KB0040 – Promenta and Single-Sign-On (SSO)
Promenta are often asked about Single-Sign-on (SSO) capabilities and how to configure them. This Knowledge Article is designed to answer some frequent questions and set the background.
Key points : Promenta is compatible with all SSO setups that are supported by, or work with, SAP for web-based authentication and logon. However Promenta (which is running running inside SAP) does not have its own SSO set up.
Background
Promenta is a solution that runs inside your own SAP system. It is an SAP Add-On that runs in the SAP ECC6 or S4Hana server
The Promenta User Interface (UI) is web-based but the web technologies used are all served from you SAP system (Using SAP SICF/SAP WAS)
Promenta does not have any additional servers.
Promenta does not have its own users or any way of managing user access – this is all controlled via your SAP system. Hence SSO is not a direct function of Promenta.
Promenta will work with any SSO setup that is configured for SAP for web-based access.
Consultancy
Sometimes a customer may want our help to properly setup the SSO infrastructure or troubleshoot issues with SSO. We have wide experience with multiple different SSO configurations.
Promenta is able to offer consultancy for help with your SSO implementation – note that consultancy is not included in the standard support model and is not included in standard implementation projects unless explicitly agree.
Single-Sign On Architecture (AD/SPNEGO)
The diagram below shows one common architecture of a SSO setup. This is applicable to SAP ECC and SAP S/4Hana.
Here Microsoft Active Directory is used to provide the authentication infrastructure to users within the corporate domain. The SAP server then accepts the authentication via Integrated Windows Authentication (IWA). The SPNego standard ensures robust communication and authentication over SAP SNC.
As can be seen, Promenta does not play any part in the SSO communication and is only involved after successful logon.
Single-Sign On Architecture (SAML external service)
In this scenario an external SAML ID Provider (IdP) is set up and linked to SAP as the SAML Service Provider (SP).
IdPs are provided by many organisations such as Okta, Auth0, Azure, Ping etc
The webservices (such as Promenta) must be configured as SP end point URLs in your SAML IdP and SAP itself must be set up to accept authentication from the IdP.
All of this setup and configuration is down outside of Promenta and Promenta has no specific settings to configure.
Sometimes it is necessary to modify the Promenta service end-point URL for your implementation – if this is needed please see next section.
Changing Promenta services
You cannot change Promenta services directly. That would constitute a repair/modification of Promenta objects and is expressly forbidden.
However – for SSO and other logon changes you are able to override the Promenta settings using the SAP External Alias concept.
SAP document : https://help.sap.com/saphelp_snc70/helpdata/en/78/9852bdc06b11d4ad310000e83539c3/content.htm?no_cache=true
SAP Note : 2012233 – How to create external alias in transaction code SICF
STEPS
1] Transaction SICF.
2] Click the External Service button
3] Select “new” button
4] In the External path – enter the same path as the service that you are overriding
Main service : /sap/bc/bsp/promenta/wfbsp
5] In the bottom section select the service you are overriding
6] You may now change the settings such as logon procedure, redirect pages etc to suite your implementation
7] Save and exit
8] You may need to perform these steps in every system – or you can transport the External Alias.
FAQ : I have SSO already for SAP Fiori / SAP Web Dynpro / SAP BSP. Will it work?
YES
Promenta should automatically use the SSO that is set up in this scenario.
The only thing that may need to be set up is the SAP Web Dispatcher URL (or other load balancer) if in use.
FAQ : I have SSO with SAP GUI / SNC – will it work?
NO – this is not a web-based SSO. However it is most of the way there.
SAP GUI SSO uses SNC and as such is a different technology to web-based technology. However SNC is still needed for web-based SSO using IWA/SPNego for communication between authentication server (AD) and SAP.
Activate SPNego to get web-based SSO.
FAQ : Which SSO solution should I use?
Promenta does not recommend any particular SSO implementation as they are very scenario-specific.
However Promenta has worked successfully with :
- SAP SPNego with ActiveDirectory and Integrated Windows Authentication [More information : SAP SPNego document]
- Kerberos based third party solutions
- Certificate based logon
FAQ : I need help with SSO
Please contact the provider of the SSO solution (SAP or other provider) in the first instance.
Promenta has experience with a wide range of SSO solutions and their problems and will help where possible but SSO is not a Promenta responsibility. Additional consultancy services may be incurred.
FAQ : Can I user user/password for login?
YES
This is normally default unless an SSO is in place.
Even if you do have SSO enabled there is normally a way of also logging on with your user/password
FAQ : Which user / password should I use?
Promenta is an SAP application – as such you should use your SAP user name (from SU01) and SAP password.
Your windows user and/or your network user will not work.