help about authentication with SAP GUI

[Former Member]

Hi guys,

1-client side. For authentication with SAP GUI, there is a screen in which it is necessary to enter userID and password. I would like to be able to modify this screen by including in it an fingerprint bitmap image (or to generate a popup window during this authentification for the fingerprint bitmap image).

    Is it possible to modify SAP GUI in order to obtain such results? (API, source codes, etc…) ?

- If this is possible, can you refer me to good links or a good documentation about how to deal with that. 

- if not, which solution do you recommend me?   (also links or documentation)

2-client side: After the authentification in SAP GUI, the user usually sees appearing a screen where he can select the modules he wants to use (BW, CRM, SCM,… etc). 

In the case that we'll have to develop a new version of SAP GUI (adapted to biometric):

     Is there any tools (or automatic ways ) which can automatically allow us to have access to the standard SAP session  screens associated to these modules (BW, CRM, SCM, etc…)?

or will it be necessary re-develop (API, coding etc…)each of these standard screens which are usually required in a SAP work session? 

Any answers, links or documentations about all of these questions will be helpfull.

Thanks you guys.

Nikita Dehoumon

[former_member181887]

Hi Nikita,

There is really no authentication done on the client side. The screen you mention in no.1 is generated from the backend system that you connected to. With SAPGUI connects to a backend system, the user usually only have access to that system.

I would suggest that you save development efforts and consider using Single-sign on for the SAP applications and implement biometric authentication for the network logon and then use this to enable single-sign for backend applications. You can enable this using an LDAP and product Active directory.

Just a thought,

Mike.

[Former Member]

Hi Nikita,

what you are looking for is the SAP SNC API. You can find a whole bunch of info, including API description and test program at http://www.sap.com/print/partners/icc/scenarios/technology/bc-snc.asp

Regards,

Patrick

[yonko_yonchev]

Hi Nikita,

Also take a look at the Secure Network Communications (SNC) documentation here:

http://help.sap.com/saphelp_nw2004s/helpdata/en/db/1f1740198d8f5ce10000000a155106/frameset.htm

SNC offers you a set of Generic Security Services (GSS) APIs to "plug-in" and use an an external security product on the ABAP system. The external security product in turn can implement custom authentication mechanisms (biometrics in your case). So, basically, you would see about getting your DLLs to work with the SNC's GSS APIs.

on a bit of a side note, SNC has client side and server side configuration. You can use the client side config for that finger print display, though you should consider if it makes sense from a security and performance perspective.

Regarding modifying the SAP GUI after authentication - you would normally use the customizing transactions to disable/enable user access to certain modules. You should probably consider this as separate from the authentication as this activity would occur after the user has been authenticated.

Well, hope this gives you a good start.

Regards,

Yonko

[Former Member]

I agree with Michael. Identity Management using the network ID and SSO to SAP (like Email, file servers, ess, etc...) is stronger than holding a thumb against a device once a day to let the secretary into SAP. It also strengthens authentication from the network, in addition to physical security to the server.

If the users have lots of secret business and naughty private things on the above mentioned systems, then it might hurt even more than cutting just their fingers off.