ITS Single Sign On

[ThomasKjelsrud]

Hi all.

We have a bsp application that is used for our employees to register work hours. This application is accessed through an URL via the integrated ITS.

Now we wish to implement SSO for this application, so that the users do not have to enter their username and password every time they access the application.

Does anybody know how to set this up?

Regards,

Thomas

[Former Member · Accepted solution]

Hi,

Something strange here : If it's a BSP, it does not use the ITS.

BSP and ITS are two different HTTP handlers in SICF.

SSO with Windows login needs a java stack with SPNEGO.

What was possible with the external ITS is no more possible neither with BSP or internal ITS.

Regards,

Olivier

[ThomasKjelsrud · Accepted solution]

Hi Olivier.

I might be misinformed here, but I know it is a BSP. How can I set up SSO for this BSP?

We have already set up SSO for SAP GUI login.

Regards,

Thomas

[Former Member · Accepted solution]

Hi thomas,

As I told you in the previous post.

You need a java stack and spnego.

We had this SSO need for SRM which is abap only. We did not want to install a java stack only for SSO. Finally, we used the java stack from MDM Catalog which is java only and was also needed for this project. A little bit of java specific coding was also needed.

For spnego SSO, have a look at

Link:[Using Kerberos Authentication for Single Sign-On|http://help.sap.com/saphelp_nw70/helpdata/en/43/4bd58c6c5e5f34e10000000a1553f6/frameset.htm]

Best Regards,

Olivier

[ThomasKjelsrud · Accepted solution]

Hi Olivier.

Sorry, but I did not have my facts straight. It is NOT a BSP, but a webgui transaction that is reached via the HTTP handler in SICF. My mistake, and I apologise.

Does this make the SSO implementation any easier?

Regards,

Thomas

[Former Member · Accepted solution]

Thomas,

I'm afraid that for SSO, it does not matter whether you use the internal ITs or BSPs.

You still need the java stack and spnego Kerberos....

It was so simple with the external ITS... IMHO, SAP did some really bad job on this !

The only other way I know which does not need java is to use X.509 client certificates.

Best Regards,

Olivier