SAP Systems - configure to authenticate against Central Authentication Server e.g Active Directory

[Former Member]

Hi,

We have configured SAP Single Sign-On 3.0 Successfully for our SAP systems. Now thinking of changing the authentication to prompt for credentials but of Active Directory i.e users should be able to login SAP ABAP System using Active Directory(AD) credentials not of SAP System. This is similar to how JAVA systems authentication works after integrating with LDAP.

Please shed some light if you have configured similar things.

Thanks

Bhaskar

[Former Member]

Thanks both methods working fine. Now we are planning to figure out best approach. Currently we configured SAP Single Sign-On for both ABAP & JAVA systems to work with X.509 certificates using Secure Login Server(SLS).

Thinking of Kerberos token approach without Secure Login Server(SLS).

1)It appears this approach need SPNEGO configuration in each ABAP/JAVA system separately unlike just parameters adjustment with SLS approach.

2)we need to have Service Principal Name(SPN) for each of ABAP/JAVA systems to be maintained in Windows serverice AD account unlike SLS, where we just need to maintain SPN's for SLS server.

Please suggest is it better approach to think about Kerberos without SLS?, to us it appears only benefit will be, will save Server resources for SLS. Other than that Approach of X.509 Certificates with SLS appears to be best. Also it appears SAP recommending customers to move towards digital(x.509) certificate based SSO instead of Logon tickets. Also thinking whether Keberos approach would be fine for ECC --> Portal SSO, as it is currently based on logon tickets. It does work with X.509 certificates approach didn't tried if Kerberos token approach will also work for ECC-->Portal SSO ?

Please provide your comments.

[Former Member]

Thansk Sriram/Carsten, will give it a try and let you know.

[Colt]

Hi Bhaskar,

you can achieve that in two ways:

a) use Secure Login Server with an LDAP Authentication client policy

b) *use Secure Login Client only with Kerberos and "multiple sign-on"

*Users are always prompted for user name and password for every logon to an SNC session (no single sign-on). There is no automatic logon in the Secure Login Client profile. After logon to Microsoft Windows, the Kerberos-based SNC profile is grayed out.

For details see 9.1.1.6 (Single Sign-On Setting for Kerberos-Based SNC Profile) in SecureLoginForSAPSSO3.0_UACP.pdf

Cheers Colt

[Sriram2009]

Hi Basker.

Check this blog and SAP guide

https://blogs.sap.com/2018/09/25/sap-single-sign-on-sso-3.0-configuration-for-sap-abap-application-s...

https://help.sap.com/doc/7d3f26c449524c54b5d8232e11f0a771/3.0/en-US/SecureLoginForSAPSSO3.0_UACP.pdf

Regards

SS