SAP Single Sign-On: Protect Your SAP Landscape with X.509 Certificates

[Martina_K]

Overview

SAP Single Sign-On offers support for X.509 certificates. X.509 certificates are highly interoperable, supporting both SAP and 3rd party web applications and clients, including many legacy systems. You can set up your own dedicated public-key infrastructure (PKI) to issue X.509 certificates, or have the Secure Login Server software, a component of SAP Single Sign-On, issue short-lived certificates. With the Secure Login Server software, you do not need to set up a full-blown PKI with its inherent administrative processes, such as certificate revocation lists, but you can still benefit from the same level of security. Enabling this kind of scenario means that users can sign on once to gain access not only to their SAP business applications but also to many of their non-SAP applications.

Implementing Single Sign-On with X.509 Certificates and Secure Login Server

In the following video series, you will learn how you can use X.509 certificates issued by the Secure Login Server component to provide single sign-on functionality as well as secure communication for SAP GUI/browser applications and SAP NetWeaver Application Server ABAP. The videos will describe the necessary configuration step-by-step.

 

Part 1: Overview / Initialization (8:03 min)

Part 2: SNC Configuration (5:12 min)

Part 3: Enrollment of User Certificate (4:53 min)

Part 4: Single Sign-On via SNC (2:00 min)

Part 5: Single Sign-On via SSL (6:29 min)

Related Blogs

Reusing Kerberos Token for Issuing X.509 Client Certificates with Secure Login Server

Configuring SAML 2.0 Authentication for your Secure Login Server

SAP Single Sign-On: Authenticate with Kerberos/SPNEGO

More Information

For more information about SAP Single Sign-On, visit our community here:

https://community.sap.com/topics/single-sign-on

 

[steven_foo]

SAP Secure Login Service / Server (on prime) will be end of maintenance by 2027.

Does SAP going to force customer to move to Cloud SAP Secure Login Service for SAP GUI?

This is going to be additional cost and it is not a small amount.

[Martina_K]

Hi Steven,

Yes exactly, the SAP Secure Login Service for SAP GUI is our new solution for providing SAP GUI users with SSO to ABAP-based systems. It is the successor of the tried and proven SAP Single Sign-On product.

For licensing questions, please contact your SAP Account Executive.

Best regards,

Martina

[Martina_K]

Hi Steven,

The Secure Login Server (on-premise) is a component of the SAP Single Sign-On product which will reach its end of mainstream maintenance at the end of 2027 (extended maintenance end of 2030). The SAP Secure Login Service for SAP GUI is the successor solution. Same as with the SAP Single Sign-On product, the new solution also requires a license. For licensing details, please contact your SAP Account Executive.

Existing SAP Single Sign-On customers don’t have to move to the new solution immediately. But the SAP Secure Login Service for SAP GUI will succeed SAP Single Sign-On 3.0 after its end of maintenance. And by then you will have to switch to the SAP Secure Login Service for SAP GUI subscription.

For more details, please refer to SAP Note 3355041.

Best regards,

Martina

[steven_foo]

Thank you for your reply. But no thank you to SAP offering. It is not feasible to pay for something so expensive from SAP. We would rather spend the money on better products.

This is going to be a huge additional cost to customer eg. an organization have 10000 users

estimate calculation:

325.00 x 20 = 6,500 per month x 12 = EUR78,000

SAP Discovery Center - SAP Secure Login Service (cloud.sap)