Skip to Content
This weblog is based on the internal ITS of the 640 Web Application Server.
I suppose the same answers apply to standalone ITS but I haven’t verified that.

When using an Apache reverse proxy in front of ITS content (or an Enterprise Portal
that integrates ITS content) you will find the simple ProxyPass and
ProxyPassReverse directives are not sufficient because of the way ITS URLs are formed.

ITS URLs look like this:

The …sap(…)/ part doesn’t make it through the proxy engine and
Apache tries to serve it as a local file. You will end up with this error:

Not Found The requested URL /sap(cz1TSUQlM2FBTk9OJTNhbHM0MDg5X0VCUV84OSUzYXlCNnhHMkswNF9OUkFyZm45RDFsSzNodElWRno5VHI3eVZCeF94Z0ctQVRU)/bc/gui/sap/its/bbpsc02/~flNUQVRFPTk1NTg1NzY4Ny4wMDEuMDEuMDE= was not found on this server

There are several solutions to this problem. I’ll discuss one trivial solution and one more elegant.

First, the typical proxy rule looks like this:

ProxyPass /sap http://ITSHOST:PORT/sap ProxyPassReverse /sap http://ITSHOST:PORT/sap

The trivial solution is to change this to:

ProxyPass / http://ITSHOST:PORT/ ProxyPassReverse / http://ITSHOST:PORT/

But this proxies every request to Apache and makes using the proxy for multiple
backend systems more complicated. You can still proxy for a portal (for instance) in
this case using normal proxy directives like:

ProxyPass /irj http://EPHOST:PORT/irj ProxyPassReverse /irj http://EPHOST:PORT/irj ProxyPass /logon http://EPHOST:PORT/logon ProxyPassReverse /logon http://EPHOST:PORT/logon

But this can get complicated from an administrative standpoint as the order
these directives appear in your httpd.conf file is important. If you put
the / directive before the /irj directive then /irj will get proxied to
ITSHOST:PORT/irj. And since that host is an ITS and not a Portal then you
will surely get errors.

The better way to solve the problem is by using the Rewrite module. Enable the Rewrite module
and then use a rule like this:

RewriteRule ^/(sap\(.*) http://ITSHOST:PORT /$1 [P,L]

Place your Rewrite directives above your Proxy directives as this is the standard way
to configure Apache and allows for Apache to apply the Rewrite before the Proxy.
This rule takes care of the Apache proxy module mishandling the sap(….) form of
URLs and also allows you serve multiple backend hosts in the same Apache server.
The next problem you might face is trying to proxy two different ITS hosts from the same Apache ๐Ÿ˜‰

To report this post you need to login first.


You must be Logged on to comment or reply to a post.

  1. Former Member
    hi nicholos,
    The blog is very helpful in trying to get backend systems to work through the proxy and portal.

    I have similar string in my httpd.conf file but it always throws me an error.

    RewriteEngine On
    RewriteRule ^/sap(.*)$1 [P,L]

    it always give me
    “RewriteRule: bad flag delimiters” error.

    can you give some advise?


      1. Former Member

        Hi Nick,<br/><br/>We are using a apache RP to access BW (was 6.20) and actually for bex request it is working fine but when we try to access SEM-BPS planning interface adresses are not mapped by the RP.<br/>Is there any configuration to do on BW side ?<br/><br/>Thanks<br/>Ben.<br/><br/>ps: here is our apache config :<br/>RedirectMatch /sap[(](.*)   https://portalserver/bw/sap($1<br/><br/><br/># –

        <br/># Proxy Pass Notes<br/># –

        <br/><br/><IfModule mod_proxy.c><br/>…<br/>        ProxyPass /sap http://sapserver:8001/sap<br/>        ProxyPassReverse /sap http://sapserver:8001/sap<br/>        ProxyPass /bw/ http://sapserver:8001/<br/>        ProxyPassReverse /bw/ http://sapserver:8001/<br/>        ProxyPass /bc/ http://sapserver:8001/<br/>        ProxyPassReverse /bc/ http://sapserver:8001/<br/>

  2. Former Member
    it´s good to see that we are not alone with apache as a reverse-proxy:) We use mod_rewrite instead of proxypass for security-reasons in a mix with mod_security to have an incoming filter on URLs.
  3. Hi,
    Great weblog series.
    I have a scenario where reverse proxy functionality is required to access the XI server.
    The situation is follows:-
    – Partners send messages(HTTP request) through the internet(no VPN) to the XI box(For ex:3B2 message).
    – These has to come in through a system on the DMZ and from there into the  LAN, as the XI system cannot be exposed directly.
    For this we proposed having a proxy server on the DMZ doing an address translation and request routing as per standard sap guidelines.

    However, the security requirements here are very tight and they want some thing like the following :-
    – whenever an HTTP request comes into the system on DMZ, it has to create a new HTTP request to the XI system, which contains all the information from the original request.

    Is it possible using reverse proxy

  4. Former Member
    Hello there,
    i´ve got exactly the problem you mentioned at the end of your blog. Got one Apache working as ReverseProxy for two ITS hosts.
    Tried different virtual hosts constellations, different Rewrite Conds and Proxy* Rules. Best result is it works for the ITS host listed first in the config file but not for the second.
    Helpfull hints would be great.

    Greetings Markus


Leave a Reply