In these article, we covered all the steps which is required to implement Single Sign On (3.0) for SAP ABAP Application servers.
Single Sign On (SSO) Overview.
In a default SAP setup, users enter their SAP user name and password on the SAP GUI logon screen. SAP user names and passwords are transferred through the network without encryption.
To secure networks, SAP provides a “Secure Network Communications” interface (SNC) that enables users to log on to SAP systems without entering a user name or password. The SNC interface can also direct calls through the SAP Cryptographic Library to encrypt all communication between SAP GUI and the SAP server, thus providing secure single sign-on to SAP.
No additional Single Sign on (SSO) server is required in this scenario. Working on the front-end software, the user experiences streamlined, easy accessibility.
Advantages.
Security.
Cost saving.
Simplicity.
The following diagram is shown step by step workflow and communication in between different components.
Execution steps.
Step: - 1 Create a one service account in the Windows domain controller.
We recommend the format is Kerberos<SID>.
Note. We recommend that you do not use SAP Service<SID> because the Password Never Expires option is not set for this account by default. If the password for this account expires, single sign-on fails.
*** Go to Windows AD and create service account as SSA_SNC_SPNEGO.
Step :-2. Registered the Service principle name for Service account.
Register the Service Principal Names (SPNs) for the service account for the host name of the SAP NetWeaver AS for ABAP and all AS ABAP aliases.
Ensure that all SPNs are unique. you can check the cmd as setspn -X SPN Name.
*** Go to Active Directory Users and computers and right click on Service account properties and assigned SPN name as per below steps
.
In Attribute Editor, edit the SPN name and set the required SPN name for service account.
In screenshot, we have set SAP/FQDN of SAP Server and HTTP/FQDN of SAP Server.
Once set the Service Principle Name, you can click on Apply and Ok
.
Step – 3. Upgrade the SAP Crypto lib version to 8.5 and restart the Application server
Step – 4.
Execute SNCWIZARD T- code in SAP. It will throw an error “ SAPCRYPTOLIB too old”.
As a solution apply SAP Note – 2304831.
Download the SAP Note using transaction SNOTE.
Select the SNOTE and execute it.
Note : SPNEGO and SNCWIZARD Transactions can work only SAP NetWeaver AS for ABAP 7.4 SPS08 or higher.
SAP Note is successfully implemented.below screenshot for reference.
Step – 5 Set the profile parameters for SNC in the t-code SNCWIZARD
Click on continue.
Keep it default value and continue.
In below profile parameters set in default profile after complete this sncwizard. it's required to restart the system to effect these parameter values.
Click on Complete and make sure Application server is restarted to affect the parameter values.
Step – 6 Create or validate the key tab for Kerberos based SNC in the Tx- SPNEGO.
Continue for next step and then enter the Service User ID.
Switch the Service principal names tab, it will shows SPN names we assigned for service user account.
In below screenshot, user principal uniqueness and Token checks are green mark. That is for no issues found in SPN’s.
Click on to continue.
Click on complete and close this wizard.
Step – 7 Mapping windows domain user ID to SAP User ID Using t-code SU01.
Step-8 Install secure Login software in client machines.
See below URl for more details.
https://help.sap.com/viewer/df185fd53bb645b1bd99284ee4e4a750/3.0/en-US/da610fd072e4409baa8b6a96973b5...
Step-9 Set the SNC name in SAP GUI properties under secure network settings.
After logon to the application server with SSO with AD logins.
Here we can choose the client which we want to login and click on user tab..
Then it will logon to the SAP system with AD logins.
For troubleshooting steps, see below Information.
http://service.sap.com/sap/support/notes/1673155
https://bit.ly/2MZzcwu
https://bit.ly/2pxZqN6
Single Sign On (SSO) Overview.
In a default SAP setup, users enter their SAP user name and password on the SAP GUI logon screen. SAP user names and passwords are transferred through the network without encryption.
To secure networks, SAP provides a “Secure Network Communications” interface (SNC) that enables users to log on to SAP systems without entering a user name or password. The SNC interface can also direct calls through the SAP Cryptographic Library to encrypt all communication between SAP GUI and the SAP server, thus providing secure single sign-on to SAP.
No additional Single Sign on (SSO) server is required in this scenario. Working on the front-end software, the user experiences streamlined, easy accessibility.
Advantages.
Security.
- Secure authentication with one strong password, optionally with additionally factors
- No more need for password reminders on post-it notes
- All passwords kept in one protected, central place.
Cost saving.
- Efficiency gains for users that only need to remember one password
- Higher productivity due to reduced efforts for manual authentication, password reset,
- helpdesk interaction, …
- Functions to efficiently set up and manage server-side security capabilities
Simplicity.
- Lean product, fast implementation project, quick ROI
- No more need to provision, protect and reset passwords across many systems
- No more efforts to manage password policies across many systems
The following diagram is shown step by step workflow and communication in between different components.
- When user click on SAP GUI connection, The Secure Login Client retrieves the SNC name (User Principal Name of the service user) of the respective SAP server system.
- The Secure Login Client starts at the Ticket Granting Service a request for a Kerberos Service token.
- The Secure Login Client receives the Kerberos Service token
- The Secure Login Client provides the Kerberos Service token for SAP single sign-on and secure communication between SAP Client and SAP server.
- The user is authenticated, and the communication is secured.
Execution steps.
| S. No | Name of the activity | Owner |
| 1 | Setup the AD Service account | Network Team |
| 2 | Setup the Service principle name for Service account. | Network Team |
| 3 | Upgrade the SAP Crypto lib version to 8.5 | BASIS Team |
| 4 | SAP Note - 2304831 implementation | BASIS Team |
| 5 | Set the profile parameters for SNC in the t-code SNCWIZARD | BASIS Team |
| 6 | Restart the SAP Application server to affect the SNC parameters | BASIS Team |
| 7 | Create or validate the key tab for Kerberos based SNC in the t-code SNCWIZARD | BASIS Team |
| 8 | Mapping windows domain user ID to SAP User ID Using t-code SU01 | Security team |
| 9 | Install Secure login client and setup the SNC Settings in the SAP GUI in the client machines | Network Team |
Step: - 1 Create a one service account in the Windows domain controller.
We recommend the format is Kerberos<SID>.
Note. We recommend that you do not use SAP Service<SID> because the Password Never Expires option is not set for this account by default. If the password for this account expires, single sign-on fails.
*** Go to Windows AD and create service account as SSA_SNC_SPNEGO.
Enable the Password Never Expires option for this account and click on finish
Step :-2. Registered the Service principle name for Service account.
Register the Service Principal Names (SPNs) for the service account for the host name of the SAP NetWeaver AS for ABAP and all AS ABAP aliases.
Ensure that all SPNs are unique. you can check the cmd as setspn -X SPN Name.
*** Go to Active Directory Users and computers and right click on Service account properties and assigned SPN name as per below steps
.
In Attribute Editor, edit the SPN name and set the required SPN name for service account.
In screenshot, we have set SAP/FQDN of SAP Server and HTTP/FQDN of SAP Server.
Once set the Service Principle Name, you can click on Apply and Ok
.
Step – 3. Upgrade the SAP Crypto lib version to 8.5 and restart the Application server
Step – 4.
Execute SNCWIZARD T- code in SAP. It will throw an error “ SAPCRYPTOLIB too old”.
As a solution apply SAP Note – 2304831.
Download the SAP Note using transaction SNOTE.
Select the SNOTE and execute it.
Note : SPNEGO and SNCWIZARD Transactions can work only SAP NetWeaver AS for ABAP 7.4 SPS08 or higher.
SAP Note is successfully implemented.below screenshot for reference.
Step – 5 Set the profile parameters for SNC in the t-code SNCWIZARD
Click on continue.
Keep it default value and continue.
In below profile parameters set in default profile after complete this sncwizard. it's required to restart the system to effect these parameter values.
Click on Complete and make sure Application server is restarted to affect the parameter values.
Step – 6 Create or validate the key tab for Kerberos based SNC in the Tx- SPNEGO.
Continue for next step and then enter the Service User ID.
Switch the Service principal names tab, it will shows SPN names we assigned for service user account.
In below screenshot, user principal uniqueness and Token checks are green mark. That is for no issues found in SPN’s.
Click on to continue.
Click on complete and close this wizard.
Step – 7 Mapping windows domain user ID to SAP User ID Using t-code SU01.
Step-8 Install secure Login software in client machines.
See below URl for more details.
https://help.sap.com/viewer/df185fd53bb645b1bd99284ee4e4a750/3.0/en-US/da610fd072e4409baa8b6a96973b5...
Step-9 Set the SNC name in SAP GUI properties under secure network settings.
After logon to the application server with SSO with AD logins.
Here we can choose the client which we want to login and click on user tab..
Then it will logon to the SAP system with AD logins.
For troubleshooting steps, see below Information.
http://service.sap.com/sap/support/notes/1673155
https://bit.ly/2MZzcwu
https://bit.ly/2pxZqN6
- SAP Managed Tags:
18 Comments
