Can we configure SSO between ECC and ECC

[former_member621075]

Hi All,

Can we configure SSO between two backend systems I.e., ECC to ECC ?

With Regards,

Dayakar.

[former_member621075]

Hi All,

Can we configure SSO between two backend systems I.e., ECC to ECC ?

With Regards,

Dayakar.

[tim_alsop]

Can you confirm what you want ? Normally SSO is used when a user logs onto a system, but you are asking for SSO between ABAP stacks. It is possible to secure the connection between ABAP systsems using SNC, and then there are no passwords sent over the connection, and the connection can be made more secure using encryption and data integrity. Is this what you wanted ?

Thanks,

Tim

[JPReyes]

Can we configure SSO between two backend systems I.e., ECC to ECC ?

I know is not good to answer and quetion with another question but...Isn't that call trusted systems?

Describe your scenario.

Regards

Juan

[Former Member]

Hi,

>Isn't that call trusted systems?

Yes, and it works perfectly when you have exchanged the certificates.

Regards,

Olivier

[tim_alsop]

>

> Yes, and it works perfectly when you have exchanged the certificates.

Unless you are using Kerberos, in which case the key table file on each server will contain the symmetric keys required, so no need to exchange anything.

[Former Member]

There is one more special scenario where it works perfectly, and it is exactly the one which Dayakar's interviewer is asking him about here:

> Can we configure SSO between ECC and ECC

The (logical) systems have the same SID, and within the same SID SAP always trusts itself --> no need to exchange certificates nor maintain the trusted / trusting pairs.

Should work without any reverting back, because it is truely "the same" this time...

Cheers,

Julius

[Former Member]

This message was moderated.

[Wolfgang_Janzen]

The (logical) systems have the same SID, and within the same SID SAP always trusts itself --> no need to exchange certificates nor maintain the trusted / trusting pairs.

No, that's not true. Let's put it that way: one system always trusts itself and when it communicates with itself, then both communication partners do have the same system ID (SID). That part is true. But you cannot simply fool the system by taking another system with the same SID; unless this 2nd system is a clone of the first system, they will not have the same keypair. And also the DB key will be different.

[Former Member]

It is the true part I was referring to, added the "logical system" disclaimer too discretely it seems.

The untrue part reminds me of a fellow who bought an image of a SAP system on a disk from a market somewhere and tried to get it working. He came to SDN's "basis" forums looking for support or his money back...

Cheers,

Julius

Edited by: Julius Bussche on May 17, 2010 6:48 PM

[anderson_parreiras]

Hi,

But if the two Portals are in different instances you can create a trust between them to use the SSO.

Just go to Visual Administrator (\usr\sap\<SID>\<InstanceID>\j2ee\admin\go.(bat/sh)) and follow the path below:

- <SID>

- Server

- Services

- Key Storage

- Runtime

- TicketKeystore

There you can Export your own certificate and import the certificate from other instances to create the trust.

[former_member621075]

Hi all,

My actual question was different ...

here the scenario is like we are creating copy of backend (ECC) and the copied instance doen't have any portal instance.

we need to access the portal pages from the copied ECC.....example..in E-Recruitment.

to makes this what needs to be done......

if possible kindly provide procedure in elaborate manner

With regards,

Dayakar.

[former_member621075]

Thanks for the discussion