Indeed SLC is required on the clients. ABAP SPNEGO is used for SAP GUI for HTML (no need for user mapping) and SLC is used in case of SAP GUI (user mapping is required). This scenario is covered in Implementing Single Sign-On with Kerberos Part 3 at the 02:00 mark. The parameter snc/identity/as should always be set to the service principal.
↧