DOCSLIB.ORG

Single Sign on for SAP Netweaver Application Server (ABAP) On

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Single Sign on for SAP Netweaver Application Server (ABAP) On Single Sign On for SAP NetWeaver Application Server (ABAP) on Power Systems How to enable Single Sign On with Secure Network Communication using Kerberos on SAP Application Servers (ABAP) running on Power Linux or AIX with a central Active Directory serving as Kerberos server Cäcilie Hampel ODOE Technology & Solutions Development Oktober 2009 This document can be found on the web, www.ibm.com/support/techdocs © Copyright IBM Corporation, 2009. All Rights Reserved. All trademarks or registered trademarks mentioned herein are the property of their respective holders Table of contents Abstract ................................................... ................................................... ........................... 3 Preface ................................................... ................................................... ........................... 3 Kerberos Client Configuration ................................................... ......................................... 5 a.) Novell Linux Kerberos Client Configuration ................................................... ................................ 5 b.) Red Hat Linux Kerberos Client Configuration ................................................... ............................ 6 c.) AIX Kerberos Client Configuration ................................................... .............................................. 8 Add Linux/AIX Server as host to Active Directory and create keytab .............................. 9 a.) Initialize keytab on Linux host ................................................... ................................................... 10 b.) Initialize keytab on AIX host ................................................... ................................................... .. 11 Enable SAP NetWeaver Application Server (ABAP) for SNC .......................................... 11 Enable SAP user for SNC ................................................... ................................................ 13 Enable Kerberos and SNC on Windows Client ................................................... ............. 15 Testing SSO ................................................... ................................................... .................. 18 Error detection/Known problems ................................................... ................................... 19 Links and Resources ................................................... ................................................... ... 20 Products used in this paper ................................................... ........................................... 21 About the author ................................................... ................................................... ........... 21 Acknowledgements ................................................... ................................................... ...... 21 Trademarks and special notices ................................................... .................................... 22 Single Sign On (SSO) with Kerberos for SAP on Power Linux and AIX 2 © Copyright IBM Corporation, 2009. All Rights Reserved. All trademarks or registered trademarks mentioned herein are the property of their respective holders Abstract The system landscape of companies grows rapidly. At the same time, the number of users increases as in heterogeneous system landscapes one employee often uses several user IDs for different systems. This leads to high maintenance and support effort as well as higher total cost of ownership and security risks. A possible solution to this situation could be Single Sign On (SSO). The name already tells all about SSO: the user has to sign on only once. This means he must remember only one user name and one password. This paper describes the setup of SSO for SAP® NetWeaver™ Application Server based on the Kerberos™ protocol. It makes use of the common combination of Windows® workstations grouped in a Microsoft® Active Directory™ domain and SAP on Linux® and AIX® running on IBM® Power™ Systems. Preface SAP offers Secure Network Communication (SNC) as a component to integrate an external security product into SAP systems. In this paper, the used external security product will be Kerberos. Kerberos is a network authentication system based on a key distribution model and a central repository. The idea is that every resource authenticates itself against the Kerberos server and receives a key, also called ticket. This ticket is then used during communication with others to identify the resource as a trusted partner and enables single sign on as no passwords will be requested due to the ticket exchange. The first step for a Kerberos authenticated communication is that a resource authenticates itself against a Kerberos authentication server and requests a ticket. This first ticket is the Ticket Granting Ticket (TGT) that is used for the communication with the Kerberos Key Distribution Center (KDC). Further, during the first communication with the authentication server, a session key is created that can be used for encrypted communication. The Kerberos authentication server and the KDC are two independent servers and could work on different servers but usually, they are part of the same system and are seen as an unit. When the resource now tries to connect to another party, it needs another ticket. Therefore it sends the TGT and a ticket request to the KDC that creates tickets for the communication with other Kerberos enabled resources. The KDC will respond with a ticket for the communication between the two partners. The first resource forwards the ticket to the host with which it would like to communicate. If the host accepts the ticket as valid, the resource has been authorized to connect to the system for the duration of the ticket. The tickets have a limited lifetime and must be renewed after a while, normally after eight to ten hours. Another security setting is that every ticket is also bound to a unique SPN, Service Principal Name, that clearly identifies a user or resource. The ticket can only be used by the partner to which it was granted. Single Sign On (SSO) with Kerberos for SAP on Power Linux and AIX 3 © Copyright IBM Corporation, 2009. All Rights Reserved. All trademarks or registered trademarks mentioned herein are the property of their respective holders Kerberos AuthenticationServer 1. Authentication Request 2. Ticket Granting Ticket 3. Ticket Granting Ticket Key Partner 1 Distribution (e.g. Windows Center Workstation) 4. Ticket (for communication with Partner 2) 5. Ticket er on his local workstation, the active directory that serves as a tion server and the KDC. soft Active directory domain is beros server during log on. Apart ion Programming Interface (GSS- Partner 2 s SNCe Linux/AIXuses the GSS-API host; it needs interface also (e.g. SAP System) be registered as domain user. ive directory users section. As will activelye started authenticate once and then it against run on its In the SAP context, the involved parties are the us - we will use another mechanism. SAP system on a Linux or AIX host, and the central ated that holds the credentials of Kerberos server, which contains both the authentica computer account. This keytab is The user on his workstation that is part of a Micro l user and all applications running automatically authenticated against the central Ker tication. As the SAP system is from that only a Generic Security Services Applicat ust be authorized to call the API) library must be installed on the workstation a to communicate with Kerberos. The same refers to th thenticated against the Kerberos the GSS-API lib. ded for communication with other Further, also the host the SAP systems runs on must started by different users, there Therefore, a computer account is created in the act Linux and AIXved. there will not be a physical user on the host that the Kerberos server – in fact the SAP system will b own without direct interaction by an administrator On the active directory server, a keytab can be cre the host, as well as its encrypted password of the erein are the property of their respective holders then copied to the host. It can be called by a loca under this user will be enabled for Kerberos authen running under a userid called <sid>adm, this user m keytab. Not the user itself but the host© Copyright is then IBM Corporation,au 2009. All Rights Reser server. The user will, however, hold the ticket nee parties. So, if thereSingle are Sign applications On (SSO) with onKerberos one forhost SAP on Power 4 All trademarks or registered trademarks mentioned h must be one ticket for each user. The tickets must be renewed in regular intervals. This can be done in an automated job. After SAP system host and user have authenticated themselves against the Kerberos server, the user is able log in to the SAP application without password input, the authentication is done in the background. Now, after the technical background has been described, you need to perform the following steps to enable your own SAP system for SSO: ● Kerberos Client Configuration ● Add Linux/AIX Server as host to Active Directory and create keytab ● Enable SAP NetWeaver Application Server (ABAP) for SNC ● Enable SAP User for SNC ● Enable Kerberos and SNC on Windows Client ● Testing SSO Kerberos Client Configuration To enable the Linux or AIX Server for Kerberos authentication, it needs a Kerberos client that will talk to the central Active Directory Kerberos server. Before you start with the configuration of Kerberos client,
Load more

Recommended publications
  • SAP Backup Using Tivoli Storage Manager
    Front cover SAP Backup using Tivoli Storage Manager Covers and compares data management techniques for SAP Presents a sample implementation of DB2 and Oracle databases Explains LAN-free and FlashCopy techniques Budi Darmawan Miroslav Dvorak Dhruv Harnal Gerson Makino Markus Molnar Rennad Murugan Marcos Silva ibm.com/redbooks International Technical Support Organization SAP Backup using Tivoli Storage Manager June 2009 SG24-7686-00 Note: Before using this information and the product it supports, read the information in “Notices” on page xi. First Edition (June 2009) This edition applies to Version 5, Release 5, Modification 0 of Tivoli Storage Manager and its related components: Tivoli Storage Manager Server, 5608-ISM Tivoli Storage Manager for Enterprise Resource Planning, 5608-APR Tivoli Storage Manager for Databases, 5608-APD Tivoli Stroage Manager for Advanced Copy Services, 5608-ACS Tivoli Storage Manager for SAN, 5608-SAN © Copyright International Business Machines Corporation 2009. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Notices . xi Trademarks . xii Preface . xv The team that wrote this book . xv Become a published author . xvii Comments welcome. xviii Part 1. Concepts . 1 Chapter 1. SAP data management. 3 1.1 SAP . 4 1.2 Data management. 4 1.3 Book structure . 5 Chapter 2. SAP overview . 7 2.1 SAP product history. 8 2.2 SAP solutions and products . 11 2.2.1 Enterprise solutions. 11 2.2.2 Business solutions . 13 2.2.3 SAP solutions for small businesses and mid-size companies . 13 2.3 SAP NetWeaver overview .
    [Show full text]
  • IBM Db2 for Linux, UNIX, and Windows Database: IBM Db2 for Linux, UNIX, and Windows
    Installation Guide | PUBLIC Software Provisioning Manager 1.0 SP 32 Document Version: 3.5 – 2021-06-21 Installation of SAP Systems Based on the Application Server ABAP of SAP NetWeaver 7.0 to 7.03 on UNIX: IBM Db2 for Linux, UNIX, and Windows Database: IBM Db2 for Linux, UNIX, and Windows company. All rights reserved. All rights company. Operating System: UNIX and Linux affiliate THE BEST RUN 2021 SAP SE or an SAP SE or an SAP SAP 2021 © Content 1 About this Document........................................................12 1.1 SAP Products Based on SAP NetWeaver 7.0 to 7.0 EHP3 Supported for Installation Using Software Provisioning Manager 1.0 .......................................................13 1.2 Naming Conventions..........................................................14 1.3 New Features...............................................................15 1.4 Constraints................................................................20 1.5 Before You Start.............................................................20 1.6 SAP Notes for the Installation....................................................21 2 Installation Options Covered by this Guide........................................23 2.1 Central System..............................................................23 2.2 Distributed System...........................................................24 2.3 High-Availability System.......................................................25 2.4 ASCS Instance with Integrated SAP Web Dispatcher ...................................26
    [Show full text]
  • SAP Overview
    SAP Overview What is SAP? SAP (Systems, Applications, Products in Data Processing), is headquartered in Walldorf, Germany. They provide business software designed to help companies execute and optimize business and IT strategies. SAP defines business software as comprising enterprise resource planning (ERP) and related applications such as supply chain management (SCM), customer relationship management (CRM), product life‐cycle management, and supplier relationship management (SRM).1 SAP currently has: • More than 51,000 employees in over 50 countries developing, marketing, and selling applications and services • 82,000 customers of all sizes across 25 industries and in over 120 countries • Listings on the Frankfurt and New York stock exchanges SAP operates in three geographic regions: EMEA (representing Europe, Middle East, and Africa), Americas, and Asia Pacific Japan (APJ, representing Japan, Australia, and parts of Asia). 2 History of SAP In 1972, SAP was founded by 5 former IBM employees in Mannheim, Germany with the vision to “to develop standard application software for real‐time business processing.” After the first year, they created the first financial accounting software application, which came to be known as the "R/1 system." "R" stands for real‐time data processing. By the end of the 1970s, R/1 evolved into SAP R/2. The programming language ABAP (Advanced Business Application Programming) was also a derivative of R/2, originally serving as the report language for the system.3 In the 1980s, SAP R/2 was updated to handle different languages and currencies‐‐subsequently, this lead to SAP’s international expansion into Austria, Denmark, Sweden, Italy, and the United States.
    [Show full text]
  • Best Practices for SAP BI Using DB2 9 for Z/OS
    Front cover Best Practices for SAP BI using DB2 9 for z/OS Benefits of SAP Business Information Warehouse on z/OS Best practices and troubleshooting Scalability of the BI Accelerator Lydia Parziale Wilfried Alle Martin Cardoso Lindy Crawford Giovanni Grita Theodor Kuebler Georg Mayer ibm.com/redbooks International Technical Support Organization Best Practices for SAP BI using DB2 9 for z/OS March 2008 SG24-6489-02 Note: Before using this information and the product it supports, read the information in “Notices” on page ix. Third Edition (March 2008) This edition applies to DB2 Version 9 for z/OS, Release 1, and SAP BI Version 7.0 . © Copyright International Business Machines Corporation 2005, 2007, 2008. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Notices . ix Trademarks . x Preface . xi The team that wrote this IBM Redbook . xii Become a published author . xv Comments welcome. xv Chapter 1. Introduction. 1 1.1 Product overview. 2 1.2 The audience for this IBM Redbooks publication . 3 1.3 Why run SAP BI on IBM System z . 4 1.3.1 Value provided by System z, z/OS, and DB2 . 4 Chapter 2. Overview of SAP BI and related data . 9 2.1 BI architecture . 10 2.2 Which cubes, DSO, and PSA objects are in your BI system. 12 2.2.1 Report SAP_BWTOOLPGM_DB2 . 13 2.3 BI data and DB2 partitioning . 14 2.3.1 Why partitioning . 15 2.3.2 Range partitioning of F- fact tables .
    [Show full text]
  • Micro Focus Fortify Static Code Analyzer User Guide, Which Are No Longer Published As of This Release
    Micro Focus Fortify Static Code Analyzer Software Version: 20.1.2 User Guide Document Release Date: July 2020 Software Release Date: July 2020 User Guide Legal Notices Micro Focus The Lawn 22-30 Old Bath Road Newbury, Berkshire RG14 1QN UK https://www.microfocus.com Warranty The only warranties for products and services of Micro Focus and its affiliates and licensors (“Micro Focus”) are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Micro Focus shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice. Restricted Rights Legend Confidential computer software. Except as specifically indicated otherwise, a valid license from Micro Focus is required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Copyright Notice © Copyright 2003 - 2020 Micro Focus or one of its affiliates Trademark Notices All trademarks, service marks, product names, and logos included in this document are the property of their respective owners. Documentation Updates The title page of this document contains the following identifying information: l Software Version number l Document Release Date, which changes each time the document is updated l Software Release
    [Show full text]
  • SAP Netweaver® Application Server ABAP/Java on Oracle Cloud Infrastructure
    SAP NetWeaver® Application Server ABAP/Java on Oracle Cloud Infrastructure August 2021, Version 2.1 Copyright © 2021, Oracle and/or its affiliates Public 1 SAP NetWeaver® Application Server ABAP/Java on Oracle Cloud Infrastructure / Version 2.1 Copyright © 2021, Oracle and/or its affiliates / Pub lic Disclaimer This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle software license and service agreement, which has been executed and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates. This document is for informational purposes only and is intended solely to assist you in planning for the implementation and upgrade of the product features described. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle. Due to the nature of the product architecture, it may not be possible to safely include all features described in this document without risking significant destabilization of the code. Revision History The following revisions have been made to this technical brief since its initial publication: DATE REVISION August 2021 Version 2.1 of this document covers the VM.Standard.E4.Flex shape.
    [Show full text]
  • ABAP Development for SAP HANA? Your Comments and 1.2 Basic Principles of In-Memory Technology
    First-hand knowledge. Reading Sample As an ABAP developer you will want to use views and database procedures you created in SAP HANA Studio in ABAP. In this samp- le chapter, you will learn how to consistently transport native SAP HANA development objects, via the Change and Transport System “Integrating Native SAP HANA Development Objects with ABAP” Contents Index The Authors Hermann Gahm, Thorsten Schneider, Christiaan Swanepoel, Eric Wes- tenberger ABAB Development for SAP HANA 625 Pages, 2016, $79.95 ISBN 978-1-4932-1304-7 www.sap-press.com/3973 Chapter 5 ABAP developers want to use views and database procedures that they’ve created in SAP HANA Studio in ABAP. Developers are also used to a high-performance transport system and expect consistent transport of native SAP HANA development objects via the Change and Transport System. 5 Integrating Native SAP HANA Development Objects with ABAP Chapter 4 illustrated how you can create analytical models (views) and database procedures using SAP HANA Studio. Now we’ll explain how you can call these native SAP HANA objects from ABAP. We’ll also discuss how you can transport ABAP programs that use native SAP HANA objects consistently in your system landscape. 5.1 Integrating Analytic Views In the previous chapter, you learned how to model the different view types in SAP HANA Studio and how to access the results of a view using the Data Preview or Microsoft Excel. In Chapter 4, Section 4.4.4, we also explained how to address the generated column views via SQL. This section describes how to access the views from ABAP.
    [Show full text]
  • How to Develop in Abap
    HOW TO DEVELOP IN ABAP How to Develop in ABAP Applies to: SAP NetWeaver 7.0. For more information, visit the ABAP homepage. Summary This is the PDF version of the development blog series on SDN published in 2007 that gave an introduction to ABAP newbies who want to learn how to develop simple programs in ABAP. This PDF file does not contain the few blogs of the original series that explained how to install and administrate the ABAP demo version and how to import and export programs. This PDF document solely focuses on the many blogs that focused on development in ABAP. This is why the PDF file starts with blog 3 and has some gaps in the numbering. The main author of this blogs is Thomas Weiss but some blogs were written by other authors (Manfred Lutz, Hans Tillinger, Dirk Feeken). For more information read the original blogs. If you are interested in the comments and answers to the comments on the blogs you should read the original blogs on SDN. Otherwise this PDF file gives you an easy opportunity to work your way through the whole series. Author Bio Thomas Weiss has a Ph.D. in analytic philosophy. He worked as a professional writer before joining, in 2001, the SAP NetWeaver product management training team where his responsibilities included the e-Learning strategy for ABAP. After becoming more involved in writing ABAP material himself, he is now a member of the SAP NetWeaver Application Server Solution Management. One of his main interests lies in rolling out ABAP topics both for experts and for beginners by writing blogs in SDN.
    [Show full text]
  • Is COBOL Holding You Hostage with Math? | by Marianne Bellotti | Medium
    7/31/2020 Is COBOL holding you hostage with Math? | by Marianne Bellotti | Medium This is your last free story this month. Sign up and get an extra one for free. Is COBOL holding you hostage with Math? Marianne Bellotti Follow Jul 28, 2018 · 12 min read Face it: nobody likes fractions, not even computers. When we talk about COBOL the first question on everyone’s mind is always Why are we still using it in so many critical places? Banks are still running COBOL, close to 7% of the GDP is dependent on COBOL in the form of payments from the Centers for Medicare & Medicaid Services, The IRS famously still uses COBOL, airlines still use COBOL (Adam Fletcher dropped my favorite fun fact on this topic in his Systems We Love talk: the reservation number on your ticket used to be just a pointer), lots of critical infrastructure both in the private and public sector still runs on COBOL. Why? The traditional answer is deeply cynical. Organizations are lazy, incompetent, stupid. They are cheap: unwilling to invest the money needed upfront to rewrite the whole system in something modern. Overall we assume that the reason so much of civil society runs on COBOL is a combination of inertia and shortsightedness. And certainly there is a little truth there. Rewriting a mass of spaghetti code is no small task. It is expensive. It is difficult. And if the existing software seems to be working fine there might be little incentive to invest in the project. But back when I was working with the IRS the old COBOL developers used to tell me: “We tried to rewrite the code in Java and Java couldn’t do the calculations right.” This was a very strange concept to me.
    [Show full text]
  • Comparative Programming Languages CM20253
    We have briefly covered many aspects of language design And there are many more factors we could talk about in making choices of language The End There are many languages out there, both general purpose and specialist And there are many more factors we could talk about in making choices of language The End There are many languages out there, both general purpose and specialist We have briefly covered many aspects of language design The End There are many languages out there, both general purpose and specialist We have briefly covered many aspects of language design And there are many more factors we could talk about in making choices of language Often a single project can use several languages, each suited to its part of the project And then the interopability of languages becomes important For example, can you easily join together code written in Java and C? The End Or languages And then the interopability of languages becomes important For example, can you easily join together code written in Java and C? The End Or languages Often a single project can use several languages, each suited to its part of the project For example, can you easily join together code written in Java and C? The End Or languages Often a single project can use several languages, each suited to its part of the project And then the interopability of languages becomes important The End Or languages Often a single project can use several languages, each suited to its part of the project And then the interopability of languages becomes important For example, can you easily
    [Show full text]
  • Database Administration Guide for SAP on IBM Db2 for Linux, UNIX, and Windows Company
    Administration Guide | PUBLIC Document Version: 2.5 – 2021-09-23 Database Administration Guide for SAP on IBM Db2 for Linux, UNIX, and Windows company. All rights reserved. All rights company. affiliate THE BEST RUN 2021 SAP SE or an SAP SE or an SAP SAP 2021 © Content 1 Introduction................................................................7 1.1 Document History............................................................ 8 1.2 Naming Conventions..........................................................10 2 Administration Tools and Tasks.................................................12 2.1 Administration Tools..........................................................12 2.2 Administration Tasks..........................................................13 3 Architectural Overview.......................................................16 3.1 SAP Application Server for ABAP.................................................16 3.2 SAP Application Server for Java..................................................17 3.3 Db2 Components............................................................18 3.4 Db2 Client Connectivity........................................................19 4 User Management and Security................................................ 21 4.1 SAP System Users and Groups...................................................21 Access Authorizations for Db2 Directories and Database-Related Files....................25 4.2 Role-Based Security Concept for Database Users..................................... 27 Database Roles for
    [Show full text]
  • Getting Started with SAP ABAP ERP Adapter for Oracle Data Integrator
    Oracle® Fusion Middleware Getting Started with SAP ABAP ERP Adapter for Oracle Data Integrator 12c (12.2.1.3.0) E96501-04 March 2019 Oracle Fusion Middleware Getting Started with SAP ABAP ERP Adapter for Oracle Data Integrator, 12c (12.2.1.3.0) E96501-04 Copyright © 2010, 2019, Oracle and/or its affiliates. All rights reserved. Primary Author: Oracle Corporation This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency- specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs.
    [Show full text]