Question Re: Active Directory authentication WITHOUT SSO? in Technology Q&A

Active Directory authentication WITHOUT SSO?

randall_king2 — Tue, 07 Oct 2008 19:21:59 GMT

Everything I have found relating to Active Directory is based around getting SSO to work. Isn't there a halfway point that doesn't require touching every user and deploying complex config?

In simple terms I am looking to do this. I want to be able to set up a connection between the SAP application (not the GUI) and Active Directory, and have the user authentication be pulled from AD. We have dozens of systems and clients, and it would be really nice if we could set it up so that user SALES1234 (who also has a OFFICE\SALES1234 NT account), uses the same password in all systems.

Is there something that can be set up using the LDAP connector on the systems to either pull the passwords down to SAP, or authenticate against AD on the fly? It's not true SSO, but having a unified password strategy is a huge leap forward without having to invest in a huge project to touch users that are spread out globally.

Help? Any ideas?

Oh, I don't know much about AD, except ours uses Kerberos for authentication. Our systems are Solaris based.

Thanks in advance!

Re: Active Directory authentication WITHOUT SSO?

Former Member — Wed, 08 Oct 2008 06:51:42 GMT

Hello Randall,

I did not understand the requirement very clearly but this can be done using Portal.

In our landscape, portal servers have 2 URLs each, one for Kerberos authentication and the other without Kerberos.

The second URL which is without Kerberos, lets users authenticate themselves by entering their AD login credentials.

If this suits your scenario too, then create a URL alias in the DNS.

Regards,

Ritu

Re: Active Directory authentication WITHOUT SSO?

randall_king2 — Wed, 08 Oct 2008 12:08:01 GMT

Take portal out of the equation. I am talking about SAPGUI users and the ABAP side of the system. Bascially I want to see if there is a way to either sync passwords with an AD back end, or use something in the LDAP connector to perform the password authentication. Security roles would still reside inside of SAP, I am talking only about the password authentication. I have systems that range from an old BW3.1 system to a new CRM 7.0 system. All of them are on at least a 6.20 kernel, and they all have the LDAP connector. It's just not being used.

Re: Active Directory authentication WITHOUT SSO?

Former Member — Thu, 09 Oct 2008 17:35:32 GMT

I don't think you'll find any way to do what you're asking for without SSO. And it's not hard to set up (in Windows, not sure about any other OS).

Re: Active Directory authentication WITHOUT SSO?

Former Member — Tue, 13 Jan 2009 17:01:10 GMT

Hi Randall,

I have a similar requirement i am trying to prototype. Please let me know if you have found a soultion to authenticate against AD without using SSO. Any guidance is appreciated.

Thanks

Pavan

Re: Active Directory authentication WITHOUT SSO?

Former Member — Thu, 15 Jan 2009 19:33:01 GMT

Hi,

Why cant you syncronize users with the help of RSLDAPSYNC_USER report from your AD to SAP including passowrds but you need to do some mapping in ldapmap tcode.

Thanks,

Kiran.

Re: Active Directory authentication WITHOUT SSO?

hofmann — Fri, 16 Jan 2009 14:09:06 GMT

Hi,

MS AD is, if you just look at the core, an LDAP Server. The UME supports LDAP.

SAP Help: http://help.sap.com/saphelp_nw04/helpdata/EN/eb/00954081efb90ee10000000a155106/frameset.htm

For getting access to the groups and user information in the MS AD LDAP, you'll need to know the exact location inside the LDAP. It is something like cn=users,ou=company,ou=com. You'll have to get this information from your AD administrator.

br,

Tobias

Re: Active Directory authentication WITHOUT SSO?

dan_pfingsten2 — Thu, 14 May 2009 18:47:38 GMT

Was there a resolution to the question? is it possible to integrate AD into SAP without using SSO?