WSA how to filter HTTPS urls without decrypting

In transparent mode HTTPS Proxy must be activated for HTTPS traffic.
If you don't want particular users to access certain https sites with out decryption , you can define those urls in custom url categories and under decryption policies :
1. Exclude that custom url category from global decryption policy
2. Create new decryption policy for those identities you want to block request and then under categories include that custom url. Default action you will get for this category is monitor .
3. If you leave it as such then it continues to evaluate the client request against other policy group control settings, such as web reputation filtering or you can use drop action if you do not want to pass the connection request to the server. The appliance does not notify the user that it dropped the connection.
HTH
"Please rate useful posts"

Dear Kush
Thanks for the reply.... you advise to start with a new Decryption Policy for Guest users. So I have now created several Decryption Policies, for Guests, Authenticated Users, VIP Users. The Guest URL Filtering is set to DROP many Categories and to Pass Through the rest, and the VIP Policy drops only the worse categories (Porn, etc) and Pass Through most. If I set the HTTPS Filter=Monitor, then it will decrypt.
I think it is working as I need it, but as a Guest User I can still bypass the Ironport block by entering http://www.youtube.com into Internet Explorer v8 (XPsp3) - However, on the same PC with Firefox v28 https://www.youtube.com is blocked. (IE8 detects the traffic as "SRCH" traffic to 74.125.21.95:443, Firefox detects category "VID" to 74.125.196.91:443)
I'll do some more testing, then feedback to the forum again...
Martin
PS. What I don't like about the solution: I need to setup two sets of URL Category Filters: for the HTTPS proxy (under Decryption Policies) and for the HTTP proxy (under Access Policies) - even though I want the same Group based filters for HTTP and HTTPS. I did not expect to have to setup two separate sets of filters.

Similar Messages

How to open a URL without session ID and reuse the current browser session?

Hi All,
I have a question about HTMLDB 2.0
How to open a URL without session ID and reuse the current browser session?
That was the behaviour in HTMLDB 1.6 ...
My usecase for this is the following:
We have written an issue tracking application, which sends e-mail to the interested users, when something happens.
In these email we've put a link to some page, with some parameters in the URL.
The idea is for the user to be easy to click on the hyperlink and to see the details of the ticket.
When the user clicks on such a link he is directed to a login screen (page 101) and he enters his Username and password, and is then forwarded to the details for the ticket.
Then he receives another email (e.g. for another ticked). He clicks on the link and :
a) in HTMLDB 1.6 he goes to the details as he didn't close his browser and session is remembered
b) in HTMLDB 2.0 he is prompted to enter username, password with the username populated
Please tell me how can I achieve the same behaviour in HTMLDB2.0 as it was in HTMLDB 1.6.
I understand this change is somehow security related, althogh I don't understand how. If you can explain this either I would be very happy?
Best regards,
Mihail Daskalov

Mihail - I detailed a couple of approaches here: Re: Application Link
Scott

How to connect HTTP URL

hai guys,
I developed one report and data downloaded into application path and file format is CSV. My development was working fine . Now I want to change file downloaded into FTP location ( this is also working). Now i want to connect HTTP URL path.
How to connect HTTP URL path ( Not Open method only connect)
Thanks in advance

Hello,
U can make use of these Fm to connect to URL.
Use this code.
CNHT
CALL FUNCTION 'WS_EXECUTE'                        "#EC *
EXPORTING
    COMMANDLINE        = LV_CMDLINE
    PROGRAM            = LV_PGMNAME
EXCEPTIONS
    FRONTEND_ERROR     = 1
    NO_BATCH           = 2
    PROG_NOT_FOUND     = 3
    ILLEGAL_OPTION     = 4
    GUI_REFUSE_EXECUTE = 5
    OTHERS             = 6.
IF SY-SUBRC <> 0.
Where LV_CMDLINE = WWW.SAP.COM
      LV_PGMNAME = IEXPLORE.EXE
If useful reward points
Vasanth
Message was edited by: Vasanth M

How to filter Multiple channels without losing outputs

Hello all, this really is my last hope. I'm having a real big issue in Logic, it's been that way since I started and I'm hoping someone help me. The issue is the same with every track I create, and is as follows:
An example I will use is the main 'drop' of a track. I want to have most elements gradually filtering out, to allow an emphasis when the beat kicks back in at the drop. At the same time, I want to leave some elements playing, such as reverse cymbal, rise/swoosh/sweep sounds etc. The problem I have is how to select multiple items to filter out, using ONE filter (eg. Beats & bass) and not have to put a filter on EVERY individual track and automate them individually.
I know one option would be to send all of these items to a bus, and then filter that bus, but then that means that the elements are playing from TWO sound sources - their original channel strip AND the bus that they are now assigned to.
I know this problem can be alleviated by removing the output from the original channel strips, and only have their sound coming from the BUS, but then this causes the problem of loss of impact/volume because I'm losing the original sound source.
Lots of my sounds are sent together to busses, eg. BeatsBus. BassBus etc. where they all gather and are compressed together creating extra volume and compression effect.
Hopefully I have explained myself well enough here, it's not the easiest problem to articulate over a message.
But to recap, I want to filter multiple sounds (beats, bass and everything else) with one filter, without losing my MULTIPLE sound sources, ie their original channel strip output.
Please please help.
Steven.

Dont use a send to get the tracks to the bus. Assign the tracks OUTPUTS (should say "stereo out" before you change it) directly to the busses.

How to filter in URL using NW04s WAD?

Greeting Web Template Gurus,
I am working in NW04s SP12 WAD (Web Application Designer) and I am trying to use the filtering criteria in my URL... <bwurl>&FILTER_IOBJNM=0PLANT&FILTER_VALUE=1000. I have brought in the Filter Pane in the Web template and when I run the Web Template in IE, I do not see where 0PLANT is being used.
Is there a setting in the Web Template I am missing, or a specific Command I need to be running to get this to work for me?
Regards,
Alex

Hello Alex,
Please try to pass the command using the Template ID and not using the Query,
for example
http://<server><port>/irj/servlet/prt/portal/prtroot/pcd!3aportal_content!2fcom.sap.pct!2fplatform_add_ons!2fcom.sap.ip.bi!2fiViews!2fcom.sap.ip.bi.bex?QUERY=MMFG_M03_Q0088&FILTER_IOBJNM_1=MPLANT&FILTER_VALUE_1=3010
instead of using QUERY=MMFG_M03_Q0088, try WebTemplate as given below, it may help you
http://<server><port>/irj/servlet/prt/portal/prtroot/pcd!3aportal_content!2fcom.sap.pct!2fplatform_add_ons!2fcom.sap.ip.bi!2fiViews!2fcom.sap.ip.bi.bex?template_id=yourTemplate&FILTER_IOBJNM_1=MPLANT&FILTER_VALUE_1=3010
See this page for more info
[Calling Parameterized Web Templates|http://help.sap.com/saphelp_nw04/helpdata/en/27/6c013a53271a05e10000000a11402f/content.htm]
Thanks
Chandran

How do i hide url WITHOUT hiding tabs in fullscreen mode (F11)?

Title says it all. I want a fullscreen mode that works exactly like it did in Firefox 4.0.

There are some hacky things you can do with the toolbar area in full screen mode. I worked on one recently to keep the Bookmarks Toolbar displayed. Hopefully someone can work out the rules for the tab bar.
That other thread: [https://support.mozilla.org/en-US/questions/956050 How do I show the bookmarks toolbar while in fullscreen on Firefox 20? In older versions you could edit the userChrome.css file. Does that still exist?]

WSA access logging for HTTPS traffic

Hi,
We have a WSA s370 with AsyncOS version 7.5.1-079 and it is configured as a transparent proxy.
HTTPS proxy is enabled and all the URL categories set to pass through ( no decrytpting or monitoring ).
Seems like the WSA does not generate logs for HTTPS transactions.
I would like to know whether this is the expected behaviour.
Is there any way that I can monitor HTTPS transactions without decrypting ?
Thanks,
Wipula.

In addition to what Ken mentioned, the only way you can monitor HTTPS traffic without decrypting it will be done so using the IP address.
In the access logs, you will see the following transaction when accessing an HTTPS site (google for example):
TCP_CONNECT 74.125.101.50
It will only report URLs once decrypted. At that point, it is just HTTP.
-Vance

SOAP URL without username and password

Hello Everyone,
its a synchronous SOAP - PI -ECC scenario .
I have created HTTP URL through sender agreement in integration for testing.
However, customer now wants HTTPS URL without Username and password in production URL. How do i create this .
Regards,
Ravi

Hello,
However, customer now wants HTTPS URL without Username and password in production URL. How do i create this .
You can disable basic authentication for the sender SOAP Adapter by following William's reply in this thread
http://forums.sdn.sap.com/thread.jspa?threadID=236507
However, the authentication will be disabled for all SOAP Sender, so you should weigh-in the impacts of granting that request.
Hope this helps,
Mark
Edited by: Mark Dihiansan on Feb 13, 2012 3:51 AM

Recorset filter by url then group by

I have a search results page that get its information via a
complex form then their is a more details page which is filtered by
the url i want to put another record set on the page which pick up
the info from the URl but then sort the information from a feild
which contains codes i want to select only part of the code ie
first 3 digits of the code.
i am using dreamweaver 8
this is the code from the dreamweaver panel if i fillet them
seprately they work but together i get no data can any give me a
clue on how to filter by url then group by field if contains "text"
SELECT *
FROM all1
WHERE product_name = 'MMColParam' AND product_id LIKE
'testVariable'
variables
MMColParam 1 Request.QueryString("product_name")
testVariable "%thr%" testVariable

thanks !
my URL call a template, so, is this the good url ? :
<SAP_BW_URL ITEM='*TPL*' MULTI='X' HIDDEN='X' FILTER_NODE_IOBJNM_1='ZIS_PDT' FILTER_VALUE_1='C' CMD_1='ITEM=*TPL1*&MULTI=X&HIDDEN='>
or did i must put it in the CMD like this ? :
<SAP_BW_URL ITEM='*TPL*' MULTI='X' HIDDEN='X' CMD_1='ITEM=*TPL1*&MULTI=X&HIDDEN=&FILTER_NODE_IOBJNM_1='ZIS_PDT'&FILTER_VALUE_1='C''>
another question,
in my query, did the characteristic must be in "free characteristic" or in "filter" or nowhere ???
thanks a lot

How to access Portal URL outside of the LAN

Hi Experts,
Our J2EE engine is hosted on one machine and R/3 is installed on other machine (IP address is different). We have configured Web Dynpro ABAP iVIEW's and Transaction iViews in my portal. To be able to access these two iViews I have to maintain the IP addresses of both EP server and R/3 server IP's in every client host file.
Hence my client system is in LAN it is working with no issues, but we want to access the URL form out of LAN which is not possible at the moment.
Could anyone please advise me how to access the URL without maintaining the IP address in host file
and
able to access the URL out side of the LAN.
Thanks
Murthy

Hi Murthy,
Directly its not possible at all, For this you need to publish the Portal Server on Internet.
Once its published on internet then you can access the URL without maintaining the
IP address in host file.
In this your Basis Team and Network team will help you.
Regards,
Piyush

How to do Handshake with tired party(bank) HTTPS URL from SAP PI server

Dear Expert,
I have developed bunch of scenarios, all are synchronous ABAP proxy to HTTP_AAE with bank on PI 7.4(dual stack). Bank web server is HTTPS enabled server. Our ABAP developments are still in progress also we have few issue in connection from ECC to PI.but that is not the focus of discussion here.
we want to do the handshake to check the connectivity with bank on their HTTPS URL from PI. Bank has provided the privet key for SSL from their server and corresponding public key they have maintained on their server. I have imported the private key under NWA -> Certificates -> Key Storage -> TrustedCA->Import Entry->Entry Type->PKCS#12->select the SSL.p12 file->import , also I have selected the option to "Use SSL" in HTTP_AAE receiver communication channel and selected the corresponding entryin "keystore view" and "keystore entry". All these I have done in our DEV system, and we are trying to connect our PI dev to bank Dev server.
Questions
Is there any specific steps to do the handshake with third party HTTPS(bank in my case) server? if not, how can we just test the HTTPS connectivity by using the SSL private installed on our PI server, without running the complete scenarios. Our PI has been installed on UNIX, and "telnet https url 443" is working, as network team has opened the HTTPS port.
We have not enabled the SSL technically on our PI server, and we have not installed any generated certificate from our PI server. Moreover, we have not made our PI url as "https:hostname:port" as we just need to communicate with bank by using their private key. Do you guys think we should enable the SSL? if yes, please explain why.
What is the best practice to test the connection with third party having HTTPS URL? how can I just assure HTTPS communication is working fine, before testing my actual scenarios.
Thanks for helping always.
Regards,
Farhan

Hi Farhan,
Some part of the blog is applicable for sending HTTPS request to partners/third party (Receiver SOAP Adapter).
If banks certificates are already in trustedCA, then, can you check if it also imported under user PIISuser under Identity management in NWA. If above 2 steps are done then i think your are good to go. But be careful when you install certificate, it should be in proper order.
As you already mentioned, connectivity is already established and you are able to PIng/telnet from pi server, connectivity looks ok.
While sending request, if you are getting 401 unauthorized, below might be the reason -
1. Certificate not installed correctly or some missing steps
2. Partner or TP is not ready to receive it, some certificate issue in there side.
other than 401 means you are ok (As per certificate and Connectivity) - 403 and 500 errors are next stops.
403 - error because of encoding method.
500 - data issue.
Regards
Aashish Sinha

How to call a URL in jsp without direct the page to the URL

Hi,
I have a jsp page, which when user come in to the page, the page will call a URL without direct the current jap page the URL. This URL will only help me to do on something in the backend. Anyone know any method that i can use to call the URL?
Thanks a lot

Doeas AJAX rings a bell? ;-)
https://blueprints.dev.java.net/bpcatalog/ee5/ajax/usingAJAXwithoutJSF.html

How to read XML file kept on NON-SAP server using the Http URL ?

Dear Experts,
I am working on CRM2007 web UI. I need to read a XML file placed on a shared server location by a third party program. Then process that XML file into CRM and create a quotation using the data extracted from the file.
All i have with me is the http URL that points to the location of the file.
I am supposed to read the file , create quotation and at later point of time i would be asked to update the quotation and then generated new XML representing updated quotation and replace the XML file on shared server location with this new updated XML file.
I know how to extract data from XML file into ABAP but i have no clue as to how to access the file on some other server using the http url i have and how to read it ?
I searched on the forum and i found the codes for reading XML file that is located either on client machine OR on the Application server wheareas my file is on some other than sap application server.
Please help me as its an urgent issue .
Points will be rewarded for sure.
Please help.
Thanks in advance,
Suchita.
p.s. : the http url to the file location is like -->
http://SomeServerDomain/SomeDirectory/file.xml

hi,
interesting task.
to request the file by a http call you need to create an if_http_client object.
More info is [here|http://help.sap.com/saphelp_nwmobile71/helpdata/en/e5/4d350bc11411d4ad310000e83539c3/frameset.htm]
to parse the file you either have to work with the ixml packages ([info|http://help.sap.com/saphelp_nwmobile71/helpdata/en/47/b5413acdb62f70e10000000a114084/content.htm]) or you use an XSLT transformation ([info|http://help.sap.com/saphelp_nwmobile71/helpdata/en/a8/824c3c66177414e10000000a114084/content.htm]).
uploading the final file isn't so easy. if you only have http, you should write a server script to allow uploading of the new file and copying it into the place of the old file. but you definitely need the script.
now it's your take. depending on how experienced you are in ABAP and networking this might turn out to be easy or pretty complicated.
have fun,
anton

How can I get URL forwarding working without touching the obj.conf

It won't work right after it is set up from the Admin server. I have to manually edit the obj.conf so that the [NameTrans fn="redirect"] lines are ahead of any other lines NameTrans lines. Why the Admin server cannot do this when adding the "redirect" lines to obj.conf, or did I miss anything when I config the URL forwarding?
SunOne WebServer6.1 SP4

This is a full copy of the obj.conf file, right after I set up a URL Forwarding. The URL Forwarding is added as the 3rd [NameTrans] line. I have to manually move it as the 1st [AuthTrans] line, else it won't work.
# You can edit this file, but comments and formatting changes
# might be lost when the admin server makes changes.
# Use only forward slashes in pathnames--backslashes can cause
# problems. See the documentation for more information.
<Object name="default">
AuthTrans fn="match-browser" browser="*MSIE*" ssl-unclean-shutdown="true"
NameTrans fn="ntrans-j2ee" name="j2ee"
NameTrans fn="pfx2dir" from="/mc-icons" dir="c:/Sun/WebServer6.1/ns-icons" name="es-internal"
NameTrans fn="redirect" from="/AuxFiles" url-prefix="http://pdiweb.pdi.sci.com:8080/AuxFiles"
NameTrans fn="document-root" root="$docroot"
PathCheck fn="nt-uri-clean"
PathCheck fn="check-acl" acl="default"
PathCheck fn="find-pathinfo"
PathCheck fn="find-index" index-names="index.html,home.html,index.jsp"
PathCheck fn="set-cache-control" control="private"
ObjectType fn="type-by-extension"
ObjectType fn="force-type" type="text/plain"
Service method="(GET|HEAD)" type="magnus-internal/imagemap" fn="imagemap"
Service method="(GET|HEAD)" type="magnus-internal/directory" fn="index-common"
Service method="(GET|HEAD|POST)" type="*~magnus-internal/*" fn="send-file"
Service method="TRACE" fn="service-trace"
Error fn="error-j2ee"
AddLog fn="flex-log" name="access"
</Object>
<Object name="j2ee">
Service fn="service-j2ee" method="*"
</Object>
<Object name="cgi">
ObjectType fn="force-type" type="magnus-internal/cgi"
Service fn="send-cgi"
</Object>
<Object name="es-internal">
PathCheck fn="check-acl" acl="es-internal"
</Object>
<Object name="send-compressed">
PathCheck fn="find-compressed"
</Object>
<Object name="compress-on-demand">
Output fn="insert-filter" filter="http-compression"
</Object>

How to encrypt UserID and Password in HTTP url

Hello experts,
We want to encrypt UserID and Password which has used in http URL in SAP PI 7.1.
As we have used SOAP adapter with Transport Protocol HTTP for sender server.
Kindly help us on it.
Regards,
Poonam.

Hi,
please go through below blog,
http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/b04408cc-f10e-2c10-b5b7-af11026b2393?QuickLink=index&overridelayout=true
please go through below threads,
SOAP Envelope with user id password
Soap ---to ----file scenario
regards,
ganesh.

WSA how to filter HTTPS urls without decrypting

Similar Messages

Maybe you are looking for