...

...

Summary

SSO / SNC is supported for BW and BW/4HANA.

Your Login screen will now have an SSO Logon button.

Image RemovedImage Added

Are you instead of looking for:
General: My SAP System connection properties has have changed

...

Troubleshooting

Error (You have no password; you cannot log on using a password.)

You have no password; you cannot log on using a password.

EN: Unencrypted communication is rejected by this system.
DE: Eine unverschlüsselte Kommunikation wird von diesem System abgelehnt.

Solution

Send us your SNC Partner Name of the respective SAP system (Link: Help Desk)

Image RemovedImage Added

Error (Unable to load GSS-API DLL)

ProjectB.SAPConnections.Data.Exceptions.ConnectionFailedToSapException: RfcOpenEx failed(RFC_ERROR_COMMUNICATION) SAP_CMINIT3 : rc=20 > Connect to SAP gateway failed
Connect_PM  GWHOST=10.118.169.25, GWSERV=sapgw05, SYSNR=05

LOCATION    CPIC (TCP/IP) on local host
ERROR       SncPDLInit()==SNCERR_INIT
            Unable to load GSS-API DLL
            named "GX64KRB5.DLL"
TIME        Tue May 28 11:32:09 2019
RELEASE     720
COMPONENT   SNC (Secure Network Communication)
VERSION     5
RC          -1
MODULE      sncxxdl.c
LINE        378
DETAIL      LoadLibrary("GX64KRB5.DLL")
              Error 126 = "The specified m
   at ProjectB.SAPConnections.SapConnectionOpeners.SapConnectionOpenerWrapper.HandleConnectionError(Exception ex, BwConnection connection)
   at ProjectB.SAPConnections.SapConnectionOpeners.SapConnectionOpenerWrapper.GetOpenConnection()
   at ConnectionTester.Helpers.BwConnectionHelper.ConnectToBW(MainViewModel mainViewModel)

Solution

1. Check SAP-Transaction RZ10 for the entry snc/gssapi_lib = 'C:\Windows\System32\xxxxx.DLL'
2. Add in your 'Environment Variables' the System variable SNC_LIB_x64 and set the Value to the DLL-name you found in the RZ10.
   

...

Error (several suitable SAP users)

System found several suitable SAP users for the SNC name of the caller.
Mehrere passende SAP-Benutzer zum SNC-Namen des Aufrufers gefunden.

Name or password is incorrect.

Solution

Make sure only one SAP-User is connected to an SNC Name.
There is currently a limitation where you cannot have an SNC Name pointing to multiple SAP-User.

If possible, reduce the amount of SAP-User bound to the SNC Name to one.

Image Added

...

Things to check first in case SSO is not working

1. Is your normal SAP GUI logon working with SSO?
2. Which SSO mechanism are you using? SNC, Logon Ticket or X.509 certificate
3. Check SAP transaction RZ10 for correct SNC Partner Name (snc/identity/as) and used SNC Library (snc/gssapi_lib)
4. Which SNC_LIB system variables are set on your machine?
   Logic: User Variables > System Variables
   
5. Are Did you try using the latest the Connection Tester to confirm your connection parameters?
6. "Write Trace log" for better analysis
7. (Double-check Services and Hosts file)

...

...

More Information

Single Sign-On with Microsoft Kerberos SSP

...

You can use Kerberos to overcome the security weakness characteristic of more basic authentication mechanisms such as user ID and password authentication.

The Kerberos authentication process relies on the exchange of session tickets. The session tickets are issued by a Kerberos Key Distribution Center (KDC) when the user attempts to connect to the AS ABAP. The KDC itself establishes and verifies the user identity and the user is not required to interactively provide a user ID and password for the AS ABAP logon.

As a result of the use of session tickets, the AS ABAP authentication credentials of users are not communicated over the network for the connection between the SAP GUI and the AS ABAP. Thereby, the credential confidentiality and integrity protection are guaranteed.

In addition, Kerberos makes use of several systems in your landscape, which may result in additional administrative effort and costs.

Client Certificate Logon:

You can use X.509 client certificates to enable secure authentication instead of using the traditional user ID and password-based authentication. The authentication credentials are protected during their transport over the network due to the use of public-key technology in X.509 client certificates.

Users need to receive their client certificates from a Certification Authority (CA), using a Public Key Infrastructure (PKI). If you do not have an established PKI then you can use a Trust Center Service to obtain certificates.

...