Is SAP lacking security in SCN and SMP?

[JL23]

The basic problem is that I can't login anymore with the SAP certificate for SSO with my Chrome browser Version 45.0.2454.101 m

While SCN is able to remember a login  using S user ID and password for some time, SMP is not  and permanently sends requests to enter user ID and password, first to enable you to search, and then again when you found an interesting note and want display it, because it is stored at a different server.  To overcome this issue SAP wants you to install the certificate for single sign on.

This worked already for some years for me, but now it stopped. I had already reported this issue as feedback in SMP, but no reaction.

Today I checked the Chrome forum and found this statement:

• This is a problem with the website's SSL certificate. Google previously announced that they would begin removing support for SHA-1 cryptographic hash algorithm beginning with Chrome 39.

Lucky I can still use the certificate in Microsoft Edge, question is just for how long until they will regret from supporting it.

Is it really state of the art to work with 2 browsers? With Internet Explorer you can't paste texts into SCN, you can't turn the tiles in the reputation of your profile. Safari has some other issues as it can be seen here in various discussions. Then people are asked to use Chrome, and now Chrome does not work with the SAP certificate.

[Former Member]

Jürgen,

I abandoned using certificates for SAP sites a couple of years ago.  When they work, they work well.  However, they always just made troubleshooting SCN and Marketplace access problems a bit more complicated than they had to be.  I am not bothered by having to access SCN and other SAP sites by entering logon credentials.  You may remember years ago (before SSO certificates) when this was the ONLY way to access the non-public SAP sites.

I also have to have two browsers running when I access SCN, and sometimes I actually have to revert to a third (Firefox) when the other two (IE and Chrome) don't work.  I will admit that find this problem not only with SAP sites, but also other non-SAP sites.

Is this state of the art?  Probably not.  It could definitely be better.

Will SAP make it better?  We'll see. If you really look hard at SAP's web presence, and look at all of their software as well, it is easy to reach the conclusion that SAP doesn't really care all that much about usability.

Best Regards,

DB49