SAP Single Sign-on and Online Data Proxy Overview

Understand how OData applications fit in the Unwired Platform landscape and learn how to secure communication paths and enable single sign-on (SSO) for these applications.

The proxy connector is the online data proxy (ODP) connector between OData applications and the SAP Gateway, and uses an HTTP(S) connection from Unwired Server to the SAP Gateway. A separate HTTP(S) port is used by the SAP Gateway to push changes through Unwired Server to the OData application. Unwired WorkSpace is not used to create MBOs, generate code, create applications, or for deployment. Instead, in OData-based mobile applications that run in Unwired Server:

Unwired Server acts as a pass-through server for OData-based applications:

  1. An OData client application registers with Unwired Server and subscribes to push notifications from the SAP Gateway. Unwired Server forwards the subscription request to the SAP Gateway. The SAP Gateway stores the subscription request for the collection with the push delivery address (HTTP(S) SSL Port).

    In an SSO configuration, the client provides credentials to Unwired Server (user name and password or X.509 user certificate) that are authenticated by the security configuration's authentication module ( CertificateAuthenticationLoginModule for X.509 or HttpAuthenticationLoginModule for SSO2). Once authenticated by Unwired Server, and assuming that Unwired Server and the SAP Gateway have a secure communication path, SSO is enabled.

  2. When application data changes in SAP and determines that a particular client has a subscription to that change, the Gateway connects to the Unwired Server HTTP(S) port and sends a message identifying the client, along with the message payload. Unwired Server looks up the client and queues the message. If the client is connected, the message is delivered immediately. If the client is offline, then Unwired Server attempts to send a push notification to the client (BES HTTP Push for Blackberry, APNS notification for iOS) to attempt to wake up the client and have it retrieve the messages.
Related concepts
Single Sign-on Authentication
Related tasks
Enabling Single Sign-on for OData Applications