SAP JCO connect using SNC kerberos

[Former Member]

Hi,

I need to be connect to sap using JCO via SNC using Kerberos authentication, that is SSO that trusts my window authentication…

I have quite a lot of experience in Microsoft development and infrastructure but not so much in sap...

I have written a small app in java and managed to connect to sap via jco using username and password, straight forward and easy.

Now I need to connect using SNC (SSO) through Kerberos(SPNEGO) from a windows context.

The scenario:

I have a sap-account and a corresponding one in Active Directory, I have verified the account by launching the sap gui via "run as" on my windows client and SSO works like expected...

The code is running in the same context on the same windows server where the SAP Gui seems to function

but I cannot seem to figure out how to set the connectProperties in my code?

Is there someone that can help me with the right parameters?

The code:

Properties connectProperties = new Properties();

connectProperties.setProperty(DestinationDataProvider.JCO_ASHOST, "ahost");

connectProperties.setProperty(DestinationDataProvider.JCO_SYSNR,  "sysno");

connectProperties.setProperty(DestinationDataProvider.JCO_CLIENT, "clientno");

connectProperties.setProperty(DestinationDataProvider.JCO_USER, "theuser");

//connectProperties.setProperty(DestinationDataProvider.JCO_PASSWD, "thepwd");

//SNC specific parameters

connectProperties.setProperty(DestinationDataProvider.JCO_SNC_LIBRARY,    "C:/sap/sapcrypt/ntintel/sapcrypto.dll");

connectProperties.setProperty(DestinationDataProvider.JCO_GETSSO2,    "1");

connectProperties.setProperty(DestinationDataProvider.JCO_MYSAPSSO2,"1");

connectProperties.setProperty(DestinationDataProvider.JCO_SNC_MODE,    "1");

connectProperties.setProperty(DestinationDataProvider.JCO_SNC_PARTNERNAME,    "p:CN=sapsys1,OU=sapservers,DC=mydomain,DC=local");

connectProperties.setProperty(DestinationDataProvider.JCO_SNC_QOP,"3");

[tim_alsop]

You will need to remove the JCO_USER and JCO_PASSWD properties, since the RFC library will use these if they are supplied and ignore any SNC_ properties provided.

Also, you need to use an SNC library that supports the Kerberos protocol, and the one you have configured looks like the standard SAP Cryptolib which uses x.509 certificates. If you use a Kerberos SNC library then this library will be able to read the credentials of the logged on user, via the MS LSA, just like the IE web browser can. The SNC_PARTNERNAME will also need to be changed if you are using Kerberos credentials.

I hope you find this helpful ?

Thanks,

Tim