SPNEGO for PI Web Components

[Former Member]

Hi,

currently we are implementing SSO with Kerberos for our PI systems running on 7.3 and 7.4.

We set up everything and logon to websites like /nwa and /pimon is already working without using username and password.

Now we also want to access Directory and Repository without entering username and password but we didn't found a guide or even a comment if this is possible.

We followed http://help.sap.com/saphelp_nw73/helpdata/de/48/ca0fe42fbb5c97e10000000a42189d/content.htm?frameset=... but afterwards we received a new popup window prompting for credentials. And the last sentence of this guide "From now on, the logon dialog will be displayed only once for each available component." is not what we wanted.

So finally my question: Is it possible to use SPNEGO for PI Web Components and if yes, how?

[former_member238977 · Accepted solution]

Hi Robert

I'm having the same Problems regarding SSO for PI running on 7.4.

Could you solve your Problem in the mean time?

Thanks for your Feedback.

Kind regards

Chris

[Former Member · Accepted solution]

Indeed I could.

The web components are using SAP Logon Tickets. Within the login-module-chain you can create such a ticket after SPNegoLoginModule.

Therefore go to NWA -> Configuration -> Single Sign-On.

For the components sap.com/com.sap.xi.directory*dir and sap.com/com.sap.xi.repository*rep (like all other components using SPNEGO) the module stack should look like:

1. EvaluateTicketLoginModule (Sufficient)

2. SPNegoLoginModule (Optional)

3. BasicPasswordLoginModule (Requisite)

4. CreateTicketLoginModule (Optional)

This is how it works for our systems.