External Portal - userIDs used by customers? guest logon?

Hi,
We want to impliment an external facing Portal where the customers(citizens) will be able to look up their account information via our CRM system.
Can somebody maybe explain or point me in the direction on how the userID's and licensing will be treated?
Obviously a customer must log in from the internet onto his own account and need a userID for this, but is this a standard SAP userID that is created? So do we need the userID in CRM as well? (I would hoped the Portal will only read the customer data from CRM rather than the user actually logging onto the Portal.
What are the user licensing implications? We can surely not be expected to have to pay for user licenses for say a million seperate accounts.
Thanks, any advise will be appreciate.

Hi Anja,
Thanks for the reply.
No, I do not like to have every customer to have an userID (via UME). I would prefer it to be some type of anonymous logon.
But then again the user must have some type of logon ID, because how will the customer be identified and linked to his/her own utilities account via CRM?
Basicaly we use IS-U. So we want to allow customers in the future to view and to manage his their account, provide meter readings, etc. Hopefully this makes more sense.
All advice will be much appreciated.
Thanks,
Adriaan

Similar Messages

Webdynpro vs External Portal - Can we use?

Hi All,
I tried looking and asking so many this question. I got mixed answers, i am in confusion. Could anyone of you let me know <i><b>whether WebDynpro based iViews can make it to External Portal (SAP EP)?</b></i>
Did anyone already did this?
Thanks,
Raghavendra Pothula

Hi,
I haven't tried this but I think it should be ok.
Anyone else has opinion on this?
Regards
Ladislav

Internal and External Portals be hosted & Configured on Same Portal server?

Hi Experts,
Is it possible to host and configure the Internal portal and External Portal on the same portal server?
If yes, kindly provide the inputs.
We have a scenario wherein we have to use the same portal server for both kinds of users (Internal as well as External).
We want to provide separate URLs for both the portals and the datasource for the users management would be different for both the scenarios.
The user managemnet in case of Internal Portal has to be authenticated to an AD server whereas in case of External Portal the user management would be taken care by UME.
Please suggest and share some docs if possible.
Thanks & Regards,
Anurag

Hi,
Can we customise the Portal logon page for both the portals differently?
I've already customised the portal logon page by modifying the UME properties in the Config Tool but that was done keeping in mind the External Portal users. Now, we want to customise the page for Intranet users but with different options at the logon page.
How can we achieve this functionality as any property that we modify in either VA or Config Tool will affect both types of portal pages.
For an eg. we have a Self Registration link for the external users which we do not want for the Intranet users. How is this possible?
If we design a webdynpro java application for the logon page and for authentication purpose, can we call a home page iview on successful authentication?
And with this customised webdynpro java application, can we connect to the AD server for the user authentication?
Best Regards,
Anurag

Use Windows Account to logon to WAS (ICM) ...

Hi All !
is it possible to use a windows Domain Account to logon to WAS Applications ( BSP or Webdypro in ICM ) ?
possible with Kerberos or Certificates ?
How to implement ?
need help !
Thanks
Oliver

Wolfgang,
Yes, I hope that Oliver finds this chat/info useful, and not too confusing.
I am sorry, but the question asked in this post was related to using the Windows Account to logon to WAS. For me that means something like :
1. The user is currently logging onto Windows using an account, and is authenticating with Active Directory using this account. e.g. via password or smart card, two-factor token etc.
2. The user wants to use this same Windows account to logon to WAS ABAP. This implies the same authentication method used to logon to Windows (e.g. password, smart card, two-factor token etc.) should be used to logon to SAP WAS. This relates to the question being asked by Oliver.
So, if we first consider x.509. How are you proposing that the user authenticates using their certificate, and determines their Windows account from this certificate when they log onto SAP ? The Active Directory approach is to use PKINIT (a Kerberos pre authentication mechanism) to determine the Windows account name from the certificate based authentication, so SAP WAS would have to use PKINIT and/or share the same certificate that Active Directory uses for this to be possible. I am not aware of a method of making this work with SAP software, and if it is possible, it certainly would not be easy. Also, I am not convinced this gives Oliver what he is asking for. The only method I am aware of is to use client certificates to authenticate to SAP, and these certificates would normally be issued by SAP or via an external CA which is trusted by SAP. When using this method to logon to SAP there is no way to relate the certificate to the account name the user is aware of in Windows since the certificate authentication used by SAP is completely separate from the Windows account authentication. Hence, I would say that x.509 cannot be used to meet Olivers requirements.
Regarding SPNEGO. There was no question asked about SPNEGO - you introduced this technical term in your response, and I answered the question referring to Kerberos since this is what Oliver asked about. Also, this is not supposed to be a discussion about standards, it is a discussion about the methods available to logon to SAP WAS using a Windows account. This is the question I have answered.
I didn't say that the ABAP systems supported SPNEGO. I simply explained how it is possible to use Kerberos to authenticate to ABAP apps, either via Integrated Windows Authentication or via a logon screen that asks for Active Directory account name and password. This answers the question from Oliver clearly and without confusing him with technology - basically, what he wants to do is possible, very easy and quite commonly implemented by SAP customers, so surely these things are more important than introducing technology and standards in to the discussion when they are not relavent, and certainly better than giving the impression that x.509 is the way to go !
I don't want this post/discussion to be taken the wrong way. I wanted to make sure that Oliver gets the answer he asked for, and when you responded implying that x.509 was the best option and Kerberos was not possible I felt I had to correct you on this, in the context of the question being asked and my knowledge of the solutions available on the market to address the requirements that Oliver has asked about.
Regards,
Tim

How to set a variable in portal session using web dynpro java.

Hi,
I have created a web dynpro application, which is running inside portal. I have created a role called "R1". Inside role R1, i have created 3 workset W1, W2 and W3. and inside each workset i have some pages and iviews.
My requirement is when user logins to the portal , and when he clicks on role R1 for the first time, a login page should come (so that we can do revalidation), and when he enters his password again in that login page , then only workset W1, W2 and W3 should be visible/accessible to him and after successful revalidation, if he clicks again on role R1, in that particular portal session, than that login page should not come.
for this, i thought i will set a variable in portal session, whenever user successfully revalidated himself, and if after successful revalidation he clicks again on role R1, i will check in doinit method of webdynpro whether variable is set or not (which i already set on successful revalidation), and if it is set then i will do Donavigation else i will present login page to the user.
Can anyone tells me how to set a variable in portal session using web dynpro java.
thanks
Arush

Hi,
Try this:
WDScopeUtil.put(WDScopeType.CLIENTSESSION_SCOPE, key, value)
WDScopeUtil.get(WDScopeType.CLIENTSESSION_SCOPE, key)
Ex:
WDScopeUtil.put(WDScopeType.CLIENTSESSION_SCOPE,"Key1","Value1");
String value1=WDScopeUtil.get(WDScopeType.CLIENTSESSION_SCOPE,"Key1").toString();
/people/william.cui/blog/2007/02/12/sharing-session-context-between-parent-and-external-windows-running-on-same-host
Regards,
Charan

Error when loggong on for external ID "": Error during SAML 2.0 logon

Hi,
I'm getting be below error when trying to use SAML SSO for a ABAP Webdynpro page on a NW 7.4 system. When I access the page, it redirects to the identity provider, comes back to the page and it shows the logon page. I'm looking for any ideas of things I could look at.
N SAML20 SP (client 400): Incoming Response
N SAML20 Binding:          POST
N SAML20 IdP Name:         http://xxxxxx/adfs/services/trust
N SAML20 Status Code:      urn:oasis:names:tc:SAML:2.0:status:Responder
N SAML20 SP (client 400): Default ACS endpoint: https://xxxxxx/sap/saml2/sp/acs/400 , old default ACS endpoint
N SAML-Trace: CALL 'SAML login': SY-SUBRC = 222 , PWDCHG = 0
N *** ERROR => SAML-Trace: Path = /sap/bc/webdynpro/sap/oauth2_authority [sign.c       16519]
N {root-id=005056AD26DF1ED4B69880FF4BE51F68}_{conn-id=005056AD26DF1ED4B69880FF4BE53F68}_1
N *** ERROR => SAML-Trace: Returncode = 222 [sign.c       16519]
N *** ERROR => SAML-Trace: Message class = SAML number = 011 [sign.c       16519]
N *** ERROR => SAML-Trace: Message = Error when logging on for external ID "": Error during SAML 2.0 logon [sign.c       16519]
I have updated the service to use alternate logon procedure and added the handler CL_HTTP_EXT_SAML20
I have added the identity provider through transaction SAML2, but it does not seem to be working.
Here is a decrypted SAML assertion:
<samlp:Response ID="_9c844d84-8117-4851-8270-aeb12e935daf"
Version="2.0"
IssueInstant="2015-04-02T00:21:06.477Z"
Destination="https://xxxxxxxxx/sap/saml2/sp/acs/400"
Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
InResponseTo="S005056ad-26df-1ed4-b699-c4c630853f68"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://xxxxxxxx.com/adfs/services/trust</Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
<ds:Reference URI="#_9c844d84-8117-4851-8270-aeb12e935daf">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<ds:DigestValue>08HK08VLpJC23JoQs+p+oHbDBvjRF+9NwBeowmlFTrY=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>xxxxxxx</ds:SignatureValue>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIIFPjCCBCagAwIBAgIHAMFKH58TFzANBgkqhkiG9w0BAQsFADCBtDELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoTEUdvRGFkZHkuY29tLCBJbmMuMS0wKwYDVQQLEyRodHRwOi8vY2VydHMuZ29kYWRkeS5jb20vcmVwb3NpdG9yeS8xMzAxBgNVBAMTKkdvIERhZGR5IFNlY3VyZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjAeFw0xNDAxMjMxOTM3MThaFw0xNzAxMjMxOTM3MThaMEIxITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRlZDEdMBsGA1UEAxMUZnNwcm94eTItZGV2LmlndC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAM13/bboldFRmDGK3QBbxlDREoGuQEUWeroZCDM/tH7Rk+AjgXbc4pkon13EwKi7q9brzkBMCY3HH9Ep2BUHjopydy+AWQH9vjLK2wXD/+6T4FCG1i8Kt+lRrcxRWUugnBuK+BRgxEJDz7ap8KvcRk6ERWQrx5Co8K7ey5nEqjapCDJQg3Yrkxo2pEWGBKSIXXmpU+CgK03y4HOW19/rmdcyLThjchn+Jgxe8obL4tiVk4D/X36wOqtV/1cnIjGak/px/p1oQEGD5PC7F3FIZConhUu7PJDLmioqdGcimZvFiZK6xQJyzy90lm0dHRT1qhkC9TTsGvAAMCh/gn41xAgMBAAGjggHEMIIBwDAPBgNVHRMBAf8EBTADAQEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nb2RhZGR5LmNvbS9nZGlnMnMxLTExLmNybDBTBgNVHSAETDBKMEgGC2CGSAGG/W0BBxcBMDkwNwYIKwYBBQUHAgEWK2h0dHA6Ly9jZXJ0aWZpY2F0ZXMuZ29kYWRkeS5jb20vcmVwb3NpdG9yeS8wdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5nb2RhZGR5LmNvbS8wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jZXJ0aWZpY2F0ZXMuZ29kYWRkeS5jb20vcmVwb3NpdG9yeS9nZGlnMi5jcnQwHwYDVR0jBBgwFoAUQMK9J47MNIMwojPX+2yz8LQsgM4wOQYDVR0RBDIwMIIUZnNwcm94eTItZGV2LmlndC5jb22CGHd3dy5mc3Byb3h5Mi1kZXYuaWd0LmNvbTAdBgNVHQ4EFgQUMRTW5O0fpR4kET2ED84QAS6ZXBowDQYJKoZIhvcNAQELBQADggEBAKCQfnSSA1gs6qyYKqAqQKhhRRhC4wMtZJLZUmMGPe2q+QM4dQxJgrFy2OVG6I4dXFrxINGlPdJVVXBKtLn9Fm2t0Cb8lAV3rLruEfRJTDK6MeDFOD5qXgU4higpuDGrAmqKvMIOk7VJA0gPbW4lasgqGQXzOspZCmCIWwOqcIDZRr0wo09QLidegr/phjZMzuy8IO0U1w7U6MX767qcl3RGcqRwpquMtMiaw5ROx9v3DK3JOemlqQwKy/uzzBohzYln6AYim8cnZMvfaKDLYNwE0+Rg6nmemlf6PXOjE3Uisc71v3uFstWsXzUPhDeQlycFzPDT4t4srIaxdMrEs3w=</ds:X509Certificate>
</ds:X509Data>
</KeyInfo>
</ds:Signature>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoPassive" />
</samlp:StatusCode>
</samlp:Status>
</samlp:Response>

Hi Brian,
I am not sure but you could check below thread and couple of sap note.
Single Sign On - Sharepoint 2010 to SAP using ADFS
1799402 - Automatic account creation for SAML 2.0 SP
1257108 - Collective Note: Analyzing issues with Single Sign On (SSO)
It may help you to resolve / identify the cause of the issue.
BR
AKJ

External Portal - Security Best Practice

We will be initiating an external portal for ESS access. For those using ESS from home, what type of additional security access is anyone using if the person happens to lock themselves out of their ESS account? Do you have a security question built into ESS? Are you using a security grid to reset their password? I'm looking to see what other alternatives people are using.
Thanks
Pam Major

Hi Tim: Here's my basic approach for this -- I create either a portal dynamic page or a stored procedure that renders an HTML parameter form. You can connect to the database and render what ever sort of drop downs, check boxes, etc you desire. To tie everything together, just make sure when you create the form, the names of the fields match that of the page parameters created on the page. This way, when the form posts to the same page, it appends the values for the page parameters to the URL.
By coding the entire form yourself, you avoid the inherent limitations of the simple parameter form. You can also use advanced JavaScript to dynamically update the drop downs based on the values selected or can cause the form to be submitted and update the other drop downs from the database if desired.
Unfortunately, it is beyond the scope of this forum to give you full technical details, but that is the approach I have used on a number of portal sites. Hope it helps!
Rgds/Mark M.

Enterprise portal access using reverse proxy using Apache and webdispatcher

Hi Guys,
As requirement, we need to give solution to customer about Reverse proxy scenario. I am new to this part.
What we have think of to use Apache and Web dispatcher.
I tried to search documents and found some sdn links also but still i am not comfortable to go about.
Need suggestion and document if anyone has used so far.reverse proxy.
As basis person, we need to do all ( Apache installation, Apache configuration, Web dispatcher installation and configuration, integration with EP.)
It will helpful to me if i can get Apache installation, Apache configuration part and integration with EP, or web dispatcher, configuration etc.
Thanks,
Deepak

We used Netscaler for Reverse Proxy implementation and can assure you that network team performed most of the set ups. This was on EP 7.01.
From BASIS stand point it would be primarily Web Dispatcher Configuration.
Also refer the links I specified in another thread. There are several scenarios discussed there -
Re: Post values for userid and passowrd fields in logon page
http://wiki.sdn.sap.com/wiki/display/BSP/Using+Proxies
~ Dhanz

Portal Development using JSF & Struts

Can some one explain about the feasibility of developing portals using JSF and Struts? What are the advantages and disadvantages of doing so? Is it a right decision to develop portal servers using these?

Yes I am familiar with all those links. Let me break down scenario and ask specific questions.
Server version: Netweaver 7.0 (2004s) SP18
1. Created External Library DC (i.e. ebuslib)
         - added 3rd party JARS (e.g. hibernate, Spring)
         - created two public parts - one for compilation, one for assembly (deploy)
         - activated activity
2. Create J2EE Server Component - Library DC (i.e. ebuslib2)
          - added "ebuslib" assembly PP as Used DC (build only)
3. Built "ebuslib2"
          - can see jars in the resulting sda file.
          - activated activity
          - confirmed on J2EE engine deployed library containing the jars.
Scenarios
A. EP Project DC
           - needs access to 3rd party jars
           - QUESTION: What do I need to reference? The External Library DC or the J2EE Server Component Library DC?
                         - I read that you should reference the J2EE Server Component BUT the jars are not available in the PP of that DC.
                         - One developer one talked to referenced the compilation PP of the External Library DC (i.e. "ebuslib").
                                 - this seemed to work but then I wondered how the project finds the JAR at runtime?
QUESTION: Does SAP load all the classes that have been deployed via the J2EE Server Component Library DC method and hence those JARs are globally available at runtime hence no need to reference them during development except for compilation? What if > 1 J2EE library contain the same jar or same API but different versions (e.g. Hibernate 2 vs 3).
Thanks for any clarifications. I want to understand the underlying technology and how it works. I have seen alot of information out there but some of it is confusing and conflicting.
Dean Cyril Wood

WDA + External Portal + Security

Hello friends!
@Moderator, sorry if I post it in a wrong forum, but I think the wda experts should have already faced this issue.
I've been reading all forums regarding to this subject. As you are going to see, I'm not used to work with WDA Portal integrations and I'm studying hard for it.
Could you please just guide me what I have be aware to connect WDA from a ERP server to another server, which has installed the Portal? (portal is accessed externally/internet)
I'm afraid about security, as the employees will access the portal by internet (it's already working fine, today they can access the portal externally and can use some Webdynpros Java) But for now, we are going to rewrite these WDJ to WDA.
1) The portal server connecting WDA's from a ERP server, isn't it a best practice?
2) As it is already working (external access to the portal), for now I have just to create the iViews to the WDA's from ERP server?
3) What would be the security risk when people access the external link to the Portal and the Portal redirected it to the ERP?
I would greatly appreciate your help in only guide me.
Thanks in advanced!

Hello Alexandre,
Please find the answers to your queries.
Alexandre Mendes wrote:
> 1) The portal server connecting WDA's from a ERP server, isn't it a best practice?
Not at all, The composition Environment CE is intended for this purpose only.
Alexandre Mendes wrote:
> 2) As it is already working (external access to the portal), for now I have just to create the iViews to the WDA's from ERP server?
First you need to create a system connection in portal to the ERP server. Later you need to create the iViews
Alexandre Mendes wrote:
> 3) What would be the security risk when people access the external link to the Portal and the Portal redirected it to the ERP?
As per my knowledge there is no security risk involved because while accessing the WDA application from ERP the request will be authenticated again.
BR, Saravanan

Create portal user using web dynpro abap application

Dear All,
I would like to know is it possible to create portal user-id through web dynpro abap application.
My requirement is
> I have to create a web dynpro abap application. In the web dynpro abap application I have name email-id and phone number as entry fields.
> I will click on submit, one unique id will get created. This unique id will be the login id for portal.
I found how to create portal user using web dynpro java, but i could not find regarding web dynpro abap.
If it is possible to create the portal users using web dynpro abap pls share the code as well.
Regards,
Swapnil Indulkar

Hi swapnil,
I think by using BAPi.. BAPI_USER_CREATE1 you can create.
Please check this...
Create portal user from webdynpro abap
Creating user and assigning a group through code
user administration su01
How can i get the portal user id from logon ticket in the webdyn 4 ABAP
Cheers,
Kris.
Edited by: kissnas on May 21, 2011 8:47 AM

Access web dynpro abap application from external portal.

Hi
How can a application made in ABAP be accessed from SAP External Portal.
Like a java web dynpro application could be easily accessed by making a webDynpro Java ivew in portal.
Is their any method to access a ABAP application similarly.
Thanks.

Thomas
Here is our scenario
We want to expose an ABAP webdynpro application using ABAP Webdynpro iView in portal to the internet. Does this scenario use the ITS http server / port like URL iview behind the scenes.
Can you please share more info on the above scenario.
Thanks in advance
Lakshmi

External Portal

Our company is planning to launch an external portal that replaces their current website.
What are the steps v need to follow to get this done?
The website has shopping cart and small search application that pulls data from SAP CRM to show detailed description of the product searched.
Shopping cart is written in asp and search application in Java,jsps.
My question (1) is , can v directly use this code in SAP EP 6.0? or v have 2 recode everything in NDS to get the same functionality in EP?(coz it has to import certain packages if it is used in portal)
I placed all the static html files in a folder in /irj/portalapps, and built some URL iveiws that point to these files.
(2)is this how v do it?
plz throw some light on this.
Thanx in advance!!

Fredrik,
We are developing an external portal for 14K+ users. We put the roles under groups. A custom service once everyday reads the data from the R/3 system and updates our portal UME/LDAP. So, the roles are re-freshed once every 24 hours.
Hope this helps.
Abu

Web dynpro URL in external Portal

Hi Friends,
when I call the web dynpro in portal iview the url is.
http://server:8002/sap/bc/webdynpro/sap/zfind_material like the application server
in the intranet.
But when I call from external this URL does not work.
How can I adapt the URL for external use?
Thanks for you help.
RG. Jimbob
Edited by: jimbob on Feb 4, 2010 10:52 PM

Hi,
Yes that's right. Externally you cannot resolve the internal server host name. You will need to setup a secure reverse proxy that does URL rewriting in order to turn an external URL into the internal one after you have navigated the firewall and proxy. Check on SDN for information about implementing an external portal. There is a lot of information that should help you.
BRgds,
Simon

Getting portal userid in VC iview

Hi all,
I want to get portal userid in my VC application. Can someone please guide me how to do that.
Regards

Hi Siddharth,
In VC 6.0 it is not possible.
Actually, you have a "User Data" element (look at the "Compose" task pane).
This element can be used to retrieve all sorts of user specific data - anything provided by the portal runtime.
This data can then be used in dynamic expressions.
The user data functionality that is mentioned above is only available with the new version of VC which is currently in Pilot phase. this version is going on ramp up with SP7 of NW04s.
Hope this helps,
Deep.

External Portal - userIDs used by customers? guest logon?

Similar Messages

Maybe you are looking for