topic Re: SAPgui logon using SNC in Application Development and Automation Discussions

SAPgui logon using SNC

Former Member — Thu, 25 Sep 2008 21:54:29 GMT

Hi Sdn,

my customer wants that external user connects using SAPRouter and SNC (SAPCRYPTOLIB), however, I didn't found any step by step documentation that supports this.

I've found a documentation for RFC communication but not for dialog communication.

I've configured SNC parameters, activated SNC, created PSE certificates and SAP commes online without problem, but in SAPGui, when I force SNC communication using SAPCRYPTO Library and SNC name as in the profile, I click in Logon buttom but the saplogon does not gave any error, as didn't ask for credentials or opens any sap window.....

SNC profile parameters maintained

SAPCRYPTO LIBRARY in client and server

SNC_LIB and SECUDIR set

I think that I should also use sapgenpse for the SNC Name I use, but I'm not sure of this!!!

Did anyone knows any documentation that could help me or enlight me with this issue?

Thanks and best regards

Pedro Rodrigues

Re: SAPgui logon using SNC

tim_alsop — Thu, 25 Sep 2008 21:59:30 GMT

Pedro,

I think you will find that the SAPCRYPTOLIB is not legally usable for SAP GUI Single SignOn. If you want to use SSO with Windows version of SAP GUI you MUST buy a commercial product from a SAP partner that supports SNC and provides you with the necessary SNC libraries. You can find a list by looking at http://www.sap.com/eapcatalog and searching for SNC.

If you are using SAPCRYPTOLIB for SAPRouter - this is for ok as the library is licensed for this use.

Thanks,

Tim

Re: SAPgui logon using SNC

Former Member — Thu, 25 Sep 2008 22:07:05 GMT

Hi Tim,

thanks for the quick answer, customer does not pretend to have a SSO configuration, it only wants that the communication using saprouter uses SNC encryption (like SAP Support uses).

Now i'm trying to configure direct connection from gui to SAP Server, but configuration of SAPRouter to accept external communication will be sufficient ....

thanks,

Pedro

Re: SAPgui logon using SNC

tim_alsop — Thu, 25 Sep 2008 22:10:04 GMT

Pedro,

ok, so if your customer wants to use SNC with SAP Router this does not require SAP GUI using SNC since the SAP Router is for routing traffic between systems, not for user logon from GUI.

If you want to configure SNC with SAP GUI this needs to use different approach.

I hope you are clear now, and your questions have been answered, but if you still have questions/concerns let us know.

Thanks,

Tim

Re: SAPgui logon using SNC

Former Member — Thu, 25 Sep 2008 22:16:59 GMT

After a new aproach to this issue,

using saprouter does not solve the issue, external users connects to SAPRouter but the communication must be already encrypted because saprouter already is at customer site, so, I need to configure in SAPgui the SNC option and SNC Name.

sorry for my mistake!!

Thanks

regards

Pedro

Re: SAPgui logon using SNC

tim_alsop — Fri, 26 Sep 2008 07:06:31 GMT

Pedro,

I think you are still confused. The SAP router encrypts communications at transport level, but when you configure SNC in SAP GUI - this is for user authentication which is a diffferent level to what is used by SAP Router.

Perhaps if you show a diagram it might help ?

For example:

Customer network ~~-> SAP Router <~~Internet~~> SAP Router <~~ SAP ABAP AS

Using a diagram like above might help us understand what you are trying to do.

Thanks,

Tim

Re: SAPgui logon using SNC

Wolfgang_Janzen — Fri, 26 Sep 2008 07:34:48 GMT

Kindly differentiate between two scenarios:

(1) SAPGUI (client) - ABAP (server) connection

Here you can use SNC to achieve SSO (and in addition, depending on the capabilities of the SNC library being used, data integrity protection and potentially also data encryption).

(2) SAProuter - SAProuter connection

This is like the SAP Remote Support Connection. Notice that the SAProuter operates on a network layer (NI) below the protocols being used by SAPGUI (DIAG) or RFC clients (RFC). You might use SNC for this (SAProuter - SAProuter) section of the communication path to achieve data integrity protection and potentially also data encryption (notice: SNC only allows you to identify the communication peers, i.e. the SAProuters).

Notice: both scenarios are independent from each other. You might even use different SNC products in both scenarios. The SAProuter - SAProuter communication is transparent for the SAPGUI - ABAP communication (aside the fact that SAPGUI has to use a "route string" as connection parameter).

Notice: my statements refer to technical aspects, only.

I cannot provide any statement regarding SAPcryptolib license constraints.

(But I can confirm: using SAPcryptolib for SSO purposes with SAPGUI is not allowed).

Re: SAPgui logon using SNC

Former Member — Fri, 26 Sep 2008 07:59:25 GMT

Working for the company that actually provides the SAPCRYPTOLIB I can also confirm that using the SAPCRYPTOLIB on the client side is violating the license terms. I also suspect, like Tim, that you will need to obtain a SAP certified product. Please explain your needs and we will see what we can do for you here in this forum.

Re: SAPgui logon using SNC

Former Member — Fri, 26 Sep 2008 09:23:31 GMT

Hi all again,

Our customer don't want any kind of SSO, it just want to encrypt the data when acessing SAP System over the internet, user that connect using local saprouter.

has I have understand from what you said, I could just achieve this using two saprouters, the customer side saprouter and other in the network of remote users. But if the remote user has an pc directly connected to the internet, I have to install a SAPRouter in this PC ?

The SAPGui SNC Section is only for SSO purposes?!?

Thanks in advance

Pedro Rodrigues

Re: SAPgui logon using SNC

tim_alsop — Fri, 26 Sep 2008 09:28:15 GMT


>  has I have understand from what you said, I could just achieve this using two saprouters, the customer side saprouter and other in the network of remote users. But if the remote user has an pc directly connected to the internet, I have to install a SAPRouter in this PC ? 
yes, this is correct. If they have PC directly connected to internet then they would use a VPN to secure the connection between their PC and the network where SAP is running, and SAP router is not involved.
> 
>  The SAPGui SNC Section is only for SSO purposes?!?
Not quite - when using SNC with SAP GUI and SAP ABAP AS you also get end to end encryption of communications between the GUI and ABAP system, and data integrity is also provided. Some customers use this application level security to secure conneciton between GUI and SAP ABAP systems, and use normal network security for the transport level security (e.g. using vpn solution). If your customer does not want to use a VPN then the SAP router option will suffice, but will not be useful when PC is directly connected to Internet.

Re: SAPgui logon using SNC

Former Member — Fri, 26 Sep 2008 09:58:23 GMT

TIM,

Has I understood, is there a Way to configure end to end encryption using SAPGui connection via SNC, so, can you provide me some links/documentation with this configuration ?

Thanks

Pedro

Re: SAPgui logon using SNC

tim_alsop — Fri, 26 Sep 2008 10:01:14 GMT

Pedro,

Yes, when SNC is used for SSO the encryption and integrity is also provided if the SAP ABAP system is configured with correct instance profile parameters to force encrypted communications when the user logs on. As mentioned earlier, if you want to use SNC with SAP GUI you need to contact a SAP partner for help and partner products cannot be discussed in detail on SDN. I work for one of those partners, which is why I know this

Thanks,

Tim

Re: SAPgui logon using SNC

Former Member — Fri, 26 Sep 2008 10:13:13 GMT

Tim,

And without SSO? It's not possible to configure connection between SAPGui an SAP System using SNC?

sorry for this but I don't yet clear undestood this!!!!

thanks,

Pedro

Re: SAPgui logon using SNC

tim_alsop — Fri, 26 Sep 2008 10:15:46 GMT

Pedro,

Let me try and explain differently.

If you install a SAP certified SNC library on each workstation where SAP GUI is installed and also on each ABAP server where the user logs on using SAP GUI, then you can implement the following: SSO, End-to-End encryption and Data Integrity of data transmitted. If you don't want SSO for some reason, some of the products allow the user to authenticate each time they logon to SAP ABAP system, but still use SNC for the network security requirements.

is this clearer ?

Thanks,

Tim

Re: SAPgui logon using SNC

Former Member — Fri, 26 Sep 2008 10:48:51 GMT

Hi Tim,

this was quite clear Thanks.

in fact we'll need is as you said:

some of the products allow the user to authenticate each time they logon to SAP ABAP system, but still use SNC for the network security requirements.

The question now is, could this be achieved with SAPCRYTPOLIB?

Witch Steps?

1. profile parameters (activate SNC and so on)

2. Install SAPCRYPTO in user PC

3. configure SAPGui for use SNC using SNC name from SAP System

The SNC Name that I confgured in STRUST should apear in comand sapgenpse get_my_name ?

I'm consulting SNC User's Guide from SAP security area in marketplace but I couldn't yet be able to logon to SAP System yet using SNC, right now using SNC NAME between "" like "p:CN=SAP, OU=Company, O=NAME, C=DE" the sapgui does not gave any error message or logs on, without "" I get the erro:

Couldn't aquire DEFAULT INITIATING credentials :-S

thanks and best regards,

Pedro

Re: SAPgui logon using SNC

tim_alsop — Fri, 26 Sep 2008 10:56:57 GMT


> Hi Tim,
> 
>  this was quite clear  Thanks.
Good. I am pleased you are clear now on what you need to do.
> The question now is, could this be achieved with SAPCRYTPOLIB? 
NO. This is not possible, since SAPCRYPTOLIB is a library OEMed by SAP and the license for its use DOES NOT allow it to be used with SAP GUI. if you try to use it with SAP GUI then you are doing something ilegal.
> 
> Witch Steps?
> 
> 1. profile parameters (activate SNC and so on)
This depends on the SNC product you use, so you need to ask the vendor you choose for guidance.
> 2. Install SAPCRYPTO in user PC
NO, you cannot do this for use with SAP GUI. Please see note above, and confirmation from Sietze who works for the vendor providing this library to SAP.
> 3. configure SAPGui for use SNC using SNC name from SAP System
You need to get advice on this from the SNC product vendor you are using.
> 
> The SNC Name that I confgured in STRUST should apear in comand sapgenpse get_my_name ?
Since you cannot use SAPCRYPTOLIB this is not relavent. Also, STRUST is for trust relationships so it not involved when logging onto an ABAP system using SAP GUI.
> 
> I'm consulting SNC User's Guide from SAP security area in marketplace but I couldn't yet be able to logon to SAP System yet using SNC, right now using SNC NAME between "" like "p:CN=SAP, OU=Company, O=NAME, C=DE" the sapgui does not gave any error message or logs on, without "" I get the erro:
> 
> Couldn't aquire DEFAULT INITIATING credentials :-S
As I have mentioned, the use of SAPCRYPTOLIB is not allowed with SAP GUI.
> 
> thanks and best regards,
> Pedro

Re: SAPgui logon using SNC

Former Member — Fri, 26 Sep 2008 11:03:09 GMT

Thanks Tim

Best Regards,

Pedro

Re: SAPgui logon using SNC

Wolfgang_Janzen — Fri, 26 Sep 2008 13:56:49 GMT


> If you install a SAP certified SNC library on each workstation where SAP GUI is installed and also on each ABAP server where the user logs on using SAP GUI, then you can implement the following: SSO, End-to-End encryption and Data Integrity of data transmitted. If you don't want SSO for some reason, some of the products allow the user to authenticate each time they logon to SAP ABAP system, but still use SNC for the network security requirements.

Sorry, Tim. But I do not agree.

Using SNC with SAP GUI you'll always disable the (ABAP) password authentication; the ABAP system then demands that the user is authenticated via SNC (SSO).

SNC is based on GSS-API and the QoP (Quality of Protection) levels allow only to choose between:

- authentication (SSO)

- authentication + data integrity

- authentication + data integrity + confidentiality (encryption)

So, you cannot have SNC without SSO (for the SAP GUI usage scenario). As I've explained earlier there is another usage scenario (SAProuter - SAProuter) where "authentication" cannot be used to identify single users and thus is not suitable for SSO. Since SAP GUI is a "user agent" (i.e. software component that represents a single user) it is possible to use the "authentication of the communication partner" (user agent) for the "authentication of an user" (-> SSO).

Re: SAPgui logon using SNC

tim_alsop — Fri, 26 Sep 2008 14:02:25 GMT


> Sorry, Tim. But I do not agree.
> Using SNC with SAP GUI you'll always disable the (ABAP) password authentication; the ABAP system then demands that the user is authenticated via SNC (SSO).
Yes, so the SNC product on workstation can authenticate the user when required (not using SAP user and password, but using external authentication server). This is what I was referring to. Our product is able to authenticate the user when the SAP GUI is used and when user selects the option in SAP Logon to logon to a particular system. I will send you an email containing a short movie showing this working.
 
> SNC is based on GSS-API and the QoP (Quality of Protection) levels allow only to choose between:
>    - authentication (SSO)
>    - authentication + data integrity
>    - authentication + data integrity + confidentiality (encryption)
> 
> So, you cannot have SNC without SSO (for the SAP GUI usage scenario). As I've explained earlier there is another usage scenario (SAProuter - SAProuter) where "authentication" cannot be used to identify single users and thus is not suitable for SSO. Since SAP GUI is a "user agent" (i.e. software component that represents a single user) it is possible to use the "authentication of the communication partner" (user agent) for the "authentication of an user" (-> SSO).
Yes you can, it is just not possible when using products that you are familiar with. With our product which is using SNC we are able to support this requirement - it is one of our competitive advantages

Re: SAPgui logon using SNC

Wolfgang_Janzen — Fri, 26 Sep 2008 14:14:06 GMT


> > Wolfgang Janzen wrote:
> > Sorry, Tim. But I do not agree.
> > Using SNC with SAP GUI you'll always disable the (ABAP) password authentication; the ABAP system then demands that the user is authenticated via SNC (SSO).
> Yes, so the SNC product on workstation can authenticate the user when required (not using SAP user and password, but using external authentication server). This is what I was referring to.

Thanks for the clarification (confirming my statement).

I just wanted to emphasize that (from the perspective of the ABAP system) it's an SNC authentication (-> you need to maintain the user-specific SNC name settings in ABAP transaction SU01).

Of course it's possible that the external security product is prompting the user each time to (re-)authenticate before it is providing its services (-> credentials).

But I guess that this is subject of customizing - and that other products might offer this option (via policy settings) as well.