Portal login : switch http - https - http

Question

Our customer has the following requirement :
- users navigates to the portal using http.
-> The protocol needs to be switchted to https, so that when he submits his password, the communication between browser and WAS is secured.
-> Next, the protocol needs to be switched back to http
Currently, this has been done by a previous developer on the project in a copy of the com.sapportals.logon.par, and in the masthead. This is not a 'clean' solution, and we wish to do this the proper way.
I did some research, and this seems likely to be achieved via the webdispatcher. Anybody already tried this?
http://wiki.sdn.sap.com/wiki/display/BSP/Using+Proxies
SAP Web Dispatcher Configuration
The Web Dispatcher will always preserve the Host header, and no further configuration is required for this aspect.
For HTTPS to HTTP protocol switching, the Web Dispatcher must be configured to also set the ClientProtocol HTTP header. This is done with the option in profile:
wdisp/add_clientprotocol_header = 1
For more information about wdisp/add_clientprotocol_header, see the corresponding section of the table in Parameterization of the SAP Web Dispatcher, and see also Setting the SSL Profile Parameters for the SAP Web Dispatcher.
Recommended is to also activate Access Points, as this is the best and simplest way to get a consistent configuration complete(starting 620>=SP57, 640>=SP16 and 700>=SP06). This is achieved with the following profile option:
wdisp/handle_webdisp_ap_header = 1

Answer 1

Hi - Benjamin - Long time ... and all that!
This is indeed not easy to do. In one customer installation I used an Apache as reverse proxy before the web dispatcher but that was mainly to serve up some static content as well as handle SSL before. You could perhaps come up with some complex re-writing and stuff in Apache, but in the end our solution was basically the same as outlined here - a custom coded logon function.
You could investigate the [redirect parameter|http://help.sap.com/saphelp_nw70ehp1/helpdata/en/48/3d993fb08c72d1e10000000a42189c/content.htm] in the web dispatcher, it has some possibilities to arrange that only certain URL's get redirected to HTTPS. If you can organise that the logon screen has a unique URL then I think that could work for you - but I dont know if that URL arrangement is possible.
One thing though, make sure that you configure the web dispatcher as the SSL termination point, if you send volumes of SSL through to J2EE, basically it will die.