Issues accessing keystore of SAP Portal

Question

we need to configure an SSO from SAP portal and a third party website by passing encrypted userid as url parameters.
To configure the SSO I have received the public key of the third party and able to access it from server location. Now I have to access priavte key of the SAP Portal certificate and sign the UserId and pass it as url parameter. I have gone through many blogs and written code as below which is giving Invalid Keystore Format error.
My question is
1. What should be passed to FileInputStream?
As of now we are passing the .cer file which is stored as part of project.
Below code is throwing error at ks.load() method.
String fielPath1 = request.getPublicResourcePath()+"/SAPLogonTicketKeypair-cert1.cer";
FileInputStream ksfis = new FileInputStream(fielPath1);
KeyStore ks = KeyStore.getInstance("JKS");
ks.load(null, sPass.toCharArray());
BufferedInputStream ksbufin = new BufferedInputStream(ksfis);
ks.load(ksbufin, sPass.toCharArray());
PrivateKey priv = (PrivateKey) ks.getKey(alias, kPass.toCharArray());
Error is:
Invalid keystore formatsun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:633)sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:38)java.security.KeyStore.load(KeyStore.java:1185)am_sso_apc.doContent(am_sso_apc.java:132)com.sapportals.portal.prt.component.AbstractPortalComponent.serviceDeprecated(AbstractPortalComponent.java:213)
Please let me know how to pass the filepath to extract the priavte key .
Regards,
Satish

Answer 1

Sorry to say: but that's a bad advise.
The usertype impacts not only the ability / requirement to change passwords (see <a href="http://service.sap.com/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=622464">SAP Note 622464</a>).
A better advise might be <a href="http://service.sap.com/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=869218">SAP Note 869218</a>: if users need to have the option to logon to the ABAP backend systems by using UID/PWD but do not want to be prompted to change those backend passwords when accessing the backend systems through the Portal, then that note can provide some solution.
Of course: not using UID/PWD but some (other) sort of SSO would be the better approach. However, somethimes that is not possible (e.g. when it would be required to purchase an SNC partner product, according to <a href="http://service.sap.com/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=66687">SAP Note 66687</a>).
Wolfgang