Single Sign-On with Logon Tickets

Purpose

Logon tickets represent the user credentials. The portal server issues a logon ticket to a user after successful initial authentication. The logon ticket itself is stored as a cookie on the client and is sent with each request of that client. It can then be used by external applications such as SAP systems to authenticate the portal user to those external applications without any further user logons being required.

Logon tickets contain information about the authenticated user. They do not contain any passwords. Specifically, logon tickets contain the following items:

· Portal user ID and one mapped user ID for external applications

· Authentication scheme

· Validity period

· Information identifying the issuing system

· Digital signature

When using logon tickets, one system must be the ticket-issuing system. This can either be the portal or another system. We recommend using the portal as the ticket-issuing system, since the portal should be a user’s single point of access to all applications.

Technically, Single Sign-On (SSO) with logon tickets works as follows:

If the portal is the ticket-issuing system:

...

1. The first time the portal server starts, it generates a cryptographic key pair. The private part of this key is used for ticket generation (for the digital signature).

2. Once the user has been successfully authenticated in the portal, the underlying SAP NetWeaver Application Server (AS) of the portal issues a logon ticket to the user. This logon ticket is stored as a nonpersistent cookie in the browser on the client.

3. Each time the user tries to access an external system from the portal, the portal sends the logon ticket with the request to the external system.

4. The external system checks that the logon ticket is valid by verifying the digital signature of the portal server. It uses the public key contained in the digital certificate of the portal server to verify this.

5. If the logon ticket is valid, the external system extracts the user ID for that system from the logon ticket.

6. The user is logged on to the external system without having to enter his or her user ID and password.

If another system is the ticket-issuing system:

...

1. The Web browser sends the user's logon ticket with the access request.

2. The underlying AS of the portal verifies the information contained in the ticket.

3. If the ticket is valid and has been issued by a trusted server, then the user is granted SSO access to the portal.

The portal AS issues a logon ticket for the Internet domain or a subdomain of the portal only.

Process Flow

To allow SSO using logon tickets between the portal and its component systems you perform the following steps:

...

...

1. Configure the portal server to allow SSO with logon tickets. See Configuring Portal Server for SSO with Logon Tickets.

2. Configure the component systems to accept and verify logon tickets. See Configuring Component Systems for SSO with Logon Tickets.

Single Sign-On with User ID and Password

Purpose

The Single Sign-On (SSO) mechanism with user name and password provides an alternative for applications that cannot accept and verify logon tickets. With this SSO mechanism the portal server uses user mapping information provided by users or administrators to give the portal user access to external systems. The portal components connect to the external system with the user’s credentials.

Since the system sends the user's logon ID and password across the network, use a secure protocol such as Secure Sockets Layer (SSL) for sending data.

Process Flow

There are different procedures depending on the requirements.

Single Sign-On to SAP Systems

You can access SAP Systems that do not support logon tickets with SSO with user ID and password. These are SAP Systems with release 3.1I. For more information, see Configuring SSO with User ID and Password to SAP Systems.

Single Sign-On to non-SAP Systems with a Java iView Developed Specifically for the Customer

The system must exist in the system landscape. For more information, see Creating Systems.

The administrator or user must map user data to user data in the system. For more information, see User Mapping.

The iView through which the user tries to access the system must be programmed to get the mapped user data from the data repository and write the user credentials (user ID and password) in a header field of the request. The system can then log on the user with these credentials. This can be done using the Java APIs provided with SAP NetWeaver Portal.

EasyDMS and Single Sign On (SSO)

Use

Some customer just want to turn off the logon screen for EasyDMS and use the Single Sign On function like for the SAPGUI.

Solution

Single sign on (SSO) feature can be enabled for Automatic logon in EasyDMS if single sign on feature is enabled and is properly functional in SAP GUI.

Steps:

1. Make sure that Single sign on is configured and is properly functional in SAP GUI.( Hint: "Activate Secure network Communication" should be checked for the system )
2. Select/Enter the system, client and user name in EasyDMS and Login (keep the password blank as now we are using SSO).You will be able to successfully login.
3. If you do not want the login screen displayed again next time when you log in select "Logon Automatically Next Time" check box.
4. At any point you need to get the login screen again (e.g. To login to another system) press SHIFT + CTRL while login to EasyDMS. Else, after login you can uncheck Menu->Preferences->System(Tab)->Logon to SAP Automatically.