We have an issue trying to use SAP Security Session Management instead of SSO cookies.
We have Netweaver 7.02 SP11 and we are trying to allow the external HTTP callers to access system using SAP Session Management and session access token. However we are getting response "Session doesn't exist".
Details:
We have activated Security Session Management in our system and we deactivated SSO completely. Here are the relevant system parameters:
login/create_sso2_ticket = 0
login/accept_sso2_ticket = 0
login/ticketcache_entries_max = 1000
login/ticketcache_off = 0
login/ticket_only_by_https = 0
icf/set_HTTPonly_flag_on_cookies = 0
icf/user_recheck = 0
http/security_session_timeout = 1800
http/security_context_cache_size = 2500
rdisp/plugin_auto_logout = 1800
rdisp/autothtime = 60
(list comes from SICF_SESSIONS).
Also, in SICF_SESSIONS we have activated Security Session Management for our current client.
Then we have developed BSP application with controller. This BSP application authenticates user (employing standard authentication mechanisms of Netweaver) and then it prepares the URL to be called by external HTTP caller. Here is the code of DO_REQUEST method of the controller:
method DO_REQUEST.
data: lf_cntntype type string,
lf_mimetype type string.
lf_cntntype = skwhc_c_http_content_type.
lf_mimetype = 'text/plain'.
response->set_header_field( name = lf_cntntype value = lf_mimetype ).
data: lf_error type string.
lf_error = space.
data: lf_url_path type string.
lf_url_path = request->get_form_field( 'URL' ). "#EC NOTEXT
if lf_url_path is initial.
lf_error = 'URL is missing'.
else.
data: lf_stateful_path type string.
lf_stateful_path = lf_url_path.
CALL METHOD server->set_session_stateful_via_url
EXPORTING
stateful = server->co_enabled
CHANGING
rewrite_url = lf_stateful_path.
data: lf_token type string.
CALL METHOD server->enable_foreign_session_access
EXPORTING
url_path = lf_url_path
one_time_access_token = abap_false
IMPORTING
session_access_token = lf_token
EXCEPTIONS
url_path_is_not_supported = 1
session_is_not_stateful = 2
user_unknown = 3
internal_error = 4
others = 5.
if sy-subrc ne 0.
case sy-subrc.
when 1.
lf_error = 'Register failed with exception url_path_is_not_supported'.
when 2.
lf_error = 'Register failed with exception session_is_not_stateful'.
when 3.
lf_error = 'Register failed with exception user_unknown'.
when others.
lf_error = 'Register failed with exception internal_error'.
endcase.
endif.
endif.
if lf_error is not initial.
response->set_status( code = 501 reason = lf_error ).
write( 'Error processing the URL into token' ).
write( cl_abap_char_utilities=>cr_lf ).
write( lf_error ).
else.
write( lf_stateful_path ).
write( cl_abap_char_utilities=>cr_lf ).
write( lf_token ).
endif.
endmethod.
Method takes the parameter URL and adds the session context to the URL (changing the path from .../sap/bc... into .../sap(session-context-id)/bc...) and it also generates the access token for the URL. Both values are then returned with plain text mime type.
In SM05, we can see the session properly created.
When we use the URL with parameter SAP-SESSION_ACCESS_TOKEN, we get the response "400 Session timed out - please log in again".
When we check the HTTP trace (transaction SMICM), it says that the session "no longer exists". Here is the part of the trace file:
HttpSAPR3Handler: Call SAP AppServer for URI: /, java: 0
DpFindWebContext: check context T24/U6677/M0, 1,1
stat:1, use:1, len:40
DpFindWebContext: no context found, id=>8E0kZhnTPDBIF7G9rS7h8G3BC2ds1won9jev1MAg<
DTRACE(8/16774/2): {root-id=000C29D761591EE1B2B6BDFA0C1C0EEF}_{conn-id=000C29D761591EE1B2B6BDFA0C1C2EEF}_1
IcmFlushBuf: Flushing 847 Bytes, buf_status: 6
flush buffer with mpi buffer id 6
MPI<26b3>2b#12 FlushOutbuf 6 1 0 225560 919 6 -> 00000000079A55B0 MPI_OK
IcmCreateDpRequest: Send request to AppServer
IcmSendRq called with session key: SID:ANON:XXXXXX0090_YYY_00:8E0kZhnTPDBIF7G9rS7h8G3BC2ds1won9jev1MAg-ATT
DpFindWebContext: check context T24/U6677/M0, 1,1
stat:1, use:1, len:40
DpFindWebContext: no context found, id=>8E0kZhnTPDBIF7G9rS7h8G3BC2ds1won9jev1MAg<
IcmSendRq: Session not found for context id: SID:ANON:DEHDSV0090_D65_00:8E0kZhnTPDBIF7G9rS7h8G3BC2ds1won9jev1MA
MPI<26b3>2b#13 Cancel 7 -> MPI_OK
MPI<26b4>2c#14 Cancel 7 -> MPI_OK
HttpSrvHdlRequest: Error return: 701
IcmPlCheckRetVal: Plugin retval: PLUGIN_RET_ERROR (701)
IcmHandleNetRead(id=8/16774): read_len: 847, HandleNetData returned: 701
IcmHandleNetRead(id=8/16774): PlugInHandleNetData failed (rc=701)
MPI<26b3>2b#14 Cancel 7 -> MPI_OK
MPI<26b4>2c#15 Cancel 7 -> MPI_OK
PlugInStopConn: role: Server(1), error: -11, write_err: 1
PlugInStopConn: write error response
HttpPlugInWriteErrorText: return static error for "Session no longer exists" (-11)
HttpPlugInWriteErrorText: templ_path: D:\usr\sap\YYY\DVEBMGS00\data\icmandir/error_templ, err_idx: -1
ICT: IctIHttpOpenMessage: 0000000002E2E220 typ=2
Example of the calls:
- first we call
http://<host>:<port>/sap/bc/bsp/ztest/token.do?url=/sap/bc/bsp/ztest/token.do
The response is
sap(cz1TSUQlM2FBTk9OJTNhREVIRFNWMDA5MF9ENjVfMDAlM2E4RTBrWmhuVFBEQklGN0c5clM3aDhHM0JDMmRzMXdvbjlqZXYxTUFnLUFUVA==)/bc/bsp/ehr/ztest/token.do
c3N0PTIzQjE1NkVBQzlBNTU5NDY4RjhBREI3MERDMjRBMEYzMDAwQzI5RDc2MTU5MUVFMUIyQjZCOEEwMDhEQTBFRUY=
So we close browser, open it again and call
http://<host>:<port>/sap(cz1TSUQlM2FBTk9OJTNhREVIRFNWMDA5MF9ENjVfMDAlM2E4RTBrWmhuVFBEQklGN0c5clM3aDhHM0JDMmRzMXdvbjlqZXYxTUFnLUFUVA==)/bc/bsp/ztest/token.do?sap-session_access_token=c3N0PTIzQjE1NkVBQzlBNTU5NDY4RjhBREI3MERDMjRBMEYzMDAwQzI5RDc2MTU5MUVFMUIyQjZCOEEwMDhEQTBFRUY=
And the result is error page "400 Session timed out - please log in again"
The solution is described in OSS note 1420203 and we did all what's described there, but it still doesn't work.
Do you have any idea what's missing?