Reading Netweaver Portal’s logon ticket -“MYSAPSSO2” cookie in BSP Applications

[Former Member]

assign value to an ABAP variable(page attribute) directly ,from javascript.

What we get in the Input field is something like this :

We can see a lot of name-value pairs like sap-appcontext,sap-contextid,JSESSIONID and finally we can see what we need,the MYSAPSSO2 cookie,but its value is incomprehensible,as it seems encrypted.

The other values also contain lots of information like Session details in cookie

JSESSIONID

, but right now we just need to extract the userid of the EP user,
basically,to just decrypt the MYSAPSSO2 cookie.
Firstly we need to separate it from the other values,so as to make our task little easier.So,in onInputProcessing event handler,we use

SPLIT mysapsso2 AT 'MYSAPSSO2=' INTO temp1 temp2 .
SPLIT temp2 AT ';' INTO cookie temp2.

And we get the following value in the variable-cookie.

It turns out that it is just Base 64 encoded and first, we have to decode it to see what it actually has in store.

In ABAP the class

CL_HTTP_UTILITY

has methods which help us achieve just that. But first we need to pass the value from the input field, so that it can be
read and processed.
Through the button click we can submit the form to to process the value in onInputProcessing.
Then, in the event handler onInputProcessing ,we process the value as:

CALL METHOD utility->decode_base64
 EXPORTING
 encoded = cookie
 RECEIVING
 decoded = cookiedecoded.

IF we print the value that we have now in page attribute cookiedecoded,we will get something like :

Bingo! Now we see something comprehensible.

On close examination we see values like

SIDDHJ

, which is the userid with which I logged onto the Portal,then we see the method used for authentication onto
our WAS on which the BSP application is hosted as

basic authentication

,we see the SYSTEM ID of Ticket Issuing Portal server as

NWS

,we see the expiry
time/validity of ticket as

200510220946

.(YYYYMMDDHHMM)
But, still we need to separate the values, to generalize the way in which we get the userid etc. in some variable.
I was unable to split up the string in this format, so I decided to do some more processing on it.
We can use another method of the class CL_HTTP_UTLITY as:

CALL METHOD utility->escape_url
 EXPORTING
 unescaped = cookie
 RECEIVING
 escaped = cookie.

We get something like:

Now we use the SPLIT statement to break the string and to get details,say userid.So we use :

SPLIT cookie AT 'portal%3a' INTO temp username.
SPLIT username at '%88' into username temp.

Finally the page attribute username contains the UserID of the Portal user logged in.
After doing this, we can do some cleaning to our code.
Instead of using document.cookie,we would use

function ReadCookie()

{

var cookiename = "MYSAPSSO2";

var cookiestring=""+document.cookie;

var index1=cookiestring.indexOf(cookiename);

if (index1==-1 || cookiename=="") return "";

var index2=cookiestring.indexOf(';',index1);

if (index2==-1) index2=cookiestring.length;

document.formAccnt.ip1.value = unescape(cookiestring.substring(index1cookiename.length1,

More details on using the Appintegrator can be had from the How To.. document on SDN

How To Use The AppIntegrator

But the Appintegrator uses GET method for passing parameters,so it may not be a very secure way of passing sensitive information.</p>

So,we can choose the method depending upon our requirement,as to what needs to be done-Read the Ticket or simply pass parameters from iViews.