Fiori Launchpad - Basic authentication popup

Hi,
I have used the std. class /UI2/CL_SRA_LOGIN for Fiori launchpad log in screen. When there is no user action for long time and the session cookie gets expired; any operation performed(like selecting an app) in this case is bringing a browser basic authentication popup.
How to avoid this by either taking the user to initial login screen instead of the authentication popup ?
Tags edited by: Michael Appleby

Hi Aakash,
Please upload the screenshot. Is it critical issue or just a nice to have?
From end user point of view, I prefer popup because I can continue the work from the last point. The best is IT sets up SSO.
Regards, Masa
SAP Customer Experience Group - CEG

Similar Messages

SAP Fiori Basic Authentication Popup

Hi All
Please advise on how to disable the basic authentication pop-up screen - I am unable to reach the SAP Fiori login page instead I get a basic http popup screen.
Please advise
RGDS
Ted
Tags edited by: Michael Appleby

Hi Ted,
Go to SICF - > /default_host/sap/bc/ui5_ui5/ui2/
Error pages tab -> Configuration -> System logon configuration ->
Regards,
Tejas

Login via Basic Auth popup

Hi, i have sap fiori running and i need GBAPP_PRAPPROVAL service to display basic authentication prompt.
Currently i have configured global settings to use the class CL_SRA_LOGIN.
I modified the system logon on the Error Page tab and i am able to display the login page that says "via popup" in the textboxes and then click to show the popup but i don't want the page to appear at all, i want only the http basic auth popup directly when you access the url of the service. How can i achieve this?
Thanks!
Andres

Could you please paste a screenshot about what would you like to achieve?

How do I protect my JNLP, my JARs etc. (with Basic Authentication)???

hi all,
i know that there is a FAQ ( [see here|http://lopica.sourceforge.net/faq.html#obfuscate] ) answering a related question with "You can use an obfuscator...". ok, but is there really no other solution?
this is the simplified folder structure of my application on the server:
[application]
[etc]
    xyz.xml
[jars]
    myapp.jar
launch.jnlp
website.jsp
initial start and basic authentication:*
my first idea was to secure everything underneath "application" with basic authentication via my web.xml (yes, i'm aware of the security concerns). this means everybody can access my website (here: website.jsp) which contains a start button that links to "launch.jnlp". as soon as the user clicks on it, the browser opens its standard authentication dialog since launch.jsp is in a protected area. after entering the correct credentials the jnlp-file is downloaded and java web start takes over control. first of all it seems as it tries to access the same jnlp-file again (??? --> probably in order to check for changes in the jnlp file --> this is certainly not the case for the initial startup) and then wants to download the relevant jar (myapp.jar). because both resources are protected jws opens its own basic authentication dialog where i have to enter the same credentials the second time. as far as i know, there is no solution to pass the credentials between the browser and the jvm.
second start and basic authentication:*
if the user starts my application for the 2nd, 3rd, ... time via desktop-link (set in jnlp-file) there is no need for accessing my website with a browser. therefore only the authentication dialog of jws gets displayed. so far, so good!
and now the actual problem:*
during runtime my application (signed with verisign certificate and having all permissions) uses commons-vfs and commons-httpclient to access resources on the same server (e.g. etc/xyz.xml). since they're underneath the protected "application" directory as well, my application needs the same credentials the user already entered in the authentication dialog of jws. now i could retrieve these credentials by calling Authenticator.requestPasswordAuthentication() within my application and passing them to vfs and httpclient. however, doing so opens up jws' authentication dialog again. grrr!!! is there a way to prevent this?
related thougts:*
i know i could disable jws' default Authenticatior and set my own Authenticator which might be able to return already entered credentials without opening the dialog a second time. however, it seems that even with <property name="javaws.cfg.jauthenticator" value="none" /> jws still opens its own dialog when acessing the JNLP file and the relevant JARs during the startup/download phase. of course, who else if not jws could handle that phase? my application might not even be downloaded at this point. so i guess setting my own Authenticator would not be a solution either (at least not if i want to secure my jnlp and my jars, too). quite the contrary, it would have to open another dialog... :-(
my current solution:*
for the moment i use jws' default Authenticatior which allows me to easily protect all my stuff on the server side (jnlp, jar, etc). i can live with the two login dialogs at the initial startup. and instead of querying the credentials from jws' default Authenticatior at runtime, i set two system properties for username and password in the (protected) jnlp-file, query them at runtime and hand it to vfs and httpclient. this prevents the 2nd (or 3rd) dialog but is definitely not a great solution. most of all i'm not happy with the fact that this somehow "destroys" the container-based security advantage of easily configuring authorized users via a separate mechanism e.g. tomcat-users.xml. now there has to be one master-password that has to be set in the jnlp-file! grrr!
a possible alternative:*
i'm not sure but would it be better to secure everything with form-based authentication on the website, and dynamically generate username and password into the jnlp-file? but what happens when the admin changes the password on the server and the user starts its application via desktop-link??? in case of basic authentication i think jws would popup the login dialog again. however, if i use the old username and password generated into the jnlp it won't work. i think the user then has to access the website again. this is not good at all! :-(
the only real solution:*
should i write a small application which can be downloaded by everybody and on startup queries the user's credentials, validates them with the help of our server, and uses the javax.jnlp-api to download the secured JARs of my real application? this seems so much overkill! does anybody have experiences with this approach? how difficult is it to implement the whole download/update stuff with javax.jnlp?
WHAT HAVE I MISSED???
AM I COMPLETELY WRONG???
WHAT IS THE EASIEST WAY???
AND WHAT IS THE BEST WAY???
thank you so much,
stephan

Not sure, whether I understood correctly, what you wanna do - but up to now I can't see any problem.
if you have a structure like this:
/ctxroot/
       launch.jnlp
       /app/
           *.jar
           *.whateveryou may use in your web.xml:
     <servlet>
          <servlet-name>JnlpDownloadServlet</servlet-name>
          <servlet-class>jnlp.sample.servlet.JnlpDownloadServlet</servlet-class>
     </servlet>
     <servlet-mapping>
          <servlet-name>JnlpDownloadServlet</servlet-name>
          <url-pattern>*.jnlp</url-pattern>
          <url-pattern>/app/*</url-pattern>
     </servlet-mapping>
     <security-constraint>
          <web-resource-collection>
               <web-resource-name>Application</web-resource-name>
               <url-pattern>/app/*</url-pattern>
               <http-method>GET</http-method>
               <http-method>POST</http-method>
          </web-resource-collection>
          <auth-constraint>
               <role-name>bla</role-name>
               <role-name>fahsel</role-name>
          </auth-constraint>
          <user-data-constraint>
               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
          </user-data-constraint>
     </security-constraint>
     <security-constraint>
          <web-resource-collection>
               <web-resource-name>Subscription</web-resource-name>
               <url-pattern>*.jnlp</url-pattern>
          </web-resource-collection>
          <user-data-constraint>
               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
          </user-data-constraint>
     </security-constraint>
     <login-config>
          <auth-method>BASIC</auth-method>
          <realm-name>whatever-realm</realm-name>
     </login-config>
     <security-role><role-name>bla</role-name></security-role>
     <security-role><role-name>fahsel</role-name></security-role>
...Than you may use the Service stuff like:
     BasicService bs = (BasicService)ServiceManager.lookup("javax.jnlp.BasicService");
     URL codeBase = bs.getCodeBase();
     URL pu = new URL(codeBase.toString() + "whatever.bla");
     HttpURLConnection res = (HttpURLConnection) pu.openConnection();
     res.setInstanceFollowRedirects(true);
     res.setRequestMethod("GET");
     res.setConnectTimeout(10 * 60 * 1000);
     res.connect();
     String enc = res.getContentType();
...Where is the problem? If you wanna intercept certain "calls" to an app resource, just use a filter, which decides, whether to answer the request directly by itself or to pass it to the JnlpDownloadServlet ...

Basic authentication not working for portal application

HI All,
i have a portal application where I have a servlet. i want to use basic authentication for this servlet.
to archive this i have followed http://docs.oracle.com/cd/E14571_01/web.1111/b31974/adding_security.htm
and configured basic authentication, also add web-resource in web.xml for the url to access the servlet.
my web.xml look like (copied is only security section from web.xml)
<security-constraint>
    <web-resource-collection>
      <web-resource-name>adfAuthentication</web-resource-name>
      <url-pattern>/adfAuthentication</url-pattern>
    </web-resource-collection>
    <web-resource-collection>
      <web-resource-name>All</web-resource-name>
      <url-pattern>/faces/Auto-connect</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>valid-users</role-name>
    </auth-constraint>
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
</login-config>
<security-role>
    <role-name>valid-users</role-name>
</security-role>
this works when in run the application in JDeveloper i.e. when i try to access http://localhost:7101/MyApp/faces/Auto-connect it ask for basic authentication (the popup) and when i access http://localhost:7101/MyApp/ it takes me to home page for login , but doesn't work when i deploy the application in weblogic 11g.(deployment done using Enterprise Manager console (EM console) (for both URL no popup).
i tried Google around it but didn't get any solution please provide your input and guide me.
thanks
-somesh

Hi,
Before deploying, have you changed:
Application properties -> Deployment
Remove the selection from "Auto Generate and Syncronize weblogic-jdc.xml ....."
Kind Regards

Basic Authentication, how to make it work?

Your input will be highly appreciated.
I am trying to make http basic authentication work in BEA Weblogic, and I am using
'examplesWebApp' as my sample program. So far, I can see the browser popup dialogbox,
but I always got authentication failure message after I gave login and password.
Steps which I did:
1. Start server - Start examples server which is weblogic700/samples/server/config/examples/startExamplesServer.sh
(I am on Sun's Solaris).
2. Start descriptor editing window -- In Management Console, select Deployment -->
Web Applications --> examplesWebApp, then start "Edit Web Appliation Deployment Descriptors.."
in another browser window.
3. Login Config - In the new window, select "Web App Descriptor", then "Configure
a new Login Config...", then select "Basic" for Auth Method , and type in "myrealm"
for "Realm Name".
4. Specify constraints - Select "Security Constraints", and then "Configure a new
Security Constraint". Use "MySecurity Constraint" as the display name, and use "MyWeb
Resource Collection" as Resource Name. Type in /* in the "Url Patterns" field.
5. Configure a security role - Select "Security Constraints", and then "Configure
a new Security Role". Type in Admin for "Role Name".
6. Configure a Auth Constraint - Select "Security Constraints" --> "MySecurity Constraint",
then "Configure a new Auth Constraint...". Click on Create button in Configuration
tab, then move Admin from Available to Choosen column, then click on Apply
7. Persist these changes and then restart the server
That's all what I did, and then I use 'weblogic/weblogic' as login/password to try
to login to http://localhost:7001/examplesWebApp/HelloWorld2. I can see the popup
dialogbox, but I always get a failure message. By the way, weblogic/weblogic (login/password)
always work for Management Console window.
The user "weblogic" is a user defined in myrealm, and it is also in Administrators
group. The role definition of "Admin" in myrealm has "Caller is a member of group
Administrators" as one of its conditions. So my understanding is that it should work,
but unfortunately it doesn't. I must miss some steps or part of my understanding
may not be right.
Hope somebody can give me some help.
Thanks.
Yunpeng Zhang

Hello Abhilash,
lets check what is the authentication selected for the Central Admin web applicaiton.
go to CA --> Appliaction management --> manage web applicaiton --> select the central admin web app --> on the top ribbon select "Authentication Providers".
here , verify under IIS authenticaiton settings section, which option is selected, if the basic authenticaiton check box is checked, please uncheck it and select "integrated Windows Authentication".
if this doesnt work,
try unprovisioning and reprovisioning the CA usning command ..
psconfig.exe -cmd adminvs -unprovision
psconfig.exe -cmd adminvs -provision -port 0000 -windowsauthprovider onlyusentlm
REF: http://technet.microsoft.com/en-in/library/cc263093(v=office.14).aspx
or ..
if you have other servers in the farm, you can just start the Central Admin service on other server and stop it on the current one from "Services on server
" option on CA.
let me know afterwards ...
Thanks, Noddy

Basic authentication when calling a web service

I am attempting to call a web service using ActionScript. The
web service provider requires that I use HTTP Basic Authentication
to communicate my SOAP requests. I cannot seem to get this done in
ActionScript. If I instantiate a WebService object and call its
SetCredentials method, I get an error "Authentication not supported
on DirectHTTPChannel (no proxy)". I have the WebService object's
useProxy property set to true. HELP!

I know this is five years later on this forum but there's no solution here or on any other forum. So after two day's of hammering this out I was able to produce a workable solution. Create a new user account for testing.
Wu_Xiao's explanation of the issue was dead on. The WebService does a GET then a POST and for the GET we are unable to supply the Authorization in the header and this is why we get the popup. The POST has the Authorization but it already to late.
Take these actions
1 Create a new user on the machine with the web services. Start with a simple name and password (text only) I had issues with different users. Start clean and simple.
2 Copy your web services a second usable service. You'll see in my example below i have Ive copied ServicesSECURE/Services1.asmx?WSDL to ServicesDEFINITION/Services1.asmx?WSDL
3 Remove all of the code inside of your services making the new set of service like a definition service. Make sure all of the inputs and outputs are the same. ServicesDEFINITION will have no coding and empty returns.
Example
[WebMethod]
        public String CountUsers(string group)
            return "";
4 Implement the code below. Call the init() right away to instantiate the web service and wait until it loads to use any of the services. I use a button event to test.
private var testws:WebService = new WebService;
private function init():void
testws.wsdl="http://test.com/ServicesDEFINITION/Services1.asmx?WSDL";
var encoder:Base64Encoder= new Base64Encoder();
encoder.insertNewLines = false; // see below for why you need to do this
encoder.encode("USERNAME:PASSWORD");
testws.httpHeaders = {Authorization:" Basic " + encoder.toString()};
testws.loadWSDL();
testws.addEventListener("load", wsdlLoadHandler);
protected function test_clickHandler(event:MouseEvent):void
testws["CountUsers"].addEventListener(mx.rpc.events.FaultEvent.FAULT,testFaultHandler);
testws["CountUsers"].addEventListener(mx.rpc.events.ResultEvent.RESULT,testResultHandler) ;
testws.endpointURI="http://test.com/ServicesSECURE/Services1.asmx?WSDL";
testws.getOperation("CountUsers").send("Test");
protected function wsdlLoadHandler (event:LoadEvent) : void
//the service has to load before using the getOperation function
//you could try using mx.core.UIComponent.callLater from
//this listener and call the gettestws.getOperation("Co....
So you'll see that the ServicesDEFINITION (GET) is called and grabs the definition of the Service1 service but this unsecured services is useless because we've removed all of the code. After the definition GET is called we can change the end point using endpointURI and perform the POST against our secure ServicesSECURE.

Problem with Basic Authentication in Web Server 7.0u8

I am using a web application which has inbuilt form based authentication. After entering correct username and password, i get logged in, but then immediatly i see a basic authentication dialog popup. I am seeing this behavior in Sun Web server 7.0u8 as well as Sun Web server 7.0u3.
Any idea what could be the reason behind this? Other app servers like Weblogic , JBoss, Websphere do not show this behavior.

This is the content of the default.acl file. This is the only .acl file that is there in https-<instance_name> directory.
# Copyright 2006 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
version 3.0;
acl "default";
authenticate (user, group) {
prompt = "Sun Java System Web Server";
allow (read, execute, info) user = "anyone";
allow (list, write, delete) user = "all";
acl "es-internal";
allow (read, execute, info) user = "anyone";
deny (list, write, delete) user = "anyone";

Password Needed - Networking basic authentication twice??

Why do I have to authenticate twice??? Using basic authentication, IIS asks me my username and password but then I also get another popup from Sun JVM asking to login again! I've seen other posts on this topic with no solutions yet. Anyone have any idea? Sun, are you working on fixing this issue? I'm so sad that MSJVM will be discontinued. It was much faster and less problematic.

Nope, no answer yet. Until Sun addresses this problem, the only suggestion I can make is not to use the Sun JVM.
You can disable it in Internet Explorer by choosing:
1. Tools
2. Internet Options...
3. Advanced
4. Uncheck (disable): Use Java 2 v1.4.2_04 for <applet> (requires restart)
5. Under Microsoft VM, should already be checked but if not check(enable): JIT compiler for virtual machine enabled (requires restart)
Other reference: http://www.java.com/en/download/help/switchvm.jsp
Of course this is only a temporary workaround for now, but hopefully Sun will fix this before Microsoft completely ends their support for MSJVM on December 31, 2007.
http://www.microsoft.com/mscorp/java/
http://www.microsoft.com/mscorp/java/faq.asp
New Microsoft products will not have MSJVM included so in that case you will need to find, download, and install msjavx86.exe (might be gambling on security if not the most updated version, oh well).
Personally, I don't care which company's JVM software I have to use, I just want one that completely works, is fast, and not problematic.

Iphone subscribed calendar - basic authentication, events and timezone

hi,
i'm attempting to use the subscribed calendar feature in iOS and having problems.
1st issue: i've put an ics file that regularly gets updated on an at a web location that is basic authentication protected. Inside the subscribed Calendar settings there is a place to put username and password. When i click "Done" and iOS tries to verify the information, i get a popup saying "account requires a username and password"... I know basic authentication works and the username and password are correct because i've tested via browser and very simple passwords e.g. 123.
2nd issue: I do work with people in other timezones and so i frequently get meeting requests from people in other timezones. In the ICS file i can see this information is published appropriately. e.g.
DTSTART;TZID="Romance Standard Time":20110510T170000
DTEND;TZID="Romance Standard Time":20110510T183000
If I import this ics file into google calendar, the timezones are read appropriately and the meetings are scheduled accordingly. in the example above, the meeting shows up as being at 8am - 9:30am.
on iOS the timezone is completely ignored. so i get the meeting showing up as 5pm - 6:30pm.
I've tried fiddling with the "Time Zone support" option in settings, but this does nothing.
Help on the issues above is greatly appreceiated. Personally I'm extremely frustrated with this.
Thanks

...Thought I would keep alive the question about incorrect times for appointments created in other time zones on subscribed calendars. I believe this other thread -- https://discussions.apple.com/message/17318550#17318550 -- is asking about the same issue.
I am experiencing the same issue, including the setting for Time Zone Support having no impact, with iOS 6.
Any whiff of a solution yet?

Can RemoteObjects using Android AIR 2.5 achieve BASIC authentication?

Can RemoteObjects in AIR/Mobile authenticate against a web server (tomcat) which requires BASIC authentication?

I have tried to setCredentials and setRemoteCredentials on the RemoteObject but neither seemed to work. When running my app on AIR on the desktop it still prompts me for a user name and password. However on my android handheld AIR does not popup a login screen and automatically throws a fault event. Is there another way to set the credentials so you aren't prompted? I've also tried passing the credentials into the login function on ChannelSet of the RemoteObject.

IIS Reverse Proxy and Basic Authentication

Hi,
we've currently put a WebAS 6.40 serving a BSP Application in our Appl-DMZ. For the access via Web the IIS Reverse Proxy is used, which works fine as long as you use a service for which a user is provided (in SICF). But if you don't provide a user in the service (in order to debug the BSP Application) you have to authenticate yourself using Basic Authentication (Browser Popup) which does not work (the popup returns and returns ...)
I' ve browsed the forums and it seems that the IIS Reverse Proxy does not support (the forwarding) of Basic Authentication "requests".
So my question, does someone exactly know if the IIS Reverse proxy supports Basic Authentication or not ?
Thanks,
Markus

Hello Markus,
1. have you checked out Alon Weinstein's Weblog <a href="/people/sap.user72/blog/2005/02/23/the-reverse-proxy-series--part-2-iis-as-a-reverse-proxy">The Reverse Proxy Series -- Part 2: IIS as a reverse-proxy</a>?
2. Is the IIS a must? Can you give Apache or SAP Web Dispatcher a try. Prakash Singh wrote a Weblog <a href="/people/prakash.singh4/blog/2005/08/16/how-to-setup-webdispatcher-to-load-balance-portal-in-a-clustered-environment">How to setup webdispatcher to load balance portal in a clustered environment</a>.
Regards
Gregor

Fiori Launchpad Designer configuration issue

Hello All,
Query 1 :
During "Launchpad Designer " configuration when we create Transport requests using scope=CONF to the url and click on "settings" button to create the package , i face the below error:
Error message : "error 400 bad request in Odata response for GET /SAP/OPU/ODATA/UI2/TRANSPORT/PACKAGE/ZLAOMySpend/:HTTP request failed" . Details :package ZXXOMySpend does not exist”
After which we created a new package under SE80 with the same PACKAGE name (ZXXOMySpend) , then when I clicked on “save” the above error was gone.
Is it the right step ?
Query :2
To create a custom role in the gateway system (using PFCG tcode) to add the catalog and assign the role to needed users
Steps followed :
PFCG -->created a role using "single role"
selected "Transaction" and then selected the TYPE "Catalog"
When a popup arrived and selected the catalog created on the Fiori launchpad designer.
Earlier we were using the under transaction "TYPE" as "Catalog Provider" now is it changed to "catalog" ? as we dont see this option on the drop down.
could you please confirm the above?
Thanks,
Usha

Hi Usha,
Please look at help.sap.com. You can find answers.
Creating Transport Requests for User Changes - User Interface Add-On for SAP NetWeaver - SAP Library
Assigning Catalogs to Roles - User Interface Add-On for SAP NetWeaver - SAP Library
Regards, Masa
SAP Customer Experience Group - CEG

How to access SOAP web service with authentication, HTTP basic Authentication

Dear All
i use Flash Builder 4.5, flex 4..1, i am developing a flex client to soap webservices hosted over Glassfish 2 Java server, the web services is protected by HTTP Basic Authentication, everythime i run my code , the prombt for username and password show up, i need to pass user name and password through action script, i followed the flollowing (but was for http web service, not soap) but really did not work.
http://stackoverflow.com/questions/490806/http-basic-authentication-wi th-httpservice-objects-in-adobe-flex-air
http://forums.adobe.com/message/4262868
private function authAndSend(service:HTTPService):void
        var encoder:Base64Encoder = new Base64Encoder();
        encoder.insertNewLines = false; // see below for why you need to do this
        encoder.encode("someusername:somepassword");
        service.headers = {Authorization:"Basic " +encoder.toString()};
        service.send();
Also i noticed in debug mode, always that WARNNING raised up
Warning: Ignoring 'secure' attribute in policy file from http://fpdownload.adobe.com/pub/swz/crossdomain.xml. The 'secure' attribute is only permitted in HTTPS and socket policy files. See http://www.adobe.com/go/strict_policy_files for details.
any idea ?

Hello,
I don't know if this could help.
Another way to connect to a web service by SOAP and WSDL is to click on the Data/Services panel, then click on "Connect to Data/Services" and then select the "Web Service" (WSDL) icon. This could help as well.

Help needed for using BASIC authentication through JDBCRealm

Help needed.
Hello,
I am doing a degree project, so far it works fine in my local machine, I need to try it on my virtual hosting (as it is a live server).
My project requires JDBCRealm, that is BASIC authentication loading access data from mysql database. Normally this setup can be done in Server.xml file, because my Tomcat hosting is a virtual one, I only have permission to access the web.xml file.
My question is: is it possible to get it done in an alternative way? In web.xml? Some properties file maybe?
Thank you very much.

You can set this up for your context using META-INF/context.xml instead of working with server.xml.
Make a directory called META-INF under your webapp ( it'll be at the same level as WEB-INF ). Under this, add a context.xml with all your context specific configuration including the realm. A sample is below
<?xml version="1.0" encoding="UTF-8"?>
<Context path="/myApp" reloadable="true">
    <Realm
        className="org.apache.catalina.realm.JDBCRealm"
        driverName="com.microsoft.jdbc.sqlserver.SQLServerDriver"
        connectionURL="jdbc:microsoft:sqlserver://127.0.0.1:1433;DatabaseName=myDB;SelectMethod=Cursor;"
        connectionName="username" connectionPassword="password"
        digest="MD5" userTable="users" userNameCol="userid" userCredCol="userpassword"
        userRoleTable="user_roles" roleNameCol="rolename"
    />
</Context>Hope this helps.
People on the forum help others voluntarily, it's not their job.
Help them help you.
Learn how to ask questions first: http://faq.javaranch.com/java/HowToAskQuestionsOnJavaRanch
----------------------------------------------------------------

Fiori Launchpad - Basic authentication popup

Similar Messages

Maybe you are looking for