Accepting Logon Tickets Issued by another AS ABAP

Use this procedure to configure the AS ABAP to accept a logon ticket issued by another AS ABAP system in your landscape.

Prerequisites

The issuing server must possess a public and private key pair and a public-key certificate. For the AS ABAP, this information must be available in the issuing server's SSO PSE.
If the accepting system is an SAP system <= Release 4.6D, then the system must have the Workplace Plug-In installed and must meet the following release requirements:
- Release 4.6x: 4.6D kernel as of Support Package level 74
- Release 4.5x: 4.5B kernel as of Support Package level 459
- Release 4.0x: 4.0B kernel as of Support Package level 758
The SAP Security Library (or the SAP Cryptographic Library) must be installed on all of the accepting system's application servers.
You can obtain the most recent version of the SAP Security Library from SAP Service Marketplace in the SAP Support Portal Software Downloads Support Packages and Patches Entry by Application Group Additional Components SAPSECULIB .

Note

If you are using functions that require encryption (for example, the Secure Sockets Layer protocol), then you can replace the SP Security Library with the SAP Cryptographic Library, which is also available on SAP Service Marketplace under SAP Cryptographic Software. The delivery of this library is subject to German export regulations and is not available to all customers. For more information, see Configuring the AS ABAP for Supporting SSL.

End of the note.

Procedure

Configure the required parameters on all the logon ticket accepting AS ABAP systems.

Set the profile parameter login/accept_sso2_ticket = 1.

Note

Set login/create_sso2_ticket = 0 for a scenario where the ticket accepting AS ABAP should also be able to issue tickets. (Use DEFAULT.PFL.)

End of the note.
For Releases 4.0 and 4.5, also set the profile parameter SAPSECULIB to the location (path and file name) of the SAP Security Library (or SAP Cryptographic Library).

For each of the accepting AS ABAP systems

Execute the SSO administration wizard (transaction SSO2).
The SSO2 Administration screen appears.
Enter the RFC destination or the <host name> and <system number> for the issuing server in the appropriate fields.
Note

Note the following:
- You must specify the destination host for the issuing server's logical system, namely, the system ID and client.
- If you do not enter a destination host on the SSO2 Administration screen, then the status for the local system is displayed.
- If you enter the <host name> and <system number>, the system automatically creates a corresponding RFC destination to use for the connection.
End of the note.
The SSO administration report for the designated server is displayed. The following information is shown:
- Profile parameter values on both the issuing server and on the accepting system's application server.
- The accepting system's SSO access control list.
- The accepting system's certificate list.
Red traffic lights in any of these areas indicate configurations that are not operational for using logon tickets.
If the report indicates errors on the issuing server (for example, profile parameters are not set correctly), correct these errors on the issuing server and re-execute the SSO administration wizard on the accepting system.
To initiate the configuration steps on the accepting system, choose Edit Activate ().
The following occurs:
- The SSO administration wizard enters the issuing server's system ID and client in the accepting system's access control list.
- If the issuing server's public-key certificate is a self-signed certificate, then the SSO administration wizard enters the public-key information contained in the certificate in the accepting system's certificate list.
- The SSO administration wizard makes the SSO PSE available to the accepting system's application servers:
  - In Releases >= 4.6C, the SSO administration wizard distributes the SSO PSE to all of the system's application servers.
  - In Releases < 4.6C, it stores the SSO PSE in the directory specified by the profile parameter DIR_PROFILE.
    
    Note
    
    If the DIR_PROFILE directory is not globally accessible to all of the application servers in the accepting system, then you have to manually copy the SSO PSE to each application server's DIR_PROFILE directory.
    
    End of the note.
All changes take place immediately and you do not have to explicitly save any data.
If any of the areas indicate errors, correct these errors and re-execute the SSO administration wizard.

Note

You can also add or delete entries from the access control list or certificate list by placing the cursor on the appropriate line and choosing Edit <function> .

End of the note.
Example
For example:
- To add the issuing server's system ID and client to the SSO access control list, place the cursor on the line SAP System <Issuing_Server_SID> Client <client> and choose Edit Enter ACL .
- To delete an entry from the certificate list, place the cursor on the system ID and choose Edit Delete from certificate list .
- To add the SAP CA certificate to the certificate list, choose Edit Add SAP CA.
End of the example.

Note Note

You can also manually change the access control list (table TWPSSO2ACL) using the table maintenance transactions (for example, SM30).

You can also manually change the certificate list using the PSE maintenance transaction (PSEMAINT) or the trust manager (transaction STRUST or STRUSTSSO2).

The PSE maintenance transaction PSEMAINT is available for SAP systems <= Release 4.6D and the trust manager is available with the SAP Web Application Server ABAP.

End of the note.

Result

The accepting systems are able to accept logon tickets and verify the issuing server's digital signature when they receive a logon ticket from a user.

Note Note

You may execute the SSO administration wizard at any time and as often as you wish.

End of the note.