Quantcast
Channel: SCN: Message List - SAP Single Sign-On
Viewing all articles
Browse latest Browse all 2732

Re: single sign on with kerberos

$
0
0

Hi Ashu,

you did some strange things wherever. If you have time, try to proceed according to this checklist. Maybe it helps.

 

Service Account in Active Directory

Make sure, the account is not locked, has a known and never changing password

Make sure „Use DES encryption“ is not checked

Make sure the Service Principal Name in AD has the following Syntax: SAP/<sAMAccountName>

Check with CLI on a domain system: setspn -l SAPService<SID> if you get returned your SPN

Check with setspn -X -F to avoid duplicate SPNs

 

Example:

Your SAPs System ID is SA1

Your User Account in AD is SAPServiceSA1

Output of setspn -l <account>

Registered ServicePrincipalNames for CN=SAPServiceSA1,<YOUR OU STRUCTURE>,DC=<..>,D C=<..>: SAP/SAPServiceSA1

 

SAP System

SNC Library

Ensure by executing „sapgenpse“ you are using a up-to-date CommonCryptoLib 8.4.48+

Make sure the environment variable $SECUDIR is properly defined and points to /usr/sap/<SID>/DVEBMGS<..>/sec

 

Most important Profile parameters (according to the example above):

snc/identity/as = p:CN=SAPServiceSA1

snc/gssapi_lib = $(DIR_EXECUTABLE)$(DIR_SEP)$(FT_DLL_PREFIX)sapcrypto$(FT_DLL)

 

Clean up your SECUDIR

Delete credentials for SAPSNCSKERB.PSE: sapgenpse seclogin -p SAPSNCSKERB.pse -d

Delete SAPSNCKERB.PSE

 

Proceed according to the manuals (for Domain names always use UPPERCASE):

Re-Create SAPSNCSKERB.pse (in your post above I noticed you are missing the „S“ in the file name)

Re-Create Credentials for the new PSE and make sure your SAPServiceSID user and/or SIDadm is able to use that credentials

List the credentials for the SIDadm using: sapgenpse seclogin -l (optionally with -O <SAPServiceSID>)

List the keytab and make sure you have 4 entries: sapgenpse.exe get_my_name -p SAPSNCSKERB.pse


Clean up your STRUST

Do NOT import the SAPSNCSKERB.pse into STRUST. Move to STRUST select SNC SAPCryptoLib and right click + delete

 

You do not need this in STRUST as it would only be required for X.509 based SNC. As the SAPSNCSKERB.pse does not contain any X.509 key pairs and certificates, you receive that error message (unable to determine public key algorithm).

Restart your ABAP System and check dev_w0 to ensure SNC was initialized correctly

 

SAP GUI Client

On the enable SNC. On the SNC Name enter: p:CN=SAP/SAPServiceSA1 which reflects your SPN syntax.

 

Regards,

Carsten


Viewing all articles
Browse latest Browse all 2732

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>