Summary
Yes, SNC/SSO is supported by the Docu Performer for BW. It is planned for HANA and BO.
If you decide to use SSO, your license needs an adjustment (free of charge).
Please create a ticket in our Help Desk with your SNC Partner Name of the respective SAP system.
The Support-Team will adjust your license and send you a new one with SSO unlocked.
Are you instead of looking for:
General: My connection properties to my SAP Systems changed. What do I have to consider?
Your Login screen will now have an SSO Logon button.
Errors
You have no password; you cannot log on using a password.
Solution
Create a ticket in our Help Desk with your SNC Partner Name of the respective SAP system.
Troubleshooting SSO
- Is your normal SAP GUI logon working with SSO?
- Which SSO mechanism are you using? SNC, Logon Ticket or X.509 certificate
- Which SNC_LIB system variables are set on your machine?
- Are you using the latest Connection Tester?
- Check SAP transaction RZ10 for correct SNC Partner Name (snc/identity/as) and used SNC Library (snc/gssapi_lib)
- "Write Trace log" for better analysis
- (Double check Services and Hosts file)
How-to setup SSO:
More Information
Single Sign-On with Microsoft Kerberos SSP
SAP’s New Cryptographic Library “CommonCryptoLib”
Setting up SAP Secure Network Communications (SNC) (RZ10)
You can use Kerberos to overcome the security weakness characteristic of more basic authentication mechanisms such as user ID and password authentication.
The Kerberos authentication process relies on the exchange of session tickets. The session tickets are issued by a Kerberos Key Distribution Center (KDC) when the user attempts to connect to the AS ABAP. The KDC itself establishes and verifies the user identity and the user is not required to interactively provide a user ID and password for the AS ABAP logon.
As a result of the use of session tickets, the AS ABAP authentication credentials of users are not communicated over the network for the connection between the SAP GUI and the AS ABAP. Thereby, the credential confidentiality and integrity protection are guaranteed.
In addition, Kerberos makes use of several systems in your landscape, which may result in additional administrative effort and costs.
You can use X.509 client certificates to enable secure authentication instead of using the traditional user ID and password-based authentication. The authentication credentials are protected during their transport over the network due to the use of public-key technology in X.509 client certificates.
Users need to receive their client certificates from a Certification Authority (CA), using a Public Key Infrastructure (PKI). If you do not have an established PKI then you can use a Trust Center Service to obtain certificates.
Typically, your Web browser generates these keys. You then send the public key of this key pair to a central instance called a Certification Authority (CA) to be signed. This step guarantees your ownership of the key pair. You can compare this to a central office that distributes identification cards. These keys then “belong” to the owner and can be used for identification purposes.
