Question Re: Microsoft Active Directory Integration in Technology Q&A

Microsoft Active Directory Integration

former_member397702 — Sat, 06 Jun 2015 22:44:44 GMT

Hi experts

We have two issue for our customer:

1-Integration of SAP User Administration into Microsoft Active Directory: Our customer wants to synchronize their SAP users and passwords with Microsoft Active Directory but they dont want to use Single Sign-on.

2-Creating and Synchronize Users in Active Directory from Employee Data Stored in SAP HR

We found two document related with this issue but their version is very old. Is there any new version of this document or we have to use different technology (for example Netweaver Identity Management)?

Re: Microsoft Active Directory Integration

former_member2987 — Sun, 07 Jun 2015 01:49:55 GMT

Hello Hande,

Well you reference old documents, but you don't mention what version of IDM is to be used. If it's 7.2, then the documents should be fairly relevant, but you might need to make a few tweaks. If it's version 8, then it's anybody's game. Documentation is coming at a slow, but steady pace. Your best bet in that case is to do your research and ask questions here.

Password management is pretty much the same. I'd suggest looking at and for the best information.

Finally, from a consulting point of view, I would want to understand why they don't want to use SSO (Several excellent reasons exist, but it's good to understand) SSO in some way, shape, or form should be a part of any long range Identity and Access Management plan.

Hope this helps!

Cheers,

Matt

Re: Microsoft Active Directory Integration

tim_alsop — Sun, 07 Jun 2015 06:16:38 GMT

Regarding 1. You can use an authentication product so that when a user logs onto the SAP system the SAP system (via the authentication product) is able to check the users password against Active Directory. This is much more secure than using the password hook to synchronise passwords between systems. If you want to you can configure some users to get SSO, whilst others are required to enter their Active Directory password each time they logon. Or you might want all users to enter AD credentials.

Thanks

Tim

Re: Microsoft Active Directory Integration

former_member397702 — Mon, 08 Jun 2015 07:47:46 GMT

Hi Matt

Thanks for your reply.

Netweaver IDentity Management is not used. We are trying to integrate AD an ERP directly.

They don't want to use SSO because most of users use same terminal server or pc.

Best Regards...

Hande

Re: Microsoft Active Directory Integration

tim_alsop — Mon, 08 Jun 2015 07:56:11 GMT

To solve this you need to use a product that can authenticate users on shared workstations using AD credentials. See my answer left on Jun 7th.

Thanks

Tim

Re: Microsoft Active Directory Integration

former_member397702 — Mon, 08 Jun 2015 10:33:07 GMT

Hi Tim

Many thanks for your reply. But i want to know is there any way to synchronize users, passwords and synchronize personel data without using any product.

Best Regards...

Hande

Re: Microsoft Active Directory Integration

tim_alsop — Mon, 08 Jun 2015 11:55:09 GMT

I am not aware of any way you can sync users and passwords between AD and a SAP ABAP System. However, you can sync the user data (e.g. job title, email address) using the LDAP connector.

Re: Microsoft Active Directory Integration

former_member2987 — Mon, 08 Jun 2015 14:18:10 GMT

Hande,

Thanks for letting us know. You might want to move this conversation to another forum then, unless you are speaking of SAP SSO.

Matt

Re: Microsoft Active Directory Integration

Christian_Cohrs1 — Thu, 18 Jun 2015 12:01:09 GMT

Hi Hande,

The Kerberos SNC authentication options available with the product SAP Single Sign-On are documented on help.sap.com .

I'm pretty sure there will be a mode that fits to your scenario.

Best regards,

Christian

Re: Microsoft Active Directory Integration

hynek_petrak — Tue, 21 Jul 2015 20:33:22 GMT

Hi Hande,

I can imagine implementing a password hook on your domain controller: PasswordChangeNotify callback function (Windows)

which would then update the SAP password for a user on all defined SAP instances via RFC call to BAPI_USER_CHANGE.

All the above would require some 200-300 lines of code, however from a security standpoint, I strongly discourage you of implementing that. Your active directory passwords are safe as long as you keep them on the domain controller and you do not touch them. Any attempt like above leads to compromise of user credentials.

Either keep the authentication separate or go for SSO. Do not synchronize the passwords.

Hynek