Secure Login Client Breaks NTLM Single Sign On - Catch 22

[former_member197700]

We currently use NTLM single sign on for SAP on Windows. As soon as kerberos is enabled on an SAP system, it breaks sso on all PCs that don't have SAP Secure Login.  If we install SAP Secure Login on a PC, it breaks sso for any systems for which spnego/kerberos isn't enabled yet.

It is not feasible for our company to roll out kerberos and secure login client as a "big bang" without testing.  How can we transition so we do this in development first, then consolidation, then production?

Current Solution:

sec/libsapsecu = $(DIR_EXECUTABLE)\sapcrypto.dll

snc/gssapi_lib = $(DIR_EXECUTABLE)\gx64ntlm.dll

snc/identity/as = p:OURDOMAIN\SAPServiceSID

In su01, on the SNC tab, we specify p:NEXEOSOLUTIONS\<User Id>

New solution:

snc/identity/as	= p:CN=KerberosSID@OURDOMAIN.COM
spnego/enable =	1

spnego/krbspnego_lib = $(DIR_EXECUTABLE)\SLL\sapcrypto.dl

In su01, on the SNC tab, we specify p:CN=<User Id>@OURDOMAIN.COM

[Former Member]

Hello,

for the client side there is a migration guide available:

Then you can migrate the server side step by step. Of cause you need a new SAPGUI on the clients for that, but you can roll out this with the new Secure Login Client and the SNC_LIB_2 enviroment variables.

Maybe this hint helps you for a smooth migration solution.

best regards

Alexander Gimbel