How do I configure a non-integrated ITS for Single Sign-On on Windows 2003?

[Former Member]

We have a homogeneous environment where everything runs on Windows 2003. Our ITS is version 6.20 (non-integrated). I was able to get SSO working using Active Directory/Kerberos 5 for logging on via SAP GUI. How do I configure our ITS to also use SSO?

[tim_alsop]

Rick,

The external ITS product does not have built-in support for this type of authentication, so you need to use a PAS module on the AGATE. The PAS module can be developed by yourselve using the SDK available from SAP, or you can purchase a commercial product which includes a PAS module, already coded to provide Kerberos-based SSO with external ITS. When you do this, you need to secure the connection between the AGATE and SAP R/3 AS using SNC.

Thanks,

Tim

[Former Member]

Thanks for your quick response, Tim. So, is SSO possible with integrated (internal) ITS? Do you know how to do that on 6.40 or 7.0?

Rick

[tim_alsop]

Rick,

Yes, SSO using the Kerberos capability included in the web browser is also possible with integrated ITS, both on 6.40 and 7.00. You can use the SPNEGO login module provided by SAP, or third-party software which often has some useful features and is more secure than the login module provided by SAP. They requires a JAVA engine to be setup to authtnicate the user at workstation, and then an SSO2 ticket is created so that the user can access other applications which might be on ABAP or JAVA AS systems.

Thanks,

Tim