00341) : Assertion authentication for user failed with reason: Unable to verify XML signature(StatusCode: , StatusMessage: ) [49366]{49366}[-1/-1] 2018-09-04 14:15:54.592005 e XSRequestHandler RequestHandler.cpp(00805) : exception 1: no.1000090 (HttpClient/Web/WebEntityBase.h:78) Reached unreachable code exception throw location: 1: 0x00007fb28580888c in xsengine::SessionManager::doSAML(ltt::smartptr_handle<xsengine::Session>&, httpclient::WebRequestInternal const&, httpclient::WebResponseInternal&, xsengine::ResourceInfo const&, xsengine::XSAAuthMethod const*, unsigned long long&, ltt::unique_ptr<ltt::basic_stringstream<char, ltt::char_traits<char> >, ltt::with_alloc_t, ltt::default_delete<ltt::basic_stringstream<char, ltt::char_traits<char> > > >&, bool, bool)+0xa08 at WebEntityBase.h:78 (libhdbxsapi.so) 2: 0x00007fb285808998 in xsengine::SessionManager::doNonInteractiveAuth(ltt::smartptr_handle<xsengine::Session>&, httpclient::WebRequestInternal const&, ltt::vector<xsengine::XSAAuthMethod*> const&, httpclient::WebResponseInternal&, xsengine::ResourceInfo const&, unsigned long long&, ltt::unique_ptr<ltt::basic_stringstream<char, ltt::char_traits<char> >, ltt::with_alloc_t, ltt::default_delete<ltt::basic_stringstream<char, ltt::char_traits<char> > > >&, bool, xsengine::SessionManager::basicAuth&, bool)+0x104 at XSSessionManager.cpp:707 (libhdbxsapi.so) 3: 0x00007fb28580a0b5 in xsengine::SessionManager::authenticate(ltt::smartptr_handle<xsengine::Session>&, httpclient::WebRequestInternal const&, httpclient::WebResponseInternal&, xsengine::ResourceInfo const&, xsengine::AuthMethod::Type, bool, ltt::vector<xsengine::XSAAuthMethod*> const*, bool, bool*)+0x281 at XSSessionManager.cpp:927 (libhdbxsapi.so) 4: 0x00007fb2ac633a36 in xsengine::RequestHandler::handleRequest(ltt::smartptr_handle<xsengine::HttpRequestContext>&, int)+0x3692 at RequestHandler.cpp:580 (libxsengine.so) 5: 0x00007fb2ac63c935 in xsengine::RequestJobWrapper::run(Execution::Context&, Execution::JobObject&)+0x41 at RequestHandler.h:77 (libxsengine.so) 6: 0x00007fb2875fd997 in Execution::JobObjectImpl::run(Execution::JobWorker*)+0x1233 at JobExecutorImpl.cpp:1099 (libhdbbasis.so) 7: 0x00007fb2876095f5 in Execution::JobWorker::runJob(ltt::smartptr_handle<Execution::JobObjectForHandle>&)+0x3b1 at JobExecutorThreads.cpp:223 (libhdbbasis.so) 8: 0x00007fb28760bc47 in Execution::JobWorker::run(void*&)+0x203 at JobExecutorThreads.cpp:442 (libhdbbasis.so) 9: 0x00007fb287661827 in Execution::Thread::staticMainImp(void**)+0x743 at Thread.cpp:464 (libhdbbasis.so) 10: 0x00007fb287662e98 in Execution::Thread::staticMain(void*)+0x34 at ThreadMain.cpp:26 (libhdbbasis.so)

[Ivan-Mirisola]

Have you configured trust between your account and ADFS? What about principal propagation in Cloud Connector?

[former_member241674]

Yes, trust is setup between account and ADFS. We even login to webide via ADFS if that helps.

Propagation in Cloud Connector is been worked on in parallel. We have some issues with the Kerberos to HANA setup. So we are exploring the Web DIspatcher option.