By default, Single Sign-on for SAP performs automatic authentication using the credentials of the currently logged-in Windows user. In some situations, you might want users to provide an Active Directory user name and password when logging in to SAP. You can configure Single Sign-on for SAP to display a login prompt whenever a new authentication request is generated.
When you enable authentication prompting, users see an authentication dialog where they must enter an Active Directory user name and password in order to gain access to SAP. The user name can be in any one of these formats:
To enable Active Directory authentication prompting from the Single Sign-on for SAP module
On 32-bit machines:
HKEY_LOCAL_MACHINE\Software\Quest Software\SSO for SAP\Always Prompt
On 64-bit machines:
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Quest Software\SSO for SAP\Always Prompt
To use SAPlpd with SNC, you must provide the SAPlpd system on the front-end desktop with the local library path and identity information.
To configure SAPlpd on the front-end system
[snc] enable=1 identity/lpd=<SNC-Name_of_saplpd> gssapi_lib=<drive>:\path\to\your\snclib.dll
Note: You can omit the gssapi_lib= entry when you have the environment variable, SNC_LIB, configured to be a system environment variable.
The identity/lpd variable, <SNC-Name_of_saplpd>, is in the SNC form of the user logged in and running SAPlpd. You must use this format: u:samaccountname@realm where sAMAccountName is the SAM-Account-Name of the currently logged in user and example.com is the Active Directory domain name.
Note: You can also add these settings to the WIN.INI file if you do not want to create the SAPLPD.INI file.
A window appears listing the output from the SAPlpd startup:
The following dialog opens:
This is the value of the snc/identity/as key from the instance profile on the Authentication Services-enabled SAP Server. (See Enabling SNC on the SAP server.)
Your front-end desktop is now configured to securely connect.
To configure SAPlpd on the SAP server
You can apply these same settings to an existing device.
To populate the Spool Server box, click F4 or , the folder icon next to the Spool Server box, to list all the application servers with a color-coded background. The application servers running a spool process are highlighted in green.
This is the Active Directory user who will be logged in when using this instance of SAPlpd.