Entering content frame

Process documentation Authentication Using an LDAP Bind to a Directory Server Locate the document in its SAP Library structure

Purpose

With this PAS option, the user is authenticated using an LDAP bind to a directory server. The PAS verifies the LDAP bind and then issues the user a logon ticket for access to further SAP services. Note that in this case, you can alternatively store the user’s ID to use for the logon ticket in the directory server instead of using the user external ID mapping table in the SAP system.

Prerequisites

For the prerequisites for using an LDAP bind for PAS, see the following topics:

Process Flow

See the graphic below:

Using an LDAP Bind to a Directory Server for Authentication

This graphic is explained in the accompanying text

The process is as follows:

  1. The user accesses the PAS service for using the LDAP bind (for example, sapldap).
  2. The user provides his or her user ID and password for the directory server.
  3. The PAS attempts an LDAP bind on the directory server using the user's ID and password.
  4. If the LDAP bind was successful, then:
    1. If the user’s ID for the SAP system is stored in the directory, then the PAS passes this ID to the SAP system application server.
    2. Otherwise, it passes the user’s ID for the directory server to the SAP system application server. The SAP system then searches for a matching user ID in the user external ID mapping table.
  5. The PAS then creates a logon ticket for the user, which it sets in the user's Web browser.
  6. The PAS redirects the user to the designated service (for example, myservice).

Result

The user accesses the SAP service after authenticating him or herself using an LDAP bind on the directory server.

When the user accesses further SAP services, the logon ticket is used for Single Sign-On access.

 

 

 

 Leaving content frame