Secure Login for SAP Single Sign-On Implementation Guide

1 PUBLICSAP Single Sign-On SP02 Document Version: 2020-03-17 Secure Login for SAP Single Sign-On Implementation Guide 2020 SAP SE or an SAP affiliate company. All rights BEST RUN Content1 Introduction to Secure System Cryptographic Library for SAP Single Clients for Methods of Secure Login Methods of Secure Login Web System Overview with Secure Login PKI PKI Login Secure Policy Server Digital Signing with Secure Store and Forward (SSF).. Authentication Basic Environment Using Secure Login Methods without Secure Login with Certificate without Secure Login with Kerberos Token without Secure Login Environment Using Secure Login Client and Secure Login Methods with Secure Login with Certificate Request Using Secure Login SNC SNC Parameters for Certificates Using the Trust SNC Kerberos Windows Account for SAP a Microsoft Windows Advanced Logging on with Secure Login Client Using Secure Login Client to Smartly Select an SNC out General Availablility of SNC-Encrypted Switching to Encryption Only for Logging on Using Configuration Options in the Secure Login Providing Certificates to Secure Login Client Using JavaScript Web Login for SAP Single Sign-On Implementation GuideContentElements Required in Secure Login Client for JavaScript Web

2 Required in Secure Login Server for JavaScript Web JavaScript Web Client to Multiple SAP GUI JavaScript Web Client to Multiple Portal the Secure Login Client for JavaScript Web the Secure Login Server for JavaScript Web Using a Remote Certification Authority in Secure for Using a Remote Certification Authority ..46 Configuring a Remote Certification Authority for Secure Remote Certification Authority Certificate Using the Secure Login Server to Provide Trusted Certification Information for Trusted Certification Authorities Provided by the Secure Login Certificate Lifecycle Management Using the Secure Login sapslscli Command Line Browser-Based Enrollment of Secure Login Client Using a Secure Login Server Methods for Profile Code Example with Secure Login Server Profile and SNC Using Secure Login Client as SSH the Use of Secure Login SSH Digital Client Signature (SSF).

3 64 How to Test SSF Client User Configuration in SAP Signature Using Microsoft Active Directory and Kerberos with Certificates and Authentication with Kerberos and on SAP NetWeaver AS Kerberos Authentication for HTML-Based User Interfaces Using AS ABAP with Landscape for Kerberos Authentication on AS the AS ABAP Profile a Service a SPNego on AS Configuring Secure Login Web Client Connections to SAP with Redirect to SAP GUI Connection with Secure Login Web SAP GUI Connection with Secure Login Web Client (Using the Message Server)..83 Launch SAP Logon Using Secure Login Client in Web Adapter Web Adapter Mode for Secure Login Login for SAP Single Sign-On Implementation Using Secure Login Server for SAML SAML Authentication in the Secure Login Certificate Lifecycle Management in the AS ABAP Using Secure Login Infrastructure Involved in Certificate Renewal Using Secure Login for Certificate Renewal Using Secure Login Certificate Lifecycle Management in the AS ABAP Using Secure Login a Certificate Renewal at Regular Certificate Lifecycle Management in the AS Java Using Secure Login Involved In Certificate Renewal Using Secure Login for Certificate Renewal Using Secure Login Certificate Lifecycle Management in the AS Java Using Secure Login Certificates at Regular Intervals for AS Java Issuing Certificates for iOS an Authentication Profile for iOS

4 Kerberos Authentication with Kerberos Authentication with SPNego for Secure Login Kerberos Authentication with SPNego for Secure Login Web SPNego on SAP NetWeaver LDAP User LDAP Server CAs or Certificates into the SAP NetWeaver Key Deleting a User Authentication against SAP Netweaver Application Server for a Destination with an RFC Destination RADIUS User a Customer-Specific Server Message Identification Using RFID Aspects of RFID Concept of RFID Identification for RFID Identification in the Kiosk Identification with RFID Secure Login Secure Login Client Installation with SAPS etup Installation Uninstalling Secure Login Secure Login Client with Microsoft Windows Control Secure Login Client with Secure Login Client with a Command Line Updating the Secure Login Client to the Support Adding Root Certificates during 1: Installing Root CA Certificates on a Windows Login for SAP Single Sign-On Implementation GuideContentOption 2: Distributing Root CA Certificates on Microsoft Domain 3.

5 Distribute Secure Login Server Root CA Certificates Using Microsoft Group Downloading Policies to the Secure Login Policies to Secure Login Client Using Profile Policies to Secure Login Client Using the Policy Download a Profile Group of Authentication Getting User-Specific Profiles for Certificate User-Specific Profile Download in Secure Login User-Specific Profile Groups to the Secure Login Configuration SNC in SAP of Registry Configuration Using the Proxy Configuration of Microsoft Internet Explorer for Secure Login Secure Login Client Profiles for Kerberos and Microsoft Cryptography API Card Secure Login the Display of LDAP Messages in Secure Login Business Client with Secure Login Secure Login Client for Citrix Login Client with a Published Login Client with a Published SAP Features of Secure Login Secure Login Client for Secure Login Client on a Mac Secure Login Client from a Mac Secure Login Client on a Mac Secure Login Installation and Installation File for Installing Secure Login Servers Supported by Secure Login Login Server Installation with Software Update Login Server Installation with Login Server Initial Configuration for Running the Initial Configuration the Secure Login Administration Login for SAP Single Sign-On Implementation GuideContentPUBLIC5 Changing and Starting Secure Login Server with and Starting Secure Login Server Using SAP Management Secure Login Web SAP GUI to Use Credentials with Secure Login Web Features of Secure Login Web Login Security Device for Mozilla Secure Login Web of Login Modules Supported by SAP Single a Policy an Authentication Profile Pointing to a Policy the

6 Enrollment URL for Secure Login Actions at Policy of User Certificate Destinations ..214 Archiving Certificate Requests, Issued Certificates, and User Certification External User Certification Certificate Secure the Availability of Secure Login Server Configuration Authentication Server into Existing Availability and Failover for Secure Login Server and Secure Login Secure Login Installing Additional Features for Secure SAP Cryptographic SAP Cryptographic Library for Secure Features of SAP Cryptographic Downloading the Installation Standard and FIPS 140-2 Certified Crypto Kernel of the SAP Cryptographic the FIPS 140-2 Certified Secure Login Crypto Configuration for the AS the Single Sign-On Wizard to Configure SNC and Signatures (SSF) with a Hardware Security Configuring the SAP Cryptographic Login for SAP Single Sign-On Implementation GuideContentEnabling Configuration of the SAP Cryptographic Library Using AS ABAP Profile Profile Parameters for the SAP Cryptographic Enabling Certificate Using Certificate Revocation CRLs with the CRL a CRL from a CRL Distribution Configuration Tracing for the Cryptographic Parameter Parameter Overview for Secure Login Configuration Parameters for Digital Parameter Overview for Secure Login for Initial Configuration (PKI Certificates).

7 270 Parameters for Signing Certificate Login Client Policy and for the Policy for User Authentication in the Authentication for Certificate Configuration in the Authentication for Destination Management for Certificate Renewal Using Secure Login Parameter Overview for the SAP Cryptographic Parameters for the SAP Cryptographic for Certificate Revocation Troubleshooting Secure Login in Name Not Security SNC Library Display of Password Expiration Error Codes in the Secure Login Troubleshooting SAP Cryptographic Library Not Not Credentials Found at Start of Application Server User Exists with SNC the SAP Cryptographic Occurred with Login for SAP Single Sign-On Implementation GuideContentPUBLIC7 SNC Error Troubleshooting Secure Login Login Web Client Authentication Warnings in Secure Login Web Codes of SAP Stacktrace User Authentication Fully Qualified Distinguished Name in Enrollment and Login Server SNC Login Authentication Profile Lock and Server Secure Login and Tracing Secure Login Server with the Log Viewer of SAP NetWeaver List of Secure Login Security Before You Component FIPS 140-2 Crypto Secure Login Procedures and Settings for Secure Login Procedures for Secure Login Procedures and Settings for Secure Login Security Considerations for Secure Login Secure Login Procedures and Settings for Secure Login Procedures and Settings for Secure Login Procedures and Settings for Secure Login Security Considerations for Secure Login Login Web SAP Cryptographic Procedures and Settings for the SAP Cryptographic Procedures for the SAP Cryptographic Procedures and Settings for the SAP Cryptographic Security

8 Considerations for the SAP Cryptographic Microsoft Windows Server Domain Microsoft Windows Server Active LDAP Directory Login for SAP Single Sign-On Implementation RSA Authentication Login for SAP Single Sign-On Implementation GuideContentPUBLIC91 Introduction to Secure LoginSecure Login is an innovative software solution specifically created for improving user and IT productivity and for protecting business-critical data in SAP business solutions by means of Secure Single Sign-On to the SAP Login provides strong encryption, Secure communication, and Single Sign-On between a wide variety of SAP components. For more information, see the central SAP Note 2300234. SAP GUI and SAP Single Sign-On with Secure Network Communications (SNC) HTML-based user interfaces and SAP Single Sign-On with Secure Socket Layer SSL (HTTPS) Third-party application servers supporting Kerberos and certificatesIn a default SAP setup, users enter their SAP user name and password on the SAP GUI logon screen.

9 SAP user names and passwords are transferred through the network without Secure networks, SAP provides a Secure Network Communications interface (SNC) that enables users to log on to SAP systems without entering a user name or password. The SNC interface can also direct calls through the SAP Cryptographic Library to encrypt all communication between SAP GUI and the SAP server, thus providing Secure Single Sign-On to Login allows you to benefit from the advantages of SNC without being obliged to set up a public-key infrastructure (PKI). Secure Login allows users to authenticate with one of the following authentication mechanisms: Windows Domain (Active Directory Server) RADIUS server LDAP server SAP Single Sign-On Smart card authentication RFID identificationIf a PKI has already been set up, the digital user certificates of the PKI can also be used by Secure Login also provides Single Sign-On for Web browser access to the SAP Single Sign-On (and other HTTPS-enabled Web applications) with Login for SAP Single Sign-On Implementation GuideIntroduction to Secure Login2 System OverviewSecure Login consists of several components.

10 Secure Login Client, Secure Login Server, and Secure Login Login is a client/server software system integrated with SAP software to facilitate Single Sign-On , alternative user authentication, and enhanced security for distributed SAP Secure Login solution includes several components: Secure Login ClientClient application that provides security tokens (Kerberos and technology) for a variety of applications. You can optionally run the Secure Login Client as an SSH agent. It uses the functions of the SAP Cryptographic Library, which is the default cryptographic library of the Application Server ABAP (see the related link). For more information on the SAP Cryptographic Library, see SAP Note 1848999. The SAP Cryptographic Library supports both and Kerberos technology. Secure Login ServerCentral service that provides certificates (out-of-the-box PKI) to users and application servers.