Hello,
I installed Netweaver SSO 2.0 Secure Login Server.
Configured ABAP and Java Systems' SSO.
I have also Business Object system in my landscape.
Is it possible to login BO system using secure login server certificate?
If yes how can we configure? Is there a document for this?
Thanks.
Yuksel AKCINAR
Dear Experts,
Good day. I have looked at several demos regarding the configuration of SSO with HTTP connections, but most seems to point to configurations that require SSL. My primary reference for the task is the 5th part of the link below. So far, I have configured as instructed on the link, except for the SSL part, and it doesn't work.
http://scn.sap.com/docs/DOC-40179
Please advise. Thank you.
Regards,
Tom
Hi All,
We are planning to implement Kerberos authentication using our Window AD. I have below queries regarding the same.
1. Our ERP is ECC 5.0 with SAP_BASIS 640 patch 31, will this support Kerberos authentication.
2. If supports, we have different user id's in Windows AD and ECC for the same user. Will this supports. (For example in Windows AD we have SSOTEST, same user has TESTSSO in ERP)
3. Is Kerberos authentication required separate license.
If possible provide links for the same.
Regards,
Sree
Hello,
we've succesfully implemented SSO authentication processes with our kerberos token for SAP Gui.
Now we'd like to unify the authentication process for all SAP applications, not only SAP Logon for SAP Gui.
Is there a way to have for example the Business Explorer tools like Query Designer to use SSO authentication? I couldn't find an option for that.
And is it possible to use Kerberos authentication when calling up the ICM addresses of our SAP systems? With SAP Portal it's no problem, we are already using that as a pre-authentication step with Logon tickets, but the ICM address itself without using the SAP Portal before doesn't offer SSO processes, am I right?
Thank you for your help.
Dear All,
We are planning to enable SSO for our SAP systems (R/3, Portal, Solman) with windows AD. Do anyone let us know if SAP charges license cost for This. As per our understanding it should not charge any cost as we are using AD and SAP functionalities and not any add-ons or additional tools.
Appreciated your valuable inputs in this regard.
Thanks,
Satyabrat
Hi Experts,
For configuring SSO, I have a BO system, SAP BI 7.4 ABAP stack , MS active directory and third party certificates ( not the one SAP provides) . The technology to be used for SSO is SAML 2.0 . I see that transaction code SAML2 has an option to enable SAML. In tSAML2 I can start by configuring local provider. However I am not very clear about the overall architecture and specific steps. In this scenario is BO and SAP BI are service providers and MS active directory is identity provider? In such case what all are the specific configuration steps in SAP BI, BO and MS directory?
Thanks and Regards,
Syam
Hi Guys
I’m wondering to know if you have a Document/table or something that show what are the supported standard technologies that NW SSO offer for third party integration.
Thanks a lot in advance.
Dear Colleagues,
We have configured secure login client to allow sso to our abap systems. The configuration is working, but the first time the user logs in to an abap system he needs to select certificate in the secure login client. Besides the kerberos token we have a microsoft certificate. As soon as you select the right entry (kerberos) sso will work. As we are rolling the sap gui out to tousands of users I would like to prevent this pop-up. Any idea if this is possible?
Regards,
Alexander
Hello,
I installed SAP Installation Server version 9.0.58.
I can create packages about SAP GUI versions.
But I cannot create a package for Secure Login Client.
Secure Login for SAP Single Sign-On Implementation Guide says that:
"You use the SAPSetup Installation Server to distribute SAP front-end software on multiple workstations across the network. You can create your own installation package or deploy Secure Login Client on multiple clients."
But how? I could not find a detailed document about deploying SL Client on multiple clients.
Has anybody experienced deploying SL Client with Installation Server?
Can you help about the issue, please?
Thanks and Regards,
Yuksel AKCINAR
Login testing the service WebGUi
1. SICF->Default_Host->sap->bc->gui->sap->its->webgui –test the service
Getting this Prompt for first AD user ID and Password and then SAP user ID and Password.
2. Same thing happens with NWBC and BW-Portal Login- it Prompts for AD ID and then SAP ID and passowrd.
Where as ABAP SSO work perfect.
Here are my configuration steps.
NWSSO Configuration Steps.
1. Service User in the MSADfor AS-ABAP or AS-JAVA/Portal with following information
• User ID: SAPService<SID>(existing individual<SID> Service user id)
• Set the User cannot change the password
• Set Password never expire
2. Created SPN for this Service User
• For ABAP -SAP/SAPService<SID>
• Web (HTTP/ Hostname for ABAP apps server)
3. Installed Secure Login Library on SAP Server
• Created a folder name (SLL)in /user/sap/<SID>/DVEBMGS00 ($(DIR_INSTANCE)\SLL)
• Verified SLLibrary:(Version - 8.4.18.0)
(Starting NW7.4 sapcrypto library is coming and check the version is same at SLL directory and in the Kernel Dir.
4. Define the following SNC parameters using RZ10
snc/identity/as = p:CN=SAPServiceSB1@mycompany.com
snc/enable = 1
snc/accept_insecure_cpic = 1
snc/accept_insecure_rfc = 1
snc/accept_insecure_gui = 1
snc/data_protection/min = 3
snc/data_protection/max = 3
snc/data_protection/use = 3
snc/permit_insecure_start = 1
snc/r3int_rfc_qop = 8
snc/r3int_rfc_secure = 0
snc/force_login_screen = 0
spnego/enable = 1
spnego/krbspnego_lib = $(DIR_INSTANCE)\SLL\sapcrypto.dll
snc/gssapi_lib = $(DIR_INSTANCE)\SLL\sapcrypto.dll
5. Kerberos KeyTab was generated successfully for SPNEGO/SNC and verified
#sapgenpse seclogin -l –v
6. Configured Credential file and verified
7. Install Secure Login Client and defined SNC name as p:CN=SAPServiceSB1@mycompany.com
8. Configure User Mapping in SAP AS ABAP – SNC name – p:CN=<USERID>@MYCOMPANY.COM
9. Restarted the SAP server and my ABAP SSO is working perfectly.
10. SPNEGO Configuration:
a. Define Kerberos KeyTab for SPNEGO using tcode – SPNEGO
b. Created UPN - SAPServiceSB1@MYCOMPANY.COM with the password of this server ID.
For WebGui all the required Service are activate and published via SICF and also per http://scn.sap.com/docs/DOC-29485
Created SAP Message and SAP also confirmed all your setting looks and Kerbros being case sensitive but since my ABAP SSO is working so that possibility is also ruled out.
Are there any different steps or know issue with above setting for SPNEGO. I have not mention the steps for Portal because first lets get the Webgui or NWBC resolve which usages the SPNEGO configuration.
Greetings all,
We ran a pilot test of SSO 1.0 a few years ago and have decided to revisit SSO 2.0. I have found the implemetation guide and the master document as well as the great SSO 1.0 - based videos, but I find that the screens we encountered in 1.0 have absolutely no match to those in 2.0 and the current guides don't have any screen shots and don't follow a logical sequence. I'm struggling to even match the terminology used between the 1.0 and 2.0 screens. Is there anywhere to find good documentation on this product?
Thanks,
Mike Dumas
SAP Single Sign-On 2.0 supports mobile SSO based on the SAP Authenticator application.
Please share with us: What are the predominant mobile devices, used by your corporate users, based on the OS type?
Thank you for your participation!
Regards,
Product Management SAP Single Sign-On
SAP Single Sign-On 2.0 supports mobile SSO based on the SAP Authenticator application. Please feel free to participate in this poll by SAP Product Management. Thank you for your participation! January 16, 2015
Check out the new sizing guide for Secure Login of SAP Single Sign-On 2.0. The document provides guidelines and recommendations on hardware requirements and software considerations for your implementation. November 18, 2014
In her latest step-by-step guide, Donka Dimitrova explains in detail how to enable mobile single sign-on for SAP Fiori using the SAML 2.0 Identity Provider and one-time password authentication mechanism. Also learn how to enable mobile single sign-on for cloud applications using SAP Authenticator. November 17, 2014
I have to implement single sign-on functionality between Facebook and sap Netweaver AS Java 7.31. So that, UME users should be able to login into SAP Netweaver Administrator without entering there SAP Netweaver user id and password. Instead, they should be able login by entering there Facebook user id and password.
For example:
Suppose there are 5 UME users accounts in SAP Netweaver Administrator with the following names or ids "A", "B", "C", "D", and "E". When user "A" clicks on Facebook login button he has to login into his account on SAP Neweaver portal and it should be same for the other users also.
Could anyone please guide me or share some helpful links which might help me to implement the above functionality.
Hi All,
We are planning to implement Kerberos authentication using our Window AD. I have below queries regarding the same.
1. Our ERP is ECC 5.0 with SAP_BASIS 640 patch 31, will this support Kerberos authentication.
2. If supports, we have different user id's in Windows AD and ECC for the same user. Will this supports. (For example in Windows AD we have SSOTEST, same user has TESTSSO in ERP)
3. Is Kerberos authentication required separate license.
If possible provide links for the same.
Regards,
Sree
Dear Experst ,
I Have enabled Single Sign On on the SLD.
However ,when i try to open SAP ,I do not see the databases .But when i click on the refresh button ,i get the following message.Kindly assist.
Dear Experts,
Good day. I have looked at several demos regarding the configuration of SSO with HTTP connections, but most seems to point to configurations that require SSL. My primary reference for the task is the 5th part of the link below. So far, I have configured as instructed on the link, except for the SSL part, and it doesn't work.
http://scn.sap.com/docs/DOC-40179
Please advise. Thank you.
Regards,
Tom
I'm trying to set up an SAML 2.0 based SSO between the SAP portal (java 7.4) and CA siteminder.
I was following the instructions in
and the metadata files were exchanged.
On the portal, the IDP seems to be active, however,when logging on to the portal the normal SAP user authentication comes up.
Any idea what could be the issue?
thanks
Hello,
We want to install SSO 2.0 on our BW/BPC environment. Our users will login via EPM add-in on MS Excel. We implemented the Secure Login Client scenario with Kerberos & SPNego only to find out that EPM users are unable to login with SPNego activated and that EPM is not
compatible with SPNego. We now need to implement Secure Login Server to issue x.509 certificates, however we do not have an AS JAVA instance in our environment (except Solman). Is it possible to use the JAVA instance on Solution Manager for SL Server or do we need a new installation? Would the installation of an AS JAVA instance for BW/BPC cause an issue with the HANA installation or would we install EP?
Thank you,
Tamara
Hi All,
We are planning to deploy NW SSO to enable Single Sign-On for NWBC for HTML and AS ABAP with Kerberos and SPNEGO. According to my understanding, the Kerberos token do not need any CA to sign, however, for https connection between NWBC for HTML and AS ABAP, we need a certificate signed by one of the CA, is it true?
If it required a CA for SSL-related certificate, can the Secure Login Server component provide necessary capabilities to sign the certificate? If it's not possible, what is the alternative option to obtain the required certificate?
Regards,
Duy
