Single Sign-On Configuration for SAP (X)MII, SAP security note 1538719

SAP security note 1538719, "Single Sign-On Configuration for SAP (X)MII". Below are the symptom and SAP recommended solution.

Description

Symptom

Due to security settings in SAP NetWeaver (release 7.0 or CE 7.11), SAP MII users might need to provide credentials every time they open the MII workbench, test or execute JSP, IRPT, or HTML pages from within the MII workbench, or execute MII Query/Display Templates in a new browser window.

Solution

Single Sign-On (SSO) should be configured in the SAP NetWeaver AS Java environment to avoid entering credentials. Both SAP NetWeaver AS Java and MII support SPNego (Kerberos) and X.509 certificate-based authentication.

SPNego (Kerberos) SSO: install the SPNego add-on required for NW CE 7.11 as described in SAP Note 1457499. On the client, configure the browser to trust the SAP MII system: in Internet Explorer, add the MII URL to the Local Intranet zone and enable Integrated Windows Authentication; in Firefox, add the trusted and delegation domains under network.negotiate-auth.trusted-uris and network.negotiate-auth.delegation-uris in about:config.

X.509 certificate-based SSO: NetWeaver AS Java must be configured to support SSL with the necessary certificates, and the root certificates of the client certificates' Certification Authorities must be available in the AS Java Key Storage. Import the root certificates into the relevant ICM_SSL_<instance_ID> keystore view, set the VCLIENT profile parameter of ICM to request or require client certificates, configure the ClientCertLoginModule to establish the AS Java user ID from the certificate, and adjust the login module stacks for applications that accept client certificate authentication.

Reason and prerequisites

The SAP NetWeaver SessionIDRegenerationEnabled parameter has been activated.

References

• SAP Note 1537813 – MII 12.1 SP08
• SAP Note 1457499 – SPNego Add-on
• SAP Note 1310561 – SAP J2EE Engine Session Fixation Protection