SSO and kerberos for another clients on the same server

[romeldavid_rodriguezdelac]

Hello Expert

We want to enable SSO with Kerberos in our AD domain

I already made some test and they work fine, but, I have this questions:

1.- should all user have the canonical name mapped? Because if the server has the snc setting users without canonical name mapped cannot logon to the SAP server

2.- Can I logon in another client (such as 000) if the server has the SNC Settings enable?

3.- what happen with the default users, such as sap* or DDIC?

I am using just the snc settings with AD

The PC users has the SAPSSO.msi installed

Thank you in advance

Romel D.

[donka_dimitrova]

Hello Romel,

See the SAP Note: https://launchpad.support.sap.com/#/notes/352295

If you need only to encrypt the communication between the client and the server using a Kerberos token, when you use the CommonCryptoLib (SAP Single Sign-On) for this encryption the configuration of the SNC users is not necessary. See more details here: https://launchpad.support.sap.com/#/notes/2338174 in Secure Login Client and CommonCryptoLib part

Regards,

Donka Dimitrova

[romeldavid_rodriguezdelac]

Hello Donka

Thank you for answer, I already checked the note, and in my test system worked.

But if I enable snc communication I can not log to the system with de sap*?

and what happen with the 000 client? Do I have to map users to AD since this is not a productive client?

Best regards

[romeldavid_rodriguezdelac]

someone?