SSO with IE to NW ABAP 7.31 with SAML 2.0 and ADFS

[xymanuel]

Hello SCN,

we are trying to establish SSO for our IE (NWBC) connections to our Netweaver ABAP systems.

CLIENT (IE) in OURDOMAIN ---> NETWEAVER ABAP --(SAML)--> ADFS 2.0 --> WINDOWS DOMAINCONTROLLER (iDP) of OURDOMAIN

Our Windows Account Name (SAMAccountname) is the same as the SAP Name, 1to1 mapping is possible.

I didn't find a correct step by step guide for this. Only special cases with portal, webservices and so on, but none for (in my opinion)

standard case.

Steps we done on ABAP Side:

1. set SSO2 settings in RZ10

2. check client is enabled for HTTPS with SICF_SESSIONS

3. Setup local SAML provider (SAML2)

    Add Authentication context alias "IntegratedWindowsAuthentication" with name: "urn:federation:authentication:windows"

4. Export metadata from NW ABAP (with zertificates)

5. Import metadata in ADFS

6. Mapping from SAMAccount-Name to NameID
   Check SecureHash is SHA-1

7.Download metadata.xml from https://<ourADFS>/FederationMetadata/2007-06/FederationMetadata.xml

8. Import federationmetadata.xml in ABAP SAML2 as Identification Provider

9. Added Alias "IntegratedWindowsAuthentication" as in Authentication Requirements

10. Added SUpported NAmeID format "Unspecified"  with "Logon ID"

11. Set SICF service NWBC to use SAML

Here are the screenshots of our configuration:

Local Provider configuration in AS ABAP:

Trusted Provider Configuration in AS ABAP:

The authentication is not working at the moment, and i do not get any error in our tracefiles... (SM50 switch online sec to level 3)

Can anyone tell me if this scenario we are trying is completly wrong?

Or can someone tell me the correct settings?

I have the "Single Sign-on with SAP" Galileo Press Book, but the guides there doesnt help us, because there are only different scenarios with portal, excel and webservices.

PS: My company is using the ADFS for external authentication processes (not SAP), and i thought i can use the ADFS to do internal SAML authentication of our HTTPS Services in SAP (MSS / SRM..) against our active directory.

SSO for SAP GUI (kerberos dll) is working perfectly. And no, i don't want to buy SPNEGO .

Kind regards

Manuel Herr

[xymanuel]

Hi together,

successfully done! Its working now. It seems that the ADFS did not import the metadataxml successfully, and the endpoints were missing.

I will add the screenshots of the working config later...

[richard_howard]

I just got mine to work too.  I also had to reimport my metadata.xml a second time.

Curious .... when you go to SICF to enable a Service (ie NWBC), you select the [Alternate Logon Procedure] and then you have to move SAML Logon up in the order.  One of the docs says that Logon Through HTTP Fields should always be #1.  Did you do that?  Or did you move SAML Logon up to be first?

[xymanuel]

Hi Richard,

i also first tested to move SAML Logon up, but i end up with standard configuration at the moment.

SAML is active because from a superordinate node SAML 2.0 is inherited.

btw. did you add the "IntegratedWindowsAuthentication" alias i mentioned above?

3. Setup local SAML provider (SAML2)

    Add Authentication context alias "IntegratedWindowsAuthentication" with name: "urn:federation:authentication:windows"

Because i removed it at the moment and its working fine.. (Screenshots of running config will come later)

Regards

Manuel

[richard_howard]

Nope.  I didn't use IntegratedWindowsAuthentication in my config.

The one thing that I did that was not in the guides:

I added a Default Path to my ACS.

Local Provider > Service Provider Settings > Assertion Consumer Service

Default Application Path:  /sap/bc/gui/sap/its/webgui

I believe that most of our use cases will start with a URL that goes to my ABAP service first and then redirects to ADFS for the identity confirmation.  However, for something like webgui I may use a DNS Alias that goes directly to ADFS first.  When I do that, it redirects with just my server name, not a full application path.

https://adfs.abccompany.com/adfs/ls/idpinitiatedsignon.aspx?logintorp=https://abaphost/

So I put the Default Path to use when it does.  It seems to work so I think I have that correct.