SSO/kerberos working in SAPGUI but not ABAP/WEBGUI

[Former Member]

I have setup SSO as per the four videos, but the Webgui is not working. The Webgui screen prompt with login user id and password.  Could be please suggest on this.

My SID is SE2

My appserver is sapse2xxxx

My host name is sapse2xxxx.<company name>.corp

Here is what my SPN looks like:using setspn -L SVEXTSE2SSO

Registered ServicePrincipalNames for CN=SVEXTSE2SSO, OU=Service, OU=Service Accounts, DC=<company name>, DC=corp:

    SAP/sapse2xxxxxx

    HTTP/sapse2xxxxxx.<company name>.corp

Here are my instance parameters:

snc/accept_insecure_cpic =  1

snc/accept_insecure_gui =   1

snc/accept_insecure_rfc  =   1

snc/enable                        =   1

snc/extid_login_diag        =    1

snc/extid_login_rfc           =    1

snc/gssapi_lib                  =   $(SAPCRYPTOLIB)

snc/identity/as                   =  p:CN=sapse2xxxxx

snc/permit_insecure_start    =   1

spnego/enable                     = 1

I did notice that when I view t-code SPNEGO and check "Service Principle Names", that the "token check" has a RED circle.

I can deactivate my password to know it uses the token to log me in.  But when I go to DBACOCKPIT using webdynpro through ABAP or when I test webgui through SICF, I get the logon screen.

I tried putting port 8000 on the HTTP spn but that didn't work either.

Thank you for your assistance,

Peggy Reed

SAP BASIS

[Former Member]

I figured this out myself.  Our security team had me remove the DES* and RC4* algorithms in t-code SPnego.  Once I put them back in, it worked.

[LutzR]

Hi Peggy, now you have it working but on low security standards. Both  DES and RC4 should be retired.

You should definitely remove DES from your list of keys. This is worst and retiring it should have the least incompatibility issues.

Second you should enable AES Encryption on your service accounts (AD account properties). This will switch from RC4 to AES if possible. Afterwards you can remove RC4 from the key list in SPNEGO.

You can always check which cipher is used by using windows ressource kit tool KLIST or with OS command line tool klist.

Regards,

Lutz