ABAP HTTP security session management, SAP security note 1322944

SAP security note 1322944, "ABAP: HTTP security session management", is a faq note released on 14.12.2010. Below is the SAP recommended solution.

Description

Solution

A security session is established between an HTTP client and an HTTP server (ABAP: logical system) as a result of a successful logon and ends upon logoff. The session ID is stored in a security context on the server and is transferred using a non-persistent cookie. This allows web applications to authenticate without requiring repeated logons, provided the existing session meets the application’s authentication requirements.

• Reauthentication: if an application requires different authentication data, reauthentication is necessary, updating the security context and generating a new session ID.
• Differences from Logon Tickets (MYSAPSSO2): security sessions are system-specific (client-specific); sessions can be ended by the server based on inactivity; activation allows FORM-based logon even without logon tickets, permitting SERVICE/SYSTEM type users.
• SAP NetWeaver Portal users should implement correction instructions in Note 1471069 before activating security session management to ensure complete logoff from the portal.
• Profile parameter icf/user_recheck: when HTTP security session management is active, this parameter behaves as if set to 1, enhancing compatibility with one-time token logon procedures like SAML.

This document may cause changes in session management behavior affecting related applications. It interacts with ABAP security sessions and SUSR_INTERNET_USERSWITCH (Note 1436525).

Reason and prerequisites

To use HTTP security session management, you require AS ABAP 7.0 as of Enhancement Package 2 (SAP_BASIS 7.02), or AS ABAP 7.2 (SAP_BASIS 7.20) and subsequent releases.

• SICF_SESSIONS: Activate/deactivate HTTP security session management for each logical system (ABAP client).
• SM05: Overview of all currently available (cross-server) security contexts, similar to SM04 for server-specific application contexts.

References

• User Mapping in the portal with BSP applications (Note 754868)
• Security Sessions / Application Sessions – and timeouts (Note 1899896)
• Security Session cleared too early or too late (UTC) (Note 1748493)