Single Sign-On Configuration

[MaheshKumar]

JSPM Single Sign-On Configuration

Applies to:  ECC 6.0,SAP Netweaver 7.0

Author(s):    Mahesh Kumar Mukkawar

Company:   Greatship India Limited

Created on:  09 May 2012

Author Bio

Mahesh Kumar Mukkawar is a Netweaver Consultant and working with Greatship India Limited and lives in Mumbai, IN. He previously worked for Alkem Laboratories, a leading pharama company in india.Mahesh Kumar is a Post Graduate from Osmania University,IN. He has exposure to SAP BPC in his coursework and interested in enterprise systems.

1) Export certificate from portal (verifyder and verifypse)

a) Navigate to 'System Administration' >> 'System configuration' >> 'Keystore Administration'

b) In 'Content' select "SAPLogonTicketKeypair-cert" and press'n'save "Download verifypse file" and "Download verifyder file"

2) Check existence of SAPJSF user in target system

a) Create if necessary using transaction SU01

b) User should have two roles: SAP_BC_JSF_COMMUNICATION and  

                                             SAP_BC_USR_CUA_CLIENT_RFC (if you have CUA in place)

                                              S_BW_RFC ( Add this profile if you are using BI Connectivity)

c) Probably you will have to generate profiles for those roles in target system (transaction PFCG)

3) Check profile parameters

a) use transaction RZ10

b) choose instance profile, 'extended maintenance', then 'Change'

c) make sure that "login/create_sso2_ticket" is set to "2" and "login/accept_sso2_ticket" set to "1"

4) Export certificate from target system (the system to which you want to connect using SSO from portal)

a) use transaction STRUSTSSO2

b) double-click on "Own Certif" on "CN=" part
 

c) press on "Export certificate" button in the middle of the screen and provide file name and path, where to save certificate file

5) Import portal certificate to target system

a) Use transaction STRUSTSSO2 in target system

b) push "Import certificate" button in the middle of the screen

c) in 'File path' field enter path to *der file, you created in step 1 (or point at it via 'Browse' 

     button)

d) Press "Enter"

e) Press 'Add to certificate list' button and then 'Add to ACL button

6) Create an JCo RFC provider in J2EE engine of portal system

a) Logon to J2EE using J2EE Admin tool (gobat)

b) navigate to 'Server' >> 'JCo RFC provider' node

c) On the right side of the screen choose any entry in 'Available RFC destinations' area

d) Enter information about new destination:
- Program ID: name of the program (you will need it later) - sapj2ee_port, for example
- Gateway host - FQDN of target system - serverdomaincom, for example
- Gateway service - sapgw00 for example

e) in 'Repository' section enter:
- Application server host - FQDN of target system - serverdomaincom, for example
- system number - 00, for example
- client - 100, for example
- logon language - EN
- user - SAPJSF (from step 2)
- password (from step 2)

f) press 'Set'

7) Add target system to Security providers list

a) Open J2EE Admin and navigate to 'Server' >> 'Services' >> 'Security Provider' In components

     select 'Ticket' Enter edit mode (button with pencil above)

b) select 'Login module' "comsapsecuritycoreserverjaasEvaluateTicketLoginModule" and press

     'Modify'

c) ensure that "umeconfigurationactive" is set to "true"

d) enter following info:
- Name - 'trustedsysN' (there should be a number instead "N", if target system is the first one you implementing SSO with, there should be 'trustedsys1') Enter <SID>,<client> as a value (C11,100 for example)
- Name - 'trustedissN' (there should be a number instead "N", if target system is the first one you implementing SSO with, there should be 'trustediss1') Enter CN=<SID> as a value (CN=C11 for example)
- Name - 'trusteddnN' (there should be a number instead "N", if target system is the first one you implementing SSO with, there should be 'trusteddn1') Enter CN=<SID> as a value (CN=C11 for example)

e) Press 'OK'

f) Do substeps b,c,d,e in 'evaluate_assertion_ticket' view for "comsapsecuritycoreserverjaasEvaluateAssertionTicketLoginModule" login module

😎 Import target system certificate to J2EE of portal system (from step 4)

a) Open J2EE Administrator and logon to portal instance

b) Navigate to 'Server" >> 'Services' >> 'Key storage'

c) in 'Ticket keystore' view press 'load' and select certificate of target system, you exported in step 3

9) Restart J2EE instance

10) Create RFC connection in target system

a) use transaction SM59

b) Point to TCP/IP connections and press 'New'

c) Enter name for new connection ("RFC_to_portal", for example), enter connection type "T" (external TCP/IP application) and description Save

d) in 'Technical settings' choose "Registered server program" and enter application name from step 6d in "Program ID" field Provide 'Gateway host' and 'Gateway service' same as in step 6d Save Test connection RFC connection ready