WSSecurity - WebDispatcher(reverse proxy)

Hi All,
We are planning to implement webservices using PI 7.1 and would like to capitalise on the WSSecurity standard along with the Webdispatcher performing the reverse proxy functionality. Is there a standard procedure to do that? Where can we find more information in terms of the interoperability of WSSecurity with reverse proxy using SAP Netweaver. We do not want to use SSL. Is it a possiblity.
Thanks in advance.
Vedavyas

As I know, the Web Dispatcher is not able to validate WS security. Maybe tools from other vendors can do this?
A non-central adapter engine could be set up like this:
||         DMZ 1    ||       DMZ 2      ||
---> Web Dispatcher --> Adapter Engine  --> PI
||                  ||                  ||
So the adapter engine could do the validation of WS security, before it leaves the DMZ.
Maybe you put the question also in the Security forum
Security
Regards
Stefan

Similar Messages

  • SAP Webdispatcher - Reverse Proxy Configuration

    Hi All,
    Need your help in configuration SAP Webdispatcher as reverse proxy. Currently we are using Apache as reverse proxy, but we are facing 400 Bad Request error and not able to solve the issue.
    So We are planning to install Webdispatcher and configure reverse proxy and test.
    Below is the Apache Reverse proxy configuration. Need help in configuring the same parameters in SAP Webdispatcher
    ProxyPass /sap http://srmerver:8000/sap
    ProxyPass /SRM-MDM  http://mdmserver:50100/SRM-MDM
    ProxyPass /mdmimages http://portalserver:8090/mdmimages
    ProxyPass /irj http://portalserver:50100/irj
    ProxyPass /saml2 http://portalserver:50100/saml2
    ProxyPass / http://portalserver:50100/　
    ProxyPassReverse /sap http://srmserver:8000/sap
    ProxyPassReverse /SRM-MDM  http://mdmserver:50100/SRM-MDM
    ProxyPassReverse /mdmimages http://portalserver:8090/mdmimages
    ProxyPassReverse /irj  http://portalserver:50100/irj
    ProxyPassReverse /saml2 http://portalserver:50100/saml2
    ProxyPassReverse /  http://portalserver:50100/
    Regards
    Ponnusamy

    Hi
    Kindly refer the SCN link
    How to...Configure SAP Webdispatcher as a reverse proxy
    http://basisondemand.com/Documents/Whitepaper_on_SAP_Web_Dispatcher.pdf
    http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/a015cea3-9627-2e10-a792-8f39e3d0b59d?QuickLink=index&…
    Regards
    Sriram

  • Webdispatcher with reverse proxy

    Hi Experts,
    We need to deploy reverse proxy and web dispatcher. This is for a relatively budget savvy customer so cost is big issue. My question is :-
    1) Can we deploy reverse proxy & webdispatcher on the same server ? (without using VMware). Probably we will use two Linux operating system.
    2) Should we plan for failover on Webdispatcher ? Or running Webdispatcher without failover may not be that big issue.
    Can you guys please share your thoughts on these two issues ? Urgently require your feedback on this.
    Regards,
    TB

    Hi,
    We need to deploy reverse proxy and web dispatcher.
    The web dispatcher IS a reverse proxy.  What do you mean ? I think you did not perfectly understand the need...
    1) Can we deploy reverse proxy & webdispatcher on the same server ?
    Yes, but it does not make sense to me until you have a very unusual requirement.
    Should we plan for failover on Webdispatcher ?
    If you need High availability, yes. You're the only one to know if you need it...
    Regards,
    Olivier

  • SAP webdispatcher as reverse proxy

    I'm using SAPNW7.3 based web dispatcher.
    I would like to know if it is possible to configure webdispatcher as reverse proxy with stateful applications...
    In my landscape,
    <client browser> --> <webdispatcher as reverse proxy> (say, A & B) --> <webdispatcher as load balancer> (say, C&D) --> <sap EP server x4> (say, W,X,Y,Z)
    A&B operate on separate servers in parallel provide reverse proxy functionality... so do C&D for load balancing.
    I have configured  system C&D to connect to SAP EP by using profile parameter wdisp/system_1. I want to know how to configure A or B,
    IMO, in System A
    wdisp/system_1 = SID=EXT, EXTSRV=http://A:8000;http://B:8000, SRCSRV=*:8093
    This sends all requests (u201Cround robinu201D) arriving in port 8093 on to the two servers C&D and thereby to EP app servers W,X,Y,Z.
    In this case, we can't use stateful request as per http://help.sap.com/saphelp_nw73/helpdata/en/48/957c6494cc73eae10000000a42189b/frameset.htm
    Is there any other way to configure A&B, to allow operating stateful connections. If not, does this mean that sap webdispatcher cannot be used as reverse proxy unless you are using only stateless requests (without stickiness)?

    Hi
    Kindly refer the SCN link
    How to...Configure SAP Webdispatcher as a reverse proxy
    http://basisondemand.com/Documents/Whitepaper_on_SAP_Web_Dispatcher.pdf
    http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/a015cea3-9627-2e10-a792-8f39e3d0b59d?QuickLink=index&…
    Regards
    Sriram

  • Webdispatcher as reverse proxy in DMZ

    Hello,
    We are planning to setup a webdispatcher in the DMZ that will connect to the portal to replace the external hardware load balancer that we currently have. The loads are not very heavy to we decided to do away with the external load balancer.
    The scenario that we want to achieve is that from an external web browser, a user can connect to the portal. The certificates will be stored in the web dispatcher such that the connection from the external web browser to webdispatcher is secure. Then the SSL should terminate for connecting the webdispatcher to the portal.
    I have read through the following but I'm still not sure on how to set this up.
    How to...Configure SAP Webdispatcher as a reverse proxy
    https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/60d6de2e-085b-2b10-7a8f-bc9ae1e0bba6
    Note 538405 - Composite SAP Note SAP Web Dispatcher
    Can someone help me or point me to a document/material that can help me?
    Thanks!
    MRR

    Try these:
    http://help.sap.com/saphelp_nw70/helpdata/EN/d8/a922d7f45f11d5996e00508b5d5211/frameset.htm
    http://help.sap.com/saphelp_nw70/helpdata/EN/39/09a63d7af20450e10000000a114084/frameset.htm
    The second link has step by step process for setting up SSL, and the parameters needed for termination at the web dispatcher.
    Cheers
    Jane

  • SSL for Reverse Proxy, webdispatcher and EP?

    We have a setup like:
    Reverse Proxy->webdispatcher->EP
    Do we need SSL for Reverse Proxy, webdispatcher and EP?
    If so, how to do it?
    Thanks!

    You don't need SSL because of the middleware architecture. It is recommended for the obvious security reasons (protect user credentials, protect sensitive content while in transmission, etc.).
    For performance reasons, I prefer not to have SSL encryption on the EP server, but instead offload it to other hardware. Ideally that's a network appliance, but you can use the Web Dispatcher instead.
    On the other hand, you have a reverse proxy as well. In some cases the reverse proxy is configured decrypting SSL traffic as well (e.g., to do packet inspection). If that is the case, there isn't much point in re-encrypting it before relaying to the Web Dispatcher, so that it can only decrypt it again. But if you reverse proxy is doing a "pass-through", the Web Dispatcher should decrypt it (in my opinion) to offload the EP server.

  • Enterprise portal access using reverse proxy using Apache and webdispatcher

    Hi Guys,
    As requirement, we need to give solution to customer about Reverse proxy scenario. I am new to this part.
    What we have think of to use Apache and Web dispatcher.
    I tried to search documents and found some sdn links also but still i am not comfortable to go about.
    Need suggestion and document if anyone has used so far.reverse proxy.
    As basis person, we need to do all ( Apache installation, Apache configuration, Web dispatcher installation and configuration, integration with EP.)
    It will helpful to me if i can get Apache installation, Apache configuration part and integration with EP, or web dispatcher, configuration etc.
    Thanks,
    Deepak

    We used Netscaler for Reverse Proxy implementation and can assure you that network team performed most of the set ups. This was on EP 7.01.
    From BASIS stand point it would be primarily Web Dispatcher Configuration.
    Also refer the links I specified in another thread. There are several scenarios discussed there -
    Re: Post values for userid and passowrd fields in logon page
    http://wiki.sdn.sap.com/wiki/display/BSP/Using+Proxies
    ~ Dhanz

  • Reverse Proxy - Apache vs SAP Web Dispatcher

    Hi,
    my config consists in a portal (EP7.0 - DB/CI + AS) and an ECC system (ECC 6.0 - DB/CI + AS).
    Web developments are based on Abap Web Dynpro and are also located on ECC.
    To ensure load balancing there are 2 web dispatchers : one on EP DB/CI, one on ECC DB/CI.
    Those 2 systems are located in intranet. Intranet access are realized via http.
    Moreover I need to open this solution to internet. I need a component to filter access in DMZ and ensure reverse proxy + https functions.
    Technical target chain links are depicted below.
    internet access : browser (https) -
    >  (https) reverse proxy in DMZ (http) -
    > IS (Portal/ECC)
    intranet access : browser (http) -
    > IS (portal/ECC)
    At the moment two application gateway solutions have been identified :
    Apache (MOD_PROXY + MOD_HTTPS) - My configuration is based on Linux
    SAP Web Dispatcher ("cascading" implementation as described in OSS note 740234)
    I'm looking for PROs and CONs of those 2 solutions and I'm also seeking for the impact of ensuring https encryption/decryption at the application gateway level ("a priori" this usage is not transparent in term of server sizing - CPU/memory, do I require to implement an SSL accelerator ?).
    Regards.
    Frederic.

    Hi,
    PRO Webdispatcher:
    - Supports SAP Java + ABAP
    - Loadbalancing of SAP applications (stateful)
    - Supports load balancing (saplb_* cookie)
    - Free of costs
    - easy to set up (up & running in 2 minutes)
    - Supports HA solutions out-of-the-box (process HA)
    - Filter + Rules to modify the requests
    CONS Webdispatcher
    - not a full reverse proxy
    - Limited functionality
    - one more server/solution (normaly, a company already does have a reverse proxy solution in place)
    - limited user base (only SAP customers)
    PRO Apache
    - free
    - widly in use
    - full reverse proxy
    - allows more complex filtering / rewriting
    - can be used for more web solutions, reuse of existing apache reverse proxy
    CONS Apache
    - does not support SAP load balancing (connection to the message server port for load distribution)
    - can be more complex to set up
    - SAP specific technology / problems are more harder to fix (ABAP, Stateful connections, sap_lb*)
    Short: both will server well as a reverse proxy.
    Rule of thumb: If you go for Apache or Web Dispatcher should mainly depend on you current IT landscape. If you already do have an apache in use, use Apache. You already have the people / knowledge, try to foster it .
    If you start from scratch and have SAP Logon Groups or many WebDynpro ABAP applications, go for the Web Dispatcher.
    br,
    Tobias

  • SAP Web Dispatcher for Portal reverse proxy

    Hi Experts,
    I am on EP6.0 SP20 and trying to use SAP web dispatcher as reverse proxy.
    I followed the below web log to configure the web dispatcher.
    [How to...Configure SAP Webdispatcher as a reverse proxy|How to...Configure SAP Webdispatcher as a reverse proxy]
    I still have some problems logging into the Portal through the web dispatcher.
    Web Dispatcher is in the DMZ not behind the firewall. We opened the port 80 only for Web dispatcher server.
    We are getting an error in the browser,
    http://<host of portal>.<domain name>:50000/irj/portal can not be recognized.
    I have no clue to how to get rid of this error. any help will be greatly appreciated.
    Regards,

    Hi,
    I do not know the exact ESS WebDynpro you are using but it may be possible that these WebDynpros use absolute URLs which of course do not point to the hostname and port of the Web Dispatcher.
    There are several ways to circumvent this:
    Please check http://help.sap.com/saphelp_nw04s/helpdata/en/62/5f374ff72c40478fcba2bb4fa79ddf/frameset.htm and add the parameters wdisp/add_client_protocol_header and (more important for you: wdisp/handle_webdisp_ap_header) to the WebDynpro configuration.
    (A nice explenation why we have to use this can be found here: https://www.sdn.sap.com/irj/sdn/wiki?path=/display/bsp/using+proxies&)
    another way would be to tell the J2EE engine directly that it is behind a WebDispatcher, by setting the ProxyMappings (http://help.sap.com/saphelp_nw70/helpdata/en/b8/437d46d4451e4c9ab756e272a1581d/frameset.htm)
    Regards,
    Holger.

  • Problem with Mobile clients - Reverse proxy

    Hi Guys,
    I have an issue that is driving me batty. I've set up a reverse proxy and am putting my mobile clients through it. I've used the Lync connectivity analyzer which is telling me that everything is good. However I am getting an error in my mobile clients to
    the effect "Please check your account info and try again"
    It looks like my IIS logs are showing 401 errors on the webticketservice.svc
    2014-05-30 00:48:01 192.168.0.58 GET / sipuri=sip:[email protected]&X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=0b8473bc-76f4-48e6-b29d-1028dad0dc2f 443 - 24.114.103.233 ACOMO - 200 0 0 93
    2014-05-30 00:48:01 192.168.0.58 GET / - 80 - 24.114.103.233 ACOMO - 406 0 0 62
    2014-05-30 00:48:01 192.168.0.58 GET /autodiscover/autodiscoverservice.svc/root/user originaldomain=openjive.com&X-ARR-LOG-ID=624d5656-03de-4d23-b7be-ef1d86f986ea 443 OPENJIVE\bryan 24.114.103.233 ACOMO - 401 0 0 72
    2014-05-30 00:48:01 192.168.0.58 GET /autodiscover/autodiscoverservice.svc/root/user originaldomain=openjive.com&X-ARR-LOG-ID=989d376d-f93d-4a61-a2e8-75e44a2f630e 443 OPENJIVE\bryan 24.114.103.233 ACOMO - 401 0 0 62
    2014-05-30 00:48:01 192.168.0.58 POST /webticket/webticketservice.svc/mex X-ARR-LOG-ID=96ab4698-b8bc-4ff6-829f-60bdd7e9d64e 443 OPENJIVE\bryan 24.114.103.233 ACOMO - 200 0 0 209
    2014-05-30 00:48:01 192.168.0.58 POST /webticket/webticketservice.svc X-ARR-LOG-ID=6884e7ec-01fa-4014-96ec-1e891fbb1c7e 443 OPENJIVE\bryan 24.114.103.233 ACOMO - 401 0 0 116
    2014-05-30 00:48:03 192.168.0.58 POST /webticket/webticketservice.svc X-ARR-LOG-ID=c4f2790c-983a-4d4f-b647-dc0c30d2335d 443 OPENJIVE\bryan 24.114.103.233 ACOMO - 401 0 0 84
    Any ideas would be appreciated. I am running windows 2012 R2 across the board. The reverse proxy is IIS 8.5 with ARR 3.

    Here is the connectivity analyzer results.
    Sending HTTP request to
    https://lyncdiscover.openjive.com/[email protected]
    Logging test parameters:
    SIP Uri: [email protected]
    User Name: openjive\bryan
    Discovery Type: Automatic Discovery
    Network access: NetworkAccessExternal
    Selected client: ApplicationLyncMobile2013
    Starting Lync server autodiscovery
    Please wait; this test may take several minutes to complete...
    Starting automatic discovery for secure (HTTPS) internal channel
    lyncdiscoverinternal.openjive.com can't be resolved by the DNS server. Skipping internal discovery.
    Starting automatic discovery for secure (HTTPS) external channel
    Cookie  found in autodiscover response: StatusCode: 200, ReasonPhrase: 'OK', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
      Pragma: no-cache
      X-MS-Server-Fqdn: banff.openjive.local
      X-Content-Type-Options: nosniff
      Cache-Control: no-cache
      Server: Microsoft-IIS/8.5
      X-AspNet-Version: 4.0.30319
      X-Powered-By: ASP.NET
      X-Powered-By: ARR/2.5
      X-Powered-By: ASP.NET
      Date: Fri, 30 May 2014 00:49:45 GMT
      Content-Length: 1049
      Content-Type: application/vnd.microsoft.rtc.autodiscover+xml; v=1
      Expires: -1
    Parsing the response for URL
    https://lyncdiscover.openjive.com/[email protected].  Full response: <?xml version="1.0" encoding="utf-8"?><AutodiscoverResponse xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    AccessLocation="External"><Root><Link token="Domain" href="https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/domain?originalDomain=openjive.com"
    /><Link token="User" href="https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/user?originalDomain=openjive.com"
    /><Link token="Self" href="https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root?originalDomain=openjive.com" /><Link
    token="OAuth" href="https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/oauth/user?originalDomain=openjive.com" /><Link
    token="External/XFrame" href="https://lyncweb.openjive.com/Autodiscover/XFrame/XFrame.html" /><Link token="Internal/XFrame" href="https://banff.openjive.local/Autodiscover/XFrame/XFrame.html"
    /><Link token="XFrame" href="https://lyncweb.openjive.com/Autodiscover/XFrame/XFrame.html" /></Root></AutodiscoverResponse>
    Autodiscover URL
    https://lyncdiscover.openjive.com/[email protected] redirected to
    https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/user?originalDomain=openjive.com
    Sending HTTP request to
    https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/[email protected]
    Cookie  found in autodiscover response: StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
      X-MS-WebTicketURL:
    https://lyncweb.openjive.com/WebTicket/WebTicketService.svc
      X-MS-WebTicketSupported: cwt,saml
      X-MS-Server-Fqdn: banff.openjive.local
      X-Content-Type-Options: nosniff
      Cache-Control: no-cache
      Server: Microsoft-IIS/8.5
      X-Powered-By: ASP.NET
      X-Powered-By: ARR/2.5
      X-Powered-By: ASP.NET
      WWW-Authenticate: Negotiate
      WWW-Authenticate: NTLM
      Date: Fri, 30 May 2014 00:49:45 GMT
      Content-Length: 1293
      Content-Type: text/html
    Authorization required for
    https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/[email protected]
    Obtaining WebTicket from
    https://lyncweb.openjive.com/WebTicket/WebTicketService.svc
    On-premises WebTicket server:
    https://lyncweb.openjive.com/WebTicket/WebTicketService.svc/Auth
    AcquireTicketAsync succeeded for
    https://lyncweb.openjive.com/WebTicket/WebTicketService.svc/Auth
    WebTicket: <saml:Assertion MajorVersion="1" MinorVersion="1" AssertionID="SamlSecurityToken-bf1eeeeb-c7b5-4d50-87df-929bf90bd370" Issuer="https://banff.openjive.local:4443/f0ca8325-b055-5552-be4f-fb4088f97387"
    IssueInstant="2014-05-30T00:52:05.151Z" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"><saml:Conditions NotBefore="2014-05-30T00:52:05.151Z" NotOnOrAfter="2014-05-30T08:49:30.151Z"><saml:AudienceRestrictionCondition><saml:Audience>https://lyncweb.openjive.com/</saml:Audience></saml:AudienceRestrictionCondition></saml:Conditions><saml:AuthenticationStatement
    AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified" AuthenticationInstant="2014-05-30T00:52:05.151Z"><saml:Subject><saml:NameIdentifier Format="sip:[email protected]</saml:NameIdentifier><saml:SubjectConfirmation><saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:holder-of-key</saml:ConfirmationMethod><KeyInfo">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/uri">sip:[email protected]</saml:NameIdentifier><saml:SubjectConfirmation><saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:holder-of-key</saml:ConfirmationMethod><KeyInfo
    xmlns="<e:EncryptedKey">http://www.w3.org/2000/09/xmldsig#"><e:EncryptedKey xmlns:e="<e:EncryptionMethod">http://www.w3.org/2001/04/xmlenc#"><e:EncryptionMethod
    Algorithm="</e:EncryptionMethod><KeyInfo><KeyName>f0ca8325-b055-5552-be4f-fb4088f97387:8d149b659ca1d29</KeyName></KeyInfo><e:CipherData><e:CipherValue>kE4cKJAJbZL3GFCEx3/XxiBO/nhVPZJ15xEIQk96DjkxRNgzgxlh+w==</e:CipherValue></e:CipherData></e:EncryptedKey></KeyInfo></saml:SubjectConfirmation></saml:Subject></saml:AuthenticationStatement><Signature">http://www.w3.org/2001/04/xmlenc#kw-aes256"></e:EncryptionMethod><KeyInfo><KeyName>f0ca8325-b055-5552-be4f-fb4088f97387:8d149b659ca1d29</KeyName></KeyInfo><e:CipherData><e:CipherValue>kE4cKJAJbZL3GFCEx3/XxiBO/nhVPZJ15xEIQk96DjkxRNgzgxlh+w==</e:CipherValue></e:CipherData></e:EncryptedKey></KeyInfo></saml:SubjectConfirmation></saml:Subject></saml:AuthenticationStatement><Signature
    xmlns="<SignedInfo><CanonicalizationMethod">http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="</CanonicalizationMethod><SignatureMethod">http://www.w3.org/2001/10/xml-exc-c14n#"></CanonicalizationMethod><SignatureMethod
    Algorithm="</SignatureMethod><Reference">http://www.w3.org/2000/09/xmldsig#rsa-sha1"></SignatureMethod><Reference URI="#SamlSecurityToken-bf1eeeeb-c7b5-4d50-87df-929bf90bd370"><Transforms><Transform
    Algorithm="</Transform><Transform">http://www.w3.org/2000/09/xmldsig#enveloped-signature"></Transform><Transform Algorithm="</Transform></Transforms><DigestMethod">http://www.w3.org/2001/10/xml-exc-c14n#"></Transform></Transforms><DigestMethod
    Algorithm="</DigestMethod><DigestValue>krqtSvw6JUlsbBsxdbXSsHyIgFzUD1G7DOKZ635AC4Q=</DigestValue></Reference></SignedInfo><SignatureValue>qo+GkTNnjyl250pQVkSSTCI707At83dn2zu1ZOSLoSlPF74FuzRgCysD5UPrgMvY5SYi+pi2igwEV7zt7ALtWFuAJWPU3e0mNT701xyO86+f11YtHXC/NhQDudJvq7DO3uWRGgZGdBodt82OyZlXKifplMgEE352y0+S4jy0GmKCpvHTbytUthInMSxSAp7UWcU+6ourkAj4NpLbSywgm4su6byHEZmZyJ1/6eZ6/xO3a395dxhlBoMbIs+Gk9zcQ75KL/VAy7WTcBq+kJ/16yfd9q73VzYO5NBSEgrOHW/xZuRUYusLyhSZ0AJTVaUUJuBi6XdG44kaP0Nsz9UTrw==</SignatureValue><KeyInfo><o:SecurityTokenReference">http://www.w3.org/2001/04/xmlenc#sha256"></DigestMethod><DigestValue>krqtSvw6JUlsbBsxdbXSsHyIgFzUD1G7DOKZ635AC4Q=</DigestValue></Reference></SignedInfo><SignatureValue>qo+GkTNnjyl250pQVkSSTCI707At83dn2zu1ZOSLoSlPF74FuzRgCysD5UPrgMvY5SYi+pi2igwEV7zt7ALtWFuAJWPU3e0mNT701xyO86+f11YtHXC/NhQDudJvq7DO3uWRGgZGdBodt82OyZlXKifplMgEE352y0+S4jy0GmKCpvHTbytUthInMSxSAp7UWcU+6ourkAj4NpLbSywgm4su6byHEZmZyJ1/6eZ6/xO3a395dxhlBoMbIs+Gk9zcQ75KL/VAy7WTcBq+kJ/16yfd9q73VzYO5NBSEgrOHW/xZuRUYusLyhSZ0AJTVaUUJuBi6XdG44kaP0Nsz9UTrw==</SignatureValue><KeyInfo><o:SecurityTokenReference
    xmlns:o="<o:KeyIdentifier">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><o:KeyIdentifier ValueType="AhJJ0tEVWf4IRNbKNKfDMD1Qyvg=</o:KeyIdentifier></o:SecurityTokenReference></KeyInfo></Signature></saml:Assertion">http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1">AhJJ0tEVWf4IRNbKNKfDMD1Qyvg=</o:KeyIdentifier></o:SecurityTokenReference></KeyInfo></Signature></saml:Assertion>
    Sending HTTP request to
    https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/[email protected]
    Cookie  found in autodiscover response: StatusCode: 200, ReasonPhrase: 'OK', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
      Pragma: no-cache
      X-MS-Server-Fqdn: banff.openjive.local
      X-Content-Type-Options: nosniff
      Cache-Control: no-cache
      Server: Microsoft-IIS/8.5
      X-AspNet-Version: 4.0.30319
      X-Powered-By: ASP.NET
      X-Powered-By: ARR/2.5
      X-Powered-By: ASP.NET
      Date: Fri, 30 May 2014 00:49:45 GMT
      Content-Length: 2111
      Content-Type: application/vnd.microsoft.rtc.autodiscover+xml; v=1
      Expires: -1
    Parsing the response for URL
    https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/[email protected].  Full response: <?xml version="1.0" encoding="utf-8"?><AutodiscoverResponse xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" AccessLocation="External"><User><SipServerInternalAccess fqdn="banff.openjive.local" port="5061" /><SipClientInternalAccess fqdn="banff.openjive.local"
    port="5061" /><SipServerExternalAccess fqdn="lyncedge.openjive.com" port="5061" /><SipClientExternalAccess fqdn="lyncedge.openjive.com" port="5061" /><Link token="Internal/Autodiscover" href="https://banff.openjive.local/Autodiscover/AutodiscoverService.svc/root"
    /><Link token="Internal/AuthBroker" href="https://banff.openjive.local/Reach/sip.svc" /><Link token="Internal/WebScheduler" href="https://banff.openjive.local/Scheduler"
    /><Link token="Internal/CertProvisioning" href="https://banff.openjive.local/CertProv/CertProvisioningService.svc" /><Link token="External/Autodiscover" href="https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root"
    /><Link token="External/AuthBroker" href="https://lyncweb.openjive.com/Reach/sip.svc" /><Link token="External/WebScheduler" href="https://lyncweb.openjive.com/Scheduler"
    /><Link token="External/CertProvisioning" href="https://lyncweb.openjive.com/CertProv/CertProvisioningService.svc" /><Link token="Internal/Mcx" href="https://lyncweb.openjive.com/Mcx/McxService.svc"
    /><Link token="External/Mcx" href="https://lyncweb.openjive.com/Mcx/McxService.svc" /><Link token="Ucwa" href="https://lyncweb.openjive.com/ucwa/v1/applications"
    /><Link token="Internal/Ucwa" href="https://banff.openjive.local/ucwa/v1/applications" /><Link token="External/Ucwa" href="https://lyncweb.openjive.com/ucwa/v1/applications"
    /><Link token="External/XFrame" href="https://lyncweb.openjive.com/Autodiscover/XFrame/XFrame.html" /><Link token="Internal/XFrame" href="https://banff.openjive.local/Autodiscover/XFrame/XFrame.html"
    /><Link token="XFrame" href="https://lyncweb.openjive.com/Autodiscover/XFrame/XFrame.html" /><Link token="Self" href="https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/user"
    /></User></AutodiscoverResponse>
    Server discovery has completed for https://lyncdiscover.openjive.com/.
    Autodiscover full response for URL https://lyncdiscover.openjive.com/ is <?xml version="1.0" encoding="utf-8"?><AutodiscoverResponse xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" AccessLocation="External"><User><SipServerInternalAccess fqdn="banff.openjive.local" port="5061" /><SipClientInternalAccess fqdn="banff.openjive.local"
    port="5061" /><SipServerExternalAccess fqdn="lyncedge.openjive.com" port="5061" /><SipClientExternalAccess fqdn="lyncedge.openjive.com" port="5061" /><Link token="Internal/Autodiscover" href="https://banff.openjive.local/Autodiscover/AutodiscoverService.svc/root"
    /><Link token="Internal/AuthBroker" href="https://banff.openjive.local/Reach/sip.svc" /><Link token="Internal/WebScheduler" href="https://banff.openjive.local/Scheduler"
    /><Link token="Internal/CertProvisioning" href="https://banff.openjive.local/CertProv/CertProvisioningService.svc" /><Link token="External/Autodiscover" href="https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root"
    /><Link token="External/AuthBroker" href="https://lyncweb.openjive.com/Reach/sip.svc" /><Link token="External/WebScheduler" href="https://lyncweb.openjive.com/Scheduler"
    /><Link token="External/CertProvisioning" href="https://lyncweb.openjive.com/CertProv/CertProvisioningService.svc" /><Link token="Internal/Mcx" href="https://lyncweb.openjive.com/Mcx/McxService.svc"
    /><Link token="External/Mcx" href="https://lyncweb.openjive.com/Mcx/McxService.svc" /><Link token="Ucwa" href="https://lyncweb.openjive.com/ucwa/v1/applications"
    /><Link token="Internal/Ucwa" href="https://banff.openjive.local/ucwa/v1/applications" /><Link token="External/Ucwa" href="https://lyncweb.openjive.com/ucwa/v1/applications"
    /><Link token="External/XFrame" href="https://lyncweb.openjive.com/Autodiscover/XFrame/XFrame.html" /><Link token="Internal/XFrame" href="https://banff.openjive.local/Autodiscover/XFrame/XFrame.html"
    /><Link token="XFrame" href="https://lyncweb.openjive.com/Autodiscover/XFrame/XFrame.html" /><Link token="Self" href="https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/user"
    /></User></AutodiscoverResponse>
    SendRequest failed for
    https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root/[email protected]
    Automatic discovery results for https://lyncdiscover.openjive.com/
    Access Location                          : External
    SIP Server Internal Access               : banff.openjive.local
    SIP Server External Access               : lyncedge.openjive.com
    SIP Client Internal Access               : banff.openjive.local
    SIP Client External Access               : lyncedge.openjive.com
    Internal Auth broker service             :
    https://banff.openjive.local/Reach/sip.svc
    External Auth broker service             :
    https://lyncweb.openjive.com/Reach/sip.svc
    Internal Auto discover service           :
    https://banff.openjive.local/Autodiscover/AutodiscoverService.svc/root
    External Auto discover service           :
    https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root
    Internal MCX service                     :
    https://lyncweb.openjive.com/Mcx/McxService.svc
    External MCX service                     :
    https://lyncweb.openjive.com/Mcx/McxService.svc
    Internal UCWA service                    :
    https://banff.openjive.local/ucwa/v1/applications
    External UCWA service                    :
    https://lyncweb.openjive.com/ucwa/v1/applications
    Internal Webscheduler service            :
    https://banff.openjive.local/Scheduler
    External Webscheduler service            :
    https://lyncweb.openjive.com/Scheduler
    Total server discovery time: 1.1 seconds
    Server discovery succeeded for secure (HTTPS) external channel against URL
    https://lyncdiscover.openjive.com/
    Starting automatic discovery for unsecure (HTTP) external channel
    Sending HTTP request to
    http://lyncdiscover.openjive.com/[email protected]
    Cookie  found in autodiscover response: StatusCode: 406, ReasonPhrase: 'Not Acceptable', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
      Date: Fri, 30 May 2014 00:49:45 GMT
      Server: Microsoft-IIS/8.5
      X-Powered-By: ASP.NET
      Content-Length: 1346
      Content-Type: text/html
    Autodiscover: SendRequest(): the URL
    http://lyncdiscover.openjive.com/[email protected] couldn't be connected.  Complete HTTP headers:\r\n Date: Fri, 30 May 2014 00:49:45 GMT
    Server: Microsoft-IIS/8.5
    X-Powered-By: ASP.NET
    Couldn't connect to URL
    http://lyncdiscover.openjive.com/[email protected] (HTTP status code NotAcceptable)
    System.Exception: Couldn't connect to URL
    http://lyncdiscover.openjive.com/[email protected] (HTTP status code NotAcceptable)
       at Microsoft.LyncServer.WebServices.AutoDiscoverManager.TerminateAD(String mesg)
       at Microsoft.LyncServer.WebServices.AutoDiscoverManager.<SendRequest>d__d.MoveNext()
    --- End of stack trace from previous location where exception was thrown ---
       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
       at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
       at Microsoft.LyncServer.WebServices.AutoDiscoverManager.<TryNextUrl>d__3.MoveNext()
    --- End of stack trace from previous location where exception was thrown ---
       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
       at Microsoft.LyncServer.WebServices.AutoDiscoverManager.<StartDiscoveryJourney>d__0.MoveNext()
    --- End of stack trace from previous location where exception was thrown ---
       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
       at LyncConnectivityAnalyzerCore.Utilities.<RetrieveUserLocation>d__3e.MoveNext()
    Server discovery failed for unsecured external channel against
    http://lyncdiscover.openjive.com/
    None, AutoInternalDNSFail, AutoInternalSecureD, AutoInternalUnsecureD, AutoExternalUnsecureD, ManualDNSFail, ManualSecureD, ManualUnsecureD, AuthBrokerInternalLMXCheckGET, AuthBrokerInternalLMXCheckPOST, AuthBrokerExternalLMXCheckGET, AuthBrokerExternalLMXCheckPOST,
    MobilityMCXInternalLMXCheckGET, MobilityMCXInternalLMXCheckPOST, MobilityMCXExternalLMXCheckGET, MobilityMCXExternalLMXCheckPOST, LMXSIPServerInternalDNS, LMXSIPServerExternalDNS, MobilityUCWAInternalCheckPOST, MobilityUCWAExternalCheckPOST
    Starting the requirement tests for Lync Mobile 2013 App
    Please wait; this test may take several minutes to complete...
    Testing the app requirements using the following discovery response:
    Access Location                          : External
    SIP Server Internal Access               : banff.openjive.local
    SIP Server External Access               : lyncedge.openjive.com
    SIP Client Internal Access               : banff.openjive.local
    SIP Client External Access               : lyncedge.openjive.com
    Internal Auth broker service             :
    https://banff.openjive.local/Reach/sip.svc
    External Auth broker service             :
    https://lyncweb.openjive.com/Reach/sip.svc
    Internal Auto discover service           :
    https://banff.openjive.local/Autodiscover/AutodiscoverService.svc/root
    External Auto discover service           :
    https://lyncweb.openjive.com/Autodiscover/AutodiscoverService.svc/root
    Internal MCX service                     :
    https://lyncweb.openjive.com/Mcx/McxService.svc
    External MCX service                     :
    https://lyncweb.openjive.com/Mcx/McxService.svc
    Internal UCWA service                    :
    https://banff.openjive.local/ucwa/v1/applications
    External UCWA service                    :
    https://lyncweb.openjive.com/ucwa/v1/applications
    Internal Webscheduler service            :
    https://banff.openjive.local/Scheduler
    External Webscheduler service            :
    https://lyncweb.openjive.com/Scheduler
    Starting tests for Mobility (UCWA) service
    UCWA user agent string: <input xmlns="<property">http://schemas.microsoft.com/rtc/2012/03/ucwa"><property name="culture">en-US</property><property name="endpointId">44:D8:84:3C:68:68</property><property
    name="type">Phone</property><property name="userAgent">LyncConnectivityAnalyzer/5.0.8308.582 (Windows OS 6.0)</property></input>
    Verifying external Ucwa service:
    https://lyncweb.openjive.com/ucwa/v1/applications
    On-premises WebTicket server:
    https://lyncweb.openjive.com/WebTicket/WebTicketService.svc/Auth
    AcquireTicketAsync succeeded for
    https://lyncweb.openjive.com/WebTicket/WebTicketService.svc/Auth
    WebTicket: <saml:Assertion MajorVersion="1" MinorVersion="1" AssertionID="SamlSecurityToken-cda8f5c3-dc31-46d1-b9ba-51fa49cffcd3" Issuer="https://banff.openjive.local:4443/f0ca8325-b055-5552-be4f-fb4088f97387"
    IssueInstant="2014-05-30T00:52:06.062Z" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"><saml:Conditions NotBefore="2014-05-30T00:52:06.062Z" NotOnOrAfter="2014-05-30T08:44:42.062Z"><saml:AudienceRestrictionCondition><saml:Audience>https://lyncweb.openjive.com/</saml:Audience></saml:AudienceRestrictionCondition></saml:Conditions><saml:AuthenticationStatement
    AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified" AuthenticationInstant="2014-05-30T00:52:06.062Z"><saml:Subject><saml:NameIdentifier Format="sip:[email protected]</saml:NameIdentifier><saml:SubjectConfirmation><saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:holder-of-key</saml:ConfirmationMethod><KeyInfo">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/uri">sip:[email protected]</saml:NameIdentifier><saml:SubjectConfirmation><saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:holder-of-key</saml:ConfirmationMethod><KeyInfo
    xmlns="<e:EncryptedKey">http://www.w3.org/2000/09/xmldsig#"><e:EncryptedKey xmlns:e="<e:EncryptionMethod">http://www.w3.org/2001/04/xmlenc#"><e:EncryptionMethod
    Algorithm="</e:EncryptionMethod><KeyInfo><KeyName>f0ca8325-b055-5552-be4f-fb4088f97387:8d149b659ca1d29</KeyName></KeyInfo><e:CipherData><e:CipherValue>HiaWvrXQLacT+brihMO3w2xV0JCWsOj2hQNAkbGkl1yuavEW5U2+yA==</e:CipherValue></e:CipherData></e:EncryptedKey></KeyInfo></saml:SubjectConfirmation></saml:Subject></saml:AuthenticationStatement><Signature">http://www.w3.org/2001/04/xmlenc#kw-aes256"></e:EncryptionMethod><KeyInfo><KeyName>f0ca8325-b055-5552-be4f-fb4088f97387:8d149b659ca1d29</KeyName></KeyInfo><e:CipherData><e:CipherValue>HiaWvrXQLacT+brihMO3w2xV0JCWsOj2hQNAkbGkl1yuavEW5U2+yA==</e:CipherValue></e:CipherData></e:EncryptedKey></KeyInfo></saml:SubjectConfirmation></saml:Subject></saml:AuthenticationStatement><Signature
    xmlns="<SignedInfo><CanonicalizationMethod">http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="</CanonicalizationMethod><SignatureMethod">http://www.w3.org/2001/10/xml-exc-c14n#"></CanonicalizationMethod><SignatureMethod
    Algorithm="</SignatureMethod><Reference">http://www.w3.org/2000/09/xmldsig#rsa-sha1"></SignatureMethod><Reference URI="#SamlSecurityToken-cda8f5c3-dc31-46d1-b9ba-51fa49cffcd3"><Transforms><Transform
    Algorithm="</Transform><Transform">http://www.w3.org/2000/09/xmldsig#enveloped-signature"></Transform><Transform Algorithm="</Transform></Transforms><DigestMethod">http://www.w3.org/2001/10/xml-exc-c14n#"></Transform></Transforms><DigestMethod
    Algorithm="</DigestMethod><DigestValue>9aGUpr6tQkHD1fj+o1gDZSFMpPp1HwnNjO9BmmGjA+Y=</DigestValue></Reference></SignedInfo><SignatureValue>jfleXw8Do6pavetwKPAGEEIezTJlJhF2UlnuNh04dK4FlCJMRowZbxHUyqUjTsCbjIdvVMhljsPrufsPwPd4v1ksvf8apfeVJ2zZZSyIqLLCjKW3Vus7X6DlBqZ+YB8rP1dGKleuH5E7kuk4asAc5XpzjoB3xvLf5cXp2hVvKuhwlDhqQp3dCIFnNCGPQLbqY+hek55uNcmyspJno13YbQ/fje/1CJxfwiN3M0o2dPskIMvOt1oqHlxn1zIeWm1lWkKd/ZDjchoWzmqiO67cbXuJpe7IrqwCx4WT7vHMkyHZznXB6D55pgPen94+h0Vwq75mWZeYBMIeXOM3t+7HnA==</SignatureValue><KeyInfo><o:SecurityTokenReference">http://www.w3.org/2001/04/xmlenc#sha256"></DigestMethod><DigestValue>9aGUpr6tQkHD1fj+o1gDZSFMpPp1HwnNjO9BmmGjA+Y=</DigestValue></Reference></SignedInfo><SignatureValue>jfleXw8Do6pavetwKPAGEEIezTJlJhF2UlnuNh04dK4FlCJMRowZbxHUyqUjTsCbjIdvVMhljsPrufsPwPd4v1ksvf8apfeVJ2zZZSyIqLLCjKW3Vus7X6DlBqZ+YB8rP1dGKleuH5E7kuk4asAc5XpzjoB3xvLf5cXp2hVvKuhwlDhqQp3dCIFnNCGPQLbqY+hek55uNcmyspJno13YbQ/fje/1CJxfwiN3M0o2dPskIMvOt1oqHlxn1zIeWm1lWkKd/ZDjchoWzmqiO67cbXuJpe7IrqwCx4WT7vHMkyHZznXB6D55pgPen94+h0Vwq75mWZeYBMIeXOM3t+7HnA==</SignatureValue><KeyInfo><o:SecurityTokenReference
    xmlns:o="<o:KeyIdentifier">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><o:KeyIdentifier ValueType="AhJJ0tEVWf4IRNbKNKfDMD1Qyvg=</o:KeyIdentifier></o:SecurityTokenReference></KeyInfo></Signature></saml:Assertion">http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1">AhJJ0tEVWf4IRNbKNKfDMD1Qyvg=</o:KeyIdentifier></o:SecurityTokenReference></KeyInfo></Signature></saml:Assertion>
    Successfully created the UCWA service
    Completed tests for Mobility (UCWA) service
    None, AutoInternalDNSFail, AutoInternalSecureD, AutoInternalUnsecureD, AutoExternalUnsecureD, ManualDNSFail, ManualSecureD, ManualUnsecureD, AuthBrokerInternalLMXCheckGET, AuthBrokerInternalLMXCheckPOST, AuthBrokerExternalLMXCheckGET, AuthBrokerExternalLMXCheckPOST,
    MobilityMCXInternalLMXCheckGET, MobilityMCXInternalLMXCheckPOST, MobilityMCXExternalLMXCheckGET, MobilityMCXExternalLMXCheckPOST, LMXSIPServerInternalDNS, LMXSIPServerExternalDNS, MobilityUCWAInternalCheckPOST
    Your deployment meets the minimum requirements for Lync Mobile 2013 App.

  • IIS Reverse Proxy and Basic Authentication

    Hi,
    we've currently put a WebAS 6.40 serving a BSP Application in our Appl-DMZ. For the access via Web the IIS Reverse Proxy is used, which works fine as long as you use a service for which a user is provided (in SICF). But if you don't provide a user in the service (in order to debug the BSP Application) you have to authenticate yourself using Basic Authentication (Browser Popup) which does not work (the popup returns and returns ...)
    I' ve browsed the forums and it seems that the IIS Reverse Proxy does not support (the forwarding) of Basic Authentication "requests".
    So my question, does someone exactly know if the IIS Reverse proxy supports Basic Authentication or not ?
    Thanks,
    Markus

    Hello Markus,
    1. have you checked out Alon Weinstein's Weblog <a href="/people/sap.user72/blog/2005/02/23/the-reverse-proxy-series--part-2-iis-as-a-reverse-proxy">The Reverse Proxy Series -- Part 2: IIS as a reverse-proxy</a>?
    2. Is the IIS a must? Can you give Apache or SAP Web Dispatcher a try. Prakash Singh wrote a Weblog <a href="/people/prakash.singh4/blog/2005/08/16/how-to-setup-webdispatcher-to-load-balance-portal-in-a-clustered-environment">How to setup webdispatcher to load balance portal in a clustered environment</a>.
    Regards
    Gregor

  • Define Reverse Proxy and Deffered Authentication Schema

    Hi Experts,
    Can some one help me with the Definition for "*Reverse Proxy in OAM*" and "Deffered Authentication Schema (*DAS*) in Directory server". And please quote one example for understanding.......
    Thanks in Advance.
    Sandy
    Edited by: sandyb4u on Oct 11, 2010 1:34 AM

    Hello Markus,
    1. have you checked out Alon Weinstein's Weblog <a href="/people/sap.user72/blog/2005/02/23/the-reverse-proxy-series--part-2-iis-as-a-reverse-proxy">The Reverse Proxy Series -- Part 2: IIS as a reverse-proxy</a>?
    2. Is the IIS a must? Can you give Apache or SAP Web Dispatcher a try. Prakash Singh wrote a Weblog <a href="/people/prakash.singh4/blog/2005/08/16/how-to-setup-webdispatcher-to-load-balance-portal-in-a-clustered-environment">How to setup webdispatcher to load balance portal in a clustered environment</a>.
    Regards
    Gregor

  • SSL /Reverse Proxy

    We have a ISA Server in DMZ which we want to use as reverse proxy for portal.
    does anyone have what configuration should i put in for ISA server.
    We installed sapwebdispatcher on portal server to do load balancing for portal dialog instances.portal is intended for ess/mss.
    On HCM server we also have webdispatcher .
    We are planning to terminate ssl at both webdispatcher(on portal and on hcm) .
    portal is portal.mycompany.com
    hcm is hcm.mycompany.com
    What should be the configuration for my system so that it points to sapwebdispatcher .
    ps. webdynpro is installed on hr as a j2ee addon.
    Regards,

    You probably want to use a real reverse proxy/load balancer. Take a look at the CSS.
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v8.10/configuration/ssl/guide/overview.html#wp999771

  • How to test the reversed proxy?

    Hi!
    Our company has a standard setup for our portal:
    Reversed Proxy <---  Webdispatcher  <---- Portal
    We want to test whether the setup is free of errors.
    Could you tell how to verify that?
    I'll give points. Thanks!
    Message was edited by:
            Laura Jones

    Hi Laura ,
    The question of yours is not clear to me .If at all are you looking for help regarding reverse proxy
    refer to this
    http://help.sap.com/saphelp_nw2004s/helpdata/en/43/2234ee0b413fe1e10000000a11466f/frameset.htm
    Thanx
    Pankaj

  • How do I use Sun Web Server 7.0u1 reverse proxy to change public URLs?

    Some of our installations use the Sun Web Server 7.0 (update 1, usually)
    for hosting some of the public resource and reverse-proxying other parts
    of the URI namespace from other backend servers (content, application
    and other types of servers).
    So far every type of backend server served a unique part of the namespace
    and there was no collision of names, and the backend resources were
    published in a one-to-one manner. That is, a backend resource like, say,
    http://appserver:8080/content/page.html would be published in the internet
    as http://www.publicsite.com/content/page.html
    I was recently asked to research whether we can rename some parts of
    the public URI namespace, to publish some or all resources as, say,
    http://www.publicsite.com/data/page.html while using the same backend
    resources.
    Another quest, possibly related in solution, was to make a tidy url for the
    first page the user opens of the site. That is, in the current solution when
    a visitor types the url "www.publicsite.com" in his or her browser, our web
    server returns an HTTP-302 redirect to the actual first page URL, so the
    browser sends a second request (and changes the URL in its location bar).
    One customer said that it is not "tidy". They don't want the URL to change
    right upon first rendering the page. They want the root page to be rendered
    instantly i the first HTTP request.
    So far I found that I can't solve these problems. I believe these problems
    share a solution because it relies on ability to control the actual URI strings
    requested by Sun Web Server from backend servers.
    Some details follow, now:
    It seems that the reverse proxy (Service fn="service-passthrough") takes
    only the $uri value which was originally requested by the browser. I didn't
    yet manage to override this value while processing a request, not even if
    I "restart" a request. Turning the error log up to "finest" I see that even
    when making the "service-passthrough" operation, the Sun Web Server
    still remembers that the request was for "/test" (in my test case below);
    it does indeed ask the backend server for an URI "/test" and that fails.
    [04/Mar/2009:21:45:34] finest (25095) www.publicsite.com: for host xx.xx.xx.83
    trying to GET /content/MainPage.html while trying to GET /test, func_exec reports:
    fn="service-passthrough" rewrite-host="true" rewrite-location="true"
    servers="http://10.16.2.127:8080" Directive="Service" DaemonPool="2b1348"
    returned 0 (REQ_PROCEED)My obj.conf file currently has simple clauses like this:
    # this causes /content/* to be taken from another (backend) server
    NameTrans fn="assign-name" from="/content" name="content-test" nostat="/content"
    # this causes requests to site root to be HTTP-redirected to a certain page URI
    <If $uri =~ '^/$'>
        NameTrans fn="redirect"
            url="http://www.publicsite.com/content/MainPage.html"
    </If>
    <Object name="content-test">
    ### This maps http://public/content/* to http://10.16.2.127:8080/content/*
    ### Somehow the desired solution should instead map http://public/data/* to http://10.16.2.127:8080/content/*
        Service fn="service-passthrough" rewrite-host="true" rewrite-location="true" servers="http://10.16.2.127:8080"
        Service fn="set-variable" set-srvhdrs="host=www.publicsite.com:80"
    </Object>
    I have also tried "restart"ing the request like this:
        NameTrans fn="restart" uri="/data"or desperately trying to set the new request uri like this:
        Service fn="set-variable"  uri="/magnoliaPublic/Main.html"Thanks for any ideas (including a statement whether this can be done at all
    in some version of Sun Web Server 7.0 or its opensourced siblings) ;)
    //Jim

    Some of our installations use the Sun Web Server 7.0 (update 1, usually)please plan on installing the latest service pack - 7.0 Update 4. these updates addresses potentially critical bug fixes.
    I was recently asked to research whether we can rename some parts of
    the public URI namespace, to publish some or all resources as, say,
    http://www.publicsite.com/data/page.html while using the same backend
    resources.> now, if all the resources are under say /data, then how will you know which pages need to be sent to which back end resources. i guess, you probably meant to check for /data/page.html should go to <back-end>/content/page.html
    yes, you could do something like
    - edit your corresponding obj.conf (<hostname>-obj.conf or obj.conf depending on your configuration)
    <Object name=¨default¨>
    <If $uri = ¨/page/¨>
    #move this nametrans SAF (for map directive - which is for reverse proxy within <if> clause)
    NameTrans.. fn=map
    </If
    </Object>
    and you could do https-<hostname>/bin/reconfig (dynamic reconfiguration) to check out if this is what you wanted. also, you might want to move config/server.xml <log-level> to finest and do your configuration . this way, you would get enough information on what is going on within your server logs.
    finally,when you are satisfied, you might have to run the following command to make your manual change into admin config repository.
    <install-root>/bin/wadm pull-config user=admin config=<hostname> <hostname>
    <install-root>/bin/wadm deploy-config --user=admin <hostname>
    you might want to check out this for more info on how you could use <if> else condition to handle your requirement.
    http://docs.sun.com/app/docs/doc/820-6599/gdaer?a=view
    finally, you might want to refer to this doc - which explains on ws7 request processing overview. this should provide you with some pointers as to what these different directives mean
    http://docs.sun.com/app/docs/doc/820-6599/gbysz?a=view
    >
    One customer said that it is not "tidy". They don't want the URL to change
    right upon first rendering the page. They want the root page to be rendered
    instantly i the first HTTP request.
    please check out the rewrite / restart SAF. this should help you.
    http://docs.sun.com/app/docs/doc/820-6599/gdada?a=view
    pl. understand that - like with more web servers - ordering of directives is very important within obj.conf. so, you might want to make sure that you verify the obj.conf directive ordering is what you want it to do..
    It seems that the reverse proxy (Service fn="service-passthrough") takes
    only the $uri value which was originally requested by the browser. I didn't
    yet manage to override this value while processing a request, not even if
    I "restart" a request. Turning the error log up to "finest" I see that even
    when making the "service-passthrough" operation, the Sun Web Server
    still remembers that the request was for "/test" (in my test case below);
    it does indeed ask the backend server for an URI "/test" and that fails.
    now, you are in the totally wrong direction. web server 7 includes a highly integrated reverse proxy solution compared to 6.1. unlike 6.1, you don´t have to download a separate plugin . however, you will need to manually migrate your 6.1 based reverse proxy settings into 7.0. please check out this blog link on how to set up a reverse proxy
    http://blogs.sun.com/amit/entry/setting_up_a_reverse_proxy
    feel free to post to us if you need any futher help
    you are probably better off - starting fresh
    - install ws7u4
    - use gui or CLI to create a reverse proxy and map one on one - say content
    http://docs.sun.com/app/docs/doc/820-6601/create-reverse-proxy-1?a=view
    if you don´t plan on using ws7 integrated web container (ability to process jsp/servlet), then you could disable java support as well. this should reduce your server memory footprint
    <install-root>/bin/wadm disable-java user=admin config=<hostname>
    <install-root>/bin/wadm create-reverse-proxy user=admin uri-prefix=/content server=<http://your back end server/ config=<hostname> --vs=<hostname>
    <install-root>/bin/wadm deploy-config --user=admin <hostname>
    now, you can check out the regular express processing and <if> syntax from our docs and try it out within <https-<hostname>/config/<hostname>-obj.conf> file and restart the server. pl. note that once you disable java, ws7 admin server creates <vs>-obj.conf and you need to edit this file and not default obj.conf for your changes to be read by server.
    >
    I have also tried "restart"ing the request like this:
    NameTrans fn="restart" uri="/data"
    ordering is very important here... you need to do this some thing like
    <Object name=default>
    <If not $restarted>
    NameTrans fn=restart uri from=/¨ uri=/foo.
    </If>

Maybe you are looking for

  • Exception while executing

    Hi Friends, When I run my application  i have got the following Exception while executing it: com.sap.tc.webdynpro.modelimpl.dynamicrfc.WDDynamicRFCExecuteException: Error connecting using JCO.Client: null What might be the problem. Is it that the JC

  • How can I use java on the web?

    hi I would like to learn about making websites using java?? do i have to learn about javascript or another type of java?? Im new in using java applet, threading and stuff like that :). And maybe I can make management systems in java language is this

  • Computer to smart tv

    Trying hookup my pc to smart tv. Problem is my computer is an all in one HP and only has isb ports. Will this even work or is there an adapter to go from hdmi to usb that will work ?

  • 0FI_AP_4 - Delta Extraction Problem - Please help

    Hi,      I activated the business content ODS 0FIAP_O03 and the relevant infosource for Accounts Payable and also did the init. In R/3 I created an Invoice using FB60 transaction and Posted the payment using F-53 transaction. I can see the document i

  • I can't sync calenders successfully

    Please help. I can't sync calenders successfully. I'm using Outlook on XP and syncing to iPhone via USB with no problems. Now have a lovely shiny new i Pad and am trying to sync that with the i phone over i Cloud. I seem to be ending up with either m