Testing the Configuration Using the ITS Administration Tool (SAP Library - Pluggable Authentication Services for External Authentication)

Testing the Configuration Using the ITS Administration Tool

Use

You can use the ITS Administration tool to test the PAS configuration if you use the SAP Cryptographic Library as the security product for SNC. See the procedures below.

Prerequisites

The SAP Cryptographic Library has been installed and SNC has been configured on both the ticket-issuing system’s AGate and application server. If you use SNC for the connection between the WGate and the AGate, then SNC has been also been configured on the system’s WGate.

The system has been configured for issuing logon tickets.

The system has been configured for using the PAS external authentication mechanism.

Procedure

Testing the Use of SNC for the Connection Between the AGate and the Application Server

The first test is to test the use of SNC for the connection between the AGate and the application server.

Using the ITS Administration tool:

Choose <server> à Security à SAPCRYPTO Admin.

The SNC administration page appears. If SNC is configured correctly, then the lights are green and the AGate’s SNC connection information appears in the various fields. If any lights are red, then correct the SNC configuration before continuing with the test.

Choose SNC Connection Maintenance.

The SNC Connection Maintenance screen appears.

Under SNC Connection Maintenance, either enter the load balancing group or the application server’s host name and system number in the corresponding fields.

Under SAP SNC Test, enter your user ID and password for the SAP system and the SAP system’s client in the corresponding fields.

Activate the option Get ticket.

Choose Login.

The connection is tested. If successful, then SNC works for the connection and you received a logon ticket. Otherwise, you receive an error message. See SAP Note 320991 for a list of possible errors and the corresponding return codes.

Testing the Use of PAS for Logon

Test if the user can use his or her external ID for logon. This test is not necessary if the external authentication mechanism provides the SAP user ID directly.

Note

This test only makes sure that the user mapping is maintained correctly in the mapping table USREXTID.

Under SAP Extid Login Test (Used for PAS):, enter your user ID for the external authentication mechanism, the type, and the SAP system client in the corresponding fields.
Choose Login.

This test makes sure that the user mapping is maintained correctly in the mapping table USREXTID. See SAP Note 320991 for a list of possible errors and the corresponding return codes.

Result

The use of logon tickets and PAS are configured correctly on the AGate and the ticket-issuing application server. SNC is also configured correctly between the AGate and the application server.

If you use SNC between the WGate and the AGate, then see Testing the Use of SNC.