No SessionIDRegeneration in CRM Web Channel B2C/B2B Scenario, SAP security note 1492234

SAP security note 1492234, "No SessionIDRegeneration in CRM Web Channel B2C/B2B Scenario". Below are the symptom and SAP recommended solution.

Description

Symptom

To add support for SessionIDRegeneration, the UME session authentication must be used in B2C/B2B and ICSS_B2C/ICSS_b2B scenarios of CRM Web Channel.

Solution

• Enable Session Authentication: set the Session Auth Switch to true in both application and scenario configurations to enable the session authentication feature.
• Configure UME User: create a UME user in the UME/Identity Management of the Application Server Java, using a ‘Technical User’ without assigning any roles to prevent password changes, and set a secure Session Auth Password.
• Maintain Configuration: update the Application Configuration in XCM > General Application Settings > Customer > application_security > application_security_config, and the Scenario Configuration in XCM > Components > Customer > scenario_security, assigning it to the customer’s application scenario_security_data parameter.
• Outcome: after successful login, the application checks the session auth switch values; if enabled, it authenticates using UME credentials and generates a JSESSIONMARKID cookie.
• Solving side effects: addresses internal structure changes for XCM settings.
• Potential side effects: may cause login issues with the technical user for SessionIDRegeneration.

Reason and prerequisites

This issue arises due to missing functionality related to session authentication in the specified scenarios.