Sap webdispatcher and spnego

what needs to be done for sapwebdispatcher to work with spnego? we've done setspn for webdispatcher host, but it prompted us to login to webdispatcher server. Do we need to change any configuration in UME or j2ee engine?
Thanks
Jane

Hi
For using SPNEGO through a SAP webdispatcher you only need to create a SPN for the webdispatcher host like "setspn -A http/<webdisp-host> <j2ee-user>".
The <webdisp-host> must be FQDN like "host.domain.com" and the <j2ee-user> should be the J2EE service user created when configuring SPNEGO/kerberos for J2EE.
BR
Tom Bo

Similar Messages

SAP Webdispatcher and EP

I have two sap webdispatchers (parallel operation) and one EP (with 4 app servers) and ECC (with 4 app servers) in landscape
Client --> reverse proxy (also webdispatcher) --> webdispatcher 1or2 (load balancing) --> EP --> backend
The scenario is that user will call the portal URL through the web dispatcher which will trigger a request in ECC system. I would like to confirm if wdisp/system_<xx> should be configured in Webdispatcher.
Do I need to configure another web dispatcher between EP and ECC system for loadbalancing of requests that are sent to ECC system ?
Thanks,

Hi,
If we have multiple app servers for an SAP system, we'll have multiple ICMs for one sap system... ? Pl. correct if this is wrong.
You, the basis admin, decides to activate the ICM (or not) on each instances (CI or DIA) with parameter rdisp/start_icman.
The most common configuration is to put the parameter in the DEFAULT profile to start the ICM on each instance
In such case, will our incoming HTTP request come through message server ? Can MS do load balancing between ICM's as well ?
MS can do http load balancing but it is not a good practice because it uses http redirects and does not hide the app servers from the user browser.
Lastly, if we have one sap webdispatcher interfacing ERP and EP system both (say, total of four ICM.. two each), how will the dispatcher decide if an incoming request, is for BSP running at ERP server or a portal page at EP ?
To use the same web dispatcher for 2 different systems, you need at least release 7.2 and you have to configure it to choose the back end system. One possibility is for exmple to use a URL prefix.
All of these informations is explained in details in help.sap.com...
Regards,
Olivier

SAP webdispatcher and URL redirect?

Hi,
I just installed SAP web dispatcher with the purpose of using it (similar to saprouter for sapgui) as single point of entry for all http(s) requests to our SAP systems.
I configured parameters icm/HTTP/redirect_x to accomplish that but to only limited success:
How do I have to set this parameter if I want to accomplish a redirect of the web dispatcher URL (1) to the webgui service running on system ECC (2)?
Example:
1. web dispatcher URL:
http://sapwebdisp:85/ECC/webgui (should be routed to url:)
2. http://saperpecc:8001//sap/bc/gui/sap/its/webgui/!
Is this posssible at all?
Thanks for any hints and tips in advance!

Hi
The parameter has the following syntax:
icm/HTTP/redirect_<xx> = PREFIX=<URL prefix>[, FROM=<pattern for URL>, FROMPROT=<incoming protocol>, FOR=<pattern for host name:port>,TO=<new URL prefix>, PROT=<protocol>, HOST=<host>, PORT=<port number/name>]
<xx> must be specified in ascending order from 0.
Optional Parameters
With the optional parameters FROM, FROMPORT and FOR
So your example the parameter would be:-
icm/HTTP/redirect_0 = PREFIX=/,FROM=/ECC/webgui,TO=/sap/bc/gui/sap/its/webgui/!
One point to note is that the URL you have provided has a double slash after the Hostname and Port which might be the root of your problem.
http://saperpecc:8001//sap/bc/gui/sap/its/webgui/!
Another point to note. If you are having problems with redirection via HTTP then HTTPwatch (basic version is freeware) can be used to check how requests are being directed. You can use this for testing your redirects.
Hope this helps.
Michael
Edited by: Michael Mulvey on Nov 11, 2008 5:27 PM

SAP Webdispatcher and URL redirect - 3 systems, one webdispatcher

Good day,
I have the following scenario, webdispatcher in the DMZ that redirects to Enterprise Portal internally.
There is a role in EP which is setup for webgui to 2 seperate ERP systems.
Is it possible to have 3 seperate redirects on the webdispatcher for the external address https://external:port/irj/portal, i.e for
1) host1:port/irj/portal
2) host2:port//sap/bc/gui/sap/its/webgui/!
3) host3:port//sap/bc/gui/sap/its/webgui/!
The portal content works fine, as soon as I access the webgui role, no content is displayed.
Thanks
Derek

Hi,
If you want to use a single web dispatcher for 3 back office systems (EP, ERP&, ERP2) you need to use release 7.2 at least.
Check
[SAP Web Dispatcher for Multiple Systems|http://help.sap.com/saphelp_nw73/helpdata/en/b0/ebfa88e9164d26bdf1d21a7ef6fc25/frameset.htm]
Regards,
Oliviier

SAP WebDispatcher with NW7.0 Double-Stack-ABAP/J2EE

Hi folks,
we have an Double Stack NW 7.0 ABAP/J2EE System running, for using ABAP WebDynpros over Portal 6.0. On the portalserver itself the Portal and the Webdynpros are running and working absoultely fine.
While configuring SAP WebDispatcher to bring the Portal to the outside world, we
experienced some problems.
Details:
We use Webdispatcher to decrypt SSL
- HTTPS: Internet -> WebDisp
- HTTP: WebDisp. -> Portal
(this works!)
The external domain is https://portal.my-customer.de
The internal hostname of the portal is portal.mycustomer.de.
Problem:
When using the ABAP-Message Server in the WebDispatcher profile (like recommended I think), the Webdynpros are available but we cannot reach the portal.
- WORKS: https://portal.my-customer.de/sap/bc/webdynpros/sap/zmy_webdynpro
- DOESNOT: https://portal.my-customer.de/irj/portal
rdisp/mshost = portal.mycustomer.de
ms/http_port = 8100
When using the J2EE-Message-Server in the WebDispatcher profile the portal is
available but the webdynpros does not work appropriately, cause they are not reached.
- DOESNOT: https://portal.my-customer.de/sap/bc/webdynpros/sap/zmy_webdynpro
- WORKS: https://portal.my-customer.de/irj/portal
- DOESNOT: WebDynpros in portal are not available and there occurs a http-timeout in the content area with: http://portal.mycustomer.de:8000/sap/bc/webdynpro/sap/zmy_webdynpro cannot be found
Of course this address cannot be retrieved over webdispatcher, it is the "internal"
one, between webdispatcher and portal, not the external one between client and
webdisp.
rdisp/mshost = portal.mycustomer.de
ms/http_port = 8101
So the questions are:
1) Which message server do I have to use? (ABAP/J2EE)
2) How to achieve to reach both stacks?
or
When it is not possible and I have to choose reaching J2EE-Stack (Portal from outside) how can I use the ABAP WebDynpros appropriately inside the portal?
Hopes somebody can bring some light into the darkness.
Best regards
Volker

Ok the ICM logg of the ABAP-Portal shows the following.
I'm not so used to read the logs, but what I see is, that the Request comes to the portal and ist handled the common HTTP-Handlerm, but the J2EE-Handler returns a "empty" request?
Here is a part of the log:
The Request Starts, the Cache Handler is calles, the J2EE Handler is called, return of Empty-HTTP but I cannot see a "Failure".
Thanks for having a look,
Best regards,
Volker
[Thr 3860] REQUEST:
    Type: ACCEPT CONNECTION    Index = 107
[Thr 3860] CONNECTION (id=1/233):
    used: 1, type: 1, role: 1, stateful: 0
    NI_HDL: 29, protocol: HTTP(1)
    local host: 195.1.1.182:8000 ()
    remote host: 195.1.1.181:29010 ()
    status: NOP
    connect time: 07.08.2008 16:11:39
    MPI request:        <0>      MPI response:        <0>
    request_buf_size:   0        response_buf_size:   0
    request_buf_used:   0        response_buf_used:   0
    request_buf_offset: 0        response_buf_offset: 0
[Thr 7548] SiSelNSelect: start select (timeout=-1)
[Thr 3860] MPI:3 create pipe 0000000003790660 1
[Thr 3860] MPI<53>3#1 Open( ANONYMOUS 3 1 ) -> 3
[Thr 3860] MPI<53>3#2 Open( ANONYMOUS 3 0 ) -> 3
[Thr 3860] MPI:1 create pipe 0000000003790360 1
[Thr 3860] MPI<54>1#1 Open( ANONYMOUS 1 0 ) -> 1
[Thr 3860] MPI<54>1#2 Open( ANONYMOUS 1 1 ) -> 1
[Thr 3860] IcmPlCheckRetVal: Next status: READ_REQUEST(1)
[Thr 3860] IcmReadFromConn(id=1/233): request new MPI (0/0)
[Thr 3860] MPI<53>3#3 GetOutbuf -1 187210 65536 (0) -> 0000000003917280 0
[Thr 3860] NiIRead: hdl 29 received data (rcd=434,pac=1,RAW_IO)
[Thr 3860] IcmReadFromConn(id=1/233): read 434 bytes(timeout 500)
[Thr 3860] Address    Offset IcmReadFromConn received
[Thr 3860] ------------------------------------------------------------------------
[Thr 3860] 00000000039172C8 000000 47455420 2f69726a 2f706f72 74616c2f |GET /irj/portal/|
[Thr 3860] 00000000039172D8 000016 696e6465 782e6874 6d6c2048 5454502f |index.html HTTP/|
[Thr 3860] 00000000039172E8 000032 312e300d 0a616363 6570743a 20696d61 |1.0..accept: ima|
[Thr 3860] 00000000039172F8 000048 67652f67 69662c20 696d6167 652f782d |ge/gif, image/x-|
[Thr 3860] 0000000003917308 000064 78626974 6d61702c 20696d61 67652f6a |xbitmap, image/j|
[Thr 3860] 0000000003917318 000080 7065672c 20696d61 67652f70 6a706567 |peg, image/pjpeg|
[Thr 3860] 0000000003917328 000096 2c206170 706c6963 6174696f 6e2f782d |, application/x-|
[Thr 3860] 0000000003917338 000112 73686f63 6b776176 652d666c 6173682c |shockwave-flash,|
[Thr 3860] 0000000003917348 000128 20617070 6c696361 74696f6e 2f766e64 | application/vnd|
[Thr 3860] 0000000003917358 000144 2e6d732d 65786365 6c2c2061 70706c69 |.ms-excel, appli|
[Thr 3860] 0000000003917368 000160 63617469 6f6e2f76 6e642e6d 732d706f |cation/vnd.ms-po|
[Thr 3860] 0000000003917378 000176 77657270 6f696e74 2c206170 706c6963 |werpoint, applic|
[Thr 3860] 0000000003917388 000192 6174696f 6e2f6d73 776f7264 2c202a2f |ation/msword, */|
[Thr 3860] 0000000003917398 000208 2a0d0a61 63636570 742d6c61 6e677561 |*..accept-langua|
[Thr 3860] 00000000039173A8 000224 67653a20 64650d0a 75736572 2d616765 |ge: de..user-age|
[Thr 3860] 00000000039173B8 000240 6e743a20 4d6f7a69 6c6c612f 342e3020 |nt: Mozilla/4.0 |
[Thr 3860] 00000000039173C8 000256 28636f6d 70617469 626c653b 204d5349 |(compatible; MSI|
[Thr 3860] 00000000039173D8 000272 4520362e 303b2057 696e646f 7773204e |E 6.0; Windows N|
[Thr 3860] 00000000039173E8 000288 5420352e 313b2053 56313b20 496e666f |T 5.1; SV1; Info|
[Thr 3860] 00000000039173F8 000304 50617468 2e313b20 2e4e4554 20434c52 |Path.1; .NET CLR|
[Thr 3860] 0000000003917408 000320 20322e30 2e353037 32373b20 2e4e4554 | 2.0.50727; .NET|
[Thr 3860] 0000000003917418 000336 20434c52 20312e31 2e343332 32290d0a | CLR 1.1.4322)..|
[Thr 3860] 0000000003917428 000352 686f7374 3a20706f 7274616c 2e61746c |host: portal.my|
[Thr 3860] 0000000003917438 000368 61732d77 65796861 7573656e 2e64650d |customer.de.|
[Thr 3860] 0000000003917448 000384 0a636f6e 6e656374 696f6e3a 204b6565 |.connection: Kee|
[Thr 3860] 0000000003917458 000400 702d416c 6976650d 0a636c69 656e7470 |p-Alive..clientp|
[Thr 3860] 0000000003917468 000416 726f746f 636f6c3a 20687474 70730d0a |rotocol: https..|
[Thr 3860] 0000000003917478 000432 0d0a                                |..              |
[Thr 3860] ------------------------------------------------------------------------
[Thr 3860] PlugInHandleNetData: role: 1, status: 1, content-length: 0/0
          buf_len: 434, buf_offset: 0, buf_status: 0
[Thr 3860] HttpParseRequestHeader: no content length set
[Thr 3860] HttpParseRequestHeader: no transfer-encoding set
[Thr 3860] HttpParseRequestHeader: Version: 1000
[Thr 3860] HttpParseRequestHeader: Keep-Alive: 1
[Thr 3860] HttpParseRequestHeader: no server port set
[Thr 3860] HttpRewriteRequestHeader: perform actions: 0
[Thr 3860] HttpSrvHdlRequest: method: 1; path: /irj/portal/index.html
[Thr 3860] Handler 3: HttpAuthHandler matches url: /irj/portal/index.html, port: 80
[Thr 3860] Handler 4: HttpCacheHandler matches url: /irj/portal/index.html, port: 80
[Thr 3860] Handler 2: HttpSAPR3Handler matches url: /irj/portal/index.html, port: 80
[Thr 3860] Handler 0: HttpJ2EEHandler matches url: /irj/portal/index.html, port: 80
[Thr 3860] HttpSubHandlerCall: Call Handler: HttpAuthHandler, task=1, header_len=434
[Thr 3860] HttpSubHandlerItDeactivate: handler 0: HttpAuthHandler
[Thr 3860] HttpSubHandlerCall: Call Handler: HttpCacheHandler, task=1, header_len=434
[Thr 3860] HttpCacheHandler: 1 434 000000000088BE80 0000000000000000
[Thr 3860] ISC: Cache Lookup. 1. try: browser independent.
[Thr 3860] ISC: hashed querystr = 9e6a '&*&'
[Thr 3860] HttpCacheMakeObjectKey() -> '/irj/portal/index.html&&&GZ=0&A6E90000&' (39) rc=0
[Thr 3860] MTX_LOCK 1628 0000000000C71940
[Thr 3860] MTX_UNLOCK 1759 0000000000C71940
[Thr 3860] IctCmOpen#195 R '/irj/portal/index.html&&&GZ=0&A6E90000&'.-1 (- ???) 13119456 1 -> 0000000000000000 -1 rc=20
[Thr 3860] MTX_LOCK 1628 0000000000C717F0
[Thr 3860] MTX_UNLOCK 1759 0000000000C717F0
[Thr 3860] IctCmOpen#257 R '/irj/portal/index.html&&&GZ=0&A6E90000&'.-1 (- ???) 13119456 1 -> 0000000000000000 -1 rc=20
[Thr 3860] ISC: Cache Lookup. 2. try: browser specific key.
[Thr 3860] ISC: hashed querystr = 26b66ec1 '&Mozilla/4.0 (compatible; MSIE 6.0;&'
[Thr 3860] HttpCacheMakeObjectKey() -> '/irj/portal/index.html&&&GZ=0&1CE66B62&' (39) rc=0
[Thr 3860] MTX_LOCK 1628 0000000000C71940
[Thr 3860] MTX_UNLOCK 1759 0000000000C71940
[Thr 3860] IctCmOpen#196 R '/irj/portal/index.html&&&GZ=0&1CE66B62&'.-1 (- ???) 13119456 1 -> 0000000000000000 -1 rc=20
[Thr 3860] MTX_LOCK 1628 0000000000C717F0
[Thr 3860] MTX_UNLOCK 1759 0000000000C717F0
[Thr 3860] IctCmOpen#258 R '/irj/portal/index.html&&&GZ=0&1CE66B62&'.-1 (- ???) 13119456 1 -> 0000000000000000 -1 rc=20
[Thr 3860] HttpCacheHandler: cache miss.
[Thr 3860] HttpSubHandlerItDeactivate: handler 1: HttpCacheHandler
[Thr 3860] HttpSubHandlerCall: Call Handler: HttpSAPR3Handler, task=1, header_len=434
[Thr 3860] HttpSAPR3Handler: url_tab_init: 1, force_dest: 0
[Thr 3860] ICT: IctLookupPathTable() -> 20
[Thr 3860] HttpSAPR3Handler: j2ee_active: 1, j2ee_conf: 1, dest: 2
[Thr 3860] HttpSubHandlerItDeactivate: handler 2: HttpSAPR3Handler
[Thr 3860] HttpSubHandlerCall: Call Handler: HttpJ2EEHandler, task=1, header_len=434
[Thr 3860] HttpJ2EEHandler called: task=1
[Thr 3860] IcmIConnPoolAllocEntry: no unused entry for pool 0000000000C29CF0 found (reuse conn: 1)
[Thr 3860] IcmIConnPoolAllocEntry: try to create new entry for pool 0000000000C29CF0
[Thr 3860] IcmConnPoolAllocSlot: allocated entry 0000000008D118D0[0] of pool 0000000000C29CF0
[Thr 3860] NiHsLGetNodeAddr: found hostname 'portal.mycustomer.de' in cache
[Thr 3860] NiIGetNodeAddr: hostname 'portal.mycustomer.de' = addr 195.1.1.182
[Thr 3860] NiIGetServNo: servicename '50000' = port C3.50/50000
[Thr 3860] NiICreateHandle: hdl 30 state NI_INITIAL
[Thr 3860] NiIInitSocket: set default settings for new hdl 30 / sock 7816 (I4; ST)
[Thr 3860] NiIBlockMode: set blockmode for hdl 30 FALSE
[Thr 3860] NiIConnectSocket: hdl 30 is connecting to 195.1.1.182:50000 (timeout=5000)
[Thr 3860] SiPeekPendConn: connection of sock 7816 established
[Thr 3860] NiICheckPendConnection: connection of hdl 30 to 195.1.1.182:50000 established
[Thr 3860] NiIConnect: hdl 30 took local address 195.1.1.182:3024
[Thr 3860] NiIConnect: state of hdl 30 NI_CONNECTED
[Thr 3860] NiILocalCheck: matched local address: 195.1.1.182 (up)
[Thr 3860] IcmConnPoolConnect: Connection to host: portal.mycustomer.de, service: 50000 established (nihdl=30)
[Thr 3860] IcmConnPoolNewEntry: created new entry 0000000008D118D0[0] for pool 0000000000C29CF0 (nihdl=30, ssl=0000000000000000)
[Thr 3860] HttpJ2EEHandler: server triggered
[Thr 3860]    Pool Entry 0000000008D118D0:
[Thr 3860]    NI: 30, SSL: 0000000000000000, allocated: 1, inuse: 1, desc: 0000000000C28BA0
local host: 195.1.1.182:3024
remote host: 195.1.1.182:50000
[Thr 3860] HttpJ2EEHandler: status: 6
[Thr 3860] MPI<53>3#4 GetOutbuf -1 197250 65536 (0) -> 00000000039272C0 0
[Thr 3860] HttpJ2EEDumpReqHeader:
eye1: deadbeef, version: 1, client ip: 195.1.1.181, protocol: 1, guid: 1/233,
length: 434, type: 0, trace: 3, status: 6, eye2: deadbeef
[Thr 3860] Address    Offset Send to AppServer via net:
[Thr 3860] ------------------------------------------------------------------------
[Thr 3860] 0000000003927308 000000 deadbeef 00000001 c30101b5 00000001 |................|
[Thr 3860] 0000000003927318 000016 00000001 000000e9 000001b2 00030600 |................|
[Thr 3860] 0000000003927328 000032 00000000 deadbeef                   |........        |
[Thr 3860] ------------------------------------------------------------------------
[Thr 3860] NiIWrite: hdl 30 sent data (wrt=40,pac=1,RAW_IO)
[Thr 3860] IcmFlushBuf: NiRawWrite (40 bytes) wrote 40, rc=0
[Thr 3860] MPI<53>3#5 DiscardOutbuf l2 0 0 197250 0 0 -> 00000000039272A0 0
[Thr 3860] Address    Offset Send to AppServer via net:

SAP Webdispatcher Setup for J2EE 640

Dear Basis Guru's,
I am trying to setup SAP Webdispatcher for our customer system. J2EE Instance is installed in a hostname called javadev which is in a domain where all other SAP Instnaces are setup ( XYZ.COM). I have installed SAP Webdispatcher in a other host called webdispdev which is existing in different domain (XYZWEB.com) Firewall rules are updated and J2EE Engine ports are opened to connect to this host.
I have generated the SSL key pair and got it certified by Digicert CA and imported it back. Now i have to configure url re direct for this webdispatcher so tht users can access j2ee instnce using with webdispatcher hostname , I have tried adding the web service name provided by developer to the url_filter , I can access this webservice using with http port , I cant access it using with j2eeengine https port . I have addedd https port to the webdispatcher profile and it fails to start when i add https port.
When i compare the new setup with existing prod systems i can see https port is addedd to sapwebdisp.pfl and users able to access it successfully. Although sap webdisp installed in one host name which is in XYZWEB.COM and users are accessing it using with diff hostname which is in XYZ.COM (Ex: webdisp host - webdispprod.XYZWEB.COM and they are accessing it using with webdispprod.XYZ.COM) looks like ur reditect setup in DNS?? I was not invloved in prod webdisp setup and i dont have any info how it was configured.
Please help me to fix the below issues
1.when i add https port to sapwebdisp.pfl wedispatcher failes to start - Error posted below
ERROR => DlLoadLib: LoadLibrary(
webdispdev\sapmnt
SYS\exe\run\sapcrypto.dll) Error 126 [dlnt.c       237]
[Thr 5492]         Error 126 = "The specified module could not be found."
[Thr 5492] *** ERROR => secudessl_LoadLibrary(): Unable to load "
webdispdev\sapmnt
SYS\exe\run\sapcrypto.dll" [ssslsecu.c   352]
[Thr 5492] *** ERROR => Loading of SSL library failed -- NO SSL available!
[Thr 5492] =================================================
2.I should access webdispatcher using with https port
3. How can i access webdispatcher servevr exisitng in XYZWEB.com using with XYZ.COM using https port ?
Do you think i should generate SSL Certificates for the both XYZ.COM and XYZWEB.COM ? If so i did that but may be i did not do correctly
Please help me , Your help is appreciated
Thanks,
Ravin

Hi Ravin,
how do you want to config ssl on your web dispatcher, termination or passing refer to http://help.sap.com/saphelp_nw70ehp1/helpdata/en/39/09a63d7af20450e10000000a114084/frameset.htm
can you post your .pfl file here?
1.when i add https port to sapwebdisp.pfl wedispatcher failes to start - Error posted below
ERROR => DlLoadLib: LoadLibrary(
webdispdev\sapmnt
SYS\exe\run\sapcrypto.dll) Error 126 http://dlnt.c 237
Thr 5492 Error 126 = "The specified module could not be found."
Thr 5492 *** ERROR => secudessl_LoadLibrary(): Unable to load "
webdispdev\sapmnt
SYS\exe\run\sapcrypto.dll" http://ssslsecu.c 352
Thr 5492 *** ERROR => Loading of SSL library failed -- NO SSL available!
Thr 5492 =================================================
Did you installed SAP crypto library at: \webdispdev\sapmnt
SYS\exe\run\sapcrypto.dll
2.I should access webdispatcher using with https port
that's a business requriement you'd check with the owner.
3. How can i access webdispatcher servevr exisitng in XYZWEB.com using with XYZ.COM using https port ?
the ssl server certificate should be applied for the domain which is used by the end user, not your server OS configuration, in your case, I assume it should be XYZ.com

Monitoring availability of SAP-WebDispatcher + ERP functions

we want to check (Nagios) the availability of Webservices components are SAP-WebDispatcher + ERP.
in the past, after offline-backup and restarting the systems, there was a problem, when the webdispatcher first starts and the ERP-system was not allready startet yet - the webdispatcher could not be used (no connection to ERP)
so, what URL can we use to check the correct function of the webdispatcher (including connection to ERP) ?

Hi,
I really doubt if it is widely used within India yet. But you can find reference customer in rest of world. Have you tried to call SAP India sales number: +91 1800 425 5959 (toll free) or +91 80 2554 7586.
If you are representing any SME then my suggestion is to send RFQ (request for quote) to various SAP partners in India and they will surely respond.
Since this SaaS based product hence you can also explore out-of-india service provider.
Regards,
Gourav

SAP Web AS - SAP Webdispatcher - RSA

Hello,
I am new to this forum. So please let me know if my question is off topic and give me a hint where to post the question.
I like to setup RSA authentication together with SAP Web AS and SAP Webdispatcher. Idea: The User is connecting via http or https to the SAP Webdispatcher. Before dispatched to the SAP Web AS the user has to perform an authentication by RSA token. I know that there are solutions available for e.g. IIS or Apache, but I don´t know if it possible with SAP Web AS and SAP Webdispatcher.
Any help is appreciated.
Best regards,
Marcus

Hi Marcus
I've moved your question to the Netweaver Security forum.
Regards,
Désiré

SAP WebDispatcher - system requirements & general questions

Hi all,
possibly we would like to use the SAP WebDispatcher as reverse proxy for
our SAP EP infrastructure. Our main goal is to secure accesses from the internet to the sap ep by installing the SAP WebDispatcher in a DMZ.
Could someone give me information about the hardware/system requirements
of the SAP WebDispatcher?
(supported operating systems, recommended CPU / Ram size, is a database necessary (if yes, which is supported))
Is it possible to restrict the requests to the SAP WebDispatcher from only
specific IPs or IP-Ranges?
Just for my curiosity: what's the implementation language of the SAP WebDispatcher.
Are there any important security vulnerabilities known?
Any help is really appreciated
Regards Karin

Hello,
Did you make some research in help.sap.com and sapservice.sap.com and the find button on SDN ? Much of the answers for your questions are there waiting for you to read them !
Anyway,
The supported OS are the same as Netweaver (Linux, Unixes and Windows), both 32 and 64 bit.
The hardware requirements are low, but depends obviously of the number of http requests to process per second. For instance we use a Linux x86 biprocessor blade with 2 GB ram, for a moderate load and the cpu load is lower than 3 %...
There is no database for the sap web dispatcher. what would be its use ??
Yes it is possible to filter IPs or IP-ranges. Check icm/HTTP/auth_xx parameter and http://help.sap.com/saphelp_nw04s/helpdata/en/b4/9aa8862e714e6db8e74e48e5d3283b/frameset.htm.
For the implementation language, the release information for a web dispatcher 7.0 running on Windows 2003 tells me :
compiled on NT 5.0 2195 Service Pack 4 x86 MS VC++ 13.10
So I guess the language shoul be C++.
Regards,
Olivier

SAP Webdispatcher :Images are not displayed after using the URL filtering

Hello,
I have installed the SAP webdispatcher 7.3 on Linux redhat 5.4 in front of the Portal 7.3.
I wanted to restrict the access just for the IRJ prefix so for this i used the parameter wdisp/permission_table = PermFile
with Permfile as follows:
#Denial of the useradmin URL from the WebDispatcher
P /irj*
P /irj/*
The filtering is working well except that for IRJ the images are not displayed so i was using so i added the following line to disply the images to the logon page
icm/HTTP/auth_
P /logon_ui_resources/*
P /logon_ui_resources*
but i still have the same issue for the irj page where no icons are displayed and i can do nothing.
The same issue also happened when using the icm/HTTP/auth_xx
Do you have an idea how to deal with this issue?
Thanks in advance;
Hassan

Hello,
After checking the HTTP code of the irj page on IE, i foud the needed URL to permit so i modified the permision table and it works fine for the moement
P /irj*
P /irj/*
P /logon_ui_resources/*
P /logon_ui_resources*
P /AFPServlet/*
P /AFPServlet*
P /com.sap*
P /com.sap/*
P /webdynpro/resources*
P /webdynpro/resources/*
Thanks for you help,
Hassan

Kerberos and SPNEGO

I wan trying to do sso for Oracle UCM 11g which uses weblogic 10.3.4 using Kerberos and SPNEGO as stated in Oracle documentation
I followed all steps on the following links
http://download.oracle.com/docs/cd/E17904_01/web.1111/e13707/sso.htm#i1102021
and
http://download.oracle.com/docs/cd/E17904_01/doc.1111/e10792/c03_security.htm#CDDDIHBA
My issue is strange there are no error no exception and SSO not working even if I added wrong info to krb5.conf or krb5login.conf, I have created JAAS configuration file, and I have specified krb5login.conf file location as a startup option in the WebLogic where I have added the following to startWeblogic.sh
JAVA_OPTIONS="${JAVA_OPTIONS} -Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.auth.login.config=krb5login.conf -Djavax.security.auth.useSubjectCredsOnly=false -Dweblogic.security.enableNegotiate=true -Dsun.security.krb5.debug=true"
what do you think I am facing here???

Hi,
Apply SAP Note 1045019 (Example 3) and provide for analysis the errors (in red) from the collected traces.
Regards,
Dimitar

Use sap webdispatcher with multiple hosts

I need to support 2 different senerios with our SAP Webdispatcher. I need to have some users accessing services on our backend ECC system using SSL between the SAP Web Dispatcher and the client. I have another group of users that need to use a different URL that does not need to use SSL. Do I need to run 2 separate instances of SAP Webdispatcher or can I configue one to handle both accesses?

Are all the users accessing the same back end system? If they are, you should be able to do it with one dispatcher. You would just need to configure two ports in the <SID>_Wxx_hostname profile, e.g.:
icm/server_port_0 = PROT=HTTP,PORT=80
icm/server_port_1 = PROT=ROUTER,PORT=443
This will route users to who connect to the web dispatcher on port 80 to the backend system via HTTP, and users who connect to the web dispatcher on port 443 will be routed to the backend system via HTTPS (Using end-to-end ssl).
If you're trying to route users to different back end systems, I think you will need multiple web dispatchers. As far as I know, a web dispatcher will only load balance users over a single system. But I'm not 100% on that, so maybe somebody else knows for sure.
Hope this helps,
Glenn

SAP WebDispatcher Vs Hardware Load Balance

Hello Gurus
I need take a decision about use or not SAP WebDispatcher for a large customer. We estimated the numbers for the service in more than 4000 hit/sec. How I can compare the service level and features or both solutions?
Regards,
Carlos

The help docs at help.sap.com are quite good for the initial install of the sap webdispatcher
Start here: http://help.sap.com/saphelp_nw04/helpdata/en/f5/51c7d170bc4a98b1b5a0339213af57/frameset.htm

SAP webdispatcher https to portal configuration guide

dear all,
i am trying to enable https port in sap webdispatcher to communicate to sap portal . can anyone suggest the configuration guide or procedure.
Thnaks and Regards
Revantha Vishnu

Hi,
You have generate one from the SAPGENPSE.
http://help.sap.com/saphelp_nw04/helpdata/en/56/a92f3ae689f058e10000000a11402f/frameset.htm
Regards,
Vamshi.

SAP Webdispatcher protocols

Hi All,
Could you let me know what is the latest SAP Webdispatcher version currently available and what protocols it can handle.
Last I had heard they don't support SOAP calls but only HTTP(s). Does it now support SOAP ?
Also does it support RNIF ?
SAP Web Dispatcher protocols are determined by the parameter icm/server_port_x.
Thx in advance
Ravijeet

Hi Ravijeet
Please check the note #908097 SAP Web Dispatcher: Released releases and applying patches.
I don't think there are any restrictions with regards to SOAP and RNIF. You can use the Web Dispatcher with your PI system which can handle these protocols.
Regards
Mark

Sap webdispatcher and spnego

Similar Messages

Maybe you are looking for