Skip to Content
avatar image
Former Member

SSO from Enterprise Portal to SAP GUI for Windows

Experts,

I need help in deciding which SSO solution to use.

We are implementing OpenSSO for Single Sign On to Enterprise Portal 7.0. When a user login to his Active Directory account (Windows PC), he is automatically authenticated to EP 7.0 using OpenSSO.

Now, for SSO to SAP GUI (Backend ABAP Stack), I have two options.

1. Launch the SAP GUI for Windows from the Portal to automatically sign into to ABAP using SAP Logon Tickets.

2. Implement SAP GUI for Windows SSO using SNC via Kerberos.

Which method is SAP recommended? What are the advantages and disadvantages of the above two methods, especially option 1?

<removed_by_moderator>

Thanks,

Saran

Edited by: Julius Bussche on Feb 24, 2009 9:11 PM

Please read the forum rules

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

3 Answers

  • avatar image
    Former Member
    Feb 24, 2009 at 10:03 PM

    I don't work for SAP and am not aware of specific general recommendations... but what I can say is that I have seen both work.

    SAP logon tickets (1) is an older technology and I don't think SAP will make any investments into it anymore as it can be replaced by standards based technologies which have the capability of better security and integration with other non-SAP applications.

    Kerberos (2) is much debated here in the forum. Personally, I have had positive experiences with Kerberos based vendor solutions (both for SAPGUI and EP's, and with regards to support and costs).

    I think it can safely be said that the MIT 5 Kerberos solutions should be avoided unless you are very adventurous, as they offer no support (you will need to find it on your own and pay for it on your own...) but it is "for free" from a licensing perspective.

    If those are the only 2 options you are considering (there are more) then I would recommend taking a look at the EcoHub tab here on SDN, where 3rd party product vendors can be found using the search terms you have given.

    Just my opinion based on my experiences - so my 2 cents worth to the topic 😉

    Cheers,

    Julius

    Add comment
    10|10000 characters needed characters exceeded

  • Feb 24, 2009 at 10:13 PM

    Saran,

    Some other differences relate to the security aspects of the solution you decide to use. If you launch SAP GUI from browser, I beleive this requires that an active-x control is used to run this program on the workstation, and I have heard that SAP do not recommend this method because it opens up the browser security and could cause you issues in future. I am also aware of at least 4 companies that I have worked with who started off using this method and when they learnt about the issues they moved to using an SNC solution instead 😊

    Also, if you use SNC the session between SAP GUI on workstation and SAP ABAP AS can be encrypted if required.

    In summary - if you are concerned about implementing a secure solution, this might help you make your decision on which way to go.

    Thanks,

    Tim

    Add comment
    10|10000 characters needed characters exceeded

  • avatar image
    Former Member
    Feb 24, 2009 at 10:27 PM

    Julius,

    Can you please list all the options that we have in order to implement SSO for EP and SAP GUI?

    I could not find any info in regards to the advantages and disadvantages of each SSO solution. Do you have any links that gives this information?

    I am thinking more of using Kerberos authentication for SAP GUI and using OpenSSO (Sun's product)solution for EP 7.0.

    Do you know what SSO technologies are other companies implementing these days?

    Let me know,

    Thanks,

    Saran

    Add comment
    10|10000 characters needed characters exceeded

    • Saran,

      Sorry it took a while to answer your question.

      The SNC solutions available support Active Directory on Windows Server 2003 and 2008, and XP pro workstations. They provide SNC libraries for both UNIX/Linux and Windows servers and for the workstation which is Windows XP.

      No, the SAP server does not need to be Windows - it only needs to be Windows if you use the SNC libraries from SAP. For other operating systems you can get the libraries from a SAP partner, but there is a cost involved. I suggest you search http://ecohub.sdn.sap.com for "kerberos" or search for "snc" and you will find solution(s) which will meet your needs.

      Thanks,

      Tim