(Kerberos Authentication) Windows AD id and SAP GUI id's are different

[Former Member]

Hi All,

We are planning to implement Kerberos authentication using our Window AD. I have below queries regarding the same.

1. Our ERP is ECC 5.0 with SAP_BASIS 640 patch 31, will this support Kerberos authentication.

2. If supports, we have different user id's in Windows AD and ECC for the same user. Will this supports. (For example in Windows AD we      have SSOTEST, same user has TESTSSO in ERP)

3. Is Kerberos authentication required separate license.

If possible provide links for the same.

Regards,

Sree

[Former Member]

all the same but the lis is this one :

snc/gssapi_lib /usr/lib/libgssapi_krb5.a(libgssapi_krb5.a.so)

[Former Member]

Hi Oliver,

I found below files while searched in google. Could you please let me know below rpm's are correct or not. From where can we download.

• krb5-devel-1.9.4-1.aix5.1.ppc.rpm
• krb5-libs-1.9.4-1.aix5.1.ppc.rpm
• krb5-pkinit-openssl-1.9.4-1.aix5.1.ppc.rpm
• krb5-server-1.9.4-1.aix5.1.ppc.rpm
• krb5-workstation-1.9.4-1.aix5.1.ppc.rpm

Regards,
Sree

[Former Member]

hi

for the yes that should be the one for AIX 5.1 to configure the AD connect.

regards

Oliver

[Former Member]

Hi Oliver,

All the files need to install or any particular rpm to be installed.

Regards,

Sree

[Former Member]

i think the devel kit is not needed but the rest.

[tim_alsop]

The mapping is taken care of in a table called USRACL. This table is normally maintained using the SNC tab in SU01 t-code.

Yes, for Kerberos authentication you need to license an SSO product. Either the product from SAP called SAP Single Sign-On or a product from a SAP partner. You can find them all (including the SAP product) in SAP Store (http://store.sap.com)

Thanks

TIm

[Former Member]

Hi,

Whether  SAP ECC 5.0 will support Kerberos or not, Even for NW 7.4 also need to have license?

Regards,

Sree

[Former Member]

Hi,

Whether  SAP ECC 5.0 will support Kerberos or not, Even for NW 7.4 portal (JAVA) also need to have license?

Regards,

Sree

[tim_alsop]

As I already mentioned, you need to buy a license for an SSO product, either from SAP or from a SAP partner.

[tim_alsop]

Same reply as above.

[Kaempfer]

Hi Ch,

so we try not to discuss license questions in SCN. This has to be done with the corresponding sales team. We would like to keep SCN a platform for technical questions and solutions.

From a SAP perspective:

- SAP Single Sign-On requires always a license.

- Any old SSO techniques like SAP Logon Tickets are still part of the NW platform.

Any details on SAP pricing --> please contact sales.

Regards

Matthias

[Former Member]

Hi,

in my understanding JAVA SSO via SPNEGO is for free.

for ABAP SSO with SAP netweaver SSO 1.0 or 2.0 you habe to buy a license.

the old ABAP SSO via kerberos os libraries is for free but sap will not help you in case of errors/problem.

Itis stable and running from 4.6C to 7.40.

just search for "kerberos setspn kinit sap" in google

greetings

oliver

[Former Member]

Hi Oliver,

Where can I get the old ABAP SSO via Kerberos OS libraries, and this configuration will be same as that of single sign on.

Regards,

Sree

[Former Member]

Hi,

these Notes will help you :

• Note 352295 - Microsoft Windows Single Sign-On options
• Note 595341 - Installation issues with Single Sign-On and SNC
• Note 1580808 - SAP Logon 7.20: "SNC logon w/o SSO" for connection entry
• http://help.sap.com/saphelp_nwes72/helpdata/en/44/0ea40dc6970d1ce10000000a114a6b/frameset.htm

For Windows SAP Servers pls download the libs of note 352295.

For Linux use the one on OS level  ( /usr/lib64/libgssapi_krb5.so )

For Linux make sure that the krb5 rpm packages are installed

krb5-32bit.......

krb5-...............

krb5-client.......

I hope this helps

greetings

oliver

[Former Member]

Hi Oliver,

Thanks for the inputs,

Could you please let me know the note for AIX  downloads.

Regards,

Sreekanth

[Former Member]

Tim -- do you have experience with the Kerberos SSP (free solution) as opposed to the licensed SAP SSO solution?

We're considering this strongly and I haven't been able to get in touch directly with someone who's done this. I understand SAP's solution may provide more security in theory but curious to see if any of the free solutions worked well for enterprises.

Joe

[tim_alsop]

Yes, I do and I would love to help you, but I cannot discuss such matters on this public forum.