SSO between Juniper and SAP Enterprise Portal
h3. Security Measures If appropriate security measures are not taken, authentication using header variables can allow attackers to impersonate a user by sending a request with a user ID in the appropriate header variable to the SAP Web Application Server. h5. To prevent this, you should do the following: 1.Using appropriate measures, make sure that the HTTP and HTTPS ports of the Web AS Java or portal cannot be directly accessed by client browsers, for example by using firewalls. [http://help.sap.com/saphelp_nw70/helpdata/EN/0a/0a2e1bef6211d3a6510000e835363f/frameset.htm | http://help.sap.com/saphelp_nw70/helpdata/EN/0a/0a2e1bef6211d3a6510000e835363f/frameset.htm] 2.The Web AS should only be accessed through Load Balancer. This prevents attackers from bypassing the LB and impersonating authenticated users. *Using an Intermediary Server to Connect to the AS Java:*
[http://help.sap.com/saphelp_nw70/helpdata/EN/b5/814d28e7b16d418917ca08b85a9921/frameset.htm | http://help.sap.com/saphelp_nw70/helpdata/EN/b5/814d28e7b16d418917ca08b85a9921/frameset.htm]
h3. Add Header variable Login Module:
When a user is authenticated on the SAP Web Application Server Java, the server processes the stack of login modules that apply to the application that the user accesses.
The header variable login module is not automatically included with the default login module stacks. Therefore, if you wish to use header variables for authentication, you must adjust the login module stacks for those applications that will use header variables to authenticate a user.The login module HeaderVariableLoginModule exists in the active user store.
(To check if it exists, in the Security Provider service, choose Runtime -> Policy Configurations, select any component in the component list, and choose the Add New button to add a new login module to the login module stack.A list of all available login module appears.)
If it does not exist, then make it available as follows:
a. In the Visual Administrator, choose Security Provider.
b. Choose the User Management tab and choose Manage Security Stores.
The currently active user store and the login modules for that user store are displayed.
c. Choose Add Login Module.
A dialog box prompting you to choose an editor for the login module option appears.
d. Choose OK. a dialog box prompting you to add a login module appears.
e. Fill in the fields as follows:
Field Name |
h5. Field value |
Class Name |
com.sap.security.core.server |
Display Name |
HeaderVariableLoginModule |
Choose OK. The HeaderVariableLoginModule now appears in the list of login modules
for the active user store.
h3. Configure Header Variable Login module:
Add the HeaderVariableLoginModule to the appropriate login module stack or template and
configure the options as follows:
1. In the Visual Administrator, choose Security Provider.
2. Choose Policy Configurations -> select ticket ->Authentication.
3. For each template or application that is to support header variable authentication:
a. Add the login module HeaderVariableLoginModule to the login module stack.
See below of what position in the login module stack to add the module.
b. Set the option Header to the name of the header variable that contains the user ID.
The default value is REMOTE_USER.
Have a look at SAP Help website for more information about Adjusting Login module stack for using Header Variables:
[http://help.sap.com/saphelp_nw70/helpdata/EN/68/5ddc40132a8531e10000000a1550b0/frameset.htm | http://help.sap.com/saphelp_nw70/helpdata/EN/68/5ddc40132a8531e10000000a1550b0/frameset.htm]
h4. Login Module Stack with Header Variable Authentication:
