Error configuring SSO with Kerberos

[Former Member]

Dear SAP/ SSO Experts,

I am configuring SSO with below procedure defined in SCN article:

http://scn.sap.com/docs/DOC-40178

I m getting Token Check error in Service Principal Names tab in SNCWIZARD transaction:

User mapping tab is also blank in SNCWIZARD transaction:

However i have followed step accordingly and User password test in Algorithm was also successful

Due to above issues i am unable to complete SSO as per article.

SAP GUI SSO setting and login error due to incomplete configuration:

Please help me for solution and successful SSO with this kerberos method.

Best Regards,

Qazi Jamil

[kaus19d]

Hi ,

How about we try using the full form like using

"CN=k3d, OU=Installation_No, OU=SAP, O=SAP, C=DE"

Thanks,

Kaushik

[Former Member]

HI,

Where to define??? your suggestion?

Regards

[kaus19d]

instead of "p:CN=K3D"

[Former Member]

Where?? in SAP GUI??

[former_member157391]

I tend to feel that this is a total different way to use certificate-based SSO, but not Kerberos-based.

Please correct me if I am wrong.

[Former Member]

I didnt get you. What??

[Former Member]

have had similar issue. You need to make sure that your user UPN (not SPN) matches domain name.

I was loggin in with DOMAIN\user.name while my service account default UPN was set to service.user@domain.com

After changing UPN and doing config from beginning token was successfully verified.

[Former Member]

Dear Alex,

Thanks for your reply.

I think my UPN is same as you said.

I am attaching all my steps screenshots for you. Please suggest is it same or some other solution

1)

2)

3)

4) In below screenshot i have set UPN same like my AD service id: K3D_SNC_SPNEGO@abc.com.pk Password was also validated with check button near password.

SPN define in user attribut of MS AD 2008

SAP/K3D

HTTP/SYSTENAME/IP both tried

Any further solution please.

Regards,

Qazi

[Former Member]

Did you define SNC in your SAP user profile?

Similar to this.

You need it in order to validate kerberos token

[Former Member]

Also please make sure you set SPN this way:

HTTP/<youserver FQDN>abc.com.pk

SAP/<you_service_user> K3D_SNC_SPNEGO

[former_member157391]

Dear Qazi,

It seems that although the password is checked correctly, Kerberos token could not be generated as expected.

Could you please also attach screenshot showing how the account user and associated SPN are defined at AD side?

Best regards,
Ning

[Former Member]

Dear Alex,

Yes i have defined user SNC parameter in su01.

But problem is due to token generation its not giving user@domain name automatically in SNCWizard transaction user mapping tab

any further suggestion??

[Former Member]

Dear Ning,

Now check AD side screenshots:

Anything else???

Regards

[Former Member]

Yeah defined in the same way in su01

Regards

[Former Member]

Alex,

Defined in the same way..

No luck so far

Any further help?

Regards

[former_member157391]

Dear Qazi,

As you define spn as SAP/K3D_SNC_SPNEGO, please change snc/identify/as to P:CN=K3D_SNC_SPNEGO, and maintain SNC name in SAPGUI to P:CN=K3D_SNC_SPNEGO.

In addition, please check if there are duplicate SPNs against SAP/K3D_SNC_SPNEGO
setspn -T -* -X

Best regards,

[former_member157391]

Instead of changing snc/idnetify/as and SNC name in SAPGUI,  you could change SPN from SAP/K3D_SNC_SPNEGO to SAP/K3D.

No matter what you are going to change,  please make sure the three of them the same.

[Former Member]

HI Ning,

I have tried your last suggestion. But token check is fail in SPNEGO transaction
No idea what to to now:

Waiting for solution.

Regards

[Former Member]

Check latest SAP GUI error after your latest suggestion

Regards

[former_member157391]

It seems you would like to use K3D but not K3D_SNC_SPNEGO.

Then, could you please attach screenshot showing

1 current spn defined in active directory

2. the setting of snc/identify/as

We need to make sure Token check green, and then specify the value of snc/identify/as in SAPGUI setting.

Best regards,
Ning

[Former Member]

RZ 10

Regards

[former_member157391]

Thanks，  then have you restarted the system after you have done this?

Best regards,
Ning

[Former Member]

why should i restart??

i didnt change anything in rz 10.... i have restarted system day when i start SNC wizard and snc identity created,

i just change AD this as per your suggestion SAP/K3D

[former_member157391]

Sorry，I overlook this part.

Then could you please make sure if you have rerun SPNego while you logged to the domain with a domain account?

Please double click on token check button, press question mark, attach the popup windows.
and user mapping tab page.

Best regards,
Ning

[former_member157391]

Let's clarify another thing.

What account are set with SPN SAP/K3D as AD side?

Is it the same user as you input in SPNego?

I see K3D_SNC_SPNEGO and KerberosK3D from past conversation.

Best regards,
Ning

[Former Member]

Ling,

Obviously i am logged in with AD account with domain. Actually i m logged in to client PC with the same ID i am using for kerebros configuration: K3D_SNC_SPNEGO. This user.

Token information error on spnego screenshot:

Question Mark message screenshot:

[Former Member]

Yes same account K3D_SNC_SPNEGO set in SPN on AD side.

and I m using same account with domain for running SPNEGO.

Regards

[former_member157391]

Thanks for confirmation.

As message shows,  please have a check at 1943266 to make sure SAPGUI and Secure Login Client are the same or higher than requested.

Then take a secure login client trace according for further check.

Best regards,
Ning

[Former Member]

Dear,

I have check this 5 days ago. I updated secure login client. and GUI was already on higher side.

any other help???

Regards

[former_member157391]

http://help.sap.com/saphelp_nwsso20/helpdata/en/f8/2380a135104ff3ba3d89a451b4a0f4/content.htm?frames...

Could you please take trace generated when reproducing the issue?

Best regards,
Ning

[former_member157391]

Dear Qazi,

Have you made sure Kerberos token is set to default profile for SAP application in secure login client?

Best regards,
Ning

[Former Member]

Dear Qazi,

First go through on the video guide : http://scn.sap.com/docs/DOC-40178

Kind regards,

Adrian

[Former Member]

Dear Adrian,

Atleast you have to check the whole thread before replying.

Dear i am following the same video as its defined steps in video... See first message of this thread.

If you can help do it.

Regards

[Former Member]

Dear Qazi,

sry, did not spot the link.

anyway, you may try to configure the Kerberos SSO solution in "standard" way.

- you create a service user @ AD site, with SPN "SPN/YourServiceUserName
SAP recommends to use AD service username "SAPService<SID>" with SPN "SPN/SAPService<SID>".

- create keytab with sapgenpse keytab -p SAPSNCSKERB.pse -x <password> -y <service_user_password> -a YourServiceUser@YOURDOMAIN

- create credential file with "sapgenpse seclogin -p <path_of_SAPSNCSKERB.pse> -x <pse_password> -O system_user

note that system_user is <SID>adm and not the AD service user UPN.

- set SECUDIR environment variable, point where you store the PSE file SAPSNCSKERB

on AS ABAP side you need to adjust parameters as well (snc/gssapi_lib and snc/identity/as, etc)

snc/identity/as should be p.CN=<service_user_UPN

check your SAPGUI's SNC name as well, should be p:CN=ServiceUser@DOMAIN>

Check the implementation guide @ http://help.sap.com/download/sapsso30/secure_login_impl_guide_en.pdf

(chapter 3.4 for SNC Kerberos configuration)

furthermore check your Secure Login Client and your CommonCryptoLib version as well.

Regards,

Adrian

[Former Member]

plus, the "standard" way implementation guide videos:

https://www.youtube.com/watch?v=JTPnUx6q3n4

https://www.youtube.com/watch?v=-zMcJ4_D5qc

https://www.youtube.com/watch?v=4inbw2xR77k

https://www.youtube.com/watch?v=M5asLvzQf4M

[Former Member]

Dear Adrian,

I have seen these videos. Seems this is for windows server.

I have RHEL6 installed on which SAP system installed. Does it work??

Regards

[Former Member]

Dear Qazi,

sapgenpse is located in your /usr/sap/SID/DVEBMGSxx/exe folder.

commands and switches are the same, you need to use the <sid>adm user to create PSE and your credential files (to avoid accessibility problems.

on linux / unix you need to set the SECUDIR via set or setenv (depends on your shell you are using), but anything else is the same.

Regards,

Adrian

[former_member157391]

In fact, it would be very helpful if you could gather secure login client and commoncryptolib trace according to SSO implementation guide http://help.sap.com/download/sapsso30/secure_login_impl_guide_en.pdf

[Former Member]

Hello,

Ensure that the SPN is set correctly.

Additionally, check if the AES encryption is enabled.

That worked for me when my token check wasn't successful.

Regards,

Tanvi

[Former Member]

HI Tanvi,

SPN is set CN:K3D in SNCWIZARD transaction so i m setting in SAP GUI SNC option p:CN=K3D

How can i check that AES encryption is enabled????

I hope u have seen all my error screenshot in first message of this thread.

Regards

[former_member157391]

Please refer to the following link to check if AES is enabled for the account property with the SPN.

Windows Configurations for Kerberos Supported Encryption Type &amp;#8211; Microsoft Open Specificati...

Best regards,
Ning

[Former Member]

Dear Ning,

with the help of MSDN article you shared, Our MS AD guy applied option 1 on AD and option 3 on my Windows 7 PC thats on same domain.

Error is changed now...

Please help.

Regards.

[Former Member]

Hello,

Yes i checked the screenshots.

Your MS AD consultant will be able to check the user attributes for the user you have on your SPNego screen for the encryption. DES if enabled,needs to be disabled and AES 128 bit and AES 256 bit has to be enabled.

Regards,

Tanvi

[former_member157391]

Dear Qazi,

Would you please click on question mark on pop up window for further check?

Could you please navigate to user mapping tab page to see if there is any change?

Best regards,
Ning

[jmoors]

Your service name doesn't look right, it should contain the domain name instead of just the SID. Should be something like p:CN=KerberosW3D@DOMAINNAME.

has the SPN been set on the AD account?

Regards,

Jason

[Former Member]

Hi Jason,

(Should be something like p:CN=KerberosW3D@DOMAINNAME.) You mean to say SNC setting in SAPGUI be like p:CN=K3D@DOMAINNAME ???

(has the SPN been set on the AD account?) Yes SPN has been set on ADaccount thats why passwords succesfully validated

Any further suggestions please?

Regards

[jmoors]

what service name did you specify in the SNCWIZARD, it should contain the actual domain, this should then be configure in sapgui,  but should contain the domain name to resolve.

Yout can check in RZ11 for the snc/identity/as parameter, which needs to contain the domain.

regards,

jason

[Former Member]

Dear Jason,

Yes i have set SNC identity without Domain when i have started SNCWIZARD

But i have followed the same in video of article

Now i m trying your suggestion by changing profile parameter snc/identity/as with Domain name.

Will let you know after change.

Regards,

Qazi

[Former Member]

Jason,

I have tried your solution for SNC identity parameter with domain name... it cause new problem dispatcher dying due to domian name.. i reverted the changes, now i defined SNC name same like in video p:CN=K3D.

Any other solution or suggestion please.

Regards.

[Former Member]

Can you check on the below link https://scn.sap.com/thread/3594416

Thanks
,

Bharathi

[Former Member]

Hi,

I didn't get same error in your suggested post nor the solution.

Regards

[former_member157391]

Hi Qzai,

Could you please check the followings?
1. if you are logging on to SAP with a domain user when running SNCWIZARD
2. if you have select Kerberos token as default application in secure login client

Best regards,
Ning