Spnego for ABAP WAS

Question

Is somebody in SAP AG working on SPnego implementation for ABAP WAS? That is so strange when application server uses GSSAPI for GUI connection's and unable to use it for HTTP!
Is somebody help me to understand how can i fix CL_BSP_LOGIN_APPLICATION and "system" BSP for SPnego support in WAS?

Answer 1

Alexey,
If you are using a different Kerberos server for authentication instead of MS ADS, this makes no difference, for the purposes of this discussion (obviously, there are differences, but not related to how SPNEGO can be used with SAP WAS).
I am familiar with how Kerberos 5 is used in an SSO environment with many apps (e.g. browser, SAPgui, MAIL, FTP, SSH, Oracle, Sybase, etc. etc.). This is what I spend most of my life working on, as my company specialises in this. So, in summary - we are on same page when we are discussing the value of using Kerberos in a heterogenous environment.
My comment about X509 and TLS was due to the fact you mentioned using it instead of SPNEGO. My point was/is that if you do, then you need to assign an X509 certificate to each user, and the user needs to authenticate at the workstation using this certificate. Clearly you are not doing this, as you are using LDAP and Kerberos at the workstation to authenticate the user. This is why (for you) SPNEGO with Kerberos/GSSAPI is more appropriate.
If I have missunderstood your reference to TLS, please accept my appology. I was just trying to explain that you cannto simply use TLS instead of SPNEGO without changing the way your users authenticate.
Thanks,
Tim