SAP Support for SNC

[former_member210392]

Today we use SNC as the method to sign on to the SAP Logon Pad. Would SAP be dropping support for SNC in favor of SAP NetWeaver SSO?

[donka_dimitrova · Accepted solution]

Hello Daniel,

SNC protects the data communication paths between the various native client and server components of the SAP system that use the SAP protocols RFC or DIAG. There are two variants to implement SNC. The first variant is to implement it using Kerberos for basic authentication (User&Password) only. The second variant is to benefit from the SAP Single Sign-On product and to implement the SNC with X.509 client certificates or Kerberos and also to improve your corporate security with one more level by implementing also single sign-on to SAP systems based on X.509 client certificates or Kerberos. We support both variants.

Regards,

Donka Dimirtova

[Former Member]

Hallo,

SNC protects your data (in transit): Secure Network Communication.

SSO allows you to, for example, to get you into a SAP instance without entering your password after you have authenticated against, for example, the Windows domain: Single Sign On.

You can use SNC without SSO, they are not necessarily connected, e.g.

Regards

Thomas.

[donka_dimitrova]

Hello Thomas,

This is exactly what I explained as variant 1 - SNC without SSO - encryption with basic authentication (User&Password) only.

Regards,

Donka Dimitrova

[former_member210392]

We have SSO configured for the SAP GUI for Windows. Below is what my SAP GUI configuration looks like.

The question I have is - is SAP planning to drop support for the below mechanism in favor of the SAP Single Sign-On 2.0 product.

[Former Member]

Hallo Daniel,

I think SAP's idea is that you only use their own product (SAP Single Sign-On) or a certified partner product.

Please refer to External Security Products - Transport Layer Security on SAP NetWeaver AS for ABAP - SAP Library

Regards

Thomas.

[donka_dimitrova]

Hello Daniel,

SAP Supports single sign-on for SAP GUI for Window via SNC. SAP Single Sign-On is the SAP product that offers a library and a client for such implementation, where the solution could be based on Kerberos tokens or X.509 client certificates.  The implementation of any SSO solution for SAP GUI for Windows requires SNC configuration as the one visible on your screenshot.

Regards,

Donka Dimitrova

[former_member210392]

Thanks again for your response. The below 2 notes are what's confusing me.

352295 - Microsoft Windows Single Sign-On options

150380 - Is Kerberos 5 supported for use with SNC?

We use the Windows based dll "sncgss32.dll". Is SSO via thia DLL going to be supported or is SAP going to drop support for this DLL in favor of the new product?

[donka_dimitrova]

Hello Daniel,

As I already mentioned, SAP Supports single sign-on for SAP GUI for Window via SNC and we have no plan to change this. You can use the SAP security product SAP Single Sign-On or a 3rd party security product. As stated clearly in the SAP Notes, mentioned by you, SAP is not responsible for the non-SAP security products used for the SNC.

Regards,

Donka Dimitrova