Single Sign-On Based On SNC Kerberos Method For SAP ABAP Application Servers. S
Single Sign-On (SSO) is becoming more attractive for all the SAP applications due to its security, cost saving and simplicity. With the introduction of Kerbros and SPNEGO as authentication methods, users from different software applications are getting logged in to SAP applications without giving credentials. Further advantages to the authentication methods are the increasing ease of installation process. This SSO Configuration is helped by simple Secure Network Communication (SNC) authentication methods to follow SAP GUI and web-based applications.
This document briefs about the SSO 3.0 Configuration for the SAP ABAP Application server using SNC Kerbros method.
What is Single Sign-On?
Single Sign-On (SSO) Overview
SAP Single Sign-On (SSO) is a SAP software product and it provides a secure authentication and encryption when the users are accessed to SAP and Non-SAP applications with single password. It is intended to improve enterprise security and simplicity by providing access to applications across all systems.
By default SAP Authentication, user can enter username and password for every application server, SAP Single sign-on (SSO) SNC method provides a security authentication encryption within the network and it provides an authentication without username and password by default login to SAP with Active Directory logins.
- Secure authentication with one strong password no need of additional factors
- All passwords are stored in central place and protected.
- Higher productivity due to reduced efforts to manual reset for user logon.
- Reduce the helpdesk interaction.
- It is generating more productivity and gaining more satisfied users with improved authentication.
- It helps to reduce the time taken by business users to log in to multiple applications.
- With simplicity, it reduces efforts to reset and manage password for multiple SAP Applications.
The following diagram is shown step by step workflow and communication in between different components.
- When user click on SAP GUI connection, The Secure Login Client retrieves the SNC name (User Principal Name of the service user) of the respective SAP server system.
- The Secure Login Client starts at the Ticket Granting Service a request for a Kerberos Service token.
- The Secure Login Client receives the Kerberos Service token
- The Secure Login Client provides the Kerberos Service token for SAP single sign-on and secure communication between SAP Client and SAP server.
- The user is authenticated, and the communication is secured.
Steps involved in SSO Configuration
|Step. No||Name of the activity||Owner|
|1||Setup the AD Service account||Network Team|
|2||Setup the Service principle name for Service account.||Network Team|
|3||Upgrade the SAP Crypto lib version to 8.5||BASIS Team|
|4||SAP Note – 2304831 implementation||BASIS Team|
|5||Set the profile parameters for SNC in the t-code SNCWIZARD||BASIS Team|
|6||Restart the SAP Application server to affect the SNC parameters||BASIS Team|
|7||Create or validate the key tab for Kerberos based SNC in the t-code SNCWIZARD||BASIS Team|
|8||Mapping windows domain user ID to SAP User ID Using t-code SU01||Security team|
|9||Install Secure login client and setup the SNC Settings in the SAP GUI in the client machines||Network Team|
Netweaver 7.4 SP08
Single Sign On 3.0 SP02.
Step 1: Create one service account in the Windows domain controller.
We recommend the format is Kerberos<SID>.
Note:We recommend that you do not use SAP Service<SID> because the Password Never Expires option is not set for this account by default. If the password for this account expires, single sign-on fails.
- Go to Windows AD and create service account as SSA_SNC_SPNEGO
Enable the Password Never Expires option for this account.
Click on finish.
Step 2: Register the Service Principal Name (SPN) for Service account.
Register the Service Principal Names (SPNs) for the service account for the host name of the SAP NetWeaver AS for ABAP and all AS ABAP aliases.
Ensure that all SPNs are unique. Use the setspn -X SPN Name.
Go to Active Directory Users and computers and right click on Service account properties and assign SPN name as per below steps.
In Attribute Editor, edit the SPN and set the required SPN for service account.
In screenshot, we have set SAP/FQDN of SAP Server and HTTP/FQDN of SAP Server.
Once the Service Principle Name is set, click on Apply and Ok.
Step 3: Upgrade the SAP Crypto lib version to 8.5 and restart the Application server.
Execute SNCWIZARD T- code in SAP. It will throw an error “SAPCRYPTOLIB too old”.
As a solution apply SAP Note – 2304831.
Download the SAP Note using transaction SNOTE.
Select the SNOTE and execute it.
Note:SPNEGO and SNCWIZARD Transactions can work only SAP NetWeaver AS for ABAP 7.4 SPS08 or higher.
Enter the transport request.
SAP Note is successfully implemented.
Step 5: Set the profile parameters for SNC in the t-code SNCWIZARD
Click on continue.
Keep default value and continue.
List the profile values to be set in the system and continue for next step.
Click on Complete and make sure Application server is restarted to affect the parameter values.
Step 6: Create or validate the key tab for Kerberos based SNC in the t-code SPNEGO
Continue for next step and then enter the Service User ID
Click on Service Principal Names tab, it will show SPN names we assigned for service user account.
In below screenshot, user principal uniqueness and Token checks are marked in green. That implies there are no issues found in SPNs.
Click on continue.
Click on Complete and close this wizard.
Step 7: Mapping windows domain user ID to SAP User ID Using t-code SU01.
Step 8: Install secure Login in client machines.
Step 9: Set the SNC name in SAP GUI properties under Secure Network Settings.
Logon to the application server with SSO with AD logins.
Here we can choose the client and click on user tab.
Then it will logon to the system with AD logins.
With this, the customers who wanted to configure SSO, can make use of this document.
Contact us for further details
G. Vijay Bhaskar Reddy
Technology Analyst – SAP Basis