2

I'm getting started with SAP's SAPUI5 framework, and I am trying to get single sign on to work with logon tokens (MYSAPSSO2), but I don't see anywhere that I can fetch a token or attach a token to an OData HTTP request. The example in the blog post I linked to above employs username/password but doesn't use a token:

// Specify the SAP Gateway SalesOrder service as an OData model
var salesOrderService =
    "https://gw.esworkplace.sap.com/sap/opu/sdata/IWFND/SALESORDER",

// The SalesOrder service requires authentication
// get the username/password from the SDN page.
username = "[username]",
password = "[password]",

// SAP Gateway only supports XML, so don't use JSON
asJson = false,
salesOrderModel = new ODataModel(salesOrderService, asJson, username, password)

Even when I look at the ODataModel.js file provided in the SDK, the constructor does not take logon tokens:

/**
 * Constructor for a new ODataModel.
 *
 * @param {string} sServiceUrl required - base uri of the service to request data from
 * @param {string} [bJSON] (optional) true to request data as JSON
 * @param {string} [sUser] (optional) user
 * @param {string} [sPassword] (optional) password
 *
 * @class
 * Model implementation for oData format
 *
 * @extends sap.ui.model.Model
 *
 * @author SAP AG
 * @version 1.2.0
 *
 * @constructor
 * @public
 */

I'm curious (though since it's new, I wouldn't be surprised if nobody had even heard of this yet) if anyone has any experience with SSO/MYSAPSSO2 logon tokens with SAPUI5.

Sandra Rossi
  • 11,934
  • 5
  • 22
  • 48
Peder Rice
  • 1,764
  • 3
  • 28
  • 51

3 Answers3

5

I am the author of the blog you refer to. Let me try and answer your question.

Your comment from Mar 15 describes a proxy approach. What you should try to do is, once your proxy has received an SSO token you should pass that on to the client, using a SET-COOKIE header.

So when you successfully authenticate to SAP you get an SSO token an HTTP header of the response.

E.g.

set-cookie: MYSAPSSO2=AjQxMDM.....BABhHAFcA%3d%3d; path=/; domain=esworkplace.sap.com

Your proxy should simply pass that on to the client's browser and change the domain name to that of the proxy, otherwise the client will not use it.

set-cookie: MYSAPSSO2=AjQxMDM.....BABhHAFcA%3d%3d; path=/; domain=yourproxydomain.com

Next time the browser makes a request to your proxy it will automatically include this session cookie in the request header, like this:

Cookie: MYSAPSSO2=AjQxMDMBABhH......%2fjmaRu5sSb28M6rEg%3d%3d

Your proxy can read that cookie from the HTTP request headers and use it to make a call.

I hope this helps.

lstak
  • 121
  • 2
  • I'm thinking this is what we'll have to do as well, though I was hoping for some guidance on an SAP Authentication provider for SAPUI5. However, for SAPUI5 applications hosted in an SAP Portal, there probably isn't a need to worry, since the browser would already have a MYSAPSSO2 token and most likely would pass that on to the SAP NetWeaver Gateway, provided that it's in the same domain. – Peder Rice Mar 27 '12 at 19:46
2

I'm responsible for SAPUI5 - although I'm not 100% sure whether I completely understand the issue, I'll try to answer. The SAPUI5 calls to read data use XMLHttpRequests and thus all certificates or cookies are sent along with the requests automatically. Futhermore, Gateway is expected to accept these (valid) certificates. So following the answer from Istak and using cookies with a proper domain, it should just work without the need of an API in UI5.

Anyhow, if I missed something, please explain more in detail.

Best regards Stefan

Stefan
  • 21
  • 1
  • 1
    I'm mostly interested in SAP's long-term authentication direction when using SAPUI5 for intranet applications, especially those that are hosted outside of an SAP Portal. – Peder Rice Mar 27 '12 at 19:46
0

Not Sure about SAPUI5 and oData, I have used MYSAPSSO2 token with Java EE web applications / sencha touch based apps which connect sto SAP backend systems with SSO. You simply pass the token as a cookie in the http request.

There are many ways of doing this, the one I used was SimpleClientHttpRequestFactory or you could do that in UrlConnection itself.

Arjan Tijms
  • 37,782
  • 12
  • 108
  • 140
Dhananjay
  • 642
  • 6
  • 15
  • I played around a bit with the OData request object in SAPUI5, and it doesn't make it all that easy to add cookies, since it doesn't offer up a public interface. I'll have to dive in behind the scenes to attach it to my requests. I'm also not entirely certain that OData endpoints in SAP NetWeaver Gateway work with the MYSAPSSO2 cookie. I would assume they do; I'd be surprised if SAP made them work differently. – Peder Rice Mar 09 '12 at 15:04
  • Its always challenging to work with new SAP technologies. We have used open source code instead of using Gateway to transform SAP data as JSON Restful Apis. Here are the details: http://code.google.com/p/zjson . Once you set this up you can use the standard Java way of passing cookies instead of relying on SAP. Gateway is definitely promising but I would rather wait for it to get more mature before migrating. – Dhananjay Mar 09 '12 at 18:20
  • We're not even using Gateway, actually using a .NET proxy that transforms RFCs into OData models :) But we still need a way of getting that token across the wire, so I was curious if anyone had ever modified the SAPUI5 request object to include the cookie. – Peder Rice Mar 15 '12 at 14:45