SAP GUI – SSO with kerberos autentication on Windows

You can find many blogs and videos about setting up SSO with Kerberos authentication on SAP GUI. With “SNCWIZARD” this has become a real simple procedure.

SSO can be configured even if SAP is running on a different domain than your end user’s computer or even if it is not attached to a domain.
This is because SAP GUI acts as a communication agent between SAP application and your AD and there is no direct communication between SAP application and AD for authentication.

  1. Upgrade the Cryptographic library to latest level.2450794 – How to update CommonCryptoLib in an ABAP system.Following files are extracted from cryptographic library SAR files.ssofiles

    Make sure that the Kernel is upgrade to latest level or at least the above files are at latest level.

  2. Check if you need to install the following SAP Notes based on your existing SAP support pack level .2516329 – “Kerberos library was not loaded” error when accessing SPNEGO transaction
    2304831 – Programs fail after CCL 8.5 is installed
  3. Create User Principal Names and corresponding Service Principal names on your Active Directory.
  4. Run transaction “SNCWIZARD”sncwiz1
    sncwiz2Verify that all the relevant parameters are set appropriately.

    sncwiz3

    sncwiz4

    Wizard will tell you if you will need a restart in the next step:

    sncwiz5
    sncwiz6

    on the next screen you are directed to SPNEGO to enter AD user and Password.

    sncwiz7

    Complete the configuration wizard.

    snc8

  5. Install SSO Login client on end user laptop.
    snc4
    Test the connection to AD using SPNEGO transaction.snc1
  6. Now you can map the SAP users to users from SU01.snc6
  7. Now change the SAP GUI to use SSOsnc9
    Now users should be able to login to SAP without using User ID and Password.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s