Table Of ContentCENTRIFY GUIDE
SAP NetWeaver ABAP SAML configuration guide
Abstract
Centrify provides mobile device management and single sign-on services that you can trust and count on
as a critical component of your corporate identity and access infrastructure. Our thorough approach to
availability, reliability, scalability, security and privacy ensures that you can depend on Centrify as a
trusted partner and provider.
Information in this document, including URL and other Internet Web site references, is subject to change
without notice. Unless otherwise noted, the example companies, organizations, products, domain names,
email addresses, logos, people, places and events depicted herein are fictitious, and no association with any
real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or
should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without
limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a
retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying,
recording, or otherwise), or for any purpose, without the express written permission of Centrify Corporation.
Centrify may have patents, patent applications, trademarks, copyrights, or other intellectual property rights
covering subject matter in this document. Except as expressly provided in any written license agreement from
Centrify, the furnishing of this document does not give you any license to these patents, trademarks,
copyrights, or other intellectual property.
© 2016 Centrify Corporation. All rights reserved.
Centrify, DirectControl and DirectAudit are registered trademarks and Centrify Suite, DirectAuthorize,
DirectSecure and DirectManage are trademarks of Centrify Corporation in the United States and/or other
countries. Microsoft, Active Directory, Windows, Windows NT, and Windows Server are either registered
trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their respective
owners.
© 2016 CENTRIFY CORPORATION. ALL RIGHTS RESERVED PAG E 2 | 33
Contents
SAP NetWeaver ABAP ................................................................................................................... 4
An overview of configuring SAP NetWeaver ABAP for SSO .......................................................... 4
Preparing for Configuration ............................................................................................................. 5
SAP NETWEAVER ABAP REQUIREMENTS FOR SSO ...................................................................................... 5
SETTING UP THE CERTIFICATES FOR SSO ...................................................................................................... 5
WHAT YOU NEED TO KNOW ABOUT SAP NETWEAVER ABAP .......................................................................... 5
Completing prerequisites for AS ABAP service providers .............................................................. 7
BASIC SAP OPERATIONS ............................................................................................................................... 7
VERIFYING AND INSTALLING THE SAP CRYPTOGRAPHIC LIBRARY ..................................................................... 7
ASSIGNING ROLES TO USERS TO CONFIGURE SAML ....................................................................................... 7
ACTIVATING SAML2 CONFIGURATION UI SERVICES ........................................................................................ 8
Configuring SAP NetWeaver ABAP in Cloud Manager (Part 1) ................................................... 15
Enabling SAML and creating a local provider in SAP NetWeaver Administrator ......................... 19
Configuring SAP NetWeaver ABAP in Cloud Manager (Part 2) ................................................... 28
(OPTIONAL) CONFIGURING SAP ABAP SAML TO ISSUE A SAP LOGON TICKET ............................................ 31
OTHER IDENTITY FEDERATION OPTIONS IN SAP ABAP ................................................................................ 31
ABOUT CENTRIFY ........................................................................................................................................ 33
© 2016 CENTRIFY CORPORATION. ALL RIGHTS RESERVED PAG E 3 | 33
SAP NetWeaver ABAP
SAP NetWeaver Application Server ABAP is one of the two installation options of SAP NetWeaver AS. The other
option is the Java Stack, which is run totally separately from the ABAP Stack. If you’re trying to configure the
SAP NetWeaver ABAP, you’re in the right place. If you’re trying to configure the SAP NetWeaver AS Java,
see SAP NetWeaver AS Java
Note: This document is written with SAP NetWeaver ABAP 7.3 EHP1 (7.3.1). If you are not using
version 7.3.1, your interface may differ from the illustrations. Only versions 7.3 and 7.3.1 are
supported.
Note: SAP NetWeaver ABAP has two GUIs, the SAP GUI and the Web GUI. Unless specified, all
configuration steps in this document can be done in either GUI.
An overview of configuring SAP NetWeaver ABAP for SSO
The following is an overview of the steps required to configure the SAP NetWeaver ABAP Web application for
single sign-on (SSO) via SAML. SAP NetWeaver ABAP offers both IdP-initiated SAML SSO (for SSO access
through the Cloud Manager) and SP-initiated SAML SSO (for SSO access directly through the SAP NetWeaver
ABAP web application). You can configure SAP NetWeaver ABAP for either or both types of SSO. Enabling
both methods ensures that users can log in to SAP NetWeaver ABAP in different situations such as clicking
through a notification email.
1. Prepare SAP NetWeaver ABAP for single sign-on.
2. Complete the prerequisites for AS ABAP to be a service provider.
3. Add and begin to configure the SAP NetWeaver ABAP application in Cloud Manager.
4. Enable SAML and create a local provider.
5. Create and Enable a Trusted Provider for Centrify.
6. Finish configuring SAP NetWeaver ABAP application for single sign-on.
7. After you have finished configuring the application settings in the Cloud Manager and the SAP NetWeaver
ABAP application, users are ready to launch the application from the Centrify user portal.
© 2016 CENTRIFY CORPORATION. ALL RIGHTS RESERVED PAG E 4 | 33
Preparing for Configuration
SAP NetWeaver ABAP requirements for SSO
Before you configure the SAP NetWeaver ABAP web application for SSO, you need the following:
SAP NetWeaver ABAP.
An active SAP NetWeaver ABAP account with administrator rights for your organization.
For more set-up information - Identity Federation in AS ABAP (7.3 EHP1):
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/f4/a4aa9a3f9e47e09f5cc2eeb017c1ec/conten
t.htm
Setting up the certificates for SSO
To establish a trusted connection between the web application and the cloud service, you need to
have the same signing certificate in both the application and the application settings in Cloud
Manager.
If you use your own certificate, you upload the signing certificate and its private key in a .pfx or .p12
file to the application settings in Cloud Manager. You also upload the public key certificate in a .cer or
.pem file to the web application.
To download an application certificate from Cloud Manager (overview):
1. In the Apps page, add the application.
2. Click the application to open the application details.
3. In the Application Settings tab, click Download Signing Certificate to download and save the certificate.
What you need to know about SAP NetWeaver ABAP
Each SAML application is different. The following table lists features and functionality specific to SAP
NetWeaver ABAP.
Capability Supported? Support details
Web browser Yes
client
Mobile client No
SAML 2.0 Yes
© 2016 CENTRIFY CORPORATION. ALL RIGHTS RESERVED PAG E 5 | 33
SP-initiated Yes
SSO
IdP-initiated Yes
SSO
Force user Yes Only if Selection Mode is Automatic.
login via SSO
only
Separate No
administrator
login
after SSO is
enabled
User or Yes Users can be locked out of SAP if they cannot access IdP.
Administrator You can specify a back door URL by using the query parameter
lockout risk “saml2=disabled”
Automatic No
user
provisioning
Multiple User Yes Refer to SAP NetWeaver ABAP documentation for details.
Types
Self-service Yes Users can reset their own passwords. Note that administrators cannot
password reset a user’s password.
Access Yes You can specify an IP Range in the Cloud Manager Policy page to restrict
restriction access to the application.
using a
corporate IP
range
© 2016 CENTRIFY CORPORATION. ALL RIGHTS RESERVED PAG E 6 | 33
Completing prerequisites for AS ABAP service providers
In order for ABAP to be fully configured as a service provider, it must have a supported cryptographic
library installed, users with administrative privileges, and activated SAML2 configuration UI services.
Basic SAP operations
Transactions are entered in the command field at the top of the SAP screen. Each function in SAP has
an SAP transaction code associated with it. After you call a transaction and the function screen opens,
calling another transaction will have no effect. You must either use the Back button to go all the way
back to the home screen and then call a new transaction, or put /N in front of the transaction call. For
example, the SICF transaction can be entered either as SICF on the home screen, or as /NSICF on the
function screen.
Verifying and installing the SAP cryptographic library
SAP ABAP version 7.3 EHP1 comes with the SAP cryptographic library, but the version of
cryptographic library that you have may vary. The SAP NetWeaver ABAP app has been tested with
v5.5.5C and v8.4.25(+MT). If the version you have is different, the illustrations may not match what
you see on your screen.
To check the version of your SAP cryptographic library:
a. Log in to the SAP GUI.
Note Checking the SAP cryptographic library can only be done in the SAP GUI. The Web GUI does not
have this capability.
b. Call the STRUST transaction.
c. Go to Environment > Display SSF Version.
If the SAP cryptographic library is already installed, it displays its version number.
d. If you do not have the SAP cryptographic library installed, you must install it as described
in http://help.sap.com/saphelp_nw73/helpdata/en/49/236897bf5a1902e10000000a42189c/con
tent.htm.
Assigning roles to users to configure SAML
If you have users without administrative privileges who you want to give the ability to configure
SAML, assign them the role SAP_SAML2_CFG_ADM. There is also a read-only role,
SAP_SAML2_CFG_DISPLAY.
© 2016 CENTRIFY CORPORATION. ALL RIGHTS RESERVED PAG E 7 | 33
Activating SAML2 configuration UI services
To access SAP ABAP's SAML 2.0 Configuration page, you must first activate SAML2 Configuration UI Services
and other related services. A series of services must be activated. Follow the steps below in
Activate each of the service paths in this Service Path list:
/sap/bc/saml2/CDC_EXT_SERVICE
/sap/bc/webdynpro/sap/SAML2
/sap/public/bc/icf/logoff
/sap/public/bc/icons/
/sap/public/bc/icons_rtl/
/sap/public/bc/pictograms/
/sap/public/bc/sec/SAML2
/sap/public/bc/webdynpro/adobeChallenge/
/sap/public/bc/webdynpro/mimes/
/sap/public/bc/webdynpro/ssr/
/sap/public/bc/webdynpro/ViewDesigner/
/sap/public/bc/webicons/
/sap/public/myssocntl/
To activate a service:
1. Log on to the SAP GUI and connect to your SAP Server
2. Within the SAP UI type SICF into the execute field
3. Click on execute
© 2016 CENTRIFY CORPORATION. ALL RIGHTS RESERVED PAG E 8 | 33
4. On the Maintain Services page, enter one of the service paths from the service path list above in
the Service Path field.
5. Click Execute.
6. Right-click the first greyed out field in the service in the tree view and select Activate Service.
If the Activate Service option is not available, that means the service is already activated.
© 2016 CENTRIFY CORPORATION. ALL RIGHTS RESERVED PAG E 9 | 33
7. When prompted to activate the service, click Yes with tree
8. Enter a new service from the service path list above into the Service Path field
9. Click Apply
© 2016 CENTRIFY CORPORATION. ALL RIGHTS RESERVED PAG E 10 | 33
Description:SAP NetWeaver ABAP SAML configuration guide. Abstract. Centrify provides mobile device management and single sign-on services that you can
