MS Kerberos login in to SRM shopping cart BSP web page

[Former Member]

Hello SAP Security Experts!

Microsoft Kerberos Single Sign-On is configured and working for SAPGUI login in to SRM 5.0.

But to access the SRM BSP / shopping cart page, one still needs to login using user-id and password.

Is there a workaround to login to SRM ICM / BSP shopping cart web page using MS Kerberos SSO, with out using Enterprise Portal / J2EE / SPNego?

Any help is highly appreciated!

Thanks and best regards,

Shaji

[Former Member]

No, Kerberos is currently not supported by SAP for BSP. I don't know if this will change in the future.

You CAN use X.509 certificates to enable SSO.

[WolfgangJanzen]

>

> No, Kerberos is currently not supported by SAP for BSP. I don't know if this will change in the future.
> 
> You CAN use X.509 certificates to enable SSO.

That's true (SSL authentication, X.509 Tokens for WS-Security).

Kerberos support is not planned for NWAS ABAP, but SAML 2 support is planned (with a future Enhancement Pack). Enabling Kerberos authentication (and other authentication schemes) at the SAML 2 Identity Provider (IdP) will then enable to utilize Kerberos authentication also (indirectly) at an NWAS ABAP (in the future).

"MS Kerberos" authentication at an NWAS ABAP is possible (if the ABAP server is operated on the Windows platform) using SNC (for SAP GUI and RFC clients serving as user agent), as you obviously already know. If you intend to invoke the BSP application via SAP GUI (using the HTML control technology), then SAP note 612670 might be of interest for you.

I wish you a Happy New Year 2009,

Wolfgang

Edited by: Wolfgang Janzen on Dec 26, 2008 7:57 PM

[tim_alsop]

>

> "MS Kerberos" authentication at an NWAS ABAP is possible (if the ABAP server is operated on the Windows platform) using SNC (for SAP GUI and RFC clients serving as user agent), as you obviously already know. If you intend to invoke the BSP application via SAP GUI (using the HTML control technology), then SAP note 612670 might be of interest for you.

It is also possible if ABAP server is on UNIX or Linux, but this requires a solution available from a SAP partner. For example, one of them is described on SAP EcoHub at https://ecohub.sdn.sap.com/irj/ecohub/solutions/trustbrokersecureclient

[tim_alsop]

Sietze is correct - Kerberos is not available for direct authentication to BSP.

However, you can only use Kerberos to authenticate the user to the BSP applications if you use a J2EE engine with SPNEGO, and then use the SSO2 ticket created in J2EE engine to authenticate the user to the BSP application.

Thanks,

Tim

[Former Member]

Hi,

Yes you have to use J2EE/SPNEGO.

We had the same problem with SSO on SRM. As we were also using MDM-Catalgo for this project and this software is running on the Java stack, the first URL directs the user on MDM-Catalog where Kerberos authentication is done, a saplogon ticket is generated and a small custom jave application redirects the browser to SRM. MDM-Catalog has been set as a trusted system by SRM which means that the MDM saplogon ticket is accepted by SRM : Not very beautiful but SSO works for SRM !

Regards,

Olivier

[Former Member]

Dear all,

Thank you very much for your replies! Looks like SPNego followed by re-direction is the way forward.

Thanks again, and best regards,

Shaji