SPNego authentication mode on WAS with ABAP stack

[Former Member]

Hi,

I have a Netweaver 2004 installation (java and abap stack). Now I want to configure the SPNego authentication mode on the java stack. Till now, the java stack uses the abap backend to authenticate the users.

Is there a possibility to change the authentication mechanism to spnego? Would there be the possibility on Netweaver 2004s?

Thanks,

Thomas

[Former Member]

Thomas,

With regard to your dual-stack, when installed, if they share the same SID (Java and ABAP were installed as a combined system), I am pretty sure that you cannot break this away from ABAP authentication. One way to tell is if you can goto the UME on the Java Stack, select Configuration, and then hit Modify Settings. Once the screen changes, select the drop-down - here for Dual-Stack, the only option should be ABAP.

If this answers your question, please set the thread to answered.

[Former Member]

Thanks for your suggestions!

I want to configure the SSO with Windows ADS.

I'm a little bit confused. Micheal: How can I switch the authentication mode? Like in Davids answer described, I'm not able to select the auth. mode Windows ADS in the configuration of the java stack on a Dual Stack installation.

So I have to ask once more: Is it possible to switch on a Dualstack installation (WAS Java/ABAP) the authentication mode from the ABAP user store to kerberos authentication (SPNego)? If yes, where can I configure this?

Regards,

Thomas

[Former Member]

Hi again

Please ignore my post, i mixed the dual stack thing with the spnego, sorry.

I only implemented spnego with a enterprise portal (no abap stack there). Additionally we added SS0 from that portal to various other SAP systems (saplogonticket) , which is not quite the thing you wanted.

Kind regards, Michael

[Former Member]

Hi Thomas

You are a bit short on details, i assume you have a windows active domain and you are trying to set up single sign on to your java stack.

In this case you can still use the abap ume and configure SSO with SPNego. If your browser can negotiate a kerberos ticket, and your java stack accepts it, you will be fine. However, you will not be able to authenticate users directly from kerberos to ABAP.

If your windows domain usernames do not match with the SAP usernames, you will have to map them. In most cases the SAP username can be extracted from somewhere in the AD.

Regards Michael