Hi Experts,

We have a SAP HANA XS Application which has a drill down link to an ECC Web Application. When this link is clicked the User is prompted for the Login Screen by the ECC System.

The requirement is to have SSO configured for this ECC System such that if the user is coming from HANA XS Application, then the user should be automatically logged in with the required user into the ECC system.

Is there a way that this can be achieved?

--

Thanks and Regards,

Shreepad Patil

Hi,

We have users that work from home and use the Secure Login Client (Fat client). We are using the SPNEGO authorization method. When they start their computer, they are not connected to the network. The SLC starts at computer startup and runs into a "No host found." error. This is correct. They then connect to the network use VPN software. Since the SLC did not connect at startup, the user does not have a valid certificate. Is there a way to get the SLC to automatically login to the SSO server after the user has connected to the VPN, or do they have to manually login after the connection?

Thanks for any help!

We are currently developing an application using SAP ID Service (SCN password) and SSO as main authentication principle.

As our application might be used by external partners / agencies it would be great if they could request a client certificate.

I only found this URL to request a client certificate:

https://websmp202.sap-ag.de/~form/sapnet?_SHORTKEY=00200797470000029066&_SCENARIO=01100035870000000202&

And some additional information around it. it seems that only customers / partners are eligible for requesting a SAP Passport.

My question is now, if there is also some kind of a self-service for creating a client certificate for public SCN users in order for future usage of HCP applications.

Best regards

Johannes

Good day,

Please help, we are implementing SSO using Secure Login Server, Secure Login Client, Active Directory, X.509 certificates. We've managed to get the setup to work for SAPGui with the Secure Login Server connected to the AD. However we cannot get nwbc (desktop & html) to work. We've done the nwbcoptions.xml settings, as well as transaction SPNEGO still the logon screen keeps popping up.

Any pointers would be appreciated.

Dear SAP Community,

We are running a website where users need to be authenticated from the Portal.

Scenario:

User logs in into SAP portal via SAML Authentication. This user can view a link in the Portal he can click the link and will be transferred to a website on another domain. This domain will receive the a "ticket" and the user will be able to login.

Information from a friend:

If you have a setup that uses SAML, there are mechanisms to transfer that session between domains that basically rely on passing a ticket through the URL to the client from the authentication server, and that ticket is then passed to the site you want to authenticate against, which can use that to establish the identity of the user with the authentication server and establish the sessi

Does SAP provide a solution for this.

Hi,

We have configured kerberos only authentication (NW SSO) for all our SAP systems. The single sign-on works perfectly fine. But in our production systems there are 9 app servers. We have activated SNC as per procedure and we use logon groups for signing in to SAP. The SSO works fine, but sporadically it does not work and it prompts for user name and password in the login screen.We have tested SSO for each individual app servers including CI and it works fine. Even with logon groups it works fine most of the times but at times it prompts for login screen. We use Secure Login client 2.0 SP3.

Thanks

Thilip Kumar

Hello

We are in the middle to configure SSL in SAP ECC 6.0.

I have couple of questions for Common Name (CN) that needs to be define while creating the SSL server PSE.

  a. Should we use server name or SID name or * in CN field? SAP is not supporting * but some non-sap sites

     are suggesting to use *.

  b. In our enviornment, we have CI and more than one dialog instances. If we need to define server name

     in the CN field, do we need to create SSL server PSE for CI and DI's separately (mean multiple SSL

     for one SID).

or is there another option instead to use multiple SSL for one SID.

Pls suggest.

Thanks

Amar

Hi guys,

after installing the SSO client for the first time, we have intermittently noticed a profile selection dialog popping up when a user tries to connect to an SNC-enabled SAP system using SAP GUI. The dialog asks the user to select a profile (in our case we have two SLS profiles). The selection is then remembered from that point going forward, same as if the user would make the selection in the client directly (via right-click).

The question is what exactly triggers that dialog from appearing since we have not been able to reproduce it - even if no profile is selected as "use for secure login".

Is there a registry key maybe that we're missing? We played around with allowFavorite, but that didn't help.

Thanks

Michael

All

Assuming a customer has Windows / Oracle environment for his SAP applications

I understand that SAP provides the wrapper libraries for Kerberos SSP

If the objective is to get simple SSO into the sap application using SNC (SAPGUI), in what way is NW SSO 2.0 superior?

Or in other words , what are the shortcomings of a Kerberos SSP solution which is for free that a customer has to buy the license for NW SSO ?

Details would be much appreciated

Note : Its clear that SSO to browser based icm applications iwth spnego is only possiblke with NW SSO but this is not required for the time being and SSO to the SNC interface with SAPGUI is the sole criteria

Thx

Hi,

We are configuring SSO with an external service provider and plan to use SAML 2.0 for this purpose.

We installed IDMFEDERATION on a NW Java 7.4 machine and configured IdP there. Installed the certificate from the service provider into the keystore and created the URL iView and maintained the parameters.

Service Provider is requesting a SAML 2.0 sample response file to configure the extraction part at his end. How do I create a SAML sample response file. Please let me know.

Thanks!!

BR,

Sanjeev

Login testing the service WebGUi

1. SICF->Default_Host->sap->bc->gui->sap->its->webgui –test the service

Getting this Prompt for first AD user ID and Password and then SAP user ID and Password.

2. Same thing happens with NWBC and BW-Portal Login- it Prompts for AD ID and then SAP ID and passowrd.

Where as ABAP SSO work perfect.

Here are my configuration steps.

• Our OS: Windows Server 2012
• DB: MSSQL 2012
• AD: Microsoft Active Directory
• SAP NW7.4 with SPS5
• SAP Installation – Central System
• SSO product- SAP NW SSO2.0 SP03
• SID – SB1, SE1 ….
• DOMAIN: MYCOMPANYNAME.COM ( Just an example, not the real name)

NWSSO Configuration Steps.

1.  Service User in the MSADfor AS-ABAP or AS-JAVA/Portal with following information

  • User ID: SAPService<SID>(existing individual<SID> Service user id)

  • Set the User cannot change the password

  • Set Password never expire

2.  Created SPN for this Service User

  • For ABAP -SAP/SAPService<SID>

  • Web (HTTP/ Hostname for ABAP apps server)

3.  Installed Secure Login Library on SAP Server

  •  Created a folder name (SLL)in /user/sap/<SID>/DVEBMGS00 ($(DIR_INSTANCE)\SLL)

   • Verified SLLibrary:(Version - 8.4.18.0)

(Starting NW7.4 sapcrypto library is coming and check the version is same at SLL directory and in the Kernel Dir.

4.  Define the following SNC parameters using RZ10

   snc/identity/as = p:CN=SAPServiceSB1@mycompany.com

   snc/enable  = 1

   snc/accept_insecure_cpic = 1

   snc/accept_insecure_rfc = 1

   snc/accept_insecure_gui = 1

   snc/data_protection/min = 3

   snc/data_protection/max = 3

   snc/data_protection/use = 3

   snc/permit_insecure_start = 1

   snc/r3int_rfc_qop = 8

   snc/r3int_rfc_secure = 0

   snc/force_login_screen = 0

   spnego/enable = 1

   spnego/krbspnego_lib = $(DIR_INSTANCE)\SLL\sapcrypto.dll

   snc/gssapi_lib = $(DIR_INSTANCE)\SLL\sapcrypto.dll

5.  Kerberos KeyTab was generated successfully for SPNEGO/SNC and verified 

        #sapgenpse seclogin -l –v

6.  Configured Credential file and verified

7.  Install Secure Login Client and defined SNC name as p:CN=SAPServiceSB1@mycompany.com

8.  Configure User Mapping in SAP AS ABAP – SNC name – p:CN=<USERID>@MYCOMPANY.COM

9.  Restarted the SAP server and my ABAP SSO is working perfectly.

10.     SPNEGO Configuration:

     a.  Define Kerberos KeyTab for SPNEGO using tcode – SPNEGO

     b.  Created UPN - SAPServiceSB1@MYCOMPANY.COM with the password of this server ID.

For WebGui all the required Service are activate and published via SICF and also per http://scn.sap.com/docs/DOC-29485

Created SAP Message and SAP also confirmed all your setting looks and Kerbros being case sensitive but since my ABAP SSO is working so that possibility is also ruled out.

Are there any different steps or know issue with above setting for SPNEGO. I have not mention the steps for Portal because first lets get the Webgui or NWBC resolve which usages the SPNEGO configuration.

Hello,

we have a Problem with the SAP Password Manager and Internet Explorer 11.

After the Upgrade from IE9 to IE11 the Add-On wouldn't start in the IE11. I can see that the Add-On is active but there is no active Tool Bar, also the Passwrod Manager ist wihtout any function.

Have any other the same Problem?

Thanks for your assistance.

Dear Sirs,

I try to do an authorization to my NW 7.3 Java instance through my Windows domain authorization.

I done:

1) Create connection to LDAP-server and tested it.

2) Add windows domain certificate to TrustedCAs

3) Configure SPnego

Now, I can to login in my NW7.3 Java instance with my windows password, but however I must to input password when I open NW7.3 Java homepage.

Is it possible to login into the Java instance without password's input, using my windows workstation login/password?

What I have to do for that?

I use Windows XP on my workstation and IE 8.0.6 & Chrome 38.0.2125.

Best regards,

Alexey Lugovskoy

Hello All,

We have recently (successfully) configured SAML2.0 on AS ABAP (ERP 6.05/NW7.02) for authenticating Web Applications (Web Dynpros, Fiori Apps...etc) via a Web Browser internediary, and using ADFS as the Identity Provider.

We would now like to extend this configuration for Message Based Authentication for Webservices being consumed by other (non-web browser) intermediaries (such as SharePoint, Project Server, Software AG (ESB)...etc).

The configuration completed so far is detailed as follows:

• SAP SSL
  • SAP Crypto Library (Version 8.4.25, SSF 1.840.40)
  • SAP PSE's and Certificates (all certs are self signed and not verified by a CA)
    • System PSE
    • SSL Sever Standard
    • SSL Client Standard (SSL Root Certificate of ADFS)
    • SSF SAML2 Service Provider - Encryption
    • SSF SAML2 Service Provider - Signing (ADFS Signing Certificate)
    • WS Security
  • Session Security Activation (Client Activated)
• SAP SAML2 Configuration
  • Local Provider
  • Local Provider Metadata exported and imported in to ADFS
  • Trusted Provider (ADFS Metadata and Signing Cert imported into SAP)
  • Endpoints default = HTTP Post, Binding = HTTP Artefact, Supported Name Format = Unspecified/Logon ID
• SAP SAML2 Message Based Authentication Configuration:
  • Secure Token Service (ADFS Metadata and Signing Cert imported into SAP, Supported Name Format = Unspecified/Logon ID (no users mappings maintained))
  • Web Service Policy - SAML 1.1 (Asymmetric consumer key, STS as attester. Authentication Contexts Alias = unspecified)
  • Web Service Policy - SAML 2.0 (Asymmetric consumer key, STS as attester. Authentication Contexts Alias = unspecified)
  • Service User DELAY_L_<SID> (WSS_SETUP), SAML 1.1 Trust
• Web Service (SOA Manager) Configuration:
  • Transport Guarantee/Communication Security = SSL (though we have also tried; No Authentication and both Symmetric/Asymmetric Message Signature/Encryption)
  • Authentication = SSO using SAML
  • Secure Token Service = Web Service Policy - SAML 1.1 (Asymmetric consumer key, STS as attester. Authentication Contexts Alias = unspecified)

Test Results/Errors:

We have used SOAP UI to make the webservice calls in our tests, with the following results:

• When using a username/password authentication at the message level the service call works
• When sending a signed message with SAML authentication with sender vouches subject confirmation, it fails:
  • ​If we use a certificate added to the truststore we get an encryption-related error
  • If we use an arbitrary, non-trusted certificate, we get a different error saying that the signature is not recognized.

Questions:

1. Is it mandatory to have the certificates in the SAP Trust Store (STRUST) signed by a verified Certificate Authority (CA) ?

2. If so, which Certificates need to be signed by the CA ?

3. Referring to the configuration detailed above, Is there any configuration or specific settings that have been missed ?

4. For the Web Service (SOA Manager) config, what is the recommended Transport Guarantee/Communication Security method ?

Your time and guidance on this discussion is greatly appreciated.

Thank you and regards,

James Curran

SAP Technical Consultant

Dear All,

In chapter "4.7.3.1.6 Using Kerberos for SNC with Users in Different

Domains" of the SAP SSO Implementation guide it is mentioned that it

might also be possible to setup SNC for users in different domains

without having a trust relationship for the different domains.

"Since it is not so easy to configure trust relationship for different

domains, the Secure Login Library also supports another option."

1. Is the CommonCryptoLib really supporting SNC for different donains without a trust?
2. Where can I get further information for this option?

BASIC PARAMETERS:

CommonCryptoLib (SAPCRYPTOLIB) Version 8.4.30 pl40

SAP GUI 7.30 PL 10 used on Windows 7 Client for testing

We are currently getting errors when trying to use SNC in another domain which has no trust to the main domain. That's the reason for this post.

I have attached the trace file of the secure login client.

Thanks & Best Regards

Matthias

PROBLEM

If two Secure Login Server instances are running independently, i.e. not in a NetWeaver cluster, their configuration is not synchronized. While Secure Login Server Administrator Console allows to maintain the same X.509 PKI by exporting and importing Certificate Authority objects, it is not possible to create exactly the same Client Authentication Profiles and Policy Groups, as they get a random GUID as part of their URLs, even if the same display names are chosen. This leads to compatibility issues if such independent SLS instances shall be used for load balancing or fail-over.

SOLUTION

A manual export and import of all configuration items except the PKI objects can be done with AS Java Config-Tool, as illustrated in this blog.

PREREQUISITES

1. AS Java SourceSystem is up and running, Secure Login Server configuration is complete and tested.
2. AS Java TargetSystem is up and running, no Secure Login Server deployed yet, or Secure Login Server deployed but not configured yet.
3. On both systems, you are able to launch AS Java Config-Tool, which may require a remote desktop or X session:
   • LINUX:        cd /usr/sap/SID/INST/j2ee/configtool ; ./configtool.sh
   • WINDOWS: cd D:\usr\sap\SID\INST\j2ee\configtool && configtool.bat
4. There is a file share available in both systems that allows to write and read from both systems, because AS Java Config-Tool uses files on the remote system only.
5. On both systems, SAP JVM is running with the same Java JCE Security Policy; recommended is JCE Unlimited Strength Jurisdiction Policy Files if applicable for your country: Download the Java 1.6 policy files and extract them here (rename the original files):
   • LINUX:        /usr/sap/SID/SYS/exe/jvm/OS/sapjvm_6.xxx/sapjvm_6/jre/lib/security/
   • WINDOWS: D:\usr\sap\SID\SYS\exe\jvm\OS\sapjvm_6.xxx\sapjvm_6\jre\lib\security\
6. The Secure Store Key Phrase must be the same on both systems; change it with AS Java Config-Tool if this is not the case.
   
   Note: Changing the JCE Security Policy requires to shut down AS Java, and to restart AS Java Config-Tool before changing the Key Phrase; changing the Secure Store Key Phrase is effective only if "Apply Changes" is performed. Do not start AS Java before all these steps are successfully done in this order. The target system can be kept stopped until the export/import procedure is completed.

EXPORT FROM SOURCE SYSTEM

1. Launch AS Java Config-Tool
2. Switch to configuration editor mode
3. Switch between view and edit mode
4. Select node "SecureLoginServer"
5. Select menu item "Export"
6. Give a valid file name in the file share, press "Start export". Occurring errors may be caused by missing write permissions in the file share.
7. If exporting is successful, press "Close window"
8. Close AS Java Config-Tool with its "Exit" menu

IMPORT INTO TARGET SYSTEM

1. Launch AS Java Config-Tool
2. Switch to configuration editor mode
3. Switch between view and edit mode
4. Select root node "Configurations"
5. Select menu item "Create sub-node"
6. Enter name "SecureLoginServer"
7. Press "Create", then "Close window"
8. Select the new node "SecureLoginServer"
9. Select menu item "Import"
10. Select the exported configuration from the file share
11. Press "Start import"
12. Press "Close window"
13. Close AS Java Config-Tool with its "Exit" menu

FINALIZING TARGET SYSTEM

1. Once the configuration import was successfully done, AS Java can be started (or must be restarted, if already up and running).
2. Now Secure Login Server can be deployed according to the product guide.
3. Don´t forget to associate the SLAC_SUPERUSER role to your NetWeaver administrator.
4. Open NetWeaver Administrator > Configuration > Authentication and Single Sign-On.
5. Create all Policy Configurations and Login Modules as in the source system.
6. Now Secure Login Administrator Console can be opened.
7. In Certificate Management, create your target system PKI by importing the PKI objects from your source system (e.g. by having both SLAC browser windows open and using your Desktop as import/export share).
8. Edit all profiles in Client Management > Client Authentication Profiles, open User Authentication, and select the correct "Policy Configuration" values.
9. Edit all profiles in Client Management > Client Authentication Profiles, open User Certificate Configuration, and select the correct "User CA" values.
10. Edit all profiles in Client Management > Client Authentication Profiles, open Secure Login Client Settings, and select the correct "Host Name" and "Port" values.
11. Edit all profile groups in Client Management > Profile Groups > General, and select the correct "Host Name" and "Port" values.
12. In Client Management, enable all profiles that are eventually locked.

CONCLUSION

That´s it. Now your target system´s Secure Login Server will look like the source system, except its hostname.

Be aware that any changes in one of the systems are still not synchronized after this procedure. Adding a client profile in one system requires a similar export/import with AS Java Config-Tool.