Encrption in EP6.0

Question

Hello,
The requirement is, we have to integrate a portal say sdn with our portal. We have to implement SSO in this. Is there any encrypting mechanism available in EP6.0 before sending the userid and pwd? Kindly help.
Regards,
Rukmani

Answer 1

HI Rukmani,
If you want to achive Single Sign On,then two methods are
available :
1) SSO with SAP logon tickets
2) SSO with user ID and password
SSO with SAP logon tickets is based on a secure ticketing
mechanism whereas SSO with user ID and password forwards
the user’s logon data (user ID and password) to the
systems that a user wants to call.
When we use USERID/PWD based SSO, it is unsecure and so
it is recommended that we protect the connections to the
backend systems using HTTPS or SNC to prevent the user ID
and password being eavesdropped by an external party.Also,
we should install the full version of the SAP Java
Cryptographic Library if you use user mapping so that
user mapping data can be stored in encrypted form.
The way SSO can be done depends on the server to which
SSO is to be achieved.
When the target server,say SDN is configured for FORM
based/Basic authentication, then the authentication
parameters-the userid and password needs to be supplied
to it in the login form so that it can be
submit/understood and the user may be authorized for
acccess. IF you see the source of the SDN login page,you
will see something like
<form name="loginForm" action="/irj/servlet/prt/portal/prtroot/com.sap.sdn.logon.
redirect" method="post" id="loginForm" style="margin-top:
0px;
<input type="hidden" name="login_submit" value="on">
                        <input type="hidden" name="j_authscheme" value="<b>sdnuidpwdlogon</b>">
<input class="urEdfTxtEnblSml" name="<b>j_user" type="text" size="14" maxlength="100"></b>
<td valign="middle" align="right" width="95" height="16"><span class="sapTxtSml">Password</span></td>
                                                <td valign="top" align="right" style="padding-right: 5px"
width="105" height="16"><input class="urEdfTxtEnblSml"
onkeypress="try { if (event == null) { event =
window.event; } if (event.keyCode == 13)
{document.loginForm.submit();} } catch (e) {}" name="<b>
j_password" type="password" size="14"</b>
maxlength="100"></td>            
</form>
So, it uses Method POST where UID/password are provided as text and not in encrypted form.
So, even if you send the userid/password in encrypted
form, the target would take them as simple String as it
is not meant/configured for decrypting the parameters and
the user would not be authenticated.
HOpe this helps,
Regards,
Siddhartha
Message was edited by: Siddhartha Jain
Message was edited by: Siddhartha Jain