Issue with SPNEGO if SAP and Browser are on the same host (NTLM issue)

[Colt]

Hi Experts,

have anyone of you ever experienced the issue with SPNEGO SSO where the browser is executed on the SAP host itself.

In my case I have to prepare a training where I only have one single Server for my students and I like to setup SPNEGO for ABAP and Java.

I have configured both correctly (pretty sure ) and in the ICM traces I am able to see HTTP 401 Negotiate is trigged by AS ABAP and Java.

In the Java traces i can see "NTLM token received in authorization header"

Does anyone know how to cure the Internet Explorer from doing NTLM?

Thanks!!!!

Cheers,

Carsten

[former_member157391 · Accepted solution]

Dear Carsten,

Please see "Are the client and server on the same box?" under below link.

https://blogs.msdn.microsoft.com/friis/2009/12/31/things-to-check-when-kerberos-authentication-fails...

The issue is described in MS's knowledge base with possible solutions. https://support.microsoft.com/en-us/kb/896861

Best regards,
Ning

[Colt · Accepted solution]

SPNEGO where the client and the server are on the same host does not work. Fact is: Kerberos is not enabled in this configuration and a hard coded loopback check will always force usage of NTLM in this scenario.

Update: Method 1 and 2 as described in https://support.microsoft.com/en-us/kb/896861 did not helped.

Workaround: see my post above

Solution1: use a different client

Solution2: create an additional DNS entry for the system and SPN pointing to that name.

(But this is not possible in my scenario as i have only limited access to AD environment, unfortunately )

[former_member157391 · Accepted solution]

Thanks for sharing your workarounds.

[Colt]

Workaround:

If I configure Local Intranet Zone for "Prompted Auth"

I see the following popup if connecting to a SAP web AS:

There i am able to enter a AD username and password and I am successfully logged in.

Is there a better way?

Carsten