Reverse Proxy must not decode Fiori URLs

‘Double Encoding’ issue with Fiori Urls in case of Apache-based Reverse Proxy

The typical infra architecture of an on premisse Fiori deployment includes a reverse proxy that enables access to the Fiori Apps from the internet. A responsibility of the reverse proxy is to forward the received external uri address to the protected internal Fiori resource. The generic pattern here is that the domain part of the external url is mapped to the internal url, and the remainder of the external url is concattenated to the internal url. Some / most reverse proxy products handle encoded special characters in the remainder part, well special, by decoding them before forwarding. However, (a.o.) for Fiori URLs this behaviour is undesired. The encoded characters must be forwarded as is, so that the web dispatcher on Gateway FES can decode them and process the correct decoded uri.

Clarification of the effect due 'double encoding' of Fiori URL:

1. Browser requests "https://<external-DNS>/sap/opu/odata/UI2/PAGE_BUILDER_PERS/PageSets('%2FUI2%2FFiori2LaunchpadHome')?$expand=Pages/PageChipInstances/Chip/ChipBags/ChipProperties,Pages/PageChipInstances/RemoteCatalog,Pages/PageChipInstances/ChipInstanceBags/ChipInstanceProperties,AssignedPages,DefaultPage&sap-cache-id=...";
2. SAP Gateway FES returns http error 404;
3. Error logged on the SAP NetWeaver node is that "http://<SAP web dispatcher / Gateway FES>:8000/sap/opu/odata/UI2/PAGE_BUILDER_PERS/PageSets('%252FUI2%252FFiori2LaunchpadHome')?$expand=Pages/PageChipInstances/Chip/ChipBags/ChipProperties,Pages/PageChipInstances/RemoteCatalog,Pages/PageChipInstances/ChipInstanceBags/ChipInstanceProperties,AssignedPages,DefaultPage&sap-cache-id=..." is an invalid URI

Relevant resources:

• Fiori Launchpad Error via Apache: Failure - Unable to load groups
• Need to allow encoded slashes on Apache
• How to Preserve Encoded character in URL from NAM AG to webserver
• Apache still double encoding slashes after correct config
• 404 page as a result of double-encoded slashes in the URL when using Apache

Resources for considering Fiori Launchpad deployment options

With the introduction in March this year of SAP Fiori Cloud Edition, SAP now supports upto 5 different deployment options for Fiori Launchpad:

1. ABAP Front-end Server
2. SAP Enterprise Portal, as of NW 7.31 SP12 and NW 7.4 SP7
3. HANA Cloud Platform (HCP)
4. SAP Fiori Cloud Edition
5. SAP HANA Server

Which of these options is a/the best fit for an organization is largely influenced by the situation and roadmap of that specific organization. Some useful resources to aid in this deployment decision-making:

• SAP Fiori Launchpad - Deployment Options Common Recommendations
• SAP Fiori Launchpad deployment options (Bluefin Solutions)
• SAP Fiori UX Launch Pad Deployment Options and Recommendations for Portal Customers (ASUG, 2015)
• FLP Architectural Options (SAP PRESS)
  • Platform Features and Functions
  • Scenarios and Corresponding Roadmaps
  • Existing SAP Enterprise Portal with Limited Portal Usage
  • SAP Business Client Customer
  • SAP GUI Customer
  • Mobile Customer
• Planning the Fiori ABAP Frontend Server (FES) - Architecture Questions
• SAP Fiori launchpad in SAP Enterprise Portal 7.40 and 7.50: Overview Information
• SAP Fiori Launchpad and SAP Enterprise Portal: Integration Options (SAP TechEd)
• Quick Sizer for SAP NetWeaver Gateway is now available
• How to Size SAP Fiori SP2 Applications
• Setup of SAP Fiori System Landscape with ABAP Environment
• SAP Fiori, Cloud Edition (Rheinwerk Publishing)
• ASUG Briefing: What Is SAP Fiori Cloud Edition?

Use them at your own convenience...

Architectural decision path to rebuild our business portal foundation

As stated in previous post, current our business portal foundation is based on SAP Enterprise Portal 7.01. The direct trigger to consider a rebuild is that SAP has announced that support on EP 7.01 ends per end of 2017, and even no extended maintenance will be offered (source: SAP Note 1648480 - Maintenance for SAP Business Suite 7 Software). But another motivation is perhaps even more important: enable our end-users to seamless access and use the business portal foundation and the business applications exposed in/via it.

What is a business portal: Architectural Views

Business Architecture

• Host of functional portals
• Launchpad to access business applications
• Structured collaboration with external counterparts (suppliers and customers)
• “Business card” of the company’s identity and IT maturity level to internal employees and external partner organizations

IT Architecture

• Presentation layer
• Identity and Access Management
• Reverse Proxy
• Authorization / Roles Management
• Single Sign-On to ASML business applications
• Content + Knowledge Management
• Application hosting

Ambition for renewed Portal foundation

We aim for a user-centric environment, Responsive Design, mobile-ready, seamless end-user operation, personalizable, role-based, performant, secure, company branding. And appealing to use…These are all aspects that SAP aims to address with the Fiori offering, and via SAP Fiori Launchpad as gateway entrance. But SAP is not alone in there, other portal platform vendors aim to support the same.

Portal platform (re)selection

The decision to rebuild our company portal foundation also beholds a good moment to re-evaluate the portal platform selection. It will again be a decision that lasts for years, thus justified to spend time to the portal platform and vendor selection.

The outcome of the selection traject is that we stick with SAP as vendor for our portal foundation. The main decision drivers for (re)selecting SAP as portal platform are:

• This is predominantly Application Lifecycle Management, like for like
• Gartner positioned SAP as a leader in it’s 2015 Magic Quadrant for Horizontal Portals – on completeness of vision for Portal and UX (via Fiori) offering
• The weighing of the 6 Portal Platform Leaders on the main company priorities results in SAP qualified as Nr 1 for our portal foundation
• A large set of the exposed business applications are current build as ‘Portal-Embedded’ applications: they make use of and are dependent on SAP Portal capabilities, e.g. Enterprise Portal Knowledge Management
• A large set of the exposed business applications are SAP backend based. Exposing via a SAP technology-based portal results in better integration plumping: authentication, Single Sign-On, end-2-end auditing.
• SAP and it’s partners (will) deliver standard SAP Fiori Apps to operate SAP Business Suites (Finance, HR, Sales, Manufacturing, Supply Chain, …). Examples applicable for Supplier context:
  • WBS Element BOM
  • Quality Notification
  • Report Quality Issue
  • Open Orders – Total Orders By Status
  • Process Order
  • Track Shipments

Portal foundation rebuild strategy

1. Application Lifecycle Management to SAP EP 7.5:
   • Remain supported by SAP
   • Remain in-control of the full Portal landscape
2. Innovation via Fiori Launchpad:
   • User Experience: Prepare and enable for new UI concepts
   • Functionality: Prepare and enable for new service concepts