SAP security note 1676065, "Assertion ticket is not evaluated correctly". Below are the symptom and SAP recommended solution.
Description
Symptom
The Web AS Java accepts assertion tickets issued for other systems.
Solution
Update Web AS Java: apply the latest patch of the respective release as detailed in the "SP Patch Level" section of the note. Upgrade the stack: upgrade the entire stack to the latest Support Package available on the SAP Service Marketplace.
The new behavior is controlled by the UME property login.assertion.ticket.validate_recipient, which is set to true by default. This ensures that the Web AS Java rejects assertion tickets issued for other systems. It is strongly advised to keep this setting unchanged. However, if necessary, you can set it to false to revert to the old behavior.
Reason and prerequisites
Starting with the releases mentioned in this note, the Web AS Java will by default reject any assertion ticket that was not created specifically for itself, even if a valid trust relationship exists. This change enhances security by preventing potentially insecure assertion tickets from being accepted.
Side effects
This document references SAP Note 1669634 – FPN does not function when UME master system is configured, which may affect certain functionalities.
Full note on SAP: SAP Support Launchpad note 1676065
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].