ECC - LDAP Authentication

[Former Member]

Hi,

I already have CUA configured to synchronize users with my LDAP Server. I'd to use authenticate SAP users at my LDAP Server. I saw the note 793191 - FAQ: User master synchronization with LDAP directories informing that is not possible to synchronize userPassword attribute. Is there a way to achieve LDAP Authentication? With Enterprise SSO is it possible?

Thank you.

[Chenyang]

Hi Bruno,

In your case, you perhaps need an Identity Management solution (rather than a SSO solution) to sync passwords among different applications, for instance SAP Identity Management (SAP IdM).

First of all you need to have an app to host all the user accounts. In your case, it should be Oracle LDAP.

Then when creating user account on Oracle LDAP or user changes its password on Oracle LDAP, this app should be able to catch this password and send it to IdM via API.

Next, IdM is able to send this password to all the systems it connects to, in your case, SAP ECC or Portal. SAP IdM is capable of provisioning productive password to SAP ABAP/Java and even Microsoft AD.

Best Regards

Chenyang Xiong

[Former Member]

Hi Chenyang Xiong,

password synchronizatioin is not a supported feature for SAP ABAP application servers. Therefor SSO is the only choice, when you want a central token to be used for authentication. For SAP Java sever, you can authenticate against an LDAP server, so there neither SSO nor IDM would be required.

Regards,

Patrick

[Chenyang]

Hi Patrick,

Yes, however this is possible in IdM and it is a standard feature of SAP IdM.

Check this out.

There is one more about productive password provisioning

http://help.sap.com/saphelp_nwidmic_72/helpdata/en/28/9a4ad9a18448bfa5d2a1b8f51610c9/content.htm?fra...

it says

To provision productive passwords to AS ABAP systems, see SAP Note 1575445.

Best Regards

Chenyang Xiong

[Former Member]

Hi Chenyang Xiong,

not everything technically feasible should be used for productive systems.

Please see Note 376856 for details. This states:

Passwords are essentially considered as a "secret between the user and the (one) system" and are dealt with accordingly.  

and

The reason for the desire to keep passwords at an identical value in different systems might be the request for a single sign-on (SSO ) mechanism.

Regards,

Patrick

[Former Member]

OK. Thank you guys!

[Former Member]

I got it. The thing is, I don't have all SAP users created in my Active Directory.

For Java System, can I use something like this:

[tim_alsop]

Yes, for Java you can setup UME for LDAP user auth, but for ABAP user auth with LDAP or Kerberos (e.g. Active Directory) you need to buy a product as that functionality is not free.

We are planning to add LDAP auth to our product. At the moment, it can just be used to authenticate using Active Directory password and RSA SecurID passcode.

[former_member200373]

SAP SSO may fit well here. With Secure Login Server, you get an easy on-the-fly conversion of your LDAP user credentials into X.509 certificates, which then allow SSO or login with session wise re-authentication into ABAP and other PKI aware apps (which is the majority). So you have both, Kerberos and X.509, with AD and LDAP. Plug it together as required by your respective use cases.

-- Stephan

[Former Member]

Active Directory's passwords are not synchronized with OID yet, but will be.

Thank you.

[tim_alsop]

It is easier to implement a solution where user gets to enter their Active Directory password when they logon to a SAP system with SAP GUI or a Web browser. Using LDAP out of the box is only possible on NetWeaver JAVA systems. For ABAP systems (GUI or Web logon) you need to buy a product to allow AD auth to be possible, and without SSO.

[tim_alsop]

I suggest that you look at using AD password and when the users passwords are in sync they won't know whether their password is being checked against AD or LDAP server (OID)

[Former Member]

That's correct.

[tim_alsop]

ok, so a user has two passwords to remember, one being the Active Directory password used to logon to their workstation, and the other being the Oracle Directory password. Are these in sync ?

[tim_alsop]

Is LDAP Server = Active Directory ?

Do you want to logon to your ABAP system using Active Directory credentials ? if so, via GUI or web browser, or both GUI and web browser ?

Thanks

Tim

[Former Member]

Its not Active Directory, actually is Oracle Directory Server (LDAP).

I'd like to authenticate both, GUI and Web Apps. I don't wanna SSO, its not a problem to me my users input username/password. I just wanna have one username/password to access SAP and other legacy apps.

Thank you.

[tim_alsop]

ok, so let me make sure I understand. A user will logon to their Windows workstation using Active Directory domain credentials, and when they login to a SAP system using SAP GUI you want to prompt them to enter credentials which are checked against Oracle Directory. Is this correct ?