Question Re: Difference in SSO with userid-password method and SAP logon tickets? in Technology Q&A

Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Tue, 31 Aug 2004 12:16:07 GMT

What is Difference in SSO with userid-password method and SAP logon tickets?

Which method is preffered and why?

In which sceneiro these methods are used?

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Tue, 31 Aug 2004 12:49:21 GMT

Hi,

There are basically 2 scenarios that you may encounter:

1) The username and password of the EP User is the same as the username and password of the system user (The system to which you are connecting through EP)

2) The username and password of the EP User is different from the username and password of the system user.

You may go for the SAPLogonTicket for the first scenario just because the EP User exists in the system also.

In the second scenario, you should better go for the UIDPassword Method. All you need to do is user mapping which would relate or map the EP User to the system user. You would need to give the system user details while mapping it to the EP User. EP would use these details to log into the System.

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Tue, 31 Aug 2004 12:49:23 GMT

SAP logon ticket is definitively recommended way to do SSO, although not all applications support them.

As far as I know you can do SSO with SAP logon ticket on the following types of system:

-SAP R/3

-SAP applications running on SAP J2EE

-Domino (there is a filter which converts the logon ticket to an LTPA token)

-Websphere (can also use LTPA tokens indirectly through domino)

-IIS (ISAPI filter which authenticates the user)

-Apache (I believe there is a filter similar to IIS)

The SAP logon ticket is implemented as about 600 bytes of encrypted content within a cookie (MYSAPSSO2) and contains the username to the portal, as well as any usermappings that exist. It is very safe

If you are using userid-password SSO you are generally sending the username password directly to the application you want to do SSO on. If you do not use HTTPS, the data is sent in clear text.

I would say that you should only use userid-password if there is no possibility for SAP Logon ticket

Re: Difference in SSO with userid-password method and SAP logon tickets?

Surferpeck — Thu, 09 Sep 2004 06:45:25 GMT

Dagfinn,

Have you managed to get SAP logon tickets to work across different Domains? I have been unsuccessful in getting this to work.

Any tips would be greatly appreciated.

Cheers,

Chris

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Thu, 09 Sep 2004 12:25:52 GMT

I'll send you an email with some instructions and code.

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Sat, 11 Sep 2004 13:14:53 GMT

Hi Dagfinn,

Can you also send me an email with the instruction to make available SSO for multiple domain with EP6 because i got the same problem.

Thanks in advance.

Bertrand

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Mon, 13 Sep 2004 12:22:00 GMT

I would if I had you email addresse (sap-addresses are easier since they follow the same pattern.

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Mon, 13 Sep 2004 12:28:46 GMT

Hi,

My email adress is bdessertenne@aegis-consulting.fr, normally it's define in my profile

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Mon, 13 Sep 2004 14:30:15 GMT

Hi Dagfinn,

Its good to see the differences between userid-password and SAP logon ticket. I' am working on Single Sign On using SAP logon ticket. We have a web based application called Aprimo Marketing (hosted on IIS 5.0) which reads the header information sent by iis_sso.dll and allow the user to login directly into the aprimo marketing based on the HTTP HEADER.

The problem is when I try to access the aprimo marketing through SAP portal, it is not sending the required http header information to my application and I' am keep getting the following error in the verify.log file.

trc file: "D:\5022\filter\bin\NT\i386\iis\log\verify.log", trc level: 3, release: "620"

Mon Sep 13 05:21:00 2004

Loading of the props returned 0.

0 allowed authschemes:

Max cache size = 1000

Initialization done.Mon Sep 13 05:23:08 2004

IISPlugin checks Access.

Can't find MYSAPSSO2 ticket cookie.

Mon Sep 13 05:23:10 2004

Could you please help me, in this regard.

Thank you very much.

Dhanaji.T

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Mon, 13 Sep 2004 14:43:30 GMT

Could you open a new thread as this one is allready answered ?

Also include some more information:

1. What http header is the required one ? AUTH_USER ?

2. Is the aprimo application on the same subdomain as the portal ?

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Thu, 23 Dec 2004 15:07:51 GMT

Dagfinn,

You wrote:

">1. What http header is the required one ? AUTH_USER ?"

How can I know what header should it be? I have used

AUTH_USER for remote_user_alias in verify.properties,

but SSO doesn't work - user/password popup is displayed

instead. I am trying to integrate IIS Web App here, and

I can see in log file that SAP logon ticket was received

and read.

trc file: "c:\portal_filter\log2.txt", trc level: 3, release: "620"

Thu Dec 23 17:06:42 2004

Loading of the props returned 0.

0 allowed authschemes:

Max cache size = 0

Initialization done.Thu Dec 23 17:07:12 2004

IISPlugin checks Access.

Checking validity...

Verifiing...

processTicket - found user "chaamhK ? " with length 6.processTicket - found authscheme "default " with length 7.

Variablename "AUTH_USER"

Variablename "REMOTE_USER_AUTHSCHEME"

Ticket was verified.

AUTH_USER=chaamh set to header.

Variablename "AUTH_USER"

Thanks,

Ami

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Sat, 12 Feb 2005 13:14:27 GMT

Can you send me or post these instructions for all to see.

Thank You

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Fri, 11 Mar 2005 09:30:38 GMT

I have a similar problem with SAP Log On Ticket. Please help.

We are trying to configure Single Sign On using SAP Log On Tickets.

We are getting the following error in the portal.

Logon requires activated Single Sign On on this server. This is not the case.

We have uploaded verify.der in transaction STRUSTSSO2 and added the certificate entry to the ACL list in STRUSTSSO2. We have Log On Method in the System as SAPLOGONTICKET

Thanks in advance

Jay

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Thu, 06 Oct 2005 08:59:32 GMT

Hi All,

we have the same problem, anyone found solution for that?

Thanks for respond,

Best regards,

Karol

Re: Difference in SSO with userid-password method and SAP logon tickets?

Former Member — Thu, 06 Oct 2005 10:31:42 GMT

On the R/3 System some configuration are (pre)required.

(check > http://help.sap.com/saphelp_nw04/helpdata/en/d3/41c8ecb31d11d5993800508b6b8b11/content.htm)

- EP Plugin installed

- Check Transaction RZ10: the Profile Parameter "login/accept_sso2_ticket = 1" and "login/create_sso2_ticket = 0, 1 or 2" are set. Restart required.

- Or follow https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/library/ep/s-u/sso checklist.html for help on sso problems

Regards

Nicolaj