I initially wrote this article in my , so I wouldn't have to search for it again later, but since no one reads the blog, I wanted to share this information with everyone, in case it might be useful.
While working on the idea of a password reset service in SAP R/3 systems, a question arose — how to launch SAP GUI with specific parameters from the browser? Since this idea involved using a web service that first processes SOAP requests from SAP GUI and sends an email with a link to the web page containing the password reset script, and then displays a message to the user about the successful password reset along with the initial password, I wanted that page to also include a link to launch SAP GUI. Moreover, this link should open the required system, preferably with fields for the login and password already filled out: the user would only need to enter the production password twice.
Launching SAP Logon was of no interest for our purpose, and when starting sapgui.exe, it was impossible to specify the client and username. However, it was possible to launch a system not defined in SAP Logon. On the other hand, launching SAP GUI with arbitrary server parameters was not particularly relevant: if we're solving the user's password reset problem, they most likely already have the required entry in SAP Logon with the necessary settings, so there’s no need to interfere with our own. Instead, the SAP GUI Shortcut technology and the sapshcut.exe program satisfied the requirements, allowing for the launch of SAP GUI using a specific 'shortcut'.
A straightforward solution: launching sapshcut.exe directly from the browser using an ActiveX object:
function openSAPGui(sid, client, user, password) {
var shell = new ActiveXObject("WScript.Shell");
shell.run('sapshcut.exe -system="'+sid+'" -client='+client+' -user="'+user+'" -pw="'+password+'" -language=RU');
}
This solution is poor: first, it only works in Internet Explorer; second, it requires certain security settings in the browser that may be prohibited at the domain level within an organization, and even if allowed, the browser presents the user with a frightening warning message:
I found Solution #2 on the internet: Allows us to launch the required application via a link by specifying the protocol, which we register ourselves in Windows in the registry under HKEY_CLASSES_ROOT. Since the SAP GUI Shortcut has its own subsection in this section, we can add a string parameter URL Protocol with an empty value:
This protocol launches sapgui.exe with the parameter /SHORTCUT, which is exactly what we need:
Or if we want to create a completely arbitrary protocol (for example, sapshcut), we can register it using the following reg file:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\sapshcut]
@="sapshcut Handler"
"URL Protocol"=""
[HKEY_CLASSES_ROOT\sapshcut\DefaultIcon]
@="sapshcut.exe"
[HKEY_CLASSES_ROOT\sapshcut\shell]
[HKEY_CLASSES_ROOT\sapshcut\shell\open]
[HKEY_CLASSES_ROOT\sapshcut\shell\open\command]
@="sapshcut.exe "%1""
Now, if we create a link on the web page specifying the protocol Sapgui.Shortcut.File like this:
<a href='Sapgui.Shortcut.File: -system=SID -client=200'>SID200</a>
we should see a window like this:
And everything seems great, but when we click the "Allow" button, we see:
Oops, the browser converted spaces to . Other characters will also be encoded in their numeric code with the percent symbol. The most frustrating part is that there’s nothing you can do at the browser level (everything is done according to the standard) — browsers don’t like such characters, and the Windows command interpreter doesn’t work with these encoded values. Another downside is that the entire string is passed as a parameter, including the protocol name and even the colon.sapgui.shortcut.file:). Although the same sapshcut.exe can discard everything that is not a parameter (starting with the symbol "-", then the name, "=" and the value), i.e., a string like "sapgui.shortcut.file: -system=SID" will still work, but without the space, "sapgui.shortcut.file:-system=SID" will not work.
Thus, there are basically two options for using the URI protocol:
- Using without parameters: We create a whole bunch of protocols for all our systems like SIDMANDT, such as AAA200, BBB200 etc. If you just need to launch the desired system, this option is quite workable, but in our case it does not fit, since at least we want to pass the user login as well, which cannot be done this way.
- Using a wrapper program to call sapshcut.exe or sapgui.exeThe essence of this program is simple — it should take the string that is transmitted by the browser via the web protocol and turn it into the representation that Windows accepts, i.e., converting all character codes back into characters (it might even parse the string by parameters) and then call the SAP GUI with the guaranteed correct command. In our case, this also doesn't quite fit (that's why I didn't even write it), because adding the protocol on all user PCs is not enough (within the domain that's somewhat acceptable, though it's better to avoid such practices), but here it requires additionally placing a program on the PCs and also constantly monitoring it to ensure it doesn't get lost during software reinstallations.
So, we discard this option as unsuitable for us.
Here, I was already starting to think that I would have to part with the idea of launching SAP GUI with the necessary parameters from the browser, but then it occurred to me that a shortcut could be created in SAP Logon and copied to the desktop. I used this method once, but until now I hadn't looked specifically at the shortcut file. It turned out that this shortcut is just a regular text file with the extension .sap. If it is launched in Windows, SAP GUI will start with the parameters specified in this file. "Bingo!"
The format of this file is roughly as follows (there may also be a transaction launched at startup, but I omitted it):
[System]
Name=SID
Client=200
[User]
Name=
Language=RU
Password=
[Function]
Title=
[Configuration]
GuiSize=Maximized
[Options]
Reuse=0
It seems that everything necessary is there: the system identifier, the client, the username, and even the password. And even additional parameters: Title — window title, GuiSize — size of the launched window (fullscreen or not) and Reuse — whether to open a new window or use an already opened one with this system. But immediately a nuance arose — it turned out that the password cannot be set in SAP Logon, the field was locked. It turned out that this was done for security reasons: all shortcuts created in SAP Logon are stored in a file sapshortcut.ini (next to saplogon.ini in the Windows user profile) and although they are encrypted, it's not very strong and with a little effort, they can be decoded. But this can also be allowed by changing the value of one parameter in the registry (by default, the value 0):
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USERSoftwareSAPSAPShortcutSecurity]
"EnablePassword"="1"
This unlocks the "Password" field on the shortcut creation form in SAP Logon:
When entering a password into this field, it will be placed in the corresponding line.
sapshortcut.ini, but when dragging the shortcut to the desktop, it does not appear there — however, you can add it manually. The password is encrypted, and for 111111 it will look like this: PW_49B02219D1F6, for 222222 — PW_4AB3211AD2F5. But what interests us more is that this password is encrypted in one way, independent of a specific PC. If we reset the password to the default, we can use a predefined value in this field. If we want to use a custom password, we will need to understand the encryption algorithm. However, judging by the provided examples, it should not be difficult. By the way, in SAP GUI 7.40, this field has completely disappeared from the form, but the file with the filled password is correctly recognized.
This means that in the browser, it is enough to click on the link to a file with the .sap extension in the correct format — and it will prompt to open it as an SAP GUI Shortcut file (of course, on a PC with SAP GUI installed) and will open the SAP GUI window with the specified parameters (if the SID and client pair is in the SAP Logon list on that PC).
However, it is clear that no one will create and store files in advance on the site — they need to be generated based on the required parameters. For example, you can create a PHP script to generate shortcuts (sapshcut.php):
<?php
$queries = array();
parse_str($_SERVER['QUERY_STRING'], $queries);
$Title = $queries['Title'];
$Size = $queries['Size'];
$SID = $queries['SID'];
$Client = $queries['Client'];
if($Client == '') { $Client=200; };
$Lang = $queries['Language'];
if($Lang=='') { $Lang = 'RU'; };
$User = $queries['Username'];
if($User'') { $Password = $queries['Password']; };
$filename = $SID.$Client.'.sap';
header('Content-disposition: attachment; filename='.$filename);
header('Content-type: application/sap');
echo "[System]rn";
echo "Name=".$SID."rn";
echo "Client=".$Client."rn";
echo "[User]rn";
echo "Name=".$Username."rn";
echo "Language=".$Lang."rn";
if($Password'') echo "Password=".$Password."rn";
echo "[Function]rn";
if($Title'') {echo "Title=".$Title."rn";} else {echo "Title=Login to the systemrn";};
echo "[Configuration]rn";
if($Size=='max') { echo "GuiSize=Maximizedrn"; };
echo "[Options]rn";
echo "Reuse=0rn";
?>
If you do not specify a username and password, you will get the following window requesting a login and password:
If you only enter the username, the username field will be filled, while the password field will remain empty. However, if we provide both the username and password, but the EnablePassword key in the registry on the user's PC under [HKEY_CURRENT_USERSoftwareSAPSAPShortcutSecurity] is set to 0, we will get the same result. Only if this key is set to 1 and we provide both the username and initial password will the system immediately prompt for the new permanent password to be entered twice. This is what we aimed to achieve.
As a result, we have the following set of options discussed as an illustration of everything mentioned above:
<html>
<head>
<script>
function openSAPGui(sid, client, user, password) {
var shell = new ActiveXObject("WScript.Shell");
shell.run('sapshcut.exe -system="'+sid+'" -client='+client+' -user="'+user+'" -pw="'+password+'" -language=RU');
}
</script>
</head>
<body>
<a href='' onclick="javascript:openSAPGui('SID', '200', 'test', '');"/>Example 1: Execute sapshcut.exe (ActiveX)<br>
<a href='Sapgui.Shortcut.File: -system=SID -client=200'>Example 2: Open sapshcut.exe (URI)</a><br>
<a href='/en/sapshcut.php/?SID=SID&Client=200&User=test'>Example 3: Open file .sap (SAP GUI Shortcut)</a><br>
</body>
</html>
The last option worked for me. However, it's also possible to use CMD file generation instead of creating SAP shortcuts, which will also open the SAP GUI window when opened from the browser. Below is an example (sapguicmd.php) for directly launching the SAP GUI with the full connection string, without needing a configured SAP Logon:
<?php
$queries = array();
parse_str($_SERVER['QUERY_STRING'], $queries);
$Title = $queries['Title'];
$ROUTER = $queries['ROUTER'];
$ROUTERPORT = $queries['ROUTERPORT'];
$HOST = $queries['HOST'];
$PORT = $queries['PORT'];
$MESS = $queries['MESS'];
$LG = $queries['LG'];
$filename = 'SAPGUI_';
if($MESS'') $filename = $filename.$MESS;
if($HOST'') $filename = $filename.$HOST;
if($PORT'') $filename = $filename.'_'.$PORT;
$filename = $filename.'.cmd';
header('Content-disposition: attachment; filename='.$filename);
header('Content-type: application/cmd');
echo "@echo offrn";
echo "chcp 1251rn";
echo "echo Logging into ".$Title."rn";
echo "set SAP_CODEPAGE=1504rn";
echo 'if exist "%ProgramFiles(x86)%SAPFrontEndSapGuisapgui.exe" set gui=%ProgramFiles(x86)%SAPFrontEndSapGuisapgui.exe'."rn";
echo 'if exist "%ProgramFiles%SAPFrontEndSapGuisapgui.exe" set gui=%ProgramFiles%SAPFrontEndSapGuisapgui.exe'."rn";
echo "set logon=";
if($ROUTER'') echo "\/H\/".$ROUTER;
if($ROUTERPORT'') echo "\/S\/".$ROUTERPORT;
if($MESS'') echo "\/M\/".$MESS;
if($HOST'') echo "\/H\/".$HOST;
if($PORT'') echo "\/S\/".$PORT;
if($LG'') echo "\/G\/".$LG;
echo "rn";
echo '"%gui%" %logon%'."rn";
?>
Source: habr.com
