SAP NetWeaver AS Java

Transcription

1 Chapter 75 Configuring SAP NetWeaver AS Java SAP NetWeaver Application Server ("AS") Java (Stack) is one of the two installation options of SAP NetWeaver AS. The other option is the ABAP Stack, which is run totally separately from the Java Stack. If you re trying to configure the SAP NetWeaver AS Java, you re in the right place. If you re trying to configure the SAP NetWeaver ABAP, see Configuring SAP NetWeaver ABAP Note This document is written with SAP NetWeaver AS Java 7.3 EHP1 (7.3.1). If you are not using version 7.3.1, your interface may differ from the illustrations. Only versions 7.3 and are supported. An overview of configuring SAP NetWeaver AS Java for SSO The following is an overview of the steps required to configure the SAP NetWeaver AS Java Web application for single sign-on (SSO) via SAML. SAP NetWeaver AS Java offers both IdP-initiated SAML SSO (for SSO access through theuser portal or Cloud Manager) and SPinitiated SAML SSO (for SSO access directly through the SAP NetWeaver AS Java web application). You can configure SAP NetWeaver AS Java for either or both types of SSO. Enabling both methods ensures that users can log in to SAP NetWeaver AS Java in different situations such as clicking through a notification . 1 Prepare SAP NetWeaver AS Java for single sign-on (see "SAP NetWeaver AS Java requirements for SSO" on page 75-2). 2 Add and begin to configure SAP NetWeaver AS Java application in Cloud Manager. Once the application settings are configured, complete the user account mapping and assign the application to one or more roles. For details, see "Configuring SAP NetWeaver AS Java in Cloud Manager (Part 1)" on page Enable SAML and Create a Local Provider. For more information, see "Enabling SAML and creating a local provider in SAP NetWeaver Administrator" on page Create and Enable a Trusted Provider for Centrify. For more information, see "Creating and enabling a trusted provider" on page Create Authentication Stack for SAML

2 Preparing for Configuration For more information, see "Creating a new authentication stack for SAML 2.0" on page Configure ticket Policy Configuration to use SAML 2.0. For more information, see "Configuring the SAML 2.0 login process to use the authentication stack" on page Finish configuring SAP NetWeaver AS Java application for single sign-on. For details, "Configuring SAP NetWeaver AS Java in Cloud Manager (Part 2)" on page After you have finished configuring the application settings in the Cloud Manager and the SAP NetWeaver AS Java application, users are ready to launch the application from the Centrify user portal. Preparing for Configuration SAP NetWeaver AS Java requirements for SSO Before you configure the SAP NetWeaver AS Java web application for SSO, you need the following: SAP NetWeaver AS Java. An active SAP NetWeaver AS Java account with administrator rights for your organization. For more set-up information: Configuring AS Java as a service provider: f2311a4181bddf0faa2e3e8a9a/content.htm Configuring SAML 2.0 based SSO for NetWeaver 7.3 Portal: Setting up the certificates for SSO To establish a trusted connection between the web application and the cloud service, you need to have the same signing certificate in both the application and the application settings in Cloud Manager. If you use your own certificate, you upload the signing certificate and its private key in a.pfx or.p12 file to the application settings in Cloud Manager. You also upload the public key certificate in a.cer or.pem file to the web application. Chapter 75 Configuring SAP NetWeaver AS Java 2

3 Preparing for Configuration To download an application certificate from Cloud Manager (overview): 1 In the Apps page, add the application. 2 Click the application to open the application details. 3 In the Application Settings tab, click Download Signing Certificate to download and save the certificate. What you need to know about SAP NetWeaver AS Java Each SAML application is different. The following table lists features and functionality specific to SAP NetWeaver AS Java. Capability Web browser client Mobile client SAML 2.0 SP-initiated SSO IdP-initiated SSO Supported? No Support details Force user login via SSO only If SP-initiated SSO is enabled and Selection Mode is Automatic. Separate administrator login after SSO is enabled User or Administrator lockout risk Users can be locked out of SAP if they cannot access IdP. You can specify a back door URL by adding the parameter saml2=disabled to your destination URL. For example: Automatic user provisioning No SAP NetWeaver Portal: http(s)://(sap-nw-as-java-fqdn-and-port)/irj/ portal?saml2=disabled SAP NetWeaver Administrator: http(s)://(sap-nw-as-java-fqdn-and-port)/ nwa?saml2=disabled Multiple User Types Refer to SAP NetWeaver AS Java documentation for details. Self-service password Users can reset their own passwords and administrators can reset user passwords. Access restriction using a corporate IP range You can specify an IP Range in the Cloud Manager Policy page to restrict access to the application. Cloud Manager user s guide 3

4 Configuring SAP NetWeaver AS Java in Cloud Manager (Part 1) Configuring SAP NetWeaver AS Java in Cloud Manager (Part 1) To add and configure the SAP NetWeaver AS Java application in Cloud Manager: 1 In Cloud Manager, click Apps. 2 Click Add Web Apps. The Add Web Apps screen appears. 3 On the Search tab, enter the partial or full application name in the Search field and click the search icon. 4 Next to the application, click Add. 5 In the Add Web App screen, click to confirm. Cloud Manager adds the application. 6 Click Close to exit the Application Catalog. The application that you just added opens to the Application Settings page. 7 On the Account Mapping page, click Download SAML Provider Metadata Document. This downloads an XML file onto your computer that you will need in the section, "Creating and enabling a trusted provider" on page Chapter 75 Configuring SAP NetWeaver AS Java 4

5 Configuring SAP NetWeaver AS Java in Cloud Manager (Part 1) 8 On the Application Settings page, expand the Additional Options section and specify the following settings: Option Application ID Show in User app list Security Certificate Description Configure this field if you are deploying a mobile application that uses the Centrify mobile SDK, for example mobile applications that are deployed into a Samsung KNOX version 1 container. The cloud service uses the Application ID to provide single sign-on to mobile applications. Note the following: The Application ID has to be the same as the text string that is specified as the target in the code of the mobile application written using the mobile SDK. If you change the name of the web application that corresponds to the mobile application, you need to enter the original application name in the Application ID field. There can only be one SAML application deployed with the name used by the mobile application. The Application ID is case-sensitive and can be any combination of letters, numbers, spaces, and special characters up to 256 characters. Select Show in User app list so that this web application displays in the user portal. (By default, this option is selected.) If this web application is only needed in order to provide SAML for a corresponding mobile application, deselect this option. This web application won t display for users in the user portal. These settings specify the signing certificate used for secure SSO authentication between the cloud service and the web application. Just be sure to use a matching certificate both in the application settings in the Cloud Manager and in the application itself. Select an option to change the signing certificate. Use existing certificate When selected the certificate currently in use is displayed. It s not necessary to select this option it s present to display the current certificate in use. Use the default tenant signing certificate Select this option to use the cloud service standard certificate. This is the default setting. Use a certificate with a private key (pfx file) from your local storage Select this option to use your organization s own certificate. To use your own certificate, you must click Browse to upload an archive file (.p12 or.pfx extension) that contains the certificate along with its private key. If the file has a password, you must enter it when prompted. 9 (Optional) On the Description page, you can change the name, description, and logo for the application. For some applications, the name cannot be modified. The Category field specifies the default grouping for the application in the user portal. Users have the option to create a tag that overrides the default grouping in the user portal. Cloud Manager user s guide 5

6 Configuring SAP NetWeaver AS Java in Cloud Manager (Part 1) 10 On the User Access page, select the role(s) that represent the users and groups that have access to the application. When assigning an application to a role, select either Automatic Install or Optional Install: Select Automatic Install for applications that you want to appear automatically for users. If you select Optional Install, the application doesn t automatically appear in the user portal and users have the option to add the application. 11 (Optional) On the Policy page, specify additional authentication control for this application.you can select one or both of the following settings: Restrict app to clients within the Corporate IP Range: Select this option to prevent users outside the company intranet from launching this application. To use this option, you must also specify which IP addresses are considered as your intranet by specifying the Corporate IP range in Settings > Corporate IP Range. Require Strong Authentication: Select this option to force users to authenticate using additional, stronger authentication mechanisms when launching an application. Specify these mechanisms in Policy > Add Policy Set > Account Security Policies > Authentication. You can also include JavaScript code to identify specific circumstances when you want to block an application or you want to require additional authentication methods. For details, see Specifying application access policies with JavaScript. 12 On the Account Mapping page, configure how the login information is mapped to the application s user accounts. The options are as follows: Use the following Directory Service field to supply the user name: Use this option if the user accounts are based on user attributes. For example, specify an Active Directory field such as mail or userprincipalname or a similar field from the Centrify user service. Everybody shares a single user name: Use this option if you want to share access to an account but not share the user name and password. For example, some people share an application developer account. Use Account Mapping Script: You can customize the user account mapping here by supplying a custom JavaScript script. For example, you could use the following line as a script: LoginUser.Username = LoginUser.Get('mail')+'.ad'; The above script instructs the cloud service to set the login user name to the user s mail attribute value in Active Directory and add.ad to the end. So, if the user s mail attribute value is Adele.Darwin@acme.com then the cloud service uses Chapter 75 Configuring SAP NetWeaver AS Java 6

7 Enabling SAML and creating a local provider in SAP NetWeaver Administrator Adele.Darwin@acme.com.ad. For more information about writing a script to map user accounts, see the SAML application scripting guide. 13 (Optional) On the Advanced page, you can edit the script that generates the SAML assertion, if needed. In most cases, you don t need to edit this script. For more information, see the SAML application scripting guide. On the Changelog page, you can see recent changes that have been made to the application settings, by date, user, and the type of change that was made. Note 14 Click Workflow to set up a request and approval work flow for this application. See Configuring Workflow for more information. 15 Click Save. After configuring the application settings (including the role assignment) and the application s web site, you re ready for users to launch the application from the user portal. Leave the browser tab open to the Cloud Manager. You will use it again in "Configuring SAP NetWeaver AS Java in Cloud Manager (Part 2)" on page Enabling SAML and creating a local provider in SAP NetWeaver Administrator To enable and configure SAML 2.0: 1 Open a new browser tab, navigate to your Web GUI URL (resembles: http(s)://<sapjava-hostname-and-port-number>/nwa), and log in to the SAP NetWeaver Administrator as an administrator. 2 Select Configuration > Authentication and Single Sign-On. 3 Click SAML 2.0 > Enable SAML 2.0 Support. 4 In Provider Name, enter CentrifySAML and click Next. Note If you enter a different provider name here, you must also enter it in the Local Provider Name field in Application Settings of your SAML application. See "Configuring SAP NetWeaver AS Java in Cloud Manager (Part 2)" on page for details. 5 Click Browse for Signing Key Pair. 6 Click Create. 7 Supply an Entry Name to identify this key entry. All the other required fields in this box have default values. Make any desired changes to these other fields. 8 Click Next. Cloud Manager user s guide 7

8 Enabling SAML and creating a local provider in SAP NetWeaver Administrator 9 In commonname, enter any value you would like SAP to use to identify this key pair when SAP generates it. For example, use the host name of your SAP NetWeaver AS Java instance. 10 Click Finish. The Select Keystore Entry window appears showing the new key pair you just created. 11 Click OK. Under Signature and Encryption, Signing Key Pair and Encryption Key Pair are filled in for you with the new key pair you just created. 12 Select On under Legacy Systems Support (Issue Login Ticket). 13 Click Next. 14 (Optional) If you plan to use SP-initiated SSO, choose one of the following for the Selection Mode under Identity Provider Discovery: Manual: displays the identity provider selection screen when the SP-initiated SSO launches. Then the user must select a configured IdP, or click the Cancel button to return to the username-password login screen. Automatic: redirects users to the default trusted provider (configured later starting here: "Creating and enabling a trusted provider" on page 75-9). Users who lose access to their IdP are locked out of SAP NetWeaver AS Java. 15 (Optional) Uncheck the remaining check boxes. 16 Click Finish. 17 Under Local Provider, select Service Provider Settings > Edit. 18 Copy the Endpoint URL and save it in a location where you can find it when "Configuring SAP NetWeaver AS Java in Cloud Manager (Part 2)" on page In Default Application Path, enter the relative path to the page where you want SSO users to land, such as: /irj/portal 20 Click Save. 21 (Optional) If you plan to use SAML over HTTP, follow these steps: a b c d Click General Settings. Click Edit. Select for Allow HTTP Access. Click Save. 22 Continue to "Creating and enabling a trusted provider" on page Chapter 75 Configuring SAP NetWeaver AS Java 8

9 Creating and enabling a trusted provider Creating and enabling a trusted provider Note This procedure continues from "Enabling SAML and creating a local provider in SAP NetWeaver Administrator" on page Click Trusted Providers. 2 Select Add > Uploading Metadata File. 3 In the SAML 2.0 Configuration pop-up window, click Browse and select the metadata file you downloaded in "Configuring SAP NetWeaver AS Java in Cloud Manager (Part 1)" on page Click Next. 5 (Optional) Enter Centrify as the Alias. If entered, SAP NetWeaver AS Java will show the name of the alias on the IdP selection screen; if not entered the selection screen will show the IdP s Entity ID that was provided in the IdP Metadata. 6 Click Next. 7 On the screen that appears, leave all the default values unchanged and click Next again. 8 Select HTTP Post and click Next. 9 Continue clicking Next without changing any values until the Finish button appears. 10 Click Finish. 11 Select the trusted provider you just created under the List of Trusted Providers. 12 Click Edit. 13 Click Identity Federation under Details of trusted provider. 14 Click Add. 15 Select Unspecified as the Format Name. 16 Select Logon ID as the Source Name. 17 Click OK. The new section Details of Name ID Format Unspecified appears at the bottom of the Trusted Providers screen. 18 Click Save at the top of the screen. 19 Click Enable. The Active icon changes from a gray diamond to a green square. 20 Continue to "Creating a new authentication stack for SAML 2.0" on page Cloud Manager user s guide 9

10 Creating a new authentication stack for SAML 2.0 Creat reating a new authentication stack for SAML 2.0 Note This procedure continues from "Creating and enabling a trusted provider" on page Go to the Authentication tab. 2 Click Create. 3 Enter centrify-saml20 as the Configuration Name. 4 Leave the default Type set to Custom. 5 Click Create. Your new custom configuration displays as the selected configuration in the Authentication tab. 6 Click Edit in the Authentication Stack tab. 7 Click Add and select EvaluateTicketLoginModule from the <Select Login Module> drop-down list. 8 Click Add and select SAML2LoginModule from the <Select Login Module> dropdown list. 9 Click Add and select BasicPasswordLoginModule from the <Select Login Module> drop-down list. 10 Click Add and select CreateTicketLoginModule from the <Select Login Module> drop-down list. 11 Select the Optional flag for CreateTicketLoginModule. 12 Click Save. Your Login Modules table should look like this: 13 Continue to "Configuring the SAML 2.0 login process to use the authentication stack" on page Chapter 75 Configuring SAP NetWeaver AS Java 10

11 Configuring the SAML 2.0 login process to use the authentication stack Configur onfiguring ing the SAML 2.0 login process to use the authentication stack Note This procedure continues from "Creating a new authentication stack for SAML 2.0" on page In the Policy Configuration Name table, scroll down and select Ticket. 2 Click Edit in the Authentication Stack tab. 3 Enter centrify-saml20 as the Used Template. 4 Click Save. Configuring SAP NetWeaver AS Java in Cloud Manager (Part 2) To finish configuring the SAP NetWeaver AS Java application in Cloud Manager: 1 Return to the browser tab you were using to work in the Cloud Manager in "Configuring SAP NetWeaver AS Java in Cloud Manager (Part 1)" on page 75-4 and navigate to the Application Settings screen of your SAP NetWeaver AS Java app. 2 Configure the following: Field ACS Endpoint URL Local Provider Name Set it to The SAML Endpoint saved from "Enabling SAML and creating a local provider in SAP NetWeaver Administrator" on page 75-7 The name of your local provider; either CentrifySAML or the name saved from "Enabling SAML and creating a local provider in SAP NetWeaver Administrator" on page 75-7 What you do Paste the SAML Endpoint from the SAP NetWeaver AS Java Administrator. Enter the local provider name you provided in Step 4 on page 7 of "Enabling SAML and creating a local provider in SAP NetWeaver Administrator" on page Click Save. For more information about SAP NetWeaver AS Java Contact SAP NetWeaver AS Java for more information about configuring SAP NetWeaver AS Java for SSO. Cloud Manager user s guide 11