Single sign on on SAP NWBC

[Former Member]

Hi experts,

SAP Version: Ecc6 Ehp4

SAP ABAP Version: SAP_ABA 7.1 /13

DB                        :SQL 2008

NWBC:3.5

AD in place which is connected to portal ( NW 7.3 ) which is implemented through SPnego

Can anybody suggust the best method for implementing  sso for NWBC and SAP GUI in this landscape ?.

Help/ suggestions will be highly appreciated and rewarded.

[tim_alsop · Accepted solution]

You need to buy a Single Sign-On product that works with ABAP ICF services, such as NWBC and with SAP GUI. You can consider the SAP SSO product or SSO products from SAP partners that are designed to work with SAP products. If you look at https://store.sap.com and search this store you will find details of all products available. When you have chosen the product you can get help from the vendor (SAP or a SAP partner) to configure the product for use with NWBC and SAP GUI.

Thanks

Tim

[Former Member · Accepted solution]

Thank you Tim..

[Former Member · Accepted solution]

Dear Tim,

Customer requiremnet will not include buying a product now. is there any other alternative

[tim_alsop · Accepted solution]

You can authenticate a user on a Portal and then use the SSO2 ticket to authenticate the user to NWBC. For SAP GUI you might be able to use open source Kerberos or free SNC library (if SAP system is on Windows Server). The time and effort required to set this up will be high and you won't get much help so unless you know what you are doing you will find it takes a lot of time to get it working. if you buy a product then you will get the help you need to make it work quickly. It is also possible to buy a product that works with any Kernel version including 7.1 so any issues with kernel dependancies are not an issue anymore. I strongly suggest you advise your client to spend some money so they get a good product and good support from the vendor. If you use free technology, when users cannot logon anymore you won't be able to get help form anybody as quickly as you need so the users and hence the business will suffer from lack of user productivity.

[Former Member · Accepted solution]

Dear Tim,

I really appreciate your feedback but unfortuneatley they are least interested at this point.

I got something from a standard doc, can u plz suggust me this need any license and is this a method i can make it done.

NWBC for Desktop embedding Dynpro applications (SAP GUI for Windows) only

SNC + X.509 certificates, SNC + Kerberos or Logon Tickets

[tim_alsop · Accepted solution]

As I explained, if your customer/client doesn't want to buy any software, they don't have many options. They can use a SAP NetWeaver JAVA system (e.g. running portal) to authenticate the user and then use the SSO2 logon ticket to log then into ABAP ICF services such as NWBC. They can develop their own product using open source Kerberos libraries, or they can setup a PKI (very expensive unless they already have one) so that every user has a certificate and then use the client certificate to authenticate the user. That's about it I am afraid, which is why we recommend buying a product.

Thanks

TIm

[Former Member · Accepted solution]

Dear All,

I am also facing an issue related to SSO.

Our system(ABAP) is already having the Single sign on option for

SAP Gui login. But when trying to open this system using the url link

(https://<FQDN>8XXX/sap/bc/gui/sap/its/webgui?sap-

client=000)

system prompted for userID and password everytime, with the

warning "webgui

sso logon not possible browser logon ticket cannot be

accepted". We have sucessfully activated all the webgui related services in this

system.Hence could you please have a look on this issue and advise

how we can logn to the system(ABAP) using the webgui url without giving

user credentials.

Thanks

Jijin

[donka_dimitrova]

Hello Manjesh,

You can simply re-use Kerberos token. See some blogs on this topic:

Regards,

Donka Dimitrova

[Former Member]

Hi Donka Dimitrova,

Thank you very much. Yes i went through the same documents before but according to that doc it  supports 7.3 and above but here in our case its 7.1.

Prerequisites

NWBC 4.0, SSO 2.0, SAP NetWeaver 7.3