SAP HANA Developer Guide - Get a Free Blog

Note: Exposed package content can include design-time objects, for example, tables and views.
● Authentication rules
Use the authentication keyword to enable authorization for the requests in URLs either at the application level
or for single packages in an application. The following authentication methods are supported:
○ SAP logon tickets
SAP logon tickets enable single sign-on across SAP boundaries; SAP logon tickets can also be used as
authentication for access to third-party applications.
○ Form-based authentication
Redirect the logon request to a form to fill in, for example, on a Web page.
○ Basic (user name and password)
Log on with a recognized user name and password
The authentication methods can also be written as an array, for example, to allow applications to support
multiple authentication methods. The order of the authentication methods in the array should proceed from
strongest to weakest, for example:
1. SAP logon ticket
2. Form-based
3. Basic authentication
● Application authorization
Use the authorization keyword in the .xsaccess file to specify which authorization level is required by a user
for access to a particular application package. The authorization levels you can choose from are defined in
the .xsprivileges file, for example, "execute" for basic privileges, or "admin" for administrative privileges
on the specified package.
● URL rewrite rules
Use the rewrite_rules keyword in the .xsaccess file to hide internal URL path details from external users,
clients, and search engines. It is not possible to define global rewrite rules; the rules you define apply to the
specified local application only. Rules are specified as a source-target pair where the source is written in the
JavaScript regex syntax, and the target is a simple string where references to the groups found can be
inserted using $groupnumber.
● Connection security
Use the force_ssl keyword in the .xsaccess file to enforce the use of secure HTTP (SSL/HTTPS) for client
connections. Browser requests that do not use SSL/HTTPS are refused and the 403 Forbidden page is
displayed. Note that if you set the force_ssl option, then you must ensure that the SAP Web Dispatcher is
configured to accept and manage HTTPS requests. For more information about configuring the SAP Web
Dispatcher to use HTTPS/SSL see the SAP HANA Administration Guide.
Note:
● Entity Tags
SAP HANA Developer Guide
Setting Up Your Application
If the SAP Webdispatcher sends the header “x-sap-webdisp-ap” with the HTTPS port, the request is
redirected to a HTTPS page, for example: http://..:80/test -> https://..:433/test.
Otherwise, a 403 error is displayed.
P U B L I C
© 2012 SAP AG. All rights reserved. 51