Config UME with ABAP+LDAP datasource

Question

Hi all,
We are implementing an EP installation. We want to reuse the abap role assignment for the portal roles and we require a SSO solution based on SPNego.
Now we can implement each on it's own fine. The question is how we can connect the ume to use both abap and ldap datasource. I opened an OSS about it and they said it's possible, supported but I'm on my own when it comes to implementing it (or consulting offcourse).
Anyone had experience with this configuration or can provide me with the datasource schema file?
Thank in advance,
Eric

Answer 1

Try the following:
1.     Download the SPNegoWizard_645.zip (for 7.0) SPNegoWizard_640 (for 6.40)from SAP Note 994791 and unzip it.
2.     Adjust the user running the SAP system in Active Directory
3.     Copy the EAR and XML Files from the SPNegoWizard.ZIP file to a temporary directory on the server.
4.     Open up the Visual Administrator.  Logon with the admin ID.
5.     SID ->Server -> Services -> Deploy
6.     Open the Config Tool. (Yes to using DB settings)
7.     Select UME LDAP Data
8.     Browse to the XML file you copied earlier. (dataSourceConfiguration_ads_readonly_db_with_krb5.xml)
Click the upload button.
9.     Select the Configuration file you just uploaded.  Click OK on the Warning message.
10.     Setup the Connection details as specified below:
Server Name: xxxxxx
Server Port: xxxxxxx
User: SAPService<SID>@domain.com
Password:  xxxxxx
Use UME unique id with unique LDAP attribute (checked): samaccountname
User Path: dc=<domain>,dc=com
Group Path: ou=xxxxxx,ou=xxxx,dc=xxxx,dc=xxxx
11.     Click the Test Connection button you should see:
Click Close when done.
12.     Click the Test Authentication button, enter NT user ID and NT password, and click the authenticate button and you should get a success message:
13.     Select cluster-data   Global Server Configuration  services  com.sap.security.core.ume.service
14.     Edit the ume.admin.addattrs.
Add the values: krb5principalname;kpnprefix;dn
Click the Set button. 
15.     Click the Save button or File -> Apply.  
16.     Close the Config tool and restart the JAVA engine.
17.     After the engine is restarted, continue on with the Kerberos configuration.
18.     Open up the SP Nego Wizard by going to the following URL: http://<server>:<port>/spnego
19.     Logon with the Administrator user ID.
20.     Select the check boxes for the u201CService user is created and configured in Active Directoryu201D and u201CUME configuration includes SPNego specific settingsu201D
Click the Next button
21.     Click the Add Kerberos Realm button and enter your domain name (e.g. company.com)
22.     For the Realm Configurationu2019s KDCs (Key Distribution Centers) put in <KDC host> and 88 for the port (the port should already be filled in. 
23.     In the KPN (Kerberos Principal Name) section enter the Service User Name & Password.
Service User: SAPService<SID>          
Password: xxxx
Leave LDAP Host - blank
24.     Click the Next button
25.     Select Prefix Based for the Resolution Mode and Click Next
26.     In Policy Configuration we want to create a new policy called spnego.  Tick Basic password Fallback (when SSO do not work) and tick SSO with Logon Tickets.  Click the Next button.
27.     Click Finish on the Confirmation screen.
28.     Close the browser and restart the engine.
29.     After the engine has finished restarting, continue with the final steps.
30.     Open up the Visual Administrator.  Logon as the Administrator ID.
31.     SID  Server  Services  Security Provider
32.     Go into change mode by clicking the change button.
33.     On the Runtime tab  Policy Configurations tab  Select ticket from the Components list.
34.     On the Authentication tab for the ticket component  select Authentication Template: spnego
35.     Now go to the useradmin service (http://<server>:<port>/useradmin) to test the Kerberos SSO.  You should get signed on without entering a user name or password.
You are done!