Use Windows Account to logon to WAS (ICM) ...

Question

Hi All !
is it possible to use a windows Domain Account to logon to WAS Applications ( BSP or Webdypro in ICM ) ?
possible with Kerberos or Certificates ?
How to implement ?
need help !
Thanks
Oliver

Answer 1

Wolfgang,
Yes, I hope that Oliver finds this chat/info useful, and not too confusing.
I am sorry, but the question asked in this post was related to using the Windows Account to logon to WAS. For me that means something like :
1. The user is currently logging onto Windows using an account, and is authenticating with Active Directory using this account. e.g. via password or smart card, two-factor token etc.
2. The user wants to use this same Windows account to logon to WAS ABAP. This implies the same authentication method used to logon to Windows (e.g. password, smart card, two-factor token etc.) should be used to logon to SAP WAS. This relates to the question being asked by Oliver.
So, if we first consider x.509. How are you proposing that the user authenticates using their certificate, and determines their Windows account from this certificate when they  log onto SAP ? The Active Directory approach is to use PKINIT (a Kerberos pre authentication mechanism) to determine the Windows account name from the certificate based authentication, so SAP WAS would have to use PKINIT and/or share the same certificate that Active Directory uses for this to be possible. I am not aware of a method of making this work with SAP software, and if it is possible, it certainly would not be easy. Also, I am not convinced this gives Oliver what he is asking for. The only method I am aware of is to use client certificates to authenticate to SAP, and these certificates would normally be issued by SAP or via an external CA which is trusted by SAP. When using this method to logon to SAP there is no way to relate the certificate to the account name the user is aware of in Windows since the certificate authentication used by SAP is completely separate from the Windows account authentication. Hence, I would say that x.509 cannot be used to meet Olivers requirements.
Regarding SPNEGO. There was no question asked about SPNEGO - you introduced this technical term in your response, and I answered the question referring to Kerberos since this is what Oliver asked about. Also, this is not supposed to be a discussion about standards, it is a discussion about the methods available to logon to SAP WAS using a Windows account. This is the question I have answered.
I didn't say that the ABAP systems supported SPNEGO. I simply explained how it is possible to use Kerberos to authenticate to ABAP apps, either via Integrated Windows Authentication or via a logon screen that asks for Active Directory account name and password. This answers the question from Oliver clearly and without confusing him with technology - basically, what he wants to do is possible, very easy and quite commonly implemented by SAP customers, so surely these things are more important than introducing technology and standards in to the discussion when they are not relavent, and certainly better than giving the impression that x.509 is the way to go !
I don't want this post/discussion to be taken the wrong way. I wanted to make sure that Oliver gets the answer he asked for, and when you responded implying that x.509 was the best option and Kerberos was not possible I felt I had to correct you on this, in the context of the question being asked and my knowledge of the solutions available on the market to address the requirements that Oliver has asked about.
Regards,
Tim