Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

SAML2 Web Single Sign-on updates too many services.

former_member186439
Participant

‎10-06-2014 9:43 PM

0 Kudos

We have just gone through the process of setting up Microsoft ADFS to be our Identity Provider for SAML2.  This allows our users to access web content in SAP based on their windows PC logon. 

After going through the process of using the SAML2 transaction to establish the trust relationship, we find that SAML2 web single sign-on is now enabled for way more than we ever intended.  Two examples of where this is a problem include: 1) OData web services (/default_host/sap/opu/odata/sap) and 2) the Netweaver Business Client (/sap/bc/nwbc).

What is the best process for selectively enabling SAML2 web single sign-on?  It seems that we could go into SICF and switch individual service nodes to using the 'Alternate Logon Procedure' and then remove 'SAML Logon' from the Logon Procedure list.  However, this requires us to touch way too many nodes.  This process is, in effect, selectively disabling SAML2 web single sign-on.  We are looking for a process where we can selectively enable SAML2 web single sign-on for the few places where we want it to be enabled (e.g. /default_host/sap/bc/webdynpro/sap).

Thank you in advance for your help.

1 REPLY 1

martin_voros
Active Contributor

‎10-06-2014 11:02 PM

0 Kudos

Hi,

SICF uses inheritance. So children inherits logon procedure unless you specify otherwise. Hence it's not that much work. You can go to top one - disable SAML and then enable SAML for nodes that you wish for.

Cheers