• Descriptive Header Area:

  The descriptive name you enter here into the first line will later appear in the system list within the logon window.

• Connection Type:

  Keep the default value Web AS ABAP as connection type to connect to a Web AS ABAP.

• Tabs for
  • System
  • Language
  • Security
  • Logon
  • Advanced Settings

• New

  Creates a new workspace.

• Delete

  Deletes an existing workspace.

  Note Only user created workspaces can be deleted while workspaces provided by a central configuration file can not be deleted. To distinguish these two types, an icon () is attached to all entries that are not created by the user.
• Hide

  Check or uncheck this checkbox to hide or show a workspace in SAP Logon.

  To display all hidden Workspaces, select  View  Show All Workspaces  from the SAP Logon menu bar. Do the same to hide them again.

• Name

  Enter the corresponding column inside the table to change the name of a workspace.

• Description

  Enter the corresponding column inside the table to change the description of a workspace.

• Connections
  • Connect to server
  • Create a New connection, Edit or Delete an existing connection
  • New Link: Creates a new connection entry as a link of an already existing system connection. The link takes over the connection string of the original connection entry. Log On settings like the Client, User and Language data as well as custom Security options can be set for each link individually independent of the original connection entry. To distinguish links from connections, an icon () is displayed next to the former one inside SAP Logon.
  • Create a New Folder (initial name is "New Folder")
  • Move connections or folders to another folder
• View options
  • Show/Hide Memo
  • Show/Hide Columns (only available with view option List Columns)
  • Hide Entry

    Hides a selected system connection or folder.

See chapter 3.4.1 Providing Connections.

The Trust Level Editor is a helpful tool to facilitate the management of custom trust levels. It contains the default trust levels of SAP GUI that work as an initial basis for the creation of user generated trust levels, stored in the file SAPGUI.policy. For more details and information regarding the concept and implementation of trust levels see Chapter 5.2.3.1 Concepts and Implementation.

The following functions can be executed via the dropdown buttons Trust Levels and Permissions on top of the textedit control or by invoking the contextmenu inside of it. Before selecting a button, mark a corresponding row inside the editor via the left mouse button to select a certain trust level, or invoke the contextmenu directly via the right mouse button.

• Add Trust Level: Invokes the Trust Level Properties dialog to add a custom trust level to the editor. The following fields are to be edited:
  • Key: Key name of a custom trust level "CLevel<number>". This value is not editable.
  • Prinicipal Class: From the dropdown list, choose com.sap.platin.base.security.GuiSessionPrincipal.
  • Copy Permission From: Select a default-, or a previously added trust level as a basis for creation.
  • Display Name & Display Description: These values are displayed on the Trust level classification:<SID> popup ( FILE  Edit Trust Level... ): "<Display Name>: <Display Description>".
  • Trust Level Order: This options affects the appearance of the list of available trust levels on the popup Trust level classification:<SID>. You can change the order using the mouse cursor.
  • Assigned Systems: Number of systems the trust level is assigned to. This information is stored and editable in the trustClassification file.

• Remove Trust Level: Removes the selected trust level.

• Trust Level Properties...: Invokes the Trust Level Properties of an already defined trust level. Similiar result to the execution of Add Trust Level, except that the fields Principal Class and Copy Permission From are not to be edited and therefore not displayed.

• Add Permission: After the execution of this function, the entry permission <PermissionClass> is created inside the editor, right below the selected custom trust level. Finally, right click <PermissionClass> and select an entry from the contextmenu to add a permission. You may also have to enter a "<target_name>" or an "<action>". For more information, see subchapter The Permission Entry.

• Remove Permission

SAP GUI for the Java Environment can be displayed in different themes and schemes. To define a standard theme go to  Design  Theme  in the Preferences dialog.

For Signature Design it is possible to create different schemes and to set a default scheme for all systems. Further more, each system can have its own custom scheme.

Custom schemes can be created with the Hue shift value scrollbar and saved with the Save As button. To set a scheme as the default-theme, select a theme from the list and choose Apply.

After login to a system, a scheme can be set for this particular system using the Menu  File  Set System Scheme for <SYSTEMNAME> . All possible schemes are displayed to choose from.

Some activities like pressing a button, changing the state of a radiobutton or checkbox and switching tabs of a tabstrip can trigger an audio feedback by default.

In this panel, font sizes can be set using preset combinations. Alternatively, fonts and font sizes can be set on an individual basis via radiobutton Use Expert Configuration.

You can choose a default Web Browser and change the Download Directory as well as the Upload Directory of SAP GUI.

Enter an appropriate path into the corresponding editfield, or click on the button Browse ... to change the Web Browser or a Directory.

To handle MIME types, it is possible to set appropriate applications. You can also add additional extensions to a MIME type.

• Select a MIME type from the list and press the button Add ... to add an extension.

• Enter the path to an application into the corresponding editfield or simply press the button Browse ... to define an application to handle MIME types.

The input by the user is stored locally by default. To modify the Input History settings, the following options are available:

• Current default values: Shows the current System Default as well as the User Default version of SAP GUI for Java
• Installed Versions: A list of all SAP GUI for Java versions that are istalled.

  • To set a default SAP GUI for Java version select one of the entries from Installed Versions and press the button Set default GUI. The changes will be displayed under Current default values.

  • To remove a default SAP GUI for Java version, press the corresponding button: Remove default GUI.

  • To adopt the changes press Apply.

There are three categories of certificates:

• User accepted certificates
• SAP certificates
• JRE certificates

It is neither possible to change SAP certifcates nor JRE certificates. So, only the button Details is available.

Scripting simplifies user interaction with SAP GUI by offering a macro-like interface that can be used for automating tasks.

SAP GUI for the Java Environment can be automated by executing scripts that emulate user interaction. These scripts can be created manually from scratch, or by recording user interaction. While a simple script may be used to present data on a SAP GUI screen, more complex scripts can easily automate whole transactions and even open connections to SAP systems automatically.

SAP GUI for the Java Environment comes with a built-in JavaScript engine. Detailed documentation is available in the SAP GUI Scripting document on SAP Community Network.

• Status messages
  • Show status bar text in new dialog: In addition to the status bar, a dialog displaying the status message will be displayed. This can be enabled or disabled separately for each message type: Success, Warning and Error.
• Dropdown listbox
  • Always show keys: In addition the the listbox text, keys will be displayed for the corresponding item (if available).
    • Sort items by key: Instead of the text, listbox items will be sorted by their key values if this option is enabled.
• Window title
  • Show long window name

java -jar PlatinGUI-<Platform>-<Version>S.jar uninstall

The uninstall command removes an installed version of the SAP GUI for Java.

java -jar PlatinGUI-<Platform>-<Version>S.jar version

The version command just lists version information for the installation package.

  Build date:          : 2014-07-26 06:06:02 +0200
  Build Info           : ldm046, 740_REL, 1478851
  Product type         : 1
  Numeric Version      : A074000040100
  Short Version Number : 7.40rev1
  Long Version Number  : 7.40 rev 1
  Short Version        : SAPGUI7.40rev1
  Long Version         : SAP GUI 7.40 rev 1
  Full Version         : SAP GUI for Java 7.40 rev 1
Official Version     : SAP GUI for the Java Environment 7.40 rev 1

You can automate the installation process by providing an installation response file using the -i <responsefile> option to the install command.

Complete lines can be commented with "#".

Example of a Typical Response File:

# Example of a typical installation response file
# suppress user interaction
disableui=true
# install to the default path
installidir=default
# reinstall gui if already present
reinstall=true

java -jar PlatinGUI-<Platform>-<Version>S.jar uninstall

On Windows platforms you can remove a centrally-installed SAP GUI for Java  using the Software control panel.

By default, the GUI start scripts use the Java Runtime Environment found in PATH (see requirements) or the application registration. On Windows and Linux, it is possible to use a different Java Runtime Environment then provided by PATH, if available. To do so, you have to specify it using the PLATIN_JAVA environment variable which points to the Java executable to be used. For example: /usr/bin/java. You can also use PLATIN_JAVA to provide the Java Runtime Environment with additional options.You can add the bin directory of the SAP GUI installation to your PATH in order to allow the invocation of the SAP GUI for Java from everywhere.

defaults write com.sap.platin JDKPATH 
    /Library/Java/JavaVirtualMachines/sapmachine-jdk-11.x.x.jdk

Every discussion about security always needs a backing security policy to define the meaning of security and to define what is acceptable and what is considered a threat.

The security concepts of the SAP GUIs are not concerned about securing the application server or to define who is allowed to connect to an application server but in contrary they deal with the question of controlling the access of back end ABAP code to local front end resources.

The SAP GUIs can access the local file system, are able to start child processes and also can access the configuration of the front end operating system by reading or writing configuration data or accessing system APIs.

For an ABAP program the SAP GUIs can act as service provider for printing documents or storing data in local files or retrieve information from the front end.

Since the SAP GUIs are run with usual user privileges, the possibilities to access or alter data are confined to the privileges granted to the current user account, still there is potential to disclosure or damage of user private information.

Different application servers may impose different trust relationships. A productive internal system running the local organizations human resources applications needs to be handled differently than a locally accessible system used for program development, where a lot of different people have access and also have the possibility to write their own (maybe just buggy or even malicious) code and where it is always possible to have a negative impact to local information, or a external system belonging to a customer or business partner.

On the other hand the SAP GUIs have more knowledge about the context of operations than the front end operating system and so can base their access control decisions on the trust relationship of the application server and the specific application running on this server.

The security concepts and the possibility of the SAP GUIs to control the access to local resources will not be sufficient for areas with a very high sensitivity, where the control of all data input and data output is mandatory. The only really reliable way to run client software in such an environment is to run the client in its own change root, or virtualized, sand box without access to the data on the host operating system at all.

Several versions of SAP GUI for Java can be installed and run on a single front-end computer in parallel. However, only one of the installed versions can be used within the web browser at one time. This dedicated version is called the "browser default version". Unless changed, this is always the most recent version installed.

You can configure the browser default version by using the Version Options dialog. Start SAP GUI for Java as a standalone application and choose  Options  Version  from the logon window menu to open this dialog. Use the Default version drop down list box to choose the default browser version.

For Mozilla this technique is not recommended as because the default browser settings will require several manual steps to download and execute the installation programs. Also, because Mozilla is available on numerous platforms it cannot easily be determined automatically which platform-specific software version must be downloaded. Therefore, an HTML page must be set to explain the installation process and offer download choices for all available platforms.

Many browsers have stopped the Java plugin from running automatically because of security issues, or by default only allow running the Java code in an additional sandbox preventing any OS and file system access although the applet is signed.

However running SAP GUI for Java as an applet needs access to the local file system to be installed and executed. Please refer to SAP Note 1831420 how to configure the browser to allow running SAP GUI for java on trusted sites.

In order to make a connection, the front-end computer is responsible for providing the complete route to the destination, possibly including a chain of several SAP routers. Path information is not provided by the routers. (Strictly speaking, an SAP router is actually better described as an application level proxy with password capabilities and strict source routing).

The address for each router is specified by a simple connection string (with the router's host name and port number), optionally followed '/P/' and the router password. The path from the current location to the destination is described by appending all router addresses together, followed by the address of the destination SAP system. Thus, a connection string with SAP routers generally has the form <router 1><router 2>.....<router n><destination>.

/H/gate.remote.org/S/3299/P/secret/H/gate.example.org/S/3298/H/host.example.org/S/3200

<---------- 1st router ----------><------ 2nd router ------><------ app_server ------> 

Care should be taken that the application server's port number is not confused with the message server's port number. In small installations the message server's host name can often be identical to the host name of an application server, the port number is however always different. Symbolic service names for message servers by convention have the form 'sapms<SID>', where <SID> is the SAP system ID.

/M/host.example.org/S/4253/G/SPACE

SAP router connection strings may be used in combination with message server connection strings simply by specifying the router address before the message server address. The router is then used for contacting the message server and the resolved application server.

• Trace Components and Trace Comments:

  List of active trace keys. Each trace key must occur on a separate line. Everything following a double-slash (//) on a line is regarded as a comment and ignored. Note that some trace keys (e. g. CON, SES, CALL and EVENT) are already preconfigured per default.

  Component	Description
  GUI Kernel
  CON	Connection
  SES	Session
  CALL	Automation Calls
  EVENT	GUI Events
  CON1	Connection (Details)
  SES1	Session (Details)
  C_NET	Network Communication
  NET	Network Communication
  PAR	Parser
  POLICY	Policy setup
  POLICYEXCEPTION
  Web Dynpro
  WDPDUMP	Parser Dump
  HTTPDUMP	Socket Dump
  Control Enabling
  C_CET	Control Enabling Technology
  CET	Control Enabling Technology
  DMGR	Data Manager
  DP	Data Provider
  DPTAB	Data Provider Table
  DRV	Data Provider Driver
  OLE	OLE Automation (Mac Only)
  SRV	GuiServices
  Start and Logon
  APPLET	Browser
  BOO	Bootstrap
  LOGN	Logon Functionality
  RFC	startup with RFC id
  GUI Components
  GBT	Button
  GBX	Box
  GCB	Check Box
  GCBX	Combo Box
  GCO	Container
  GCT	Combo Text Field
  GFW	Window
  GLN	Line
  GMB	MenuBar
  GMI	MenuItem
  GMN	Menu
  GSC	Scroll Container
  GSF	Symbol Field
  GTBN	Toggle Button
  GTC	Text Field
  GUA	User Area
  GUA_R	User Area Raster
  GSC_R	Scroll Pane Raster
  GSI_R	Simple Container Raster
  Control Components
  CHART	Chart Control
  CTM	Context Menu Control
  GRD	Grid Control
  HTML	HTML Control
  PICT	Image Control
  TBCL	ToolBar Control
  TREE	Tree Control
  DIAG Parser
  C_AGI	DIAG Parser Interface
  C_CON	Connection
  C_SES	Session (externam mode)
  C_AREA	Area Adopter (Containers)
  C_ATOM	Atom Adaptor (Containers)
  C_MENU	Menu Adaptor
  C_TABL	Table Control Adaptor
  C_TOOL	Toolbar Adaptor
  C_WIND	Window Adaptor
  C_PAR	DIAG Parser
  C_EVT	Event Handler
  GMUX
  C_GMUX	Graphics Multiplexer
  GMUX	Graphics Multiplexer

• Output Format:
  Determines the additional information output before each line of trace output

  • Date/Time:
    Timestamp Information

  • Thread:
    Name of the active thread

  • Millisecond Delays:
    Delay in milliseconds since last trace output

• Dump:

  • Component Tree:
    All GUI components in the object tree

  • Automation Table:
    All GUI automation objects

• Logfile for error / traces:

  Specify a trace file name here (absolute filenames should be used). Leaving this field empty disables the use of trace files. Changes to this field will close any previously active trace files. Trace files are always opened in 'append' mode. For OS X, note that you must use slashes (/) as file name separators here.

  To enable tracing for selected compenents check the checkbox Start Trace. The path to the trace file will be displayed on a pop up after pressing Apply or OK. Press Show Log to display the trace file.

  Note Errors and dump information are also written if the checkbox Start Trace is not checked.

Press the OK or Apply button to save the new settings (Apply will keep the dialog open, while OK will close it). Press Cancel to discard all changes and close the dialog.

If SAP GUI for the Java Environment is started with a direct connection, there is no logon window for adjusting trace settings before logon. If it becomes necessary to generate trace information before the first session window appears (for example, because the logon process itself is to be traced), the following procedure is required to set trace keys from the command line (only recommended if the desired trace information cannot be produced using the logon window):

1. Modify the command line invoking the GUI by inserting the parameter -t, followed by a single space and the required trace keys separated by colons (:). This parameter must be the first command line parameter after com.sap.platin.Launcher. The actual command line is platform dependent.
2. Trace information is output to standard error (depending on the operating system, this can be redirected appropriately).
3. If trace information is additionally to be written into a trace file, the file name can be specified by inserting the parameter -l, followed by the name of the trace file. Use forward slashes (/) to separate directory names.

... com.sap.platin.Gui -n -t BOO:LOGON:RFC -o /H/...

... com.sap.platin.Gui -n -t BOO:LOGON:RFC -l /tmp/guitrace.txt -o  /H/... 

If it becomes necessary to generate trace information before the first session window appears in the applet (if, for example, because the applet startup process itself is to be traced), the following procedure is required to set trace keys from the HTML page (only recommended if the desired trace information cannot be produced using the logon window):

1. Make a (local) copy of the HTML page containing the applet reference (you should avoid enabling trace on a web page that is used by others).
2. In the local copy of the HTML page, specify the required trace keys in the 'trace' parameter on the web page, separated by colons (:). Note that the syntax of the parameter is different for Internet Explorer and Mozilla (see chapter 5.2.4 Applet HTML Reference).
3. Open the Java Plugin Configuration Panel. This is a program installed by the Java Plugin and located in a place that is platform-specific:

   Windows:
   In the Windows  Start  Programs  menu.
   Linux:
   In /<java instalation directory>/jre/bin/ControlPanel.
   OS X:
   In  System Preferences  Other  Java  menu.

4. Make sure the Show Java Console check box is checked.
5. Close all browser windows, so that the Java Plugin is unloaded.
6. Open the Web page modified above with your browser.
7. Trace output is shown in the Java console window that appears when the virtual machine is started (if the console window does not appear, repeat steps 3 and 4 and ensure all browser windows are closed).

...
<PARAM NAME = "trace" VALUE = "APPLET:LOGON">
...

...
trace = "APPLET:LOGON"
...

If it ist not possible to use the Java console for applet trace output, a tracefile can be written from the applet by performing the following steps (in addition to the steps to activate applet trace as described above):

1. In the local copy of the HTML page, specify the local file name of the trace file in the trace file parameter on the web page. Use forward slashes (/) to separate directory names. Note that the syntax of the parameter is different for Internet Explorer and Mozilla (see chapter 5.2.4 Applet HTML Reference).
2. Open the modified web page with your browser.
3. Trace output is written into the local trace file and additionally shown in the Java console window (if enabled, see above).
   Example For Internet Explorer, the trace file C:\tmp\guitrace.txt, shows only the parameter:

   ...
   <PARAM NAME = "tracefile" VALUE = "C:/tmp/guitrace.txt">
   ...

   Example For Mozilla, the trace file C:/tmp/guitrace.txt only shows the parameter:

   ...
   trace = "C:\tmp\guitrace.txt"
   ...