JCo Security

Question

Hello all,
I call an EJB through the JCo RFC provider service from an ABAP function module.
Everything works fine but now I want to add security aspects.
I don´t want eveyone who has access to the function module to access my EJB.
Can I add a login module to this EJB, so that ABAP-users who use this (ABAP) function module have to use their (J2EE) users to call this bean???? How??
Are ther any other possibilities?
Thanks for your help!!
Jan

Answer 1

Hi Jan,
Disabling the default communication user is an option, but then you'll need to make another communication user, so that the two systems can use something for authentication...
I rather think the issue would come down to modifying the communication user's role permissions though. The communication user (or its user group) is probably assigned a role on the J2EE Engine that has permissions to access your EJB, so whenever you call it from the ABAP system authentication succeeds.
You can try the Security Roles tab to see if you can modify the communication user's (or its user group's) J2EE role assignment for your EJB. Also, in the Resources tab, you can modify the permission assignments for your EJB's J2EE roles.
Hope this works. See also SAP NetWeaver Security Guide - the Security Aspects for Connectivity and Interoperability section, and the SAP Web Application Server Security Guide - you can use these as an entry point to the relevant documents.
Here's a link:
http://help.sap.com/saphelp_nw04/helpdata/en/ed/18cc38e6df4741a264bddcd4f98ae2/frameset.htm
Regards,
Yonko