SSO for Personas embedded in Oracle WebCenter Portal

[Former Member]

Hello All,

We have a requirement to implement the SSO (single sign-on) for Personas 2 for NW 7.4 AS-ABAP ECC 6 EhP 7. (abap stack only)

The Personas will be embedded as a link in the Portal [oracle webcenter portal].

The end user firstly logs in to the oracle webcenter portal with user credentials which are maintained by Oracle IDAM (oracle identity and access manager) which provides user authentication. User ids will be same across Oracle Portal, Oracle IDAM, and SAP ECC ABAP.

i have gone through several threads in SCN forums, but could not able to get a sense of approach discussed anywhere.

Personas 2.0 by default tries to authenticate using X.509 certificates if present in the system.

Also we can set up web SSO using SAML .

What should be the ideal approach for my above problem statement....pls let me know.

Do we have any setup guide in SMP for this?

BR,

shyam

[tim_alsop]

You need a cryptographic token to be generated after user has been authenticated which can be accepted by SAP NetWeaver so it knows who the user is. Since you are authenticating the user using Oracle, it won't be possible to get Oracle to generate an SSO2 logon ticket (the token) so maybe you can use SAML if Oracle support SAML ? If Oracle don't support SAML, then I recommend you consider using credentials of the user issued by Active Directory during the workstation logon to authenticate the user to NetWeaver. It should be possible to do the same with Oracle, so the user is being authenticated using their Active Directory credentials when they logon to Oracle and SAP NetWeaver.

Thanks

Tim

[Former Member]

Thanks Tim for your reply.

I required clarification on few more things.

1) As per my understanding we require SAP- WebAS Java for SAML method. but we planned to integrate OWC portal with ABAP system only. Is there any possible way in which SAML can be used for this type of integration(without using java system).

2) Could you let me know whether oracle supports SSO-Logon ticket method, if so, can we customize the logon ticket as per our requirement(which will accepted by SAP-ABAP system)?

Regards,

Shyam

[tim_alsop]

1) You don't need Java stack for SAML.

2) No, Oracle doesn't support SAP SSO2 logon tickets, since these tickets are proprietary to SAP software. This is why SAML might be a good solution since SAML is a standard and not proprietary to Oracle or SAP.

[Former Member]

Are you able to provide more information about authenticating Personas against active directory.  We presently provide Single singe on for our gui users by using an snc authentication against active directory then would like our users to be able to click in a personas url in their gui without being challenged for a username and password.