Skip to Content
0
Former Member
Mar 16, 2011 at 06:31 AM

Unable to setup SSO on ABAP with Microsoft Kerberos 5

246 Views

My SAP system is installed on a Windows 2008 SP2. The AD is a W2K domain.

I want to configure SSO on the Server with Microsoft Kerberos. I've followed the instructions in

http://help.sap.com/saphelp_nwmobile71/helpdata/en/44/0ebf6c9b2b0d1ae10000000a114a6b/frameset.htm.

I've also set the SPN for the system.

And below are my settings for the central instance:

snc/identity/as = p:SAPService<SID>@<DOMAIN>

snc/gssapi_lib = C:\Windows\System32\gx64krb5.dll

snc/permit_insecure_start = 1

snc/r3int_rfc_qop = 8

snc/accept_insecure_r3int_rfc = 1

snc/accept_insecure_rfc = 1

snc/accept_insecure_cpic = 1

snc/accept_insecure_gui = 1

snc/data_protection/use = 1

snc/data_protection/max = 3

snc/data_protection/min = 1

snc/enable = 1

snc/r3int_rfc_secure = 0

But the central instance can't startup and everytime it trying to start, the work process produces the error below:

N SncInit(): Initializing Secure Network Communication (SNC)

N PC with Windows NT (mt,ascii,SAP_UC/size_t/void* = 16/64/64)

N SncInit(): found snc/data_protection/max=3, using 3 (Privacy Level)

N SncInit(): found snc/data_protection/min=1, using 1 (Authentication Level)

N SncInit(): found snc/data_protection/use=1, using 1 (Authentication Level)

N SncInit(): found snc/gssapi_lib=C:\Windows\System32\gx64krb5.dll

N File "C:\Windows\System32\gx64krb5.dll" dynamically loaded as GSS-API v2 library.

N The internal Adapter for the loaded GSS-API mechanism identifies as:

N Internal SNC-Adapter (Rev 1.0) to Kerberos 5/GSS-API v2

N SncInit(): found snc/identity/as=p:SAPService<SID>@<DOMAIN>

N *** ERROR => SncPAcquireCred()==SNCERR_GSSAPI [sncxxall.c 1439]

N GSS-API(maj): No valid credentials provided (or available)

N GSS-API(min): No Kerberos SSPI credentials available for requested name

N Could't acquire ACCEPTING credentials for

N

N name="p:SAPService<SID>@<DOMAIN>"

N SncInit(): Fatal -- Accepting Credentials not available!

N <<- SncInit()==SNCERR_GSSAPI

N sec_avail = "false"

Does anyone has any idea what is wrong and how should I proceed?