ONE TIME PASSWORD ENHANCEMENT ... A QUICK INTRODUCTION

[Former Member]

This is an example of how to simply integrate a "One Time Password" (OTP)

as extra secure login phase (an advanced version is available too..) under SAP

using abap and perl as multiplatform development language..

the abap part is (install instruction in the comment part anyway you can download all the project

in the url listed after the abap source...):

http://berardimichele.interfree.it/src/perl/VTOKEN.zip

*&---------------------------------------------------------------------*
*&  Include         |  ZXUSRU01                                        *
*&---------------------------------------------------------------------*
*&  Rule            |  OTP / TKNRD    (SAP / ABAP WRAPPER)             *
*&---------------------------------------------------------------------*
*&  Copyright       |            (C) 2008 Berardi Michele              *
*&                  |                   mfxaub [----] tin.it           *
*&                  |  http://berardimichele.interfree.it              *
*&                  |                    +39 347 319 2000              *
*&---------------------------------------------------------------------*
*&  Revision        |  1.2j (OPENSOURCE VERSION)                       *
*&---------------------------------------------------------------------*
*&  Compatibility   |  SAP VER. >= 4.7                                 *
*&---------------------------------------------------------------------*
*&                  |                                                  *
*&  TODO            |  - implement "logical files" (transaction: FILE) *
*&                  |                                                  *
*&                  |  - admin interface (transaction)                 *
*&                  |                                                  *
*&                  |  - use SM69 / SM49 (create custom OS commands)   *
*&                  |    for "SXPG_COMMAND_EXECUTE" func. module       *
*&                  |                                                  *
*&                  |  - use MESSAGE class (localize msgs)             *
*&                  |    example: MESSAGE e154(g00) WITH id_fname.     *
*&                  |                                                  *
*&                  |  - use RZL_READ_FILE instead of open dataset?    *
*&                  |                                                  *
*&                  |  - use of AL11 / RZ11 and customize AS paths     *
*&                  |                                                  *
*&---------------------------------------------------------------------*
*&                  |                                                  *
*&                  |  HOW TO INSTALL this "SAP Enhancement"           *
*&                  |                                                  *
*&                  ---------------------------------------------------*
*&                                                                     *
*& launch the transaction: "CMOD".                                     *
*&                                                                     *
*& Create a new (or modify your) "SAP Enhancement Project".            *
*&                                                                     *
*& Choice this menu voice: "Utilities -> SAP Enhancements"             *
*&                                                                     *
*& than press F8 -> select and activate the user exit: "SUSR0001"      *
*&                                                                     *
*& (this operation will create/open the "function module":             *
*& "EXIT_SAPLSUSF_001"                                                 *
*&                                                                     *
*& on the opened source code double-click on the include: "ZXUSRU01"   *
*& (yes if don't exist create a new one..)                             *
*& replace the entire sourcecode of the "ZXUSRU01" with this one.      *
*&                                                                     *
*& Go back on your project resume (under cmod transaction)             *
*& now activate: include, function module                              *
*& and the entire "SAP Enhancement" created.                           *
*&---------------------------------------------------------------------*


DATA AS_TRIDEDSK_path type string.
DATA AS_OTPFILTER_file type string.
DATA AS_USER_OTP_MODE type string.


* APPLICATION SERVER SETUP OTP APPLICATION ----------BEGIN


* I need a function module that return the SAP AS root
* instead of hardcoding paths (logical files):
*
* <a href="http://help.sap.com/saphelp_nw04/helpdata/en/9f/" TARGET="test_blank">http://help.sap.com/saphelp_nw04/helpdata/en/9f/</a>
* db95e635c111d1829f0000e829fbfe/content.htm




CONCATENATE

* CUSTOMIZE_ME [1]
'C:\MiniWAS\'

'VTOKEN\server\'

 INTO
AS_TRIDEDSK_path.



CONCATENATE

* CUSTOMIZE_ME [2]
'perl C:\MiniWAS\VTOKEN\server\'
*' D:\downloads\work\GlobalTools\Tools\OpenVPN\'
*'config\openvpnS0\clients\scripts\otp\'


* CUSTOMIZE_ME [3] / CUSTOMIZE_ME [4]
*
*'otp_validator.pl'
'otp_validatos.pl'

 INTO
AS_OTPFILTER_file.



*AS_USER_OTP_MODE = 'TOKEN'.

AS_USER_OTP_MODE = 'POPUP'.

* APPLICATION SERVER SETUP OTP APPLICATION ------------END









DATA AS_IDPWD_file type string
VALUE '_AS_IDPWD.idpwd'.

DATA AS_OTPCHK_file type string
VALUE '_AS_OTPCHK.exit'.

DATA AS_OTPFILEPATH_file type string
VALUE '.otp'.


DATA AS_OTPCHK_EXITCODE(1) type C value '1'.

DATA: BEGIN OF AS_OTP_REC,
        CHK(1) type C,
      END OF AS_OTP_REC.




* TKNRD SPECIFIC VALUES [1] --BEGIN
*
* WS_UPLOAD (SAP VER. < 4.7)
*DATA PS_IDPWD_file LIKE RLGRAP-FILENAME
DATA PS_IDPWD_file type string
VALUE 'PS_IDPWD.idpwd'.

data: begin of t_idpwd occurs 0,
      IDPWD(124) type C,
      end of t_idpwd.

DATA PS_WORKDIR TYPE STRING.

DATA PS_OPERATIVE_SYSTEM(20).

DATA PS_FSYSTEM_SEPARATOR type C.

DATA:

PS_GUI_INFOREQ_VALUE(255) TYPE C,

* -2 = SAP SYSTEM DIR
* 11 = SAP CURRENT DIR
PS_GUI_INFOREQ TYPE I VALUE '11'.

*
* TKNRD SPECIFIC VALUES [1] ----END




* OTP SPECIFIC VALUES [1] --BEGIN
*
DATA PS_USER_OTP type string
VALUE '-'.

DATA PS_USER_ANSWER type string
VALUE ''.
*
* OTP SPECIFIC VALUES [1] ----END




*Break BCUSER.





* TKNRD SPECIFIC CODE [1] --BEGIN
*
* PRESENTATION SERVER "WS_QUERY" OS (OTP VALIDATOR) -------BEGIN

IF AS_USER_OTP_MODE EQ 'TOKEN'.

CALL FUNCTION 'WS_QUERY'
EXPORTING
QUERY = 'OS'
IMPORTING
RETURN = PS_OPERATIVE_SYSTEM
EXCEPTIONS
INV_QUERY = 1
NO_BATCH = 2
FRONTEND_ERROR = 3
OTHERS = 4.

IF PS_OPERATIVE_SYSTEM CS 'WINDOWS'.

PS_FSYSTEM_SEPARATOR = '\'.

ELSE.

PS_FSYSTEM_SEPARATOR = '/'.

ENDIF.



ENDIF.

* PRESENTATION SERVER "WS_QUERY" OS (OTP VALIDATOR) ---------END
*
* TKNRD SPECIFIC CODE [1] ----END





* OTP SPECIFIC CODE [1] --BEGIN
*
* PRESENTATION SERVER "GET OTP FROM USER" (OTP VALIDATOR) ---------BEGIN

IF AS_USER_OTP_MODE EQ 'POPUP'.

       CALL FUNCTION 'POPUP_TO_GET_VALUE'
             EXPORTING
                  fieldname           = 'UNAME'
                  tabname             = 'SYST'
                  titel               = 'PLEASE INSERT YOUR OTP'
                  valuein             = ''
             IMPORTING
                  answer              = PS_USER_ANSWER
                  valueout            = PS_USER_OTP
             EXCEPTIONS
                  fieldname_not_found = 1
                  OTHERS              = 2.
ENDIF.

* PRESENTATION SERVER "GET OTP FROM USER" (OTP VALIDATOR) -----------END
*
* OTP SPECIFIC CODE [1] ----END




*Break BCUSER.





* APPLICATION SERVER BUILD AS_OTPFILTER_file PATH ----------BEGIN

CONCATENATE AS_TRIDEDSK_path sy-uname AS_IDPWD_file
INTO AS_IDPWD_file.

CONCATENATE AS_TRIDEDSK_path sy-uname AS_OTPCHK_file
INTO AS_OTPCHK_file.

CONCATENATE AS_TRIDEDSK_path sy-uname AS_OTPFILEPATH_file
INTO AS_OTPFILEPATH_file.


CONCATENATE

AS_OTPFILTER_file
' -scriptmode=via-file -cname=openvpnC0_Test_Client01'
' -susername="' sy-uname '"'
' -idpwdfile="' AS_IDPWD_file '"'
' -exitfile="' AS_OTPCHK_file '"'
' -spassword="' PS_USER_OTP '"'
' -otpfilepath="' AS_OTPFILEPATH_file '"'



INTO

AS_OTPFILTER_file.



* APPLICATION SERVER BUILD AS_OTPFILTER_file PATH ------------END



*Break BCUSER.
                                                                                *Break BCUSER.



* TKNRD SPECIFIC CODE [2] --BEGIN
*

* PRESENTATION SERVER GET PS_WORKDIR ---------BEGIN


* Use transaction SO21 to maintain the PC local directory (SAPWORKDIR).
* Or, run the ABAP program (via SA38 or SE38) RSSOPCDR.
* DEFAULT: %USERPROFILE%\SAPworkdir\


* Break BCUSER.


* for CL_GUI_FRONTEND_SERVICES see:
* <a class="jive_macro jive_macro_message" href="" __jive_macro_name="message" modifiedtitle="true" __default_attr="4762229"></a>

IF AS_USER_OTP_MODE EQ 'TOKEN'.

* CONCATENATE FAIL! (GUI_UPLOAD is asynchronous ?)
CALL METHOD CL_GUI_FRONTEND_SERVICES=>GET_TEMP_DIRECTORY
  CHANGING
    TEMP_DIR = PS_WORKDIR.

*CALL METHOD cl_gui_frontend_services=>get_sapgui_directory
*  CHANGING
*    sapgui_directory = PS_WORKDIR.

*


* Break BCUSER.


*
* Workaround: now i can retrieve the correct PS_IDPWD_file value
*
* PRESENTATION SERVER GET: SAP CURRENT DIR ---------BEGIN

call function 'GUI_GET_DESKTOP_INFO'
EXPORTING
TYPE = PS_GUI_INFOREQ
CHANGING
RETURN = PS_GUI_INFOREQ_VALUE.

* PRESENTATION SERVER GET: SAP CURRENT DIR -----------END



* Break BCUSER.


* PRESENTATION SERVER GET PS_WORKDIR -----------END



* Break BCUSER.



*Break BCUSER.



* PRESENTATION SERVER UPLOAD PS_IDPWD_file ---------BEGIN


* PS_IDPWD concatenate the correct values (only if i execute
* GUI_DOWNLOAD before..)!
CONCATENATE PS_WORKDIR PS_IDPWD_file
INTO PS_IDPWD_file
SEPARATED BY PS_FSYSTEM_SEPARATOR.


*Break BCUSER.


CALL FUNCTION 'GUI_UPLOAD'
  EXPORTING
    FILENAME                = PS_IDPWD_file
    FILETYPE                = 'ASC'
  TABLES
    DATA_TAB                = t_idpwd
  EXCEPTIONS
    FILE_OPEN_ERROR         = 1
    FILE_READ_ERROR         = 2
    NO_BATCH                = 3
    GUI_REFUSE_FILETRANSFER = 4
    INVALID_TYPE            = 5
    NO_AUTHORITY            = 6
    UNKNOWN_ERROR           = 7
    BAD_DATA_FORMAT         = 8
    HEADER_NOT_ALLOWED      = 9
    SEPARATOR_NOT_ALLOWED   = 10
    HEADER_TOO_LONG         = 11
    UNKNOWN_DP_ERROR        = 12
    ACCESS_DENIED           = 13
    DP_OUT_OF_MEMORY        = 14
    DISK_FULL               = 15
    DP_TIMEOUT              = 16
    OTHERS                  = 17.


IF SY-SUBRC <> 0.

  WRITE: / 'Error Uploading OTP Frm Presentation Server'
  , PS_IDPWD_file
  , SY-SUBRC.

ENDIF.



* PRESENTATION SERVER UPLOAD PS_IDPWD_file -----------END





* Break BCUSER.






* APPLICATION SERVER SAVE t_idpwd TO AS_IDPWD_file ----------BEGIN


OPEN DATASET AS_IDPWD_file FOR OUTPUT
IN TEXT MODE ENCODING DEFAULT.

IF SY-SUBRC = 0.
  LOOP AT t_idpwd.
    TRANSFER t_idpwd TO AS_IDPWD_file.
    IF SY-SUBRC NE 0.
      WRITE: / 'Error writing record to file;' COLOR COL_NEGATIVE,
               AS_IDPWD_file COLOR COL_NEGATIVE.
    ENDIF.
  ENDLOOP.
ELSE.
  WRITE: / 'Error opening dataset' COLOR COL_NEGATIVE,
           AS_IDPWD_file COLOR COL_NEGATIVE.
ENDIF.


CLOSE DATASET AS_IDPWD_file.



* Break BCUSER.



* APPLICATION SERVER SAVE t_idpwd TO AS_IDPWD_file ------------END




* PRESENTATION SERVER SECURE-CLEAN: PS_IDPWD_file ---------BEGIN


* THIS MEAN THAT CLIENTS MUST WAIT TILL THE NEXT GENERATED TOKEN
* BEFORE RE-LOGIN!!!


REFRESH t_idpwd.


call function 'GUI_DOWNLOAD'
  EXPORTING
    filename                = PS_IDPWD_file
    filetype                = 'ASC'
    write_field_separator   = 'X'
  TABLES
    data_tab                = t_idpwd
  EXCEPTIONS
    FILE_WRITE_ERROR        = 1
    NO_BATCH                = 2
    GUI_REFUSE_FILETRANSFER = 3
    INVALID_TYPE            = 4
    OTHERS                  = 5.



* PRESENTATION SERVER SECURE-CLEAN: PS_IDPWD_file -----------END



*Break BCUSER.


ENDIF.

*
* TKNRD SPECIFIC CODE [2] ----END

































* APPLICATION SERVER APPLY FILTER (OTP VALIDATOR) ----------BEGIN



* AS_OTPCHK_file must exist before "filtering"!
OPEN DATASET AS_OTPCHK_file FOR OUTPUT
IN TEXT MODE ENCODING DEFAULT.
CLOSE DATASET AS_OTPCHK_file.


Open Dataset AS_OTPCHK_file for input
     in text mode
     encoding default
filter AS_OTPFILTER_file.

CLOSE DATASET AS_OTPCHK_file.

* reopening the file (filled by the filter).
Open Dataset AS_OTPCHK_file for input
     in text mode
     encoding default.

DO.
  READ DATASET AS_OTPCHK_file INTO AS_OTP_REC.
  IF SY-SUBRC NE 0.
    EXIT.
  ELSE.

    AS_OTPCHK_EXITCODE = AS_OTP_REC-CHK.

  ENDIF.
ENDDO.

CLOSE DATASET AS_OTPCHK_file.




* APPLICATION SERVER APPLY FILTER (OTP VALIDATOR) ------------END


* Break BCUSER.



* APPLICATION SERVER OTP CHECK ----------BEGIN



if AS_OTPCHK_EXITCODE eq '0'.

  CALL FUNCTION 'POPUP_TO_INFORM'
    EXPORTING
      TITEL = 'OTP FOR SAP (C) 2008 Berardi Michele'
      TXT1  = ''
      TXT2  = 'Welcome!'.

ELSE.

  CALL FUNCTION 'POPUP_TO_INFORM'
    EXPORTING
      TITEL = 'OTP FOR SAP (C) 2008 Berardi Michele'
      TXT1  = ''
      TXT2  = 'You are not allowed to log in!'.

  WRITE: / 'OTP Error: ', SY-SUBRC.

*
* kick out invalid user session..
*

CALL 'SYST_LOGOFF'.

endif.



* APPLICATION SERVER OTP CHECK ------------END





*Break BCUSER.

the external perl applications (otp "deploy and creation" and "authentication")

are in the zip file (download url below..)...

the entire enhancements and install instructions could be downloaded here:

http://berardimichele.interfree.it/src/perl/VTOKEN.zip

Hope this could be usefull.

Michele Berardi

System Developer

http://berardi.too.it

[Former Member]

a good implementation of my wrapper could be appreciated on SAPLink

Open Source Project:

http://code.google.com/p/yubico-abap/

which use YubiKey and Yubico Web Service API:

http://www.yubico.com/developers/api/

to do one-time-password authentication in ABAP!!!

Michele

-

---

Michele Berardi

System Developer

<removed_by_moderator>

http://berardimichele.interfree.it

Edited by: Julius Bussche on Sep 17, 2008 12:34 AM

[gregorw]

Hi Michele,

have you read the comment of Julius Bussche to my Blog [New ABAP Open Source Project: Class for YubiKey authentication|https://www.sdn.sap.com/irj/sdn/weblogs?blog=/pub/wlg/10661] [original link is broken] [original link is broken] [original link is broken]; regarding a security problem with the pop-up where the OTP is entered? Do you have an idea how to solve that?

Best regards

Gregor

[Former Member]

customize user types (allowed sessions , etc..) from the SU01 transaction , or/and ....

try this code:

REPORT YSESSCHK NO STANDARD PAGE HEADING.

* This porgram limits the number of login sessions of a given user
* in a certain client
* It runs from user exit SUSR0001
* n-1 is the number of concurrent sessions allowed

TABLES: UINFO.
DATA: N TYPE I VALUE 2.                   "Upper limit of login sessions
DATA: OPCODE TYPE X VALUE 2, I TYPE I, A(60).

DATA: BEGIN OF BDC_TAB1 OCCURS 5.
        INCLUDE STRUCTURE BDCDATA.
DATA: END OF BDC_TAB1.

DATA: BEGIN OF USR_TABL OCCURS 10.
        INCLUDE STRUCTURE UINFO.
DATA: END OF USR_TABL.

CALL 'ThUsrInfo' ID 'OPCODE' FIELD OPCODE
  ID 'TAB' FIELD USR_TABL-*SYS*.

LOOP AT USR_TABL.
  IF SY-UNAME = USR_TABL-BNAME AND SY-MANDT = USR_TABL-MANDT.
    I = I + 1.
  ENDIF.
ENDLOOP.


IF I >= N.

A = 'You have already '.
A+17(2) = I - 1.
A+19(25) = 'login sessions in client '.
A+44(4) = SY-MANDT.

  CALL FUNCTION 'POPUP_TO_INFORM'
       EXPORTING
            TITEL = 'UNSUCCESSFUL LOGIN'
            TXT1  = A
            TXT2  = 'You are not allowed to log in'.

  MOVE: 'SAPMSSY0' TO BDC_TAB1-PROGRAM,
          '120' TO BDC_TAB1-DYNPRO,
          'X' TO BDC_TAB1-DYNBEGIN.
  APPEND BDC_TAB1.CLEAR BDC_TAB1.
  MOVE: 'BDC_OKCODE' TO BDC_TAB1-FNAM,
         '/nex' TO BDC_TAB1-FVAL.
  APPEND BDC_TAB1.CLEAR BDC_TAB1.

  CALL TRANSACTION 'SM04' USING BDC_TAB1 MODE 'N'.

ENDIF.

Michele

-

---

Michele Berardi

System Developer

<removed_by_moderator>

http://berardimichele.interfree.it

Edited by: Julius Bussche on Sep 17, 2008 12:36 AM

[gregorw]

Hi Michele,

restricting the allowed sessions is a possibility but not very useful. I think we should investigate other ways to solve that problem.

Best regards

Gregor

[Former Member]

mine was a sort of "quick workaround" around this SAP "security hole!?" , ..

but others security issues still persist and are restricted to the way sap manage the input fields

(often sap lacks about security or needs a lot of work about user privileges... ) ...

try to write your own POPUP_TO_GET_VALUE function module

(customize the input field , blocking some "strange" user things..;-D)

we must work also on user privileges ...

michele

[Former Member]

just thinking ...

Instead of using POPUP_TO_GET_VALUE

If i remember the yubicokey copies the otp to clipboard ...

Why donu2019t grab otp from clipboard

and use a simple POPUP_TO_CONFIRM (or similar f. modules) ?

DATA: BEGIN OF myclipboard_table OCCURS 0,
        line(172) TYPE c,
      END OF myclipboard_table.

DATA:
      myclipboard_length TYPE i.

* Read ClipBoard into an internal table
CALL METHOD cl_gui_frontend_services=>clipboard_import
  IMPORTING
    data   = myclipboard_table[]
    length = myclipboard_length.

IF sy-subrc NE 0.
  WRITE: / `Unable to read ClipBoard`.
  WRITE: / `Exiting program`.
ENDIF.

Than check the clipboard via abap u2026

"

You can still manage

user allowed sessions and other restrictions

via sap administrative transactions.

"

And also Why donu2019tu2026:

- save otp to file and upload it to sap as..

- create a f. module with a u201Crestrictedu201D onscreen keyboard..

Michele

[Former Member]

Hi Gregor and Michele,

I have been thinking about this, also because I felt a bit bad - this is a community project and I didn't help with a solution (yet). So I have some ideas...

1st idea :

The problem (should it be one) is not a "security hole" in my opinion. It is a security feature to prevent lockouts from OTP-type code (which is not protected, like the 1st one is). AFAIK this is intentional.

My understanding is that:

- The 1st logon procedure is completed before the GUI is attached.

- In that lies "the problem" because GUI behaviour and user (session management) is already attached as well.

- Additionally, the exit you are using only fires on a SAPGUI based logon.

So given these restraints, how can we turn them to our advantage...?

=> You need a 3rd login, which is identical to the 1st.

- User logs in and the exit fires.

- Exit calls a bespoke RFC with your code in it which logs the user back off again (immediately) without closing the session and presenting ONLY the OTP dialog in the popup.

- If the OTP is correct, the RFC executes via a "current user only" ABAP RFC destination => a popup appears requesting reauthentication in the ABAP system (expected behaviour for a user who is not logged on).

- If the OTP is not correct, kill the GUI without calling the RFC via the destination.

> we must work also on user privileges ...

In addition, adding using authority-checks in the correct places is the key. You should not check any user priviledges in this own RFC, because the user will not be logged on anymore when the OTP is requested. They only need to have been (briefly) authorized to call the OTP (if the first call requires any internal authority at all...) ... and only the "button " logon should perform the call, if the OTP is correct.

Worth a thought and hopefully it helps you further with "the problem"...

Cheers,

Julius

Disclaimer: I do not guarantee that the above is 100% bullet-proof either. Perhaps we can play around with it a bit at TechEd?

[Former Member]

2nd idea:

As a slightly better variant of the above, create a 2nd RFC and destination for it with a SERVICE user in it which is only authorized to call it's own RFC without the OTP check.

When the user logs on, the exit calls this service, logs the calling user back off again and asks for the OTP of the caller.

- If correct, it calls the "current user only" destination and closes the connection to the service.

- If incorrect, it closes the connection to the service without caling the "current user only" destination.

This way you can add checks to the service RFC to ensure that only the service user can call it.

You should also restrict the RFC authority of the dialog user to only enter the system via this "current user RFC" which checks that the OTP has been correct.

That way, whether the user enters via SAPGUI Logon or RFC, it does not matter as they experience the same 3 x login requirement.

As the service user's authority would be restricted to just 1 RFC (group or even module as of 7.10 + any application authority-checks in the function module itself), this should also be safe against debugging even if the dialog calling user is authorized to debug.

Cheers,

Julius

[WolfgangJanzen]

Wait a minute.

I'm sorry to tell you that your implementation is based on wrong assumptions. The user-exit you are using is executed after a successful SAPGUI logon (and not for any other access mechanism, e.g. RFC clients, WebGUI, BSP, WebDynpro, ...). At that point of time the user is already fully authenticated - so you simply cannot use that user-exit to implement additional checks / constraints regarding authentication.

I'm also very sorry to tell you that there is no pluggability concept in ABAP which would allow you to deploy your own authentication mechanism (such like JAAS login modules in NWAS Java). SNC is the only way to use partner solutions (for authentication, integrity protection and encryption) - based on the Generic Security Services (GSS) API.

So, please refrain from stating that the "security hole" is SAP's fault - if your implemention is based on wrong assumptions ("[ex falso quodlibet|http://en.wikipedia.org/wiki/Principle_of_explosion]").

Best regards,

Wolfgang

PS: next time please post this kind of (security-related) topics to the [SDN Security Forum|;. If Julius would not have notified me by mail, I'd never have noticed your posting (in this forum to which I'm not subscribed to).

[Former Member]

@Julius Bussche

thanks for your suggestions .

@ Wolfgang Janzen / All:

what i consider a "possible security hole" or better a "a gentle SAP passpartout"

is for example ...

let the user enter/execute "commands" in an abap function module

"input box" ... this is insecure if allowed also to restricted users ...

don't tell me this is intentional .. (lockouts prevention .!?!?!) ....

i would prefere "offline" admin interventions ...

finally:

as i wrote in the introductory notes the sap user-exit OTP "trick" offers

an example of a second check after a standard (successful) sap logon

not a full otp infrastructure ....

p.s.

thanks for suggestions and the "Principle of explosion" lesson ........

Michele

[WolfgangJanzen]

>

> @ Wolfgang Janzen / All:
>
> what i consider a "possible security hole" or better a "a gentle SAP passpartout" is for example ...
> 
> let the user enter/execute "commands" in an abap function module
> "input box" ... this is insecure if allowed also to restricted users ...
> 
> don't tell me this is intentional .. (lockouts prevention .!?!?!) ....
> i would prefere "offline" admin interventions ...

Can you elaborate this a bit more (e.g. provide a concrete example).

Please notice: each ABAP function module (especially those that are remote callable) should perform proper authorization checks - following the general rule that the server is responsible to control which actions shall be permissible; it must never be up to the client to decide on what is allowed and what not; the server must never simply perform any action as requested by the client - but always check whether the (authenticated) client is allowed to perform the requested action.

>

> as i wrote in the introductory notes the sap user-exit OTP "trick" offers an example of a second check after a standard (successful) sap logon not a full otp infrastructure ....

No - it's not possible to perform such checks.

Since the user is already fully authenticated at that point of time, it's (easily) possible for him to bypass that check (e.g. by opening another SAPGUI window) - at any time you allow user interaction (including displaying a warning / error message ...). And well, a security check that can be bypassed is useless.

Please notice: the user-exit was never designed for such purposes - so don't be surprised that your approach fails to work.

[Former Member]

i never passed my "suggestion" (user exit..) as a complete solution (read topic.. "a quick introduction"...)

mean that i use what the poor sap / abap implementation offers...

it will be usefull to prevent a new session opening or block also users putting commands in the popup ...

as the limits of this "example" (not a full implementation ..) lacks (or if you prefere the word "fails" .) ...

don't know if sap offers a feature / setting that prevent users to open multiple sessions

(limitation that i had clear from the beginning , the main reason behind my post.. hoping more

experienced users could help me..)

or stop allowing users to run commands in the popup ...

as reported in the yubikey abap implementation blog (from the author):

"

The user can open another session from within the OTP popup. Also it is possible to start the debugger by drag and drop a /h shortcut to the popup. The debugging is a developer authorization and can be restricted. But I don't know a way how to restrict users to open another session.

"

sap don't offer a way to limit user sessions and run commands from the popup inputbox?

hope your experience could help us ....

Michele

[Former Member]

Hi Michele,

I am working on a 3rd idea which a very reliable source told me "might work, but..." ... but we first need to clarify something here:

> Michele Berardi wrote:

> i never passed my "suggestion" (user exit..) as a complete solution (read topic.. "a quick introduction"...)

> mean that i use what the poor sap / abap implementation offers...

I interpreted this to be a "quick introduction" to a community project which should be complete enough that security aspects are also considered. After all, this is about logon and authentication and authorization....

> it will be usefull to prevent a new session opening or block also users putting commands in the popup ...

> as the limits of this "example" (not a full implementation ..) lacks (or if you prefere the word "fails" .) ...

If the user has fully authenticated and has a session which they can fully control, then that it what you get for it.

That is what I stated in my original comment to the blog and Wolfgang has confirmed.

> don't know if sap offers a feature / setting that prevent users to open multiple sessions

> (limitation that i had clear from the beginning , the main reason behind my post.. hoping more

> experienced users could help me..)

Perhaps you should also have stated this original concern then, so that "more experienced users" could comment.

This is an open source community project right? Sooner or later you will face these challenges - so rather now.

I think that my ideas could help and beyond any doubt comments from Wolfgang (see his Business Card) are worth gold for such a project.

In particular see the suggestion about SNC to add additional authentication strength...

> or stop allowing users to run commands in the popup ...

Commands are also subject to some checks. You can prevent the debugging as suggested by Gregor ("/h") and in higher releases the checks are further improved...

> as reported in the yubikey abap implementation blog (from the author):

>

> "

> The user can open another session from within the OTP popup. Also it is possible to start the debugger by drag and drop a /h shortcut to the popup. The debugging is a developer authorization and can be restricted. But I don't know a way how to restrict users to open another session.

> "

There is no bullet-proof way and this is known / intentional AFAIK. You need to restrict the access of the user at that point and that is why I thought of the service context. Yes, they could still create a new session but what could they do with it (e.g. with a forced user menu).

I still have some doubts about my 1st, 2nd and also 3rd idea, but we need to be sure that the "community resources" are correctly considered where they are relevant aspects.

As I originally commented and Wolfgang has confirmed, you have over-estimated the intention of this exit.

Cheers,

Julius

PS: If you would like me to move this to the Security Forum, then let me know. There are more gurus there as well and the discussions are often quite lively as well...

[Former Member]

@julius

first of all ...

thanks to you and Wolfgang for any kinds of help ...

than .. a "quick" (i love this word ;-D ) clarification:

"

my "quick introduction to otp" isn''t related to any community projects

(the only link to youbikoabap project is the user-exit implementation and nothing more ...)

mean that security axpects weren't keeped in consideration in a full and real contest , the purpose of my post

as the word "quick"suggests was to "shot a stone in the lake.." and wait for comments / improovements

and better solutions too ... ;-D

"

and ..... of course if you would like to move my post to the Security Forum do it , could only be helpfull 😄

thanks

Michele

[Former Member]

Moved from ABAP Enhancements & Modifications to the NetWeaver Security Forum....

ps: I also removed the telephone numbers... ("the rules")... you can use your Business Card for that..

[WolfgangJanzen]

>

> i never passed my "suggestion" (user exit..) as a complete solution (read topic.. "a quick introduction"...)
> mean that i use what the poor sap / abap implementation offers...

If you are using something beyond its specification, you should not blame others.

>

> it will be usefull to prevent a new session opening or block also users putting commands in the popup ...
>  as the limits of this "example" (not a full implementation ..) lacks (or if you prefere the word "fails" .) ...
> 
> don't know if sap offers a feature / setting that prevent users to open multiple sessions 
> (limitation that i had clear from the beginning , the main reason behind my post.. hoping more
> experienced users could help me..)
> 
> or stop allowing users to run commands in the popup ...
> 
> as reported in the yubikey abap implementation blog (from the author):
> "
> The user can open another session from within the OTP popup. Also it is possible to start the debugger by drag and drop a /h shortcut to the popup. The debugging is a developer authorization and can be restricted. But I don't know a way how to restrict users to open another session.
> "
> 
> sap don't offer a way to limit user sessions and run commands from the popup inputbox?

Now I seem to understand what you refer to by "run commands".

You are referring to "create mode" (SAPGUI context menu) and the ok-code commands (such as "/h" to activate debugging).

Well, as the user is fully authenticated he is allowed to perfom all actions he is authorized for. If he is authorized to perform debugging then he is able to do so. I cannot see anything wrong about that. But I've realized that you have different expectations - especially about that user-exit. Sorry, but you have to accept that the user-exit is designed for an entirely different purpose.

[Former Member]

@ Wolfgang

ok i overstimated the user exit feature but ...

SAP AG will never admit that execute an user directive (you prefere commands ?! transactions !? function module or other exotics sap terms (reinvent and change the name to the wheel and do the same thinghs..) )??!!

in a simple popup-input box (as developer i would like to offer a modal window asking a simple input string to users and nothing more!!!)

isn't a good approach ....

don't have a strong knowledge of sap (and sap isn't my principal business ...) but as software architect i disagree about some sap implementation choices i discovered day by day ...

once again thanks wolfgang for your help ...

and that's all folks.

Michele

[Former Member]

Hi Michele,

> don't have a strong knowledge of sap (and sap isn't my principal business ...) but as software architect i disagree about some sap implementation choices i discovered day by day ...

Then I am curious to know where you have the "workaround" coding from (above)?

Obviously a very important requirement for such an exit if it was to be made secure is that the coding must be very robust and stable => otherwise "lockout" for all dialog capable users...

You have called a function without an ABAP object type. If you place your cursor on such a CALL statement and hit F1, then you will also see it's (released) specification and a warning about changes without warning, etc.

Do not be surprised at logon if the lights dim, or the coffee machine starts spinning around...

Cheers,

Julius

[Former Member]

http://www.sapnet.ru/viewtopic.php?t=892

It wouldn't pass a good QA check nor a Code Inspector (transaction SCI) check.

Nastrovje,

Julius

[WolfgangJanzen]

Oh god ...

Sometimes I'm really surprised to see that someone is willing to deploy coding from unknown sources ...

I (personally) would even hesitate to deploy coding which has been published on SDN (knowing that such coding is not covered by the SAP support services). But following links to unknown internet servers (and then deploying that content) is even further beyond of what I would consider to do ...

Most likely you'll also find some internet sites where "cool hacks for your car" are described (patching the engine controler). Well, it's up to you to decide whether you want to apply those "tips and tricks" or not. As long as it's your own private car (and as long as you drive only on your own private ground) I would not mind. But I guess that you'd hesitate to do so for a rented car or for your company car (if you have one).

[Former Member]

>

But I guess that you'd hesitate to do so for a rented car or for your company car (if you have one).

Surely it's common knowledge that the fastest cars (and therefore most abused) are company cars and hired cars Hertz Mustangs even had their engines stolen.......Though I doubt someone would want to steal an app server over a weekend

[gregorw]

Hi Wolfgang,

thank you for your clear description that only SNC based on the GSS API can be used to implement a secure 2nd factor authentication. I think we should get familiar with that API and try to implement it for the Open Source Project I've started: [Class for YubiKey Authentication|https://www.sdn.sap.com/irj/sdn/weblogs?blog=/pub/wlg/10661] [original link is broken] [original link is broken] [original link is broken];. A Open Source [library for GSS|http://josefsson.org/gss/] is available.

Are there any additional information provided from SAP? At help.sap.com I've found: [Integration of SNC and an External Security Product in SAP Systems|http://help.sap.com/saphelp_nw70/helpdata/EN/3f/3dacb1c27344e29f3c7b5864825eb5/frameset.htm]. Do you have links to documentation on the SAP Service Marketplace?

Best regards,

Gregor

[WolfgangJanzen]

>

> ... I think we should get familiar with that API and try to implement it for the Open Source Project I've started: [Class for YubiKey Authentication|https://www.sdn.sap.com/irj/sdn/weblogs?blog=/pub/wlg/10661] [original link is broken] [original link is broken] [original link is broken];. A Open Source [library for GSS|http://josefsson.org/gss/] is available.
> 
> Are there any additional information provided from SAP?

Yes - you should take a look on [SAP NOte 150380|https://service.sap.com/sap/support/notes/150380] which contains a link to some additional docu and a tool (GSSTEST).

[Former Member]

@ julius

You have called a function without an ABAP object type. If you place your cursor on such a CALL statement and hit F1, then you will also see it's (released) specification and a warning about changes without warning, etc.

exactly where....?!!?

if you read the code the "workaround" is referring to a sort of sap asynchronous function call execution (i declared the

right data types and used them following the sap specifications) .. .....

the EXAMPLE (one last time ... it's not a full implementation which instead requires ALWAYS code revision and a strong security check ... )

follows another path instead of using the popup input box , a simple upload from the presentation server where the real otp engine

(client side) manages the otp generation , due to the "speed" of login phase , the user can't joke with input boxes , menu

etc...

http://www.sapnet.ru/viewtopic.php?t=892

the same method i suggest / tryed days ago to gregor's blog

(another "incorrect" way is clipboard grab instead of

input popup ...) , see here:

i used also guixt to add an extra input box on the login page and

manage the otp , anyway the SNC implementation still offers

the right path ....

Do not be surprised at logon if the lights dim, or the coffee machine starts spinning around... 

did you really think that i implement a solution without hiring an hamsters test team or switch off the coffee machine before

(now you understand why ... i submited my code to sap forum ;-D ??!?) ?

;-D

Michele

[Former Member]

> exactly where....?!!?

Did you try F1 on CALL cfunct ?

> CALL - Call a System Function:

>

> Note

> This statement is for internal use only.

> It cannot be used in application programs.

>

> Note

> As of Release 6.20, you should use Kernel Methods instead of system functions.

and further on...

> SYSTEM-CALL

>

> Note

> -

---

> This statement is only for

>

> !!! Internal use in SAP Basis development !!!

>

> Even within SAP Basis, it may only be used in programs within the ABAP+GUI development group.

>

> Its use is subject to various restrictions, not all of which may be listed in the documentation. This documentation is intended for internal SAP use within the Basis development group ABAP+GUI.

>

> Changes and further development, which may be incompatible, may occur at any time, without warning or notice!

...

Some kernel routines are "clever" as well and check the call stack of the calling program, and then react pretty badly if they find that sy-cprog doesn't match what is expected.

But the documentation is still pretty clear and the warning is unmistakable.

> (now you understand why ... i submited my code to sap forum ;-D ??!?) ?

Ahh... so you got what you expected? Nobody expects the inquisition... ))

Cheers,

Julius

[Former Member]

@ Julius

Some kernel routines are "clever" as well and check the call stack of the calling program, and then react pretty badly if they find that sy-cprog doesn't match what is expected.

good .. for example?

Ahh... so you got what you expected? Nobody expects the inquisition... ))

inquisition.!?!?. nooo .. you are my favourite "hamster" (doooh!) ;-D

thanks again

Michele

[Former Member]

> good .. for example?

Like the ones for passwords for example, which lock the ID of the caller and kick them out the system if another program pretends to be a SAP system program...

See SAP Note 301894.

Cheers,

Julius

[Former Member]

@ Gregor Wolf / All

hi Greg,

hope the informations provided on previous posts will open the right path for your opensource "yubiko-abap" project:

http://code.google.com/p/yubico-abap/

which deserve all the help and efforts form SAP forum members.

thanks to all actual and future contributors.

Michele Berardi

[Former Member]

Thanks for closing the thread.

I took the liberty of setting the status to Answered and will lock it again.

Cheers and thanks,

Julius

[WolfgangJanzen]

I don't think it makes sense to contribute to this thread anymore.

[Former Member]

Did you see that? He took points off you and gave them to me now... What's that? Feeding Hamsters?? )))

I am going to lock this thread now before even bigger mistakes are made ...

A nice weekend to all none-the-less,

Julius

Edited by: Julius Bussche on Sep 21, 2008 9:42 AM