Login in BSP (WAS) doesn't work when navigating to ITS (PAS)

Question

Hi,
We have a BSP application working on WAS, clicking a tab we show a ITS application.
We have setup Single Sign On (SSO) with the SAP Logon Ticket. On BSP application first we made log on. WAS create a SSO2 Logon Ticket.
How can we pass any HTTP Header (for SAP-User) from BSP to ITS for PAS?
WAS 620
ITS 620
Best regards.
Thomas

Answer 1

I don't know if I have a lot to add on what exactly your setup problem is, but I can tell you that what you are trying to do is possible.  We do the same thing at our facility.
We logon to a BSP application (which generates the SSO2 ticket).  The BSP then navigates to an ITS transaction. Now when we navigate to the ITS service we always pass through a PAS Service File.  I use the following settings:
@Copyright SAP AG 2002
Example Service File for the Pluggable Authentication Service (PAS)
Remark:The PAS Modul sapextauth must be included in ~xgateways in global.srvc
There are following types for PAS on ITS:
    X509              --> ITS 4.6D
    NTLM           --> ITS 4.6D
    NTPassword     --> ITS 4.6D
    LDAP          --> ITS 6.10 (remark also note: 509237)
    HTTP          --> ITS 4.6D (see note: 493107 and 494984)
The following settings are an example for NTLM :
For detailed information see documentation (http://service.sap.com/security)
~theme                  99
Module
~xgateway               sapextauth
possible settings  -> X509 , NTLM , NTPassword , LDAP , HTTP
~extauthtype            NTLM
For NTLM and NTPassword: NT , for LDAP: LD , for HTTP: define your
own mapping in USREXTID
Remark: extid_type UN (user name) can also be set. Then you dont have to
map in USREXTID, but the authentication mechanism must provide the unique
SAP System user ID. This might be useful for LDAP and/or HTTP mechanism.
~extid_type          NT
predefine Domainname - only for type NTPassword
~ntdomain
for LDAP connect - only for type LDAP
#~ldaphost          ldap.sap.com
~ldaphost
#~ldapport          389
~ldapport
#~ldapbasedn                //Base DN
~ldapbasedn
#~ldapuid                //User Attribute Name e.g. cn
~ldapuid
#~ldapsapuid                //SAP User Attribute Name e.g. sapuid
~ldapsapuid
Remark: ~ldapsapuid should be only set in combination with ~extid_type UN
#~maxtrials          3        //limits the ldap logon trails
~maxtrials
define which HTTP Header Variable contain the User - only for type HTTP
#~remote_user_alias - the most common and useful value is REMOTE_USER
                    which will be set by webservers for authenticated users
please remark here note 494984 for the WGate settings
~remote_user_alias
settings for PAS service self
~client               088
~language               en
#get a SSO2 Ticket
~mysapcomgetsso2cookie     1
~timeout                10
#converts the login input to upper case. Might useful for LDAP and NTPassword
#if in doubt, set to 1 and maintain USREXTID mapping in caps.
~login_to_upcase 1
after external authentication
Hostname which should redirected
~redirectHost          kww-d15i.kimball.com:81
path to another service 
~redirectPath           /scripts/wgate/su3!
#~redirectQS (Query String): ITS specific service parameters can be set there
~redirectQS             client=088&language=en
~redirectHttps          0
~login_template         login
if 1, user get only a ticket, if there is no
~dont_recreate_ticket   1
~sncNameR3 p:[email protected]
#~sncQoPR3 9
~mysapcomusesso2cookie 1
~mysapcomnosso1cookie 0
~mysapcomssonoits 1
This way if my logon ticket already exists, it doesn't try and recreate it.  In this particular situation a Link in our BSP page lets the user change their user profile.  Therefore we launch SU3 using the ITS (WebGui).