User Authentication and Single SignOn

Single Sign-On (SSO) is one of the key concept that allows you to login to one system and you can access multiple systems in the backend. SSO allows the user to access software resources across SAP systems in the back-end.

The SSO with NetWeaver platform provides user authentication and helps system administrators to manage the user loads in a complex SAP System Landscape. SSO configuration simplifies the process of how a user logs into the SAP systems and applications in landscape by enhancing the security measures and reduces the password management tasks for multiple systems.

SSO helps an organization to reduce their operation cost by decreasing the number of calls to the Service Desk related to password issues and hence increase the productivity of the business users. SAP NetWeaver integration mechanism allows you to easily integrate your SAP NetWeaver system in the SSO concept and provides easy access to backend systems in SAP System Landscape Environment.

SAP Single Sign-On Concept

The Single Sign-On can be configured with mySAP Workplace which allows a user to login to mySAP Workplace daily and they can access the applications without repeatedly entering their username and password.

You can configure SSO with mySAP Workplace using the following authentication methods −

• Username and password
• SAP Logon Tickets
• X.509 client Certificates

Integration in Single Sign-On

The SSO with NetWeaver platform provides user authentication and helps system administrators to manage the user loads in a complex SAP system landscape. SSO configuration simplifies the process how user login to SAP systems and applications in landscape by enhancing the security measures and reduces the password management tasks for multiple systems.

Using SAP NetWeaver allows you to configure different mechanisms that authorized users use to access the NetWeaver System using the SSO method. The login mechanism in system depends on the technology of SAP NetWeaver system and different communication channels used for accessing those systems.

Configuring Single Sign-On in a SAP GUI

To configure a Single Sign-On, you need to have access to the following T-codes −

• RZ10
• STRUST

Once you have these T-codes, you should follow the steps given below −

Step 1 − Login to any SAP ECC System using the SAP GUI, go to T-code RZ10.

Step 2 − Select the Default profile and Extended Maintenance after that.

Step 3 − Click on Change and you will see the list of parameters for the profile.

Step 4 − Change the following profile parameters −

• login/create_sso2_ticket = 1
• login/accept_sso2_ticket = 1

Step 5 − Save and Activate the profile. It will generate a new profile.

Step 6 − Export the R3SSO certificate from the Trust Manager, go to transaction STRUST.

Step 7 − Double-click the text box to the right of Own Certificate. The certificate information is displayed. Note down the values of this certificate as you need to enter the values.

Step 8 − Click on Icon Export Certificate.

Step 9 − Save the file as <R3_Name>-<Client>.crt.

Example − EBS-300.crt

Step 10 − Click on the tick box to create the file in the parent directory.

Step 11 − Import R3 SSO certificate to the Java engine using the administrator tool.

Note − Make sure the Java engine is started.

Step 12 − Open the Java Administration tool.

Step 13 − Enter the Java Engine Administrator password and click on Connect.

Step 14 − Choose Server → Services Key → Storage.

Step 15 − Click on the Ticket Key Store in the View panel.

Step 16 − Click on Load in the Entry group box. Select the .crt file you exported in the previous step.

Step 17 − Configure the Security Provider service in the SAP Java engine using the Administrator tool.

Step 18 − Choose Server Services Security Provider.

Step 19 − Choose ticket in the Component panel and go to the Authentication tab.

Step 20 − Modify the options of Evaluate Ticket Login Module and add the following properties to each backend system on which you want to configure SSO.

Single Sign-On for Web-Based Access

You can configure several options with SSO to access SAP NetWeaver system. You can also access SAP NetWeaver System via a web browser or from some other web client. Using SSO, users can access backend systems and other secured information located in the company network.

SSO allows you to use several security authentication methods for integrating web based user access on NetWeaver Application servers. You can also implement various network communication security methods like Cryptography to send the information over network.

The Following authentication methods can be configured with SSO to access data over Application servers −

• Using User ID and Password Authentication
• Using Logon Tickets
• Using X.509 Client Certificates
• Using SAML Browser Artifacts
• Using SAML 2.0
• Using Kerberos Authentication

While accessing data over the internet, you can also use the security mechanism in the Network and Transport Layer.

Step by step procedure for SSO between EP 7.4 and ECC 6.0

ESS & MSS implementation we have implemented SSO(Single Sign-On) between enterprise portal 7.4 and ECC 6.0.As everyone knows we have SSO is used to communicate with backend system without username&password.
Note: 1) Employee self-service (ESS) is web-based applications that provide employees with access to their personal records and payroll details.
           2) MSS- Manager Self Service is an web enabled tool used for Managers to take report or update the datas of subordinate.

Below is the procedure:

Step1 :Request the basis guys to set the following profile parameters in RZ10

ICM_Full_host_name         = “basis guys give this url”;(Should be FQDN)

Login/create_sso2_ticket  = 2;

Login/accept_sso2_ticket =1;

After setting the profile parameters and don’t forget to remind the basis guys to restart the ECC server (if we didn’t restart the server the profile parameters will not reflect).

Step2: After Restart we have cross verify the parameters. Login to the SAP GUI with ECC credentials. 

After Login to the ECC that just search for RZ10 t-code like below

In the RZ10 t-code select the Default profile(The profile parameters can be set in default or instance profile) and select the Extended maintenance and click on Display.

Then we have to check the profile parameters have been changed correctly or not.

Now everything in RZ10 t-code is perfect.

Step 3:To download the certificates we have to login to the NWA (you should have NWA role) as we don’t have Keystore Administration for the portal latest versions we have to use NWA .

(Its always preferred to delete the existing certificate and create the new certificate or u can download the certificate)

For creating the certificate:

Configuration–>Security–>Certificates and Keys–>Ticket Key Store–>View Entries–>Create New

While creating the certificate remember the name should be system name (Forex : epdev.apple.in:5000 , u have to create the name as epdev)

Now we have to login to the portal as NWA using http://server:port/nwa to download the certificate.

Configuration–>Security–>Certificates and Keys

Then you have to select the ticket keystore in the key storage.

Then select the SAPLogonticketpair-cert in the “View Entries” and click on Export Entryàselect the Base 64 type and click on Download.

Then finally the certificate will downloaded like below

Step4: Login to the SAP GUI once again and search for “strustsso2” t-code and click enter

And click on the import certificate to import. Browse the certificate from the local pc and click on ok.

Then click on Add to Certificate List and add to ACL, An pop-up will display where you need to enter the Client as 000 and name as  example “EPD”.

We have imported the portal  certificate in the backend,now we have to get the backend into the portal.For that

Configuration–>Security–>Trusted Systems–>Add  Trusted Systems

In the Add Trusted Systems select the By Querying System

If the bakend system is already maintained in the tech systems of SLD it will come in the list other wise you have to enter the following details and click on Next

Once you are done .The certificate will automatically added into the Certificate and keys list.

Then create the system object and test the SSO.

 Done SSO is implemented successfully.