Safeguard Authentication Services 5.1.1 - SSO for SAP Integration Guide

Introducing Safeguard Authentication Services Single Sign-on for SAP

SAP Secure Network Communications Client requirements Functional description Summary

Unix installation and join Unix configuration Windows installation Windows SAP GUI configuration Configure an SAP account for SSO/SNC

SAP server configuration

Supported platforms Creating and using a service account for the SAP service Enabling SNC on the SAP server Configuring a SAP user to enable SNC authentication Installing Safeguard Authentication Services Single Sign-on for SAP Deploying Single Sign-on for SAP through Group Policy

Creating the license CAB file Silent install

Configuring the SAP GUI client on Windows XP Configuring the SAP GUI client on Windows Vista and above Prompting for user name and password

Enabling authentication prompts

Configuring SAPlpd on the front-end system Configuring SAPlpd on the SAP server Testing the printer connection

Creating the license CAB file

SAP server configuration > Deploying Single Sign-on for SAP through Group Policy > Creating the license CAB file

To create the license CAB file

Locate your license file and rename it to:
Quest-QAS-GSSAPI-for-SAP.asc
Run the following command:
```
makecab.exe Quest-QAS-GSSAPI-for-SAP.asc license.cab
```
Note: You may need to download makecab.exe if it is not available on your system.

This creates a file called license.cab.
Copy license.cab to the directory containing the qas-sso-for-sap-<version>.msi and qas-sso-for-sap.mst files.

Silent install

SAP server configuration > Deploying Single Sign-on for SAP through Group Policy > Silent install

To deploy Single Sign-on for SAP through Group Policy silently

Open a command prompt window, navigate to the directory containing the qas-sso-for-sap-<version>.msi, qas-sso-for-sap.mst and license.cab files.

Run the following command:

msiexec /i "qas-sso-for-sap-<version>.msi" TRANSFORMS="qas-sso-for-sap.mst" /qb

Configuring the SAP GUI client on Windows XP

SAP server configuration > Configuring the SAP GUI client on Windows XP

To configure the SAP GUI client on Windows XP

Verify that the environment variable SNC_LIB contains the path to qgsskrb5.dll.

The library is located in the folder where you installed Single Sign-on for SAP.
Run the SAPlogin application.
Select a server connection and click Change Item to open the properties.
The SAP GUI client should already be installed and configured for normal password-based authentication.
Click the Advanced button to open the Advanced Options.
Select Enable Secure Network Communication to enable SNC.
In the SNC Name field, enter the KPN of the SAP Server. For example, enter:
```
p:sAMAccountName@realm
```
This is the same KPN that was used for the SAP instance profile key snc/identity/as described in Enabling SNC on the SAP server.
Select the Max. Available option to enable single sign-on as well as data integrity and encryption for all of the traffic between the SAP GUI client and the R3 server.
Click OK to save these settings.
You can now click the server name in SAPlogon to log onto the server without being prompted for a user name or password.

Once you have configured the server connection to use SNC, it is now possible to create desktop shortcuts using SAPlogon. Shortcuts normally require a password to either be included with the shortcut (not recommended) or else the user is prompted for a password when the shortcut is activated. With SNC activated, however, it is only necessary to enter an arbitrary shortcut (a single letter will do) in the password field of the shortcut. This shortcut is not actually used for authentication, as the SAP system attempts authentication using GSSAPI first.

The use of SNC and shortcuts allows SAP administrators to create desktop icons for users that will launch them directly into specific SAP applications, securely authenticating without the use of passwords.

Configuring the SAP GUI client on Windows Vista and above

SAP server configuration > Configuring the SAP GUI client on Windows Vista and above

To configure the SAP GUI client on Windows Vista

Open SAP GUI Logon 7.10 and click New Item.
On the Create New System Entry screen, select User Specified System and click Next.
Ensure Connection Type is Custom Application Server.

Enter the appropriate information in Application Server, System Number, and System ID and click Next.
Select the Activate Secure Network Communication option and enter the Kerberos Principal Name (KPN) of the SAP Server and click Next.
For example, enter:
```
p:sAMAccountName@realm
```
Use the same KPN that you used for the SAP instance profile key snc/identity/ as described in Enabling SNC on the SAP server.
Leave the defaults on this screen and click Finish.

The new item you created will now appear on the SAP GUI log on.
Click Logon and log in as a user who is set up to use SNC.