SharePoint integration with SAP Netweaver Portal on extranet scenario

[Former Member]

Is kerberos authentication a must in setting-up SSO in SharePoint to access 3rd party applications like SAP on an extranet deployment?

I found this info from:

http://download.microsoft.com/download/b/c/1/bc1939d9-638f-4053-b602-4258f18bb683/CB_045_Interoperab...

"SSO using Windows Integrated Authentication does only work out-of-the-box if SharePoint Portal components embedded into SAP NetWeaver Portal using URL iViews are being called in an intranet scenario. If an end user opens the URL of the SharePoint component in its browser in an intranet scenario the user is automatically authenticated using Windows Integrated Authentication.

In an extranet scenario, this does not work since Kerberos does not work well across the Internet due to client side firewall configuration and because Windows integrated authentication requires that client and server reside in trusted domains."

This is my scenario:

We have a SAP NetWeaver 7.0 website which we normally have to login before we can access the web portal via http://myportal.com:portnumber/irj/portal. Our portal provides role-based secured access to SAP and non-SAP applications. e.g. orders, transactions, etc. We are using iviews on the SAP portal.

We have a MOSS sharepoint website (Basic Authentication extended with Integrated Auth.) accessed via https://company.com that we want to be the main point of entry. Once a user is logged in to the MOSS sharepoint site using his AD account, he should be able to go directly to SAP Netweaver website without having to login again for SAP authentication and vice-versa. I'm planning to implement BDC in SharePoint to display contents from SAP as well as create InfoPath forms to update SAP.

Does anyone have a workaround on this? Thanks in advance.

[Andre_Fischer · Accepted solution]

Hi Michael,

there is a solution for your scenario.

You can use either ISA Server 2006 or Intelligent Application Gateway (IAG) 2007 from Microsoft.

Both products allow for an Pre-authentication

using user name and password of an active directory user.

ISA Server 2006 and Intelligent Application Gateway (IAG) 2007 introduce support for Kerberos constrained delegation to enable published Web servers to authenticate users by Kerberos after their identity has been verified by either ISA or IAG.

This way it is possible to provide SSO for SAP NetWeaver Portal using the SPNego Login Module that supports Integrated Windows Authentication.

Please note that this scenario only works if username and password have been provided at the initial authentication against ISA Server or IAG. If the initial authentication is performed without the use of passwords (for example using a Smart Card) SSO against the SPNego Login Module will not work.

Kerberos Constrained Delegation in ISA Server 2006

Enabling Kerberos constrained delegation

Best regards,

André

[Former Member · Accepted solution]

Thanks Andre