X.509 certificate (SSL) Configurations

[Former Member]

Hello,

I have ECC 6 ABAP stack system with SSO enabled.(SNC thru SAP Gui and authenticated by Windows Server)

I want to publish my SAP Server on the web. I know how to configure it thru its built-in ITS, but if I configure it as it is , the system asks for the user ID and Password, Since SSO (SNC) is enabled, user password are unknown for the users. I want to know the procedure / steps to establish Certificate issuing authority /Client mechanism. I believe SSO implementation with X.509 certificate (SSL) would be more suitable for me.

Pls. advice any procedure/ URL / Study guide to configure the SAP Server.

Regards

[tim_alsop]

Hello,

The SNC interface only applies to the SAP GUI logon method and any other SAP front end library which connects to SAP ABAP AS, e.g. SAP RFC. If you logon via web browser, then SNC is not involved so the reason why you are getting prompted for usreid and password when you logon using browser, is becasue of the configuration of your NetWeaver ABAP stack and the application in ICF. It is possible to configure the system to ask the user for an Active Directory userid and password, instead of expecting them to enter a SAP userid and password. Perhaps this is what you want ?

Thanks,

Tim

[Former Member]

Hello Tim

Thanks for the reply, yes I understand SNC is not my solution for web authentication, I need certificate authentication thru Web browser.

But your suggested solution would also work in my case if System ask for the AD user ID and Password.

Would you like to pls. share some more detail about it.

Regards

Saqib

[tim_alsop]

Saqib,

Yes, if you use client certificates then you can logon to SAP ABAP AS using this certificate and the certificate will be mapped to a user. This has some implications however, since you will need to manage these certificates and you are not needing to do that now, and you will need to issue client certificates to users and make sure that each user uses same browser/pc when they logon, so no roaming will be possible, unless of course you use smart cards to store the client certificates. The solution I am suggesting does not have any of these implications because it will simply allow the user to enter their AD account and password, which is same that they use when they logon to Windows domain when in office.

To implement the AD userid+password authmethod, you need a Java stack and the installation of a login module in the java stack which handles Kerberos forms-based authentication (so that AD accounts and passwords can be used). Then, in ABAP stack you would configure the redirection so that when no SSO2 ticket is sent by browser, the ABAP stack redirects to the Java stack where the user is authenticated. After authenticaiton and the SSO2 ticket has been issued by Java stack, the user will be redirected back to the original app on ABAP stack and their SSO2 ticket will be decoded to know who they are.

I have helped many customers implement this approach. Your requirement is not uncommon.

Thanks,

Tim

[Former Member]

Hello Tim

We can also go for this, but let me tell you one thing, we are using SNC_LIB gssapi32.dll for authentication. Do we need to change our current SNC method to direct authentication with AD as well?

Anyways, I would like to check your proposed solution in my test environment, would you like to pls. share any guide/ documents with me.

by the way, do you have any specific guid / document for client / certificate authentication as well? i would like to read that and try it.

I am familiar to add JAVA stack, so donu2019t worry about it.

Best Regards

Saqib

[tim_alsop]

Saqib,

The SNC authentication is only used when you logon from SAP GUI or SAP front end library, and is not effected or involved in browser authentication. I am therefore wondering why you are asking about SNC_LIB ? If you have SNC auth working then you can leave this as it is.

The solution I am proposing involves third-party product, which you can find described on SAP EcoHub at http://ecohub.sdn.sap.com/irj/ecohub/solutions/trustbrokeradapter

- You can evaluate this product if you are interested to see it working, or I can setup a web meeting and show you it working.

Thanks,

Tim