HTTPS SICF services over HTTP Webdispatcher

[Former Member]

Hi !

We have the below setup:

External World (HTTPS request) --> F5 --> HTTP request to Web dispatcher --> HTTP request to SAP

Thus, the Web dispatcher works only on HTTP<-->HTTP.

The issue is there are some services in SRM, like ros_ext for SLC, which work only on HTTPS.

Thus, these services pose a problem since the Web dispatcher does not support HTTPS.

There is a way to change them to HTTP in SE80, but that requires access keys & changes in multiple places (which we want to avoid).

Please kindly help advise how to get over this issue.

Thanks a lot !

saba.

[isaias_freitas · Accepted solution]

Hello Saba,

I believe that the best solution for this is to make your F5 add the following HTTP header:

• HTTP header name: clientprotocol
• Value: the protocol used by the end user to reach the F5

Then, the ABAP will know that there is "something in front" of it that is terminating the HTTPS.

Regards,

Isaías

[Former Member · Accepted solution]

Thanks a lot, Isaias !

We modified the iRule to insert “https” into the clientprotocol header on the F5; however, we now see a 503 service unavailable response.

Is this because its traversing through the "HTTP" only webdispatcher ?

Any help would be super welcome.....

I see the below errors in the Webdispatcher logs too:

IcrFindTargetSystem: No system found for addr: <SAP WD>:<SRM WD Port> url: /ros_ext

Please help...

Thanks a lot !

-s.

[isaias_freitas · Accepted solution]

Can you add a screenshot of the 503 error?

Regards,

Isaías

[Former Member · Accepted solution]

Hello Isaías,

Thanks a lot for your help...so sorry I couldn't reply earlier...

This is what we see now:

Port 77 is the SRM port defined on the WD for SRM & on the F5 too.

This service (since it needs HTTPS) is jumping to port 44321 (the SRM SMICM HTTPS port), thus resulting in a Page cannot be displayed message.

It should stay on port 77 & use the HTTPS certificate provided by the F5 instead.

The thing is we don't have regular F5 expertise...thus, please can you kindly let me know exactly what needs to be done on the F5 to get past this...

Thanks a lot for your help !

Happy Wednesday

-s.

[isaias_freitas · Accepted solution]

Hello Saba,

You're welcome!

Did the hostname remain the same? The F5 hostname?

It was only the port that changed?

Happy Wednesday to you too!

Isaías

[Former Member · Accepted solution]

Hi !

Yes, the F5 name remained intact, only the port changed...please please please help

Thanks a ton !

-s.

[isaias_freitas · Accepted solution]

What is "behind" the Web Dispatcher?

Only the SRM? Or is there a Portal as well?

[isaias_freitas · Accepted solution]

Just sharing the solution with the community.

Saba opened an incident at SAP and I was assigned to it .

The landscape was:

Hardware load balancer -> Web Dispatcher -> Portal -> SRM

The SRM service (transaction SICF) "/sap/bc/bsp/sap/SRMSUS" was configured to require HTTPS.

The final solution was:

1. Configure the hardware load balancer ("HW LB") to add the HTTP header "clientprotocol".

1.1) If the end user reached the HW LB through HTTP, it is supposed to add the HTTP header "clientprotocol: http"; or

1.2 If the end user reached the HW LB through HTTPS, it is supposed to add the HTTP header "clientprotocol: https".

2) During the troubleshooting we also added entries to the HTTPURLLOC table, at the SRM. I believe that these are not required anymore.

Cheers!

Isaías

[Former Member · Accepted solution]

Thanks a lot for all the superb help, Isaias

We finally managed to get the page working after installing a self signed certificate on the WD & setting the WD to accept HTTPS requests.

Thanks again !

saba.