Configuring SAP Web AS ABAP to Accept Logon Tickets from Another SAP Web AS ABAP 

Prerequisites

●      The issuing server must possess a public and private key pair and a public-key certificate. For the SAP Web AS ABAP, then this information needs to be available in the issuing server’s SSO PSE.

●      If the accepting system is an SAP Systems <= Release 4.6D, then the system must have the Workplace PlugIn installed and must meet the following release requirements:

○       Release 4.6x: 4.6D kernel as of Support Package level 74

○       Release 4.5x: 4.5B kernel as of Support Package level 459

○       Release 4.0x: 4.0B kernel as of Support Package level 758

●      The SAP Security Library (or the SAP Cryptographic Library) must be installed on all of the accepting system's application servers.

You can obtain the most recent version of the SAP Security Library from the SAP Service Marketplace at service.sap.com/download under Download → Support Packages and Patches  → Entry by Application Group → Additional Components → SAPSECULIB.

If you are using functions that require encryption (for example, the Secure Sockets Layer protocol), then you can replace the SAP Security Library with the SAP Cryptographic Library, which is also available on the SAP Service Marketplace at service.sap.com/download under SAP Cryptographic Software. Note however, the delivery of this library underlies German export regulations and is not available to all customers. For more information, see Configuring the AS ABAP for Supporting SSL.

Procedure

On all of the accepting system's application servers

...

       1.      Set the profile parameter login/accept_sso2_ticket = 1. Set login/create_sso2_ticket = 0 unless the server should also be able to issue tickets. (Use DEFAULT.PFL.)

       2.      For Releases 4.0 and 4.5, also set the profile parameter SAPSECULIB to the location (path and file name) of the SAP Security Library (or SAP Cryptographic Library).

On one of the accepting system's application servers

...

       1.      Execute the SSO administration wizard (transaction SSO2).

The SSO2 Administration screen appears.

       2.      Enter the RFC destination or the <host name> and <system number> for the issuing server in the appropriate fields.

Note the following:

●        You must specify the destination host for the issuing server's logical system, namely, the system ID and client.

●        If you do not enter a destination host in the SSO2 Administration screen, then the status for the local system is displayed.

●        If you enter the <host name> and <system number>, the system automatically creates a corresponding RFC destination to use for the connection.

The SSO administration report for the designated server is displayed. The following information is shown:

○       Profile parameter values on both the issuing server and on the accepting system’s application server.

○       The accepting system’s SSO access control list.

○       The accepting system’s certificate list.

Red traffic lights in any of these areas indicate configurations that are not operational for using logon tickets.

       3.      If the report indicates errors on the issuing server (for example, profile parameters are not set correctly), correct these errors on the issuing server and re-execute the SSO administration wizard on the accepting system.

       4.      To initiate the configuration steps on the accepting system, choose Edit → Activate ().

The following occurs:

○       The SSO administration wizard enters the issuing server’s system ID and client in the accepting system’s access control list.

○       If the issuing server’s public-key certificate is a self-signed certificate, then the SSO administration wizard enters the public-key information contained in the certificate in the accepting system’s certificate list.

○       The SSO administration wizard makes the SSO PSE available to the accepting system’s application servers:

■       In Releases >= 4.6C, the SSO administration wizard distributes the SSO PSE to all of the system’s application servers.

■       In Releases < 4.6C, it stores the SSO PSE in the directory specified by the profile parameter DIR_PROFILE.

If the DIR_PROFILE directory is not globally accessible to all of the application servers in the accepting system, then you have to manually copy the SSO PSE to each application server’s DIR_PROFILE directory.

All changes take place immediately and you do not have to explicitly save any data.

       5.      If any of the areas indicate errors, correct these errors and re-execute the SSO administration wizard.

You can also add or delete entries from the access control list or certificate list by placing the cursor on the appropriate line and choosing Edit → <function>.

For example:

●        To add the issuing server's system ID and client to the SSO access control list, place the cursor on the line SAP System <Issuing_Server_SID> Client <client> and choose Edit → Enter ACL.

●        To delete an entry from the certificate list, place the cursor on the system ID and choose Edit → Delete from certificate list.

●        To add the SAP CA certificate to the certificate list, choose Edit → Add SAP CA.

You can also manually change the access control list (table TWPSSO2ACL) using the table maintenance transactions (for example, SM30).

You can also manually change the certificate list using the PSE maintenance transaction (PSEMAINT) or the trust manager (transaction STRUST or STRUSTSSO2).

The PSE maintenance transaction PSEMAINT is available for SAP Systems <= Release 4.6D and the trust manager is available with the SAP Web Application Server ABAP.

Result

The accepting systems are able to accept logon tickets and verify the issuing server’s digital signature when they receive an logon ticket from a user.

You may execute the SSO administration wizard at any time and as often as you wish.