Kerberos and SSO and SNC problem

[former_member464887]

Hi forum members

I have SAP running on Linux.I have MSAD on windows 2003.I want to setup SSO using snc and MIT kerberos.

I have seen below link and follwed the steps.

[;

I have generated the Keytab file from AD and configured the krb5.conf file.I have setup the parameters in profiles.My system is up and running with snc.

I have downloaded the gsskrb5.dll and copied into the windows/system32 directoory in my laptop.I have set the environment variables also .I have configured the logon pad entry for logon and enabled the snc field.

I clicked on sapgui and got the sap screen with standard fields like client ,user ,language and getting the error message at the bottom of the screen that

No user exist with snc name "p:amit@<DOMAIN>COM>

Please help to resolve the issue.

Thanks

Amit

[former_member464887]

I had to include the port into the krb5.conf file,

It is resolved.

Thanks

Amit

[Former Member]

If you check your user entry in SU01, do you have the correct entry in the SNC tab? If not, you can set it via SNC1.

Kind regards,

Mark

[former_member464887]

Hey Mark

Thanks for the reply.

I have made changes in the su01 under tab snc and inserted the correct snc name.This snc name is same as the profile parameter value of snc/identity/as .

Is it the correct way of setting snc tab in su01?Or we have to run snc1 to set this value?

Thanks

Amit

[Former Member]

SU01 should do the trick...

In the saplogon SNC name setting, you should use the same value as snc/identity/as

In SU01 -> SNC Name, you should use p:domain user@<DOMAIN>

Kind regards,

Mark

Edited by: Mark Dijsselbloem on Jan 7, 2011 3:58 PM

[former_member464887]

Hi Mark

I have the same setting.

SU01-snc tab has p:domain user@<DOMAIN> and SAP Logon has same entry as snc/identity/as .

but i am getting below errors in the developer traces

Fri Jan 7 10:04:19 2011

N *** ERROR => SncPSetNewName()==SNCERR_BAD_NT_PREFIX [sncxxall.c 2207]

N SncPImportPrName() parsing error

N name="amita@DOMAIN name"

N <<- SncNameToAclKey()==SNCERR_BAD_NT_PREFIX

N in: name = "amita@DOMAINNAME"

What could be the issue.?

Thanks

Amit

[Former Member]

Can you post your snc profile parameters?

Kind regards,

Mark

[former_member464887]

here are the parameters i have setup

default profile

snc/data_protection/use 3

snc/data_protection/max 3

snc/data_protection/min 1

snc/permit_insecure_start 1

snc/accept_insecure_rfc 1

snc/accept_insecure_r3int_rfc 1

snc/accept_insecure_gui 1

snc/accept_insecure_cpic 1

snc/extid_login_rfc 1

snc/extid_login_diag 1

instance profile

snc/enable 1

snc/gssapi_lib /usr/lib64/libgssapi_krb5.so

snc/identity/as p:sapsnc/domainname@DOMAINNAME

Thanks

Amit