DOCSLIB.ORG

Secure Login for SAP Single Sign-On Implementation Guide Company

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Secure Login for SAP Single Sign-On Implementation Guide Company PUBLIC SAP Single Sign-On 3.0 SP02 Document Version: 1.9 – 2020-03-17 Secure Login for SAP Single Sign-On Implementation Guide company. All rights reserved. All rights company. affiliate THE BEST RUN 2020 SAP SE or an SAP SE or an SAP SAP 2020 © Content 1 Introduction to Secure Login.................................................. 10 2 System Overview............................................................11 2.1 Cryptographic Library for SAP Single Sign-On........................................12 2.2 Clients for Authentication...................................................... 12 Authentication Methods of Secure Login Client.....................................12 Authentication Methods of Secure Login Web Client................................. 13 2.3 System Overview with Secure Login Server..........................................13 2.4 PKI Structure...............................................................14 Out-of-the-Box PKI Login Server............................................... 14 PKI Integration............................................................14 2.5 Secure Communication........................................................15 2.6 Policy Server Overview.........................................................16 2.7 Digital Signing with Secure Store and Forward (SSF)....................................17 2.8 Authentication Profiles.........................................................17 3 Basic Scenarios............................................................ 18 3.1 Environment Using Secure Login Client.............................................18 Authentication Methods without Secure Login Server................................19 Workflow with X.509 Certificate without Secure Login Server...........................20 Workflow with Kerberos Token without Secure Login Server............................21 3.2 Environment Using Secure Login Client and Secure Login Server...........................21 Authentication Methods with Secure Login Server.................................. 22 Workflow with X.509 Certificate Request Using Secure Login Server......................23 3.3 SNC X.509 Configuration...................................................... 24 Configuring SNC Parameters for X.509 Certificates................................. 24 Configuring X.509 Certificates Using the Trust Manager..............................25 3.4 SNC Kerberos Configuration....................................................27 Microsoft Windows Account for SAP Server.......................................28 Create a Microsoft Windows Account............................................32 4 Advanced Scenarios.........................................................33 4.1 Logging on with Secure Login Client Using SNC.......................................33 Enabling Secure Login Client to Smartly Select an SNC Mode.......................... 34 Rolling out General Availablility of SNC-Encrypted Logon..............................35 Manually Switching to Encryption Only for Logging on Using SNC........................36 SNC Configuration Options in the Secure Login Client................................36 4.2 Providing X.509 Certificates to Secure Login Client Using JavaScript Web Client................38 Secure Login for SAP Single Sign-On Implementation Guide 2 PUBLIC Content Elements Required in Secure Login Client for JavaScript Web Client......................39 Elements Required in Secure Login Server for JavaScript Web Client.....................40 Extending JavaScript Web Client to Multiple SAP GUI Logins........................... 41 Extending JavaScript Web Client to Multiple Portal Logins.............................41 Configuring the Secure Login Client for JavaScript Web Client..........................42 Configuring the Secure Login Server for JavaScript Web Client..........................43 4.3 Using a Remote Certification Authority in Secure Login................................. 46 Prerequisites for Using a Remote Certification Authority ..............................46 Configuring a Remote Certification Authority for Secure Login..........................48 4.4 Remote Certification Authority Certificate Templates...................................54 4.5 Using the Secure Login Server to Provide Trusted Certification Authorities....................54 Configuration Information for Trusted Certification Authorities Provided by the Secure Login Server................................................................. 55 4.6 Certificate Lifecycle Management Using the Secure Login Server.......................... 57 The sapslscli Command Line Interface...........................................58 4.7 Browser-Based Enrollment of Secure Login Client Using a Secure Login Server Profile............58 API Methods for Profile Enrollment.............................................59 HTML Code Example with Secure Login Server Profile and SNC Name.................... 61 4.8 Using Secure Login Client as SSH Agent............................................62 Restricting the Use of Secure Login SSH Agent.....................................63 4.9 Digital Client Signature (SSF)................................................... 64 How to Test SSF Client Signature.............................................. 64 SSF User Configuration in SAP GUI.............................................66 System Signature Using Microsoft Active Directory Authentication.......................66 4.10 X.509 and Kerberos Authentication...............................................69 Authentication with X.509 Certificates and Kerberos................................ 69 Supporting Authentication with Kerberos and X.509 on SAP NetWeaver AS ABAP............70 4.11 Kerberos Authentication for HTML-Based User Interfaces Using AS ABAP with SPNego.......... 72 System Landscape for Kerberos Authentication on AS ABAP...........................73 Setting the AS ABAP Profile Parameters..........................................74 Configuring a Service Account................................................ 75 Creating a keytab..........................................................78 Troubleshooting SPNego on AS ABAP...........................................80 4.12 Configuring Secure Login Web Client Connections to SAP GUI............................ 80 Connection with Redirect to URL...............................................81 Direct SAP GUI Connection with Secure Login Web Client.............................82 Load-Balanced SAP GUI Connection with Secure Login Web Client (Using the Message Server) ......................................................................83 Launch SAP Logon Pad..................................................... 85 4.13 Using Secure Login Client in Web Adapter Mode...................................... 85 Configuring Web Adapter Mode for Secure Login Client...............................86 Secure Login for SAP Single Sign-On Implementation Guide Content PUBLIC 3 4.14 Using Secure Login Server for SAML 2.0 Authentication.................................86 Configuring SAML 2.0 Authentication in the Secure Login Server........................87 4.15 Certificate Lifecycle Management in the AS ABAP Using Secure Login Server..................88 PSE Infrastructure Involved in Certificate Renewal Using Secure Login Server...............89 Prerequisites for Certificate Renewal Using Secure Login Server........................ 90 Configuring Certificate Lifecycle Management in the AS ABAP Using Secure Login Server......90 Preparing a Certificate Renewal at Regular Intervals.................................95 4.16 Certificate Lifecycle Management in the AS Java Using Secure Login Server...................97 Infrastructure Involved In Certificate Renewal Using Secure Login Server..................98 Prerequisites for Certificate Renewal Using Secure Login Server........................ 99 Configuring Certificate Lifecycle Management in the AS Java Using Secure Login Server.......99 Renewing Certificates at Regular Intervals for AS Java Clients......................... 103 4.17 Issuing Certificates for iOS Devices...............................................109 Configuring an Authentication Profile for iOS Devices................................110 4.18 Kerberos Authentication with SPNego.............................................110 Configuring Kerberos Authentication with SPNego for Secure Login Client.................112 Enabling Kerberos Authentication with SPNego for Secure Login Web Client................112 Configuring SPNego on SAP NetWeaver Adminstrator...............................113 4.19 LDAP User Authentication..................................................... 114 Importing LDAP Server CAs or Certificates into the SAP NetWeaver Key Storage............ 115 4.20 Deleting a Configuration.......................................................116 4.21 User Authentication against SAP Netweaver Application Server for ABAP....................117 Creating a Destination with an RFC Destination Type................................118 4.22 RADIUS User Authentication....................................................119 Using a Customer-Specific securid.ini Server Message File............................120 4.23 Identification Using RFID Tokens.................................................121 Security Aspects of RFID Identification..........................................121 Implementation Concept of RFID Identification....................................122 RFID Identification Example................................................
Load more

Recommended publications
  • HPE Storeopen Standalone for Microsoft Windows User Guide
    HPE StoreOpen Standalone for Microsoft Windows User Guide Abstract This guide provides information about HPE StoreOpen Standalone for Microsoft Windows, which is an implementation of the Linear Tape file system (LTFS) to present an LTO-5, LTO-6, and LTO-7 tape drive and media as a disk volume, accessed via a drive letter. Part Number: EH969-90980 Published: July 2016 Edition: 1 © Copyright 2012, 2016 Hewlett Packard Enterprise Development Company LP Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard Enterprise has no control over and is not responsible for information outside HPE.com. Acknowledgements Microsoft®, Windows®, Windows® 7, Windows Vista®, Windows® 8, and Windows Server® are trademarks of the Microsoft group of companies. Linear
    [Show full text]
  • Peer-To-Peer Systems: Taxonomy and Characteristics 1B
    IJCST VOL . 3, Iss UE 2, APR I L - JUNE 2012 ISSN : 0976-8491 (Online) | ISSN : 2229-4333 (Print) Peer-to-Peer Systems: Taxonomy and Characteristics 1B. Lalitha, 2Dr. Ch. D. V. Subbarao 1Dept. of CSE, JNTUCE, Anantapur, AP, India 2Dept. of CSE, S.V University, Tirupathi, AP, India Abstract Various types of networks include: The limitations of client/server systems became a proof in large scale distributed systems for emerging of peer to peer systems, A. Centralized Networks which is the basis for decentralized distributed computing. In peer Centralized P2P protocols consist of a centralized file list. In this to peer model each node takes both the roles of client and server. model a user can send a query for a file to the centralized server. As a client, it can query and download its wanted data files from The server would then send back a list of peers that have the other nodes (peers) and as a server, it can provide data files to requested file. Once the user chooses which peer to download the other nodes. This paper provides the taxonomy of P2P systems file from the centralized would then facilitate the connection of gives an overview of structured and unstructured P2P systems, the peers then remove itself from the process as illustrated in Fig also discusses the characteristics and applications of peer to peer 1. Examples of centralized networks are Napster and eDonkey systems". in its early stages. Keywords Peer-To-Peer, Distributed Systems, Structured P2P, Unstructured P2P Systems. I. Introduction A Peer-to-Peer (P2P) computing or networking is a distributed application architecture that partitions tasks or workloads between peers.
    [Show full text]
  • A Generic Integrity Verification Algorithm of Version Files for Cloud Deduplication Data Storage Guangwei Xu*†, Miaolin Lai, Jing Li†,Lisun† and Xiujin Shi
    Xu et al. EURASIP Journal on Information Security (2018) 2018:12 EURASIP Journal on https://doi.org/10.1186/s13635-018-0083-x Information Security RESEARCH Open Access A generic integrity verification algorithm of version files for cloud deduplication data storage Guangwei Xu*†, Miaolin Lai, Jing Li†,LiSun† and Xiujin Shi Abstract Data owners’ outsourced data on cloud data storage servers by the deduplication technique can reduce not only their own storage cost but also cloud’s. This paradigm also introduces new security issues such as the potential threat of data lost or corrupted. Data integrity verification is utilized to safeguard these data integrity. However, the cloud deduplication storage only focuses on file/chunk level to store one copy of the same data hosted by different data owners, and is not concerned with the same part of different data, e.g., a series of version files. We propose an integrity verification algorithm of different version files. The algorithm establishes the generic storage model of different version control methods to improve the universality of data verification. Then, the methods of verification tags and proofs generating are improved based on the index pointers corresponding to the storage relationship in the version groups and chained keys. Finally, the random diffusion extraction based on the random data sampling in the version group is proposed to improve the verification efficiency. The results of theoretical and experimental analysis indicate that the algorithm can achieve fast and large-scale verification for different version data. Keywords: Data integrity verification, Version file storage, Version group, Random diffusion extraction 1 Introduction These misgivings have prompted the data owners to worry With the rapid development of the cloud computing, whether the outsourced data are intact or corrupted cloud storage as a new generation of computing infras- on the remote servers since they are deprived of the tructure has received more and more attention.
    [Show full text]
  • Download File Management and Processing Tools
    File Management and Processing Tools Published January 2018 CONTACT US Division of Library, Archives and Museum Collections | [email protected] File Management and Processing Tools Contents Introduction ................................................................................................................................................................................... 3 Bulk operations ............................................................................................................................................................................. 3 Duplicate file finding and deduplication ......................................................................................................................................... 4 Disk space analysis....................................................................................................................................................................... 4 Image viewer ................................................................................................................................................................................. 5 Integrity checking .......................................................................................................................................................................... 5 Last Updated January 2018 2 Introduction This guidance document provides a list of software tools that can assist in electronic file management and processing. This document is intended for records managers at state agencies,
    [Show full text]
  • Workflow Experts, from Acquisition to Archive – We’Ve Got Your Back(Up)!
    Workflow experts, from acquisition to archive – we’ve got your back(up)! Version 2020.1, Released January 2020, Indianapolis, Indiana USA [email protected] www.imagineproducts.com ShotPut Pro® for Windows Contents Preface 3 Legal Copyright License Welcome 5 Overview Preferences 9 General Preferences Queue Options File Verification 15 Notifications 17 Reports 21 Offload History 23 Advanced Preferences Offloading 27 Offloading Simple and Preset Modes Folder Naming Options Advanced Folder Naming 35 Begin Offloading Offload Status and Details Drive Details Appendix 38 Appendix A— Installation 40 Appendix B— Troubleshooting Frequently Asked Questions Technical Support 42I Index n d e x 2 ShotPut Pro® for Windows Legal Copyright Documentation Version 8.2 for Windows, copyright © 2019 Imagine Products, Incorporated. All rights reserved. This documentation and the software accompanying it are the property of Imagine Products, Incorporated and are loaned to the user under the terms of a Limited Use License Agreement. Unauthorized copying or use of this documentation, the software, or any associated material is contrary to the property rights of Imagine Products Incorporated and is a violation of state and federal law. This material must be returned to Imagine Products, Incorporated upon request. ShotPut Pro® for Windows copyright © 2008-2019 Imagine Products, Incorporated. ShotPut Pro® is a registered federal trademark Reg. No. 5,757,782. Imagine Products, Inc. ® is a registered federal trademark Reg. No. 4,711,231. PreRoll Post is a trademarK of Imagine Products, Incorporated. Offload with Confidence! and Imagine: We’ve Got Your BacK(up)! are service marks of Imagine Products, Incorporated. Portions of this application use certain unmodified FFmpeg libraries under the LGPLv2.1 licensing.
    [Show full text]
  • Modified SHA1: a Hashing Solution to Secure Web Applications Through Login Authentication
    36 International Journal of Communication Networks and Information Security (IJCNIS) Vol. 11, No. 1, April 2019 Modified SHA1: A Hashing Solution to Secure Web Applications through Login Authentication Esmael V. Maliberan Graduate Studies, Surigao del Sur State University, Philippines Abstract: The modified SHA1 algorithm has been developed by attack against the SHA-1 hash function, generating two expanding its hash value up to 1280 bits from the original size of different PDF files. The research study conducted by [9] 160 bit. This was done by allocating 32 buffer registers for presented a specific freestart identical pair for SHA-1, i.e. a variables A, B, C and D at 5 bytes each. The expansion was done by collision within its compression function. This was the first generating 4 buffer registers in every round inside the compression appropriate break of the SHA-1, extending all 80 out of 80 function for 8 times. Findings revealed that the hash value of the steps. This attack was performed for only 10 days of modified algorithm was not cracked or hacked during the experiment and testing using powerful online cracking tool, brute computation on a 64-GPU. Thus, SHA1 algorithm is not force and rainbow table such as Cracking Station and Rainbow anymore safe in login authentication and data transfer. For Crack and bruteforcer which are available online thus improved its this reason, there were enhancements and modifications security level compared to the original SHA1. being developed in the algorithm in order to solve these issues [10, 11]. [12] proposed a new approach to enhance Keywords: SHA1, hashing, client-server communication, MD5 algorithm combined with SHA compression function modified SHA1, hacking, brute force, rainbow table that produced a 256-bit hash code.
    [Show full text]
  • Advanced Features for an Integrated Verification Environment
    Advanced Features for an Integrated Verification Environment Ruben Kälin [email protected] Master Thesis November 2016 https://bitbucket.org/viperproject/viper-ide/ Supervisor Arshavir Ter-Gabrielyan Abstract Currently, in software verification, the IDE support is insufficient, especially for symbolic exe- cution. Many verification technologies are being developed, but only few IDEs target software verification. For example, users of the Viper framework had only little assistance in writing, and no assistance in debugging their software so far. The common way of invoking the verifier is through the command line, as a sufficient IDE support has been missing. An IDE capable of handling more than one language is desirable, as there are many small verification languages. Without proper IDE support writing, verifying, and debugging software is cumbersome. Many of the tasks normally handled by an IDE need to be performed manually. A capable IDE so- lution could reduce the overhead of verifying software and thereby improve the programmer’s productivity. In this Master’s thesis, we built a cross-platform IDE for creating Viper programs. The IDE assists the user in the process of writing, verifying, and debugging Viper source code. This support ranges from automatically performing tasks at the right time to visualizing the symbolic states and counterexamples. We provide intuitive debugging support for traversing all states of symbolic execution and allow the user to visually compare states. The Viper IDE is based on Microsoft Visual Studio Code. We use the Viper toolchain as a verification engine. We provide a solution for symbolic execution, whereas the existing solutions focus on a different verification approach.
    [Show full text]
  • Java Sign File with Certificate
    Java Sign File With Certificate Micheil is artificially cryptographic after dastardly Dominic coagulate his euchology synergistically. How ghostlierunilluminated Jameson is Micah always when unyoke crunchy leastwise and unadmitted and feminising Curt keelhaul his Poznan. some Teague? Unsoaped and Gui tool vendor of jdk security manager keystore password as it goes, so large that need to its crypto system pops up to. Generate Keys The Java Tutorials Security Features in. When signing certificate signed by importing keys and sign software, clear your java. These certificates with java certificate file that there is. Javakey will stump the signed JAR file in the spoke directory. Once the certificate is in located in the browser export the certificate with the private key and include all footing the certificates and export all extended properties. Such certificate signing files as unsigned. This file with certificates stored into generating a project web browser! The policy file can omit that classes coming soon a room site be signed by a. Here the exception is java pem file key card you generate the CSR you sweat to. This all okay left the receiver already knows and trusts the sender. First road bike: mech disc brakes vs dual pivot sidepull brakes? That command puts a Certificate Signing Request into requestfile for the certificate know run the keyname alias. Making statements based on opinion; back them saying with references or personal experience. Check the signer information as short clear the global trust the private key which are registered users. The security properties file is called javasecurity and it resides in the security properties.
    [Show full text]
  • Network Edition Implementation Guide
    AccountEdge® Network Edition Implementation Guide Networking Basics Setting Up Your Network Starting FileConnect Working with Company Files Acclivity LLC Websit e: accountedge.com © Accli vity LLC 2009 © MYOB Technology Pty Ltd 2009 All rights reserved. Disclaimer Information supplied by the member companies of the MYOB group (whether in user d ocu men ta ti on a nd ot he r li ter atu re , vi de o or a ud io mat eri al , tr ai ni n g cou rs es , web s it es, ad vice given by staff, or provided by other means) is intended only to illustrate general principles, and may not be complete, accurate or free of error. As accounting standards, taxation requirements, legislation and the circumstances of individual businesses vary widely, this information cannot be considered authoritative and may not apply to your specific situation. You should obtain competent advice from a qualified accounting, taxation, information-technology or legal professional bef or e a ct ing on such informa tion. To the e xtent per mitte d by law, me mber companies of the MYOB group are not liable for any special, consequential, direct or indirect damages arising from loss of function, profits or data resulting from your application of such inform ation. In the event that any of the above lim it ations are found to be une nf or ce able , the MYOB member company's liability is limited to the return of any fees or monies paid for the p urch as e of th e pr od u ct or serv ice.
    [Show full text]
  • XML Schema Validation Instructions
    XML Schema Verification The integrity of the data the New Hampshire Retirement System (NHRS, the retirement system) receives from its employers is crucial to our ability to effectively administer retirement benefits. In order to assist in the monthly reporting process, NHRS makes available to participating employers an XML Schema Verification Application that allows an employer to test whether its employer reporting XML file is properly formatted (valid) before submitting it. The XML files you generate for employer reporting must be formatted to match the schema or they will be rejected. The XML Schema Verification Application is an automated and effective means to review the format of payroll system-generated XML files designed for employer reporting. The XML file verification process is only the first stage of a multi-level review of employer-submitted files. By validating a file before uploading it to the NHRS Data Reporting System (DRS), an employer can address issues with the file proactively, saving time in the process. This application will identify problems in the XML file such as: • Missing tags, (i.e. beginning and end tags for batches, phone numbers, etc.) • Missing fields, (i.e. fund or batch identification numbers) • Invalid values, (code values not matching the predefined list or values containing unrecognized characters) • Tags being out of order. Notes: (1) This application identifies formatting issues with the XML file, but does not examine the data for exceptions, which may be identified after a valid XML file is submitted to NHRS. (2) The application is used to validate XML files for active member reporting; it is not used for monthly reporting submitted by web entry or a text file and is not used for reporting of NHRS retiree information or Wage Correction.
    [Show full text]
  • Oracle® Fusion Middleware Publishing Reports to the Web with Oracle Reports Services 11G Release 1 (11.1.1) B32121-06
    Oracle® Fusion Middleware Publishing Reports to the Web with Oracle Reports Services 11g Release 1 (11.1.1) B32121-06 July 2013 Oracle Fusion Middleware Publishing Reports to the Web with Oracle Reports Services, 11g Release 1 (11.1.1) B32121-06 Copyright © 2003, 2013, Oracle and/or its affiliates. All rights reserved. Primary Author: Swati Thacker Contributing Author: Gururaj B S, Usha M P, and Ingrid Snedecor Contributors: Rajesh Ramachandran, Rajiv Malhotra, Ratheesh Pai, Vidya Viswanathan, Suma Shanthappa, Vikram Nanda, Pankaj Yadav, Balaravikumar Shanmugasundaram, Hariharan Srinivasan, Vinod Murthy, Nagesh Patange, Navneet Singh, Rohit Marwaha, Prabakara Reddy, Philipp Weckerle, Kumar Dhanagopal This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations.
    [Show full text]
  • Securing Remote Untrusted Storage
    SiRiUS: Securing Remote Untrusted Storage ¡ ¢ Eu-Jin Goh, Hovav Shacham, Nagendra Modadugu, Dan Boneh Stanford University £ eujin, hovav, nagendra, dabo ¤ @cs.stanford.edu Abstract remote server, they cannot install a security system that requires changing the remote file server. Similarly, orga- nizations who have invested in large NAS devices have no This paper presents SiRiUS, a secure file system de- control over the inner implementation of the device. These signed to be layered over insecure network and P2P file organizations can only add security mechanisms that do systems such as NFS, CIFS, OceanStore, and Yahoo! not require changing the NAS server. Hence, insisting on Briefcase. SiRiUS assumes the network storage is un- no changes to the file server enables us to enhance the se- trusted and provides its own read-write cryptographic ac- curity of legacy network file systems without changing the cess control for file level sharing. Key management and existing infrastructure. revocation is simple with minimal out-of-band communi- Second, we want a security mechanism that can be lay- cation. File system freshness guarantees are supported by ered on top of any network file system; NFS, CIFS, P2P, SiRiUS using hash tree constructions. SiRiUS contains a HTTP, etc. By insisting on no changes to the underly- novel method of performing file random access in a cryp- ing file systems, SiRiUS becomes agnostic of the network tographic file system without the use of a block server. Ex- storage system. The result is a uniform mechanism for tensions to SiRiUS include large scale group sharing us- securing many different types of network storage.
    [Show full text]