SSO issue with reverse proxy in front of Web Dispatcher

[Former Member]

Hi,

we have an ESS/MSs enabled portal with additional webdynpro ABAP functionality for other functions. We have a web dispatcher in front of it and our SSO works fine when connecting via the web dispatcher for ESS/MSS and the webdynpro ABAP calls.

We have had a reverse proxy setup for the web dispatcher and when we try our portal logons using the reverse proxy URL the SSO fails for the webdynpro ABAP functions and a logon screen is displayed.

I enabled the diagtool on the Portal to catch the error , and the following is recorded :-

System.err system.forward.info

Can anyone suggest what needs to be done to enable SSO to work fo the webdynpro ABAP when using the RPROXY URL.

Portal URL :- http://portal.city.org.uk

Wed Disp URL :- http://webdisp.city.org.uk

RPROXY URL :- http://www.external.city.org.uk

All 3 have the city.org.uk domain.

Can anyone suggest why he SSO is failing for the webdynpro ABAP functions when using the RPROXY URL ?

Regards,

Brian.

[Former Member]

Hi,

We don't have all the needed information. So, I suppose that your abap system is http://abap.city.org.uk

I think that when you logon successfully to http://www.external.city.org.uk the sap logon ticket cookie is valid for domain

external.city.org.uk and so is not sent to the different domain called city.org.uk.

If you want it to work you need to use domain relaxing on the portal : property ume.logon.security.relax_domain.level for service com.sap.security.ume.service

Regards,

Olivier

[Former Member]

SAP Web Dispathcer has the inbuilt functionality to serve as Reverse Proxy, I don't know why you wanna use another layer between backend system and SAP Web Dispatcher.

For more info: http://help.sap.com/saphelp_nw70/helpdata/en/59/31ae42e0fac911e10000000a1550b0/frameset.htm

if you wanna know how to configure SAP WD as Reverse proxy use this link or reply back with your questions.

http://help.sap.com/saphelp_nw70/helpdata/en/42/5cfd3b0e59774ee10000000a114084/frameset.htm

Thanks

SM

[Former Member]

Hi SM,

I beg to differ on your opinion. Although the SAP Web Dispatcher has reverse proxy capabilities, it cannot be implemented as a fully reversed proxy since the response does not go through the SAP Web Dispatcher. So there could be a need to implement a reverse proxy with a SAP web dispatcher.

Hope it helps,

Prathamesh

[Former Member]

You mean to say we need a Proxy which can route the calls from WD to Internet? I'm under the assumption that Web Dispatcher is still a ICM and can work in either directions.

Correct me if I'm wrong.

thanks

SM

[Former Member]

Hi SM,

Well, this discussion is going tangent and I hope Brian doesn't mind. All I am trying to say is, there could be a possibility of using both a reverse proxy and a SAP Web Dispatcher in your landscape. The proxy is typically used in a DMZ and the SAP web dispatcher could be placed before (in the DMZ before the proxy) or after it (in the network after the inner firewall), all depends on how you want to set it up and what your infrastructure and requirements are.

As you say, a SAP Web Dispatcher can be good enough for all what a reverse proxy does and you are correct and we don't really "need" a reverse proxy to route calls from WD to the internet. It is sufficient but it may not be enough.

Hope it helps,

Prathamesh

[Former Member]

Hi Brian,

Check these blogs

[http://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/23833] [original link is broken] [original link is broken] [original link is broken];

[http://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/24103] [original link is broken] [original link is broken] [original link is broken];

Hope these help,

Prathamesh