SNC between GUI and SAP Server

[Former Member]

Hello,

is there a good guide how to setup up the free soloution for SNC between the SAP GUI and the applikationserver?

Is this soloution only working in an active directory enviroment?

[tim_alsop]

Is your SAP server on Unix, Linux or Windows ?

[Former Member]

It is a Windows Server

[tim_alsop]

I suggest you search in SCN for thread which refer to the setup instructions and also search in SAP notes for instructions.

If you find you need 'more than' SSO and still want to use Active Directory authentication, let me know.

[Former Member]

Hello,

is it possible to use the SNC function without SSO? I only want to encrypt the traffic between the the GUI and the Server

[tim_alsop]

If you want to use the SAP user and password, but use SNC for encryption then this is possible using any SNC library, if you use the latest SAP GUI 7.20 patch release - in that release you can right click on an entry in SAP Logon and select option to logon using no SSO.

However, if you use SAP user and password, this doesn't reduce the number of passwords users have, so you might want to turn off SSO but still use Actie Directory for user authentication (then the users only have one identity and one set of credentials to remember). This scenario is NOT supported by any SNC library but can be implemented if you use the right product.

[Former Member]

Hello,

I try to setup the SNC connection from the GUI to the sever.

I enable the SNC on the server side.

I enable on the GUI the SNC on the network tab. for the SNC Name i take the name i saw in the STRUST transaction: p:CN=THP, OU=BC, O=WORK, C=DE

Is this correct?

If i make a double click on the entry i get a error message:

Miscellaneous Failure

Kerberos SSPI not usable with this User account

STOP! initial call to gss_indicate_mechs()failed

I try the SNC setup in a local enviroment, no domain user. Is this possible, or is a domain enviroment a must to use SNC only for network encryption?

[tim_alsop]

Bernhard,

The SNC name in su01 needs to be an SNC name such as p:<user>@<REALM> since you are using a Kerberos SNC library. If you were using an SNC library that supported x.509 certificates, then the SNC name would be like p:CN=THP,OU=... etc.

Thanks,

Tim

[Former Member]

Tim,

i am not able to enter any user in the SAP Logon. As soon as i make a double click on the line with the SAP server with SNC enabled i get the error message.

For me it seems the system try to logon with the user from the windows, but i use a different one in SAP.

I there anything else i have to look on the GUI side? I setup the SNC_LIB in the enviroment variables for the user.

[tim_alsop]

I don't understand what you mean. Are you saying that you want SSO, so user doesn't get SignOn screen ? If you do, then you need to enter the SNC name of the user who is logged on at the workstation into the user record in SU01 (in SNC tab). Then, when user logs on, the SNC name of the user will be matched against the entry in the user record (in table USRACL) and the user will be logged in without a SignOns creen.

Did you configure the SNC name of the SAP server in saplogon.ini ?

[Former Member]

Hello Tim,

no i only want to use SNC without SSO.

I download now the newest SAP GUI Patch and now i see the option SNC-Logon with User/Password (without SSO).

If i try to logon now i get the error message "SNC name and specified user/client do not match". Can you help me with this?

regards,

Bernhard

[tim_alsop]

Would you prefer to have no SSO, but still have a single AD user and password for each user, and stop using SAP user and password ?  The problem with using SNC and the features in SAP GUI to turn off SSO, is that they require the user to have to remember many user id's and passwords, which is where the issues with helpdesk costs etc. arrise. If you would prefer to turn off SSO, but allow a user to use a single identity with single set of credentials (e.g. their AD account and password) then I can help you with this.

The error you are getting, is not one I am familiar with, since I don't know anybody who uses the method you are using. Maybe you should get SSO working with SNC first and then try to turn it off - it will be easier to troubleshoot that way. Maybe you need to be aware that, even with SSO off, the SNC library is still use to authenticate the user, but the difference is that the SAP ABAP system is not using the SNC name of the user, and the SAP SignOn screen is shown where the user can enter their SAP user and password. Are you getting this screen and trying to enter the AD account and password ? If so, that is not right.

[Former Member]

Hello Tim, I have read carefully the thread 3150833 "snc between GUI and SAP Server".

We would like to implement  that solution: to turn off SSO, but allow a user to use a single identity with single set of credentials using their Active Directory account and password.

Our configuration and systems are:

- Active Directory for user/workstation authentication (Windows)

- SAPGUI 730

- SAPSERVER on HP-UX 11.31 IA64

- SAP ECC6.0 (only ABAP - no EP or WEB AS JAVA)

- Oracle DB

Can you help us for this question ?

Best regards

Massimo

[Former Member]

@Tim Alsop, please can you help, am configuring Active Directory and SAP Integration, i want to turn off SSO, but allow a user to use a single identity with single set of credentials especially their AD account and password to log on to SAP. Please how do i go about it am stuck

Thanks