SAPGui and Kerberos with Suse Linux

[Former Member]

Hi,

We areconfiguring the SSO between the Windows AD and the SAPGui using Kerberos in one of our AP servers. Our SAP system is a SAP ECC EhP7 with Netweaver 7.40 where the CI is running on HP-UX but one of the AP servers is running in Linux3.12.49-11-default x86_64.

We have installed the following libraries:

krb5

krb5-32bit

krb5-client

The keytabfrom from the CI has been copied to the / etc directory on the AP server .Using the SIDADM user we have generated the ticket /usr/bin/kinit -k -t/etc/krb5.keytab ht1adm@XHIJT.SEV.COM.

On RZ10, we have added the following SNC parameters:

### SNC parameters

snc/permit_insecure_start = 1

snc/data_protection/use = 3

snc/data_protection/max = 3

snc/data_protection/min = 1

snc/accept_insecure_r3int_rfc = 1

snc/accept_insecure_rfc = 1

snc/accept_insecure_cpic = 1

snc/accept_insecure_gui = 1

snc/gssapi_lib = /usr/lib64/libgssapi_krb5.so.2

snc/enable = 1

snc/identity/as = p: ht1adm@XHIJT.SEV.COM

login/password_change_for_SSO = 0

The APserver can be started without problems but when we try to access to the system via SSO we have this error:

M ThSncCheckEnv: I'm SNC acceptor

M ThSncCheckEnv: initialized snc env

M ThSncCheckEnv: snc count of T16/U23: 1

M ThSncIn: process input data at7fe7ea30b008 with length 1812

N *** ERROR => SncPEstablishContext()==SNCERR_GSSAPI [sncxxall.c 3563]

N GSS-API(maj): No credentials were supplied, or the credentials were unavailableor inaccessible

N Unable toestablish the security context

N <<-SncProcessInput()==SNCERR_GSSAPI

M *** ERROR => ThSncIn:SncProcessInput (SNCERR_GSSAPI) [thxxsnc.c 1035]

M {root-id=00505684AB7D1EE6A2F91D63738B9A86}_{conn-id=00000000000000000000000000000000}_0

M *** ERROR => ThSncIn: SncProcessInput[thxxsnc.c 1040]

M {root-id=00505684AB7D1EE6A2F91D63738B9A86}_{conn-id=00000000000000000000000000000000}_0

M in_ThErrHandle: 1

M *** ERROR => ThSncIn:SncProcessInput (step 4, th_errno 44, action 1, level 1)[thxxhead.c 11560]

M {root-id=00505684AB7D1EE6A2F91D63738B9A86}_{conn-id=00000000000000000000000000000000}_0

Does anyone know what could be happening? We have already checked the SECUDIR and SECULIB and the server hostname it´s on the DNS.

SSO is working without problems in the CI that is running on HP-UX , problem is happening on the AP server which is running on SuSe Linux.

Thanks alot and best regards, Sapera