SSO integration via ITS using PAS, SAP security note 493107

SAP security note 493107, "SSO integration via ITS using PAS", is a note. Below are the SAP recommended solution and the affected software components.

Description

Solution

SAP Note 493107 outlines the integration of Single Sign-On (SSO) via the Internet Transaction Server (ITS) using the Pluggable Authentication Service (PAS). This integration facilitates seamless authentication across SAP systems, enhancing security and user experience.

PAS supports various external authentication methods when integrated with ITS:

• X509: utilizes X.509 client certificates for issuing logon tickets. More information can be found in Note 350776.
• NTLM: NT Lan Manager authentication through Microsoft IIS. Refer to Note 510916 for common errors and solutions.
• NTPassword: explicit NT domain authentication verified by an NT domain controller. Detailed in Note 497532.
• LDAP: authentication via LDAP-enabled directory services. Configuration details are available in Note 509237.
• DLL: authentication handled by external libraries loaded by PAS. Refer to Note 535538 for implementation guidance.
• HTTP: authentication using HTTP header variables. Setup instructions are provided in Note 494984.

Reason and prerequisites

To implement SSO with PAS and ITS, ensure the following prerequisites are met:

• SSO2 Logon Tickets: at least one SAP system must be capable of issuing SSO2 logon tickets, and other systems must be configured to accept them. Refer to Note 177895 for more details.
• Secure Network Communication (SNC): the issuing SAP system must be configured for SNC. See Note 66687 for configuration guidelines.
• SNC Secure Connection: establish an SNC secure connection between the SAP system issuing the ticket and the AGate of the ITS. For dual host installations, ensure SNC connections between WGate and AGate as recommended in Note 389810.
• Browser Support: user browsers must support session cookies, specifically the 'MYSAPSSO2' cookie, to store the SSO2 logon ticket.
• User Assignment: when logging in with external user names, use the USREXTID table to create user assignments between external and SAP users.
• PAS Configuration: PAS is included in ITS 4.6 DC3 and later versions. Ensure it is properly configured on the Agate. Additional packages like ntauth.sar are available on the SAP Service Marketplace.

References

• 734484 – LDAP SSL authentication with PAS on the ITS
• 654544 – Using HTTP header variables for the PAS with the ITS
• 535538 – Linking custom libraries to PAS using the ITS
• 528530 – PAS with the logon language saved by the user
• 510916 – Common errors and solutions when implementing PAS with NTLM

Affected components

• BC-FES-ITS: 46D C3 to 46D C4+, 610 to 620
• SAP_BASIS: 46D to 46D+, 610 to 620