Implement SSO without Portal - Logon tickets

[Former Member]

Hi ALL

I have a situation where SSO needs to be implemented between 3 WEB AS servers, Portal should not be used at all.

I have figured out that following steps to implement SSO need someone to verify it for me.

Pre-requisities - User ID should be same in all systems.

Issuing server:

1. Configure a single Web AS server for issuing tickets by chnaging the system parameters. Lets say this Server has "A"

2. Replace the Servers SSO PSE.

Accepting server:

1. Configure the remaining Web AS server for accepting the logon tickets using the system parameters. lets say these servers has "B & C"

2. SAP Library needs to be installed.

3. create an RFC destination to the issuing Web AS.

Now the configuration is over & system is ready for the SSO testing.

So now if the user just logons into a system "A" using SAP GUI with the correct user id & password then logon ticket is created.

Now to login to Server "B or C" the user just clicks in the SAP GUI, the menu screen appears using already created logon ticket.

My Questions.

1. Is my implementation steps correct or needs some thing else also.

2. What if the Users password is different in other systems, will the logon into Server "B or C" be successfull.

3. What if another user needs to login from the same computer which has already got a logon ticket created by another user.

Your answers will greatly help me in leading this project.

<b><removed_by_moderator></b>

Best wishes

Naveen Murthy

[WolfgangJanzen]

> So now if the user just logons into a system "A" using SAP GUI with the correct user id & password then logon ticket is created.

No, you'll never receive any SAP Logon Ticket when you logon to an ABAP system using SAPGUI. SAP Logon Tickets will only be issued (as cookie MYSAPSSO2) when you logon to an WebAS using your browser.

For SAPGUI you should use SNC to achieve the intended SSO functionality.

Unless your ABAP systems are running on Windows, you need to purchase a 3rd party SNC solution.

In both cases (SNC and SAP Logon Ticket) the SSO mechanism does not rely on passwords. The user does not even have to have a password (in the ABAP system). For SAP Logon Tickets the contraint to use the same ABAP UserID in all systems is correct. For SNC that's not a requirement since a local mapping (in each system) is performed between the SNC name and the ABAP userID.

> What if another user needs to login from the same computer which has already got a logon ticket created by another user.

Well, Single Sign-On (SSO) means Single Sign-On; once you are authenticated, you'll not be requested to re-authenticate - unless you logoff. So, when the same PC is shared by multiple users they have to perform a logoff before handing over the PC to the next person. Using SNC might even require to logoff from the operating system (depending on the SNC product). Using a web-browser you should keep in mind that it is important to clear the "Temporary Internet Files" (browser cache, etc.).

If you leave your car unattended (and unlocked) while the engine is still running misuse by another person cannot be prevented. Your car insurance might consider you responsible (and liable) for any actions (damages) which have been performed with the car.

If you leave your PC unattended (and unlocked) while applications are still running misuse by another person cannot be prevented. Your employer might consider you responsible (and liable) for any actions (damages) performed which are associated with your identity.

[Former Member]

Hi Wolfgang Janzen

Thank you for the excellent addressing you have given for my issue.

So it looks like i will have to opt for SNC Scenario & also need a 3rd party SNC solution, Has my Web AS servers are running on Unix & portal on Win2003 servers.

I have some question for you

1. Do you know any relaible products & cost of owning this 3rd party solution.

2. If my Portal systems are running on Win2003 servers will same SNC solution be apicable.

3. How can i convince my superiors to take the portal also into account for implementing SSO has it will be very easy in implementing SSO.

regards

Naveen Murthy

[WolfgangJanzen]

> 1. Do you know any relaible products & cost of owning this 3rd party solution.

Sorry, but I cannot give any recommendations or comments on partner products.

But I'm sure you'll get some feedback by other SDN members.

> 2. If my Portal systems are running on Win2003 servers will same SNC solution be apicable.

Well, you should choose a SNC product that is also available on this platform (which should be fairly easy). But please be aware that SNC can only be used for ABAP servers - not for Java servers (like EP). However, some (PKI-based) products provide support for both, SNC and X.509 client certificates. The X.509 client certificates can then be used for SSO at the EP (as well as at any other NWAS - ABAP and Java). That's, of course, not the only possible solution approach which provides SSO for both "worlds" (http and non-http communication). There are also SNC products available which are Kerberos-based; and those vendors also provide custom JAAS login modules which can be deployed on a NWAS Java / EP.

> 3. How can i convince my superiors ...

Well, I don't know.

[Former Member]

Hi Naveen Murthy,

Hi my name is Michael Kummer and I work for SECUDE IT Security as a

Customer Support Engineer.

Feel free to drop me an email to <b><email_removed_by_moderator></b> and I'd

be happy to explain to you how SECUDE's SSO solution for SAP works.

Cheers

Michael

[WolfgangJanzen]

Now, you got already one reply / offer from someone who represents a vendor providing a PKI-based solution.

I'm sure that <a href="https://forums.sdn.sap.com/profile.jspa?userID=120626">Tim Alsop</a> will soon also reply to this posting. He is representing a company which offers a Kerberos-based solution.

And of course, all others are also invited to present their offerings (in an appropriete way, complying with the <a href="https://wiki.sdn.sap.com/wiki/display/HOME/RulesofEngagement">Rules of Engagement</a>).

[Former Member]

Hello all,

There was a suggestion a few months ago for 3rd party product-vendors to get together and write a "vendor-neutral" Blog on SSO using 3rd party solutions.

That was the last which I had heard of it (though that does not say much either.. )

Michael / Tim, is there any such thing in the pipeline for us? These questions get asked regularly... it would be usefull to have a blog or article to point to.

Kind regards,

Julius

[Former Member]

Hi

This is very important for me to get a solution on this topic.. this is my first project & did lot of searching & re-fining all the solutions.

After i composed the steps to implement SSO using logon tickets i got suggestion from Jansen that logon ticket won't work without a portal front end. what a set back..

let me know if any one of you have done this before & how did you manage the scenario if there are any alternatives.. appreciate a lot about the time & effort you guys are investing in this..

thankx again.

[WolfgangJanzen]

> i got suggestion from Jansen that logon ticket won't work without a portal front end

Sorry to disagree. All I've stated was that you will not get any SAP Logon Tickets back if you use SAPGUI (for Windows) as frontend. However, I've pointed out that you can use SNC to obtain SSO functionality, in that case.

[Former Member]

Hi Janzen

Sorry for any confusion i have created for you, i mentioned that for Web AS systems running on AIX servers, implementing SSO without portal can only be done using 3rd party SNC solution..

and asked there should have been some other solution.. hope i haven't offended you by any means..

thankx

Naveen Murthy

[WolfgangJanzen]

Thanks for clarification - no, I'm not feeling offended.

PS: my firstname is 'Wolfgang' (not: 'Janzen')

[Former Member]

Hi Wolfgang

i think i have a solution for this situation, Logon tickets can be used using a browser rite.

So if i set up SAP GUI in browser & have the ABAP systems running on them, Then the Logon tickets can be used rite.. Do you have any idea on how to setup SAP GUI in Browser.

Let me know thankx

[WolfgangJanzen]

"SAP GUI for HTML" requires an ITS (as of NWAS 6.40 the ITS functionality is contained in the NWAS ABAP, so-called "internal ITS").

In case of the internal ITS it is just an ICF service (to be activated via transaction SICF) - with the URI /sap/bc/gui/sap/its/webgui

But please notice: "SAP GUI for Windows" and "SAP GUI for HTML" have different capabilities (especially regarding integration with MS Office products).

Regards, Wolfgang

[Former Member]

Hi Wolfgang.

I have one more idea to solve this SSO issue.

Where SAP systems will authenticate using LDAP protocol from AD server.

Do you know any procedures around this method.

Regards

Naveen Murthy

[WolfgangJanzen]

Unfortenately, that authentication mechanism is not available for ABAP systems.

However: in many cases "LDAP authentication" is referring to the usage of MS ADS. In that case you can consider to use the SNC library descibed in [SAP Note 352295|https://service.sap.com/sap/support/notes/352295] (if your ABAP system is running on the Windows platform) when using SAPGUI.

Using WebGUI this is only possible if either using an external ITS (6.20, see [SAP Note 493107|https://service.sap.com/sap/support/notes/493107]) or when using an Enterprise Portal (or at least a NWAS Java) which supports SPNEGO authentication.

I advise to perform a search in this forum with the keyword 'SPNEGO' or 'Kerberos'.

You'll find many hits ...

Cheers, Wolfgang

[Former Member]

Hi Wolfgang

I want to summarize the details has below which is:-

SAP UME needs to use AD server has the datasource for authenticating users into SAP.

Ex: currently the same mechanism works with Exchnage server where user logs into the Network & then just opens mailbox, which inturn authenticates the user with the active directory using LDAP protocol.

i have a link which details the steps - http://help.sap.com/saphelp_erp2004/helpdata/en/cc/cdd93f130f9115e10000000a155106/frameset.htm

so would like to know am i going in the rite way.

Hope i am not taking much of your time.

Regards

Naveen Murthy

[tim_alsop]

Naveen,

Actually, when you access MS Exchange or any Windows application that recognises the user logged on at workstation you are using Kerberos protocol for authentication, NOT LDAP protocol.

I hope you don't mind me correcting you, but many people confuse LDAP with Kerberos because MS AD is a Kerberos authentication server and also provides a Directory that is accessible via the LDAP protocol. The LDAP protocol is used to access Directory objects, and you can even authenticate using Kerberos to obtain a secure LDAP session - via the SASL GSS-API mechanism. Generally though, when using MS AD the authenticating protocol is Kerberos, not LDAP since Kerberos is more secure and better suited to SSO due to the tickets issued being cached after initial authentication.

Thanks,

Tim

[Former Member]

Hi Tim

Thank you for clarifying the misconception i had about LDAP protocol & Kerberos.

The goal in my company is to have SSO impemented by making the central LDAP become main user persistence storage for all connected SAP Web AS.

Once connected, all user administration will be done in LDAP for consistency.

I would like to know how to if the SASL GSS-API mechanism will work for above scenario.

Any SAP notes or Documents for me to get the steps to do the implementation.

Appreciate your time & effort in answering my question.

[tim_alsop]

Naveen,

When you mention that you want SSO for your users when they logon to SAP Web AS, I assume you want/need what is known as Integrated Windows Authentication (IWA for short). With IWA when a user logs onto Windows workstation using a domain account they are authenticating themselves to the WIndows Active Directory domain. Then when the user opens a web browser and accesses a SAP applicaiton hosted on SAP WebAS they are not asked to auithenticate again ? If this is what you are looking for then you need to use IWA, which is implemented in Java engine using an SPNEGO login module. There is no SASL requirement, so I am sorry I mentioned it - the reference I made to SASL was to explain that SASL protocol combined with GSS-API can be used to authenticate and provide a secure session with an LDAP directory. In your case you are wanting to authenticate users and get SSO, not have secure access to your directory.

So, from above you will see that you need to configure a login module in Java engine. When you have done this you will need to consider web accessible applications which are on ABAP stack, and this is done using a redirect on intiial authentication. It is explained many times elsewhere in this forum so I suggest you search for appropriate keywords such as SPNEGO and Java and you will find links which will help you setup this redirection.

Just for completeness, the company I work for has a product which we sell which does what you are looking for. The product is called TrustBroker Adapter. You can also use the SPNEGO login module provided by SAP, but our product is different in many ways, including the support for various Keberos protocol extensions and encryption types - our product does not use the Kerberos included with Java JDK which is notorius for being old and bug ridden

Thanks,

Tim

[Former Member]

Hi Tim..

The situation in my company is that..

After users logon to the network by authenticating with AD server, The user needs to logon automatically into SAP system using a SAPGUI logon pad & not using portal or through a web browser.

Some constriants are:-

1. Logon tickets can't be used cause the portal & browser will not be used.

2. SAP built-in SNC can't be used cause the our ABAP systems are running on AIX servers.

So my company has given me the responsibilty of finding the last possibility of authenticating users thru LDAP servers when they click on a SAP system in the loggon Pad.

I am in the process of gathering the design phase of this situation, then i can probably let my superiors know that any one of yours or other 3rd party sofware can handle this situation.

So let me know which Mechanism i need to concentrate on.

Is it Kerberos or SPNEGO etc..

Thankx in advance.

[tim_alsop]

Naveen,

I was not clear that you were looking for a solution with SAP GUI since the parts of your thread which I read didn't mention that. sorry for any confusion.

Anyway, with SAP GUI you are not going to use Java engine for this, and you can instead use SNC. The SNC library you need cannot be obtained from SAP since you have SAP on AIX, so you need a commerical SAP certified library instead. This is what our company sells, and [is explained here|http://www.cybersafe.com/links/snc.htm].

If you want to see a demo of how our product works with SAP Logon, please check [this link|http://www.cybersafe.com/d2] where we show the installation of our product on SAP server which is UNIX based and a demonstration is also shown so you can see a user logon to windows workstation and then opening SAP Logon and clicking on an entry to logon to SAP system.

You will notice that the only software requires is installed on each Windows workstation and on the SAP server which in your case is AIX.

Note: The SPNEGO references earlier in this thread are related only to Web access, and you are not looking for a Web based solution.

Thanks,

Tim

[Former Member]

Hi Tim

i reviewed the link & contented with the results.

Also can this software be used to integrate other applications to have single sign on other than SAP.

[tim_alsop]

Naveen,

Short answer is "YES".

I think it is appropriate if you want to discuss our product more that we do that outside of SDN. If you are interested to discuss further and perhaps arrange an evaluation can you contact me using the email address in my SDN business card.

Thanks,

Tim

[WolfgangJanzen]

Just for completeness:

there is more than just one certified SNC solution which would be suitable for the described scnenario.

See: http://www.sap.com/ecosystem/customers/directories/SearchSolution.epx

[Former Member]

Hi,

SSO - New Wizard.

SAP recently released a new (web dynpro based) wizard to help you in stetting up Single-Sign-On (SSO2) in your WebAS Java system. You can download the wizard and it documentation from SAP Note 1083421.

[Former Member]

Naveen,

before you go down a specific road, I think it is important for you to understand that there are other options to address your requirements (user authentication via Kerberos or Windows logon info to enable secure SSO to SAP via SAPGUI or other SAP user interfaces). You can implement SNC without installing a 3rd-party library on the SAP server (AIX), using SAPCRYPTOLIB. There are various advantages of this approach - most of all, you are not locked in. Again, an offline discussion - feel free to contact me. My contact info is in the business card.

Peter

[Former Member]

Could you please provide more info on SAPCRYPTOLIB.

[tim_alsop]

Sunita,

The SAPCRYPTOLIB is an SNC library that uses x.509 certificates. In your other thread related to your requirements you said you didn't want to use x.509 certs.

Thanks,

Tim

[WolfgangJanzen]

> ... there are other options to address your requirements (user authentication via Kerberos or Windows logon info to enable secure SSO to SAP via SAPGUI or other SAP user interfaces). You can implement SNC without installing a 3rd-party library on the SAP server (AIX), using SAPCRYPTOLIB. ...

Well, SAPCRYPTOLIB can be used as SNC library, that part is true.

But (due to the OEM license) it must only be used to establish an SNC-protected server-to-server communication; it is not suitable to achieve a SSO solution (user authentication based on SNC) since SAPCRYPTOLIB must not be used with SAPGUI or RFC clients installed on the frontend PC.

Yes, SAPCRYPTOLIB offers certificate-based cryptographic services - but without providng the Public Key Infrastructure (PKI) itself. You can only create self-signed certificates but you cannot perform Certification Authority (CA) operations. For server-to-server communication that is not critical since you can mutually exchange the certificates. However, that approach does not scale - it will not be appropriete for hundreds or thousands of users.