topic Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux in Application Development and Automation Discussions

User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Mon, 20 Jan 2014 17:21:05 GMT

Hello everybody,

There is a documentation or a guide about the configuration of SapGui authentication using MS AD instead of using standard user repository?

I have found some documentations, but all them are about a ECC server system in Microsoft Windows. Is it possible make the configuration without use a third party software?

Thanks in advance,

Renato Lima.

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Mon, 20 Jan 2014 18:21:42 GMT

Hi Renato

sorry to be a pain but, sapgui is the presentation server of a ecc server and ad is microsoft's directory server, what's the third party sw?

Let me know

cheers

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

tim_alsop — Mon, 20 Jan 2014 18:37:45 GMT

Andrea,

He is looking for an SSO solution that uses AD as an authentication server (via. SNC interfaces). There are many of these available, either from SAP or from SAP partners. Looks like he wants one for free since he said he doesn't want to buy third party s/w.

Renato,

If you don't want to spend money on a product, you can build your own using open source Kerberos libraries. Other SAP customers have done this. I personally wouldn't recommend it, but you can if you wish.

Thanks,

Tim

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Mon, 20 Jan 2014 19:51:08 GMT

HI Both

apologies for my silly question

It appears i have to book again the adm100

later

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Tue, 21 Jan 2014 08:01:43 GMT

Hi,

Just some additional info to what Tim already said above.

There is actually a whitepaper from realtech available on this topic.

However keep please keep in mind, this is not officially supported and if using the native libs from the linux distributions, you may run into trouble, as they are sometimes not complete or do not work.

Kind regards,

Patrick

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

tim_alsop — Tue, 21 Jan 2014 08:06:51 GMT

Also, it is worth mentioning that the cost of the software might be ZERO, but if it is not supported and it stops working, there is a cost of downtime and user productivity on your critical SAP systems, since users won't be able to logon if it stops working. This is why customers generally prefer to buy products that are SAP certified and supported.

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Tue, 21 Jan 2014 08:16:37 GMT

Or they buy SAP NetWeaver SSO 2.0 😉

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

tim_alsop — Tue, 21 Jan 2014 08:20:08 GMT

Yes, SAP NW SSO 2.0 product is SAP certified and supported. There are other products from SAP partners that are also SAP certified and supported. The details described in the Realtech doc would mean that the implementation is NOT SAP certified and NOT supported.

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Tue, 21 Jan 2014 08:58:43 GMT

Hi Tim,

with regards to the realtech doc, this is why I mentioned the lack of support.

BTW: SAP NW SSO 2.0 isn't certified, as it is not a partner product but an SAP product. SAP only certifies partner products, that's why I added it to your list.

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Tue, 21 Jan 2014 09:25:29 GMT

OMG SAP that mention realtech?!? I thought it was banned!

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Tue, 21 Jan 2014 10:03:07 GMT

Regardless of the costs and support, it is highly recommendable to have a tested failover plan in case the SSO goes down in real life, such as a password reset self-service which can be redirected to or mailed as info.

This takes the immediate risk out of any alternate authentication mechanism, in the unlikely event of loss of cabin pressure... 🙂

Cheers,

Julius

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Tue, 21 Jan 2014 10:49:44 GMT

And how exactly would you set this up? I have skimmed the SAP SSO documentation but didn't see it (I wasn't reading it carefully, though). Any ad-hoc ideas?

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Tue, 21 Jan 2014 11:21:32 GMT

Hello Mylene,

Nice to hear from you again!

There is no password self-service within SAP SSO. It is something separate and independent of whatever SSO solution is deployed.

What I meant is that it generally makes a lot of sense for a plan B such as a redirect to automatically drop from the overhead area to that you can carry on working if needed. This means that the risk of cost and support delays for failure in any SSO is less.

Cheers,

Julius

Re: User authentication using Microsoft AD with SapGui - ECC server with Suse Linux

Former Member — Tue, 21 Jan 2014 11:38:35 GMT

Hello Julius,

nice to see you, too (also, beautiful floppy ears).

I concurr, this seems a most sensible arrangement, if you want to avoid being crucified by wandering mobs of users unable to login.

I was just speculating whether SAP SSO 2.0 delivered something like a password self-service - I know you have it as a part of IdM (the expense!) or some more or less dignified 3rd party companies (who have terrible problems handling such a self-service on both: SAPGui accessed systems and BEX and portals ...).

I will now stop derailing this thread. Sorry, Renato.