How to implement SSO to non-SAP systems using SAP logon ticket?

Hello,
We would like to implement Single Sign On between our SAP Netweaver system and a Siebel which is a non-SAP system using SAP logon tickets.
Can anyone please give me some leads on this, in particular:
1. Is there a JAVA API or an SAP plug-in that can be implemented on the Siebel machine to extract the SAP logon ticket?
2. As the other machine might seat on a complete different domain, is it possible to implement SAP logon ticket without using cookies (perhaps through the HTTP header?
3. In case you think using SAP logon tickets is not the best solution here I would be happy to hear any other suggestions you might have.
Roy

Hi,
I'm currently using SAML as well. Unfortunately the SAP J2EE cannot work as authority (identity provider) but what you can do is using an open implementation of SAML such as opensso which is an open version of SUNs Java System access manager.
There are a couple of other projects such as opensaml, apache's wss4j or shibboleth that might be interesting in this context.
I just installed opensso and got it working with SAP J2EE 7.0 using SAPs JAAS SAMLLoginModule to authenticate users within SAP J2EE.
In this scenario opensso serves as identity provider just as you need! There are a couple of Policy agents available on SUNs Download site you can use with Apache, Tomcat, JBOSS, WebSphere, Bea Web Logic etc. in order to authenticate! Otherwise you just directly authenticate against opensso. When installing opensso you can configure the type of user store you want to use! By default it uses LDAP but you can also use different types of user store using JDBC or other mechanisms. Since you have a Directory Service you could easily connect it to your existing directory.
There is also a way to map user ids directly in opensso by adding a uid mapping class. I created some documentation with lots of screenshots about using opensso with SAP J2EE. You can easily use opensso with any other system that supports SAML. In the case of SAP the usage is currently limited to SAML versions 1.0 and 1.1. Version 2.0 is not yet supported but should be in one of the following versions.
Here are some links you might want to check:
OpenSAML: https://spaces.internet2.edu/display/OpenSAML/Home
wss4j: http://ws.apache.org/wss4j/
shibboleth: http://shibboleth.internet2.edu/
opensso: https://opensso.dev.java.net/
On SDN you will find a documentation on how to connect SUN Java System Access Manager to SAP J2EE (see https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/906d9fc6-31b9-2910-1385-90edad7d7570). As I said opensso is based on the SUN Access Manager code and looks quite the same. So you can adapt this documentation in order to configure opensso or you can just ask me for the documentation.
Hope this is helpful...
Let me know if you need further assistance on this topic
Cheers

Similar Messages

Integration of SAP Cloud for Customer with third party / legacy / non-sap system using SAP Netweaver PI

Hello,
has anyone experience with the Integration of a 3rd Party System with SAP C4C using SAP Netweaver Process Integration?
Is this a process of days, weeks or months?
Any documentation on this?
I am thankful for every Input!
BR, Roman

Roman,
Please read through the integration guides available on the SAP service marketplace as they address this specific topic in great detail.
http://service.sap.com/cloud4customer
The time duration of the project depends on the business process complexity being resolved and the level of integration desired between the different enterprise solutions in the landscape.
Thank you.

How to implement a dual booting PXI system using windows 7 and labview RT

Good Day
My name is Mariano Ocana from the University of Manitoba, and I want to implement a dual system using windows 7 and labview RT in a PXIe-1082 chassis with a PXIe-8102 embedded controlled (the chassis came with windows 7 installed). What are the steps to use both systems (windows and RT) in the same chassis?, in the NI help comes an example implementing a dual system using windows xp and RT, it is the same procedure?.
Thank you in advance for all your help.
Regards
M. Ocana

Greetings, Mariano.
The real issue you have to contend with is whether or not you have a LabVIEW RT license. If the 8102 controller was purchased Windows-Only, you likely do not have a license to run LabVIEW RT on the controller - you can purchase one, I think it's about $500, and at that point you can request a LabVIEW RT Configuration CD (that's not what it's called, but the sales guy will know what I'm talking about). The Config CD is a CD that will partition your controller correctly with both FAT32 and NTFS filesystems (in the appropriate way) to allow you to run Windows 7 and LabVIEW Real-Time on the controller correctly. Once done, you can then switch within the BIOS between LabVIEW Real-Time and Windows in order to dual-boot.
Either way, you likely need to contact NI sales to either purchase an RT license (if one was not received at the time of purchase) or to request a Configuration CD (it might also be called a dual-boot install CD or similar).
-Danny

SSO to non SAP Application using SAP Logon Ticket

Hi Experts,
I Have EP 7 SP 15 using SPNego Wizard to SSO with Active Directory and SSO between EP and ECC using SAP Certificates.
Now I have a demand to SSO some JAVA based applications (non SAP) to my portal using the SAP Logon Ticket.
I Have followed some blogs that directed me to use SAPSSOEXT (some libs) to read the MYSAPSSO2 cookie. The problem is that I didn't found this cookie, I even executed the command javascript:document to look for this cookie but the browser just show me the JSESSIONID info.
Does anybody knows where I can find this cookie or if there's a better way to set up this SSO? It´s necessary to say that I cannot SSO these application to the kerberos protocol because some security reasons on my company.
Thanks
Armando

Hi,
I dont have much info related but i can giv u hint
refer OSS Notes 442401 and 723896.
When using SAP logon tickets for non-SAP applications, two different implementation options are available. The difference lies in where the ticket verification takes place.
In the first case, the SAP logon ticket is submitted to the web server filter located on the web server. The web server filter verifies the portal serveru2019s public key
certificate using its local Personal Security Environment (PSE) and then populates the HTTP header field with the user ID for SSO to the non-sap web application.
In the second case, the SAP logon ticket is sent to the non-SAP application, which then verifies it using the ticket verification DLL and submits the user ID to the application for SSO.
You can refer following link :-
http://help.sap.com/saphelp_nw70/helpdata/EN/89/6eb8deaf2f11d5993700508b6b8b11/frameset.htm
user authentication and SSO
http://help.sap.com/saphelp_nw70/helpdata/EN/8f/ae29411ab3db2be10000000a1550b0/frameset.htm
Authentication Using a Directory with SSO Integration Using Logon Tickets
http://help.sap.com/saphelp_nw70/helpdata/EN/f8/3b514ca29011d5bdeb006094191908/frameset.htm
SSO
SAP Logon Ticket-based Single Sign-On
http://help.sap.com/saphelp_nwce10/helpdata/en/45/b6af743753003ae10000000a11466f/frameset.htm

How to take the data from sage system to sap r/3

hi expects,
how to take the data from sage system to sap r/3? which adapter is to be used?what is the format of data in sage system?how the scenarios will work ? please help me in solving this problem?

hi rohit,
the data transfer can be done by using SOAP adapter
do chk this link
http://www.sage.org/lists/sage-members-archive/2001/msg01718.html
http://www.sage.org/lists/sage-members-archive/2001/msg01739.html
thanx
Sampath

How to Implement a screen exit to a standard SAP transaction

Hi All,
Can any body give How to Implement a screen exit to a standard SAP transaction??
Regards,
AK

Hey,
This link which gives the Step by step way of iimplement a screen exit:
http://wiki.ittoolbox.com/index.php/HOWTO:Implement_a_screen_exit_to_a_standard_SAP_transaction
Regards,
Arjun

HT1420 How can I deauthorize a non-existant system. My hard drive died so I bought a new one, reinstalled the OS and iTunes but iTunes seems to think this is a new computer.

How can I deauthorize a non-existant system. My hard drive died so I bought a new one, reinstalled the OS and iTunes but iTunes seems to think this is a new computer.

Try deauthorizing the computer even if you haven't authorized it. If you've already authorized it, deauthorize it twice and then authorize it again.
(67626)

How to stop start SAP system from SAP transactions?

Hi Experts,
How can i stop start the SAP system from SAP screens? Are there any transaction for this need?
thanks,
philaphi

Hi,
Use Tcode RZ03 --> Control --> Stop SAP Instance.
Best Regards,
Sachin.

Login to multiple SAP systems using pwd of single SAP system

Hi All,
We have 3 different SAP servers, with sids: ECD, BWD, HRD.
for each user, a user with the same username is created in all three systems.
the user does not want to maintain 3 different passwords, instead only single password to be used in all systems. i.e. when he changes the password in system ECD, the changed password should work in other systems BWD and HRD as well.
if we were using SAP EP, we checked the possiblity of username based SSO and having portal login using only on system ECD.
but we are not using the portal, and all the users will access 3 sap systems using SAPGUI.
is there any way, where one system's password will work to login to other systems.
thanks in advance,
Madhu_1980

Hi Tim,
You're right about the fixed client for the MYSAPSSO2-ticket-issuing system. In the case for Java, the "client" is specified inthe UME parameter login.ticket_client. And the trusting ABAP system will have to add the Java system + "client" into its ACL (in addition to the certificate). This "client" will only play a role in that "trust" relationship.
As for launching the actual transaction via SSO, this is how it works.
SAPGUI transaction will be launched by a thing called Portal transaction iview. That iview will have a parameter called the System Object. The System Object will determine which ABAP system-client it will connect and logon on to. So if you want to logon to multiple clients, then create one System Object for each of the system-client combination, and then create transaction iviews to each of the corresponding system object. The iviews will be presented to the user which then allows the user to launch the transaction iview (specificy SAPGUI link in the iview property)
https://help.sap.com/saphelp_nw74/helpdata/en/4e/1262711e3d2287e10000000a15822b/content.htm
I hope I understood your questions.
Cheers
Donald

Migrate all Open Sales Orders From Legacy System (SAP) To SAP System using

Hi Experts,
             I've to Migrate all Open Sales Orders From Legacy System (SAP) To SAP System using Business Objects with a new SALES ORDER DOCUMENT NUMBER referencing the older one.
           I'll get all the required data with field in an excel file.
             Does any standard transaction exist for it ? Or how to go ahead with it ?
Thanks and regards,
Jyoti Shankar

Hi
If you are checking for CREATE option then Sales Doc Type
For more Info goto SWO1 transaction -> BUS2032 --> DIsplay --> Execute --> There SELECT the method which you want to perform... There you can fine the MANDATORY parameters also....
Or in DISPLAY mode PLACE Cursor on the Required Method and CLick the PARAMETERS button on toolbar...
That will show the MANDATORY parameters...
Reward if helpful....
Message was edited by:
        Enter the Dragon

How to find out the Non Partitioned Tables used 2Gb on oracle

Hi team
how to find out the Non Partitioned Tables used > 2Gb on oracle where not is sys & system
regards

heres 1 I made earlier
set pagesize 999
set linesize 132
col owner format a25
col segment_name format a60
select owner,segment_name,segment_type,(bytes/1024/1024)"MB size"
from dba_segments
where owner not in ('SYS','SYSTEM','XDB','MDSYS','SYSMAN') -- edit for taste
and segment_type = 'TABLE'
having (bytes/1024/1024) > 2000
group by bytes, segment_Type, segment_name, owner
order by 4 asc

RFC connection between two SAP systems (with SAP router)

Hi!
I would like to set up a RFC-connection from SAP Solution Manager to other SAP system.
The network connection between the servers is VPN.
How can I set up this RFC-connection, if my connection between two SAP systems looks as follows,
(I use the following SAP routers)?
my server --> customer
my server --> internal SAP Router server xy (10.101....) --> SAP Router customer 2 (10.1....) --> SAP System customer (134....)
Back-way
SAP Systeme customer --> SAP Router customer (134.1....) --> internal SAP router (212.6....) --> my server
How can I set up this RFC-connection, if my connection between two SAP systems looks as follows,
(I use the following SAP routers)?
something like:
/H/10.101..../S/sapdp99/H/10.1.4..../S/sapdp99/H/134...
Thank you very much!
regards
Thom

Same answer as in the other forum where you cross posted....

How can we report on R/3 tables using SAP BO

How can we report on R/3 tables using SAP BO.
Thanks

Hi
you can use the CR Designer and build CR reports that access your R/3 system. Another option is to use the R/3 connector for the Data Federator which is available in the Innovation Center. Still this connector is not a product rather can be used on your own risk.
Regards,
Stratos
PS: Accessing directly the tables of the underlying database(e.g oracle) using universes and Web Intelligence is not recommended. You will not be able to decode all contents of the database tables you are accessing since in some cases R/3 encodes the data before storing them in the actual database tables.

How to configure IS-H outpatients appointment booking using SAP Portal?

Hello everyone,
I just want to know if anyone has implemented On-line outpatients appointment booking using SAP Portal ?. I saw SAP for Healthcare: Supporting Enterprise-Wide Appointment Booking demostration and here in our institution we are interested on it.
If so then can anyone of you please guide? I just want an overview about this. If you have some documentation related to this then that will be more helpful.
Thanks for advanced!!
Regards
Ruben Salinas
Clinica Vitro
Mexico

Hi Ruben,
I know a few examples where such service portals have been implemented. The Thoraxklinik Heidelberg has implemented a service portal for their referrers. Some information can be found [in the SAP success story|http://download.sap.com/industries/healthcare/customers/download.epd?context=CE8BFF0B88BF13A10B64E1ECB4EC460FC2A64DA0B06CAB0012CE747672A20DF534AFB35493AC7989EB7B66D866B70FFE6C45BC0ABA7783B2] and [the SIEMENS success story|http://www.medical.siemens.com/siemens/sv_SE/cs_healthcare_cons_FBAs/files/brochures/primergy_server_thorax_clinic_heidelberg_en.pdf]. They have also been hounored by Computerworld , see [here|http://www.cwhonors.org/viewCaseStudy2008.asp?NominationID=656], where you can also find some details: a [screenshot|http://www.cwhonors.org/CaseStudy/Uploads/Thoraxklinik/Appendix1.jpg], the [security architecture|http://www.cwhonors.org/CaseStudy/Uploads/Thoraxklinik/Appendix2.jpg] and a [graphic|http://www.cwhonors.org/CaseStudy/Uploads/Thoraxklinik/Appendix3.jpg] how this portals ties into their overall HIS.
Regards
Claudius

Exposing SAP Systems using EP6 SP2?

I am interested in Exposing SAP Systems (using Webgui and/or Wingui)using EP6 to the outside world. All Java iViews connecting to SAP Systems seem to work if EP6 is exposed to the outside world. But exposing webgui/wingui thru the portal seem to require me to expose them indiviually thru the firewall.
Is this correct or does anyone know a way of exposing the webgui/wingui thru the portal without having to explicitly exposing each installation?

Maybe I am wrong, but I am afraid, that the webgui/wingui really must be exposed through the firewall to the outside world. It's because the portal doesn't produce the content of the iViews itself, it just merely passes according URL's of the webgui/wingui to the client's browser, which then communicates directly with the according (ITS) server.

How to implement SSO to non-SAP systems using SAP logon ticket?

Similar Messages

Maybe you are looking for