Looking for sample code to decrypt MYSAPSSO2 session cookie

Question

Hello,
I am looking for a sample code to decrypt MYSAPSSO2 session cookie and get the username out of it.

Answer 1

Hi Roy,
if you just need the username the easiest way is to grab the Cookie and Decode it using Base64. The username is contained in cleartext.
e.g.
MYSAPSSO2 Ticket as fetched from Browser:
AjExMDAgABFwb3J0YWw6bXRyaWNhcmljb4gAE2Jhc2ljYXV0aGVudGljYXRpb24BAApNVFJJQ0FSSUNPAgADMDAwAwADRDAxBAAMMjAwODA3MjUwNTA3BQAEAAAACAoACk1UUklDQVJJQ0%2F%2FAQUwggEBBgkqhkiG9w0BBwKggfMwgfACAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHATGB0DCBzQIBATAiMB0xDDAKBgNVBAMTA0QwMTENMAsGA1UECxMESjJFRQIBADAJBgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDgwNzI1MDUwNzU5WjAjBgkqhkiG9w0BCQQxFgQUxUGK!5EDTrHQErPQCVJhEySzTBAwCQYHKoZIzjgEAwQvMC0CFQCD3K2A2hrgpNa5EceiDXjRN309ewIUTM3DJi8QTxmk%2FJez!rjnFlTM3BQ%3D
Decoded Ticket using Base64:
1100 uFFFD portal:mtricaricou02C6uFFFD basicauthentication uFFFD
MTRICARICO uFFFD 000 uFFFD D01 uFFFD 200807250507 uFFFD uFFFDuFFFDuFFFD
If you want to do it programmatically using any libraries to completely decode the ticket, check the validity and also access the certificate information inside the ticket you can use a SAP Extension called SAP SSOEXT (Goto service.sap.com/swdc and search for SSOEXT => The package also contains documentation and samples for various programming langauges such as JAVA).
This one needs dynamic libraries or shared libraries to be linked.
There also is a pure JAVA approach.
Have a look at this:
http://www.zope.org/Members/Dirk.Datzert/MySapSsoSupport/
But:
The approach of decrypting the cookie does not really make since when you are in a SAP system it is more intended for 3rd party systems in order to implement SSO.
Hope this helps
Cheers