Eliminating Authentication Pop- Ups in SAP Landscapes

Transcription

1 Eliminating Authentication Pop- Ups in Landscapes Cristina Buchholz, Patrick Hildenbrand Product Security, Learning Objectives As a result of this workshop, you will be able to: Understand Authentication and Single Sign-On options with or without the Enterprise Portal Understand Authentication Delegation via Pluggable Authentication Service AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 2

2 Agenda Introduction Why use single sign-on? Single sign-on with Without Enterprise Portal With Enterprise Portal Outlook Summary AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 3 NetWeaver: Introduction Enable the Enterprise Services Architecture Business Intelligence Knowledge Management Portal Collaboration Multi-channel Access Master Data Management Integration Broker Business Process Management NetWeaver is the application and integration platform to unify and align people information and processes across technologies and organizations AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 4

3 NetWeaver NetWeaver People Integration Multi-Channel Access Portal Collaboration Composite Application Framework Business Intelligence Integration Broker Information Integration Master Data Management Process Integration Application Platform Knowledge Management Business Process Management Life Cycle Management J2EE ABAP NET DB DB and OS Abstraction Sphere AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 5 Agenda Introduction Why use single sign-on? Single sign-on with Without Enterprise Portal With Enterprise Portal Outlook Summary AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 6

4 Single Sign-On Single Sign-On R/2 Different ERP systems Open Internet standards 3rd party FI FI CFM KW non mycom 31H R/3 46 HR LO CRM APO BW SEM my components BBP Marketplace Partner Enterprise boundary Outside Inside Various Internet services my Internet services AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 7 Why Use Single Sign-On? Complex system landscapes with many user IDs and different passwords -> Procedures for each system to roll-out, reset and change new/existing passwords High administration cost and effort Users find continuous password changing for many systems annoying Users write passwords down and store them where they can easily be found -> security risk Solution: Single Sign-On Users only have to remember one password to gain access to every system Administration costs and effort are drastically reduced AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 8

5 Agenda Introduction Why use single sign-on? Single sign-on with Without Enterprise Portal With Enterprise Portal Outlook Summary AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 9 Single Sign-On What authentication mechanisms are possible? Single Sign-On mechanisms available for systems SNC SSL and X509 client certificates Logon Tickets Pluggable Authentication Services AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 10

6 Single Sign-On Variants Depending on GUI GUI for Windows GUI for HTML SNC: Partner Product SNC: Microsoft NTLM or Kerberos Logon tickets in Shortcuts X509 client certificates Logon tickets PAS (+ Partner) Additional costs No additional costs Microsoft-only environment proprietary Initial access via ITS Based on standards Available in Internet scenarios Configuration of SSL necessary proprietary No additional costs When using partner, additional costs AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 11 Two Worlds: GUI for Windows and Traditional Secure Network Communications (SNC) GUI for Windows X509 client certificate Logon ticket Pluggable Authentication Service (PAS) Use external authentication mechanisms GUI for HTML AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 12

7 Single Sign-On for GUI for Windows GUI for Windows External security product External security product Use SNC and external security product Authentication takes place outside of system Use -certified SNC product Also available: Windows NTLM (gssntlmdll) Windows 2000 Kerberos (gsskrb5dll) AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 13 Logon Tickets SSO Process Initial logon External system Intranet Logon Ticket Any other page Internet AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 14

8 Verifying the Logon Ticket: s Logon Ticket Component system Server s public-key certificate Step 1: Verification of the digital signature provided with the Logon Ticket Step 2: Logon using the user ID which is stored in the Logon Ticket No additional authentication using password or certificate necessary AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 15 Logon Ticket / ****** / ****** Initial authentication (user ID / password) on ticket-issuing system issues user logon ticket Digitally signed by ticket-issuing server Provides for integrity and authenticity protection Accepting systems check logon ticket for validity AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 16

9 Issuing Logon Tickets PSE system / ****** / ****** Set up one system as ticket issuer must be >= Release 46D must possess public and private key pair Stored in system PSE AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 17 Verifying Logon Tickets PSE system / ****** / ****** 3 1 system Step 1: Verify digital signature Step 2: Check access control list Step 3: Log user on to system SSO Access Control List Ticket-Issuing Server <SID> <client> 2 AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 18

10 Configuring the Use of Logon Tickets Step 1: Configure the ticket-issuing system: application server Step 2: Configure the ticket-issuing system: ITS Step 3: Configure accepting system: application server Step 4: Configure accepting system: ITS Step 5: Test the connection AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 19 Step 1: Configure the Ticket-Issuing Application Server Profile Set profile parameters # logon ticket parameters login/create_sso2_ticket = 1 login/accept_sso2_ticket = 1 login/ticket_expiration_time = 60 Restart application server AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 20

11 Step 2: Configure the Ticket-Issuing ITS Global service file parameters globalsrvc ~login ~password ~cookies 1 Individual service file parameters systeminfosrvc ~mysapcomgetsso2cookie 1 ~mysapcomusesso2cookie 1 ~mysapcomnosso1cookie 1 ~mysapcomnoits 1 AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 21 Step 3: Configure the Accepting s Application Server Also applies to ticket-issuing system Profile parameter: login/accept_sso2_ticket Access Control List TWPSSO2ACL Contains entry for ticket-issuing system Certificate List Contains ticket-issuing system s public-key certificate (if login/create_sso2_ ticket = 2 on ticket-issuing system) Maintenance transaction SSO2 Activate! AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 22

12 Step 4: Configure the Accepting s ITS ~login Service file parameters ~password ~mysapcomusesso2cookie 1 AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 23 Step 5: Test the Configuration Set browser to prompt for cookies Access ticket-issuing application server using service (for example, systeminfo) Logon ticket is cookie named MYSSO2 AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 24

13 X509 Client Certificates Authentication occurs using SSL with mutual authentication User possesses a private and public key pair and public-key certificate Access to -based systems, for example, the AS or non- systems that support SSL SSL AS SSL SSL AS non- AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 25 Pluggable Authentication Service (PAS) ~~~~ ~~~~ Authentication using an external authentication service Windows NTLM Protocol Windows user ID / password checking using the domain controller LDAP bind Radius / SecureID HTTP header variables After authentication the user is issued a Logon Ticket for use with services AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 26

14 Pluggable Authentication Service External Authentication Mechanisms Examples: Windows NT LAN Manager (NTLM) Verifying user ID and password on the Windows domain controller LDAP bind SSL and X509 client certificates Arbitrary mechanism on the server that sets HTTP header variable Arbitrary mechanisms provided by a partner AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 27 Pluggable Authentication Service: AGate Verifying user ID and password on the Windows domain controller LDAP bind Arbitrary mechanisms provided by a partner User External ID Mapping Table (USREXTID) External Auth Mech Authentication ( and Password) server WGate AGate sapextauth AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 28

15 Pluggable Authentication Service: WGate Windows NT LAN Manager (NTLM) SSL and X509 client certificates Arbitrary mechanism on the server that sets HTTP header variable User External ID Mapping Table (USREXTID) External Auth Mech Authentication ( and Password) server WGate AGate sapextauth AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 29 Pluggable Authentication Service: SNC Required between AGate and ticket-issuing application server Recommended between AGate and accepting systems If authentication mechanism occurs on the server, then also recommended between the AGate and the WGate User External ID Mapping Table (USREXTID) External Auth Mech Authentication ( and Password) server WGate AGate sapextauth SNC SNC AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 30

16 Pluggable Authentication Service: Process 1 The user enters the URL for the PAS service User External ID Mapping Table (USREXTID) External Auth Mech Authentication ( and Password) server WGate AGate sapextauth SNC SNC AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 31 Pluggable Authentication Service: Process 2 The user provides authentication information (user ID and password) User External ID Mapping Table (USREXTID) External Auth Mech Authentication ( and Password) server WGate AGate sapextauth SNC SNC AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 32

17 Pluggable Authentication Service: Process 3 The external authentication mechanism verifies the user s information User External ID Mapping Table (USREXTID) External Auth Mech Authentication ( and Password) server WGate AGate sapextauth SNC SNC AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 33 Pluggable Authentication Service: Process 4 The ticket-issuing system maps the external user ID to the user ID User External ID Mapping Table (USREXTID) External Auth Mech Authentication ( and Password) server WGate AGate sapextauth SNC SNC AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 34

18 Pluggable Authentication Service: Process 5 The user is issued a logon ticket External Auth Mech User External ID Mapping Table (USREXTID) Authentication ( and Password) server WGate AGate sapextauth SNC SNC AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 35 Pluggable Authentication Service: Process 6 The AGate redirects the user to the initially desired service (myservice) Authentication ( and Password) External Auth Mech User External ID Mapping Table (USREXTID) server WGate AGate sapextauth AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 36

19 Configuring Pluggable Authentication Services Step 1: Install PAS module Step 2: Set service file parameters Step 3: Maintain user mapping AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 37 Step 1: Install PAS Module PAS package ntauthsar Attached to Note Contains sample service files and template files Install in \services and \templates directories AGate D: Program Files ITS 20 AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 38 <SID> services sapntauthsrvc templates sapntauth 99 loginhtml extautherrorhtml redirecthtml Copy and rename if necessary (for example, sapntpasswd, sapldap, saphttp, etc

20 Step 2: Set the Service File Parameters ~xgateway sapextauth ~extauthtype NTLM ~extid_type NT ~mysapcomgetsso2cookie 1 ~dont_recreate_ticket 1 ~redirecthost host1 ~redirectpath /scripts/wgate/webgui/! ~redirectqs ~client=000&~language=en ~redirecthttps 1 ~login_to_upcase 1 AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 39 Step 3: Maintain The User Mapping User s external ID must correspond to an system user ID Maintain in table USREXTID (Report RSUSREXTID) Type NT Type = ITS parameter ~extid_type External ID Seq No User Mindate Activ MYDOMAIN/ALICE 000 ALICE 01/01/2002 User s external ID User s sytem ID AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 40

21 Pluggable Authentication Service: Digital Certificates SSL and X509 client certificates User external ID mapping table (USREXTID) Optional revocation Third Party system user ID Authentication server WGate AGate sapextauth system user ID AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 41 Obtaining a Digital Certificate Digital certificates must be X509v3 compliant Various options possible: Using Trust Center Service For users only Free of charge Portal server acts as Registration Authority (RA) Setting up internal PKI system Buy software from CA product vendor Using external PKI system Contract with Trust Center Service AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 42

22 Trust Center Service: Enrollment Process Trust Center Service 5 Verifies naming conventions and issues certificate 4 Send approved certificate request browser 1 2 Log on using user ID and password and initiate the Passport request Specify naming convention and trigger key generation Portal Server 3 browser generates key pair and sends the Passport request 6 Log on using the Passport AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 43 Combining the Two Worlds GUI for HTML GUI for Windows AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 44

23 SSO From to Traditional Using logon tickets, ITS, and Shortcuts Logon ticket is passed to Shortcut using ITS service wngui GUI for HTML server WGate AGate sapextauth Start Shortcut GUI for Windows AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 45 Logon Ticket: Non- s The Logon Ticket contains public information only: Validity period Issuing system Digital signature Therefore we can offer a library which can be linked to other systems These systems can verify the user s Logon Ticket and use the stored information for their own logon AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 46

24 SSO to Non- Components Using Logon Tickets 2 Ticket Verification Library SSOEXT Non- -based application Ticket 3 Security product (SECULIB) Ticket 1 server Public address book (if not SECULIB) Legend 4 ticket Digitally-signed mycom Logon Ticket Access Control List Workplace server s public-key certificate issued by the CA Workplace server s public key if not issued by the CA Services/objects provided by Services/objects to be provided by application 5 Workplace server <SID> <client> mycom user ID Application user ID AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 47 Agenda Introduction Why use single sign-on? Single sign-on with Without Enterprise Portal With Enterprise Portal Outlook Summary AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 48

25 Authentication Initial Logon Procedure Verification of the user s identity Initial logon procedure to authenticate user Various authentication methods / password X509 digital certificates Third-party authentication Windows authentication Access Management (WAM) products Others through JAAS interface (pluggable JAAS login modules) Anonymous user concept AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 49 Authentication Process / PW Logon Ticket Portal Server / PW verification mapping User Persistence Store Portal Database SSL SSL X509 Certificate Logon Ticket Portal Server X509 Certificate Comparison mapping User Persistence Store Portal Database SSL SSL AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 50

26 SSO to Non- Components Using Logon Tickets Two alternatives: Server Filter 2 1 Logon Ticket Filter HTTP header field: Application user ID Portal Server s public-key certificate server Non- component system Application Programming Interface (API) 2 1 Logon Ticket Non- component system 3 Application user ID Ticket verification library (DLL) Portal Server s public-key certificate AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 51 SSO Account Aggregation If the external system does not support logon tickets Portal components connect to the external system with the user s credentials (user ID and password) User mapping and credentials are stored in the Portal Database Administrator maps user using administration iview User maps own credentials using portal personalization function Portal User: User: Siebel UserID/Password: Michael_Schumacher d , {yu323ab} Anna_Kournikova i , {34u0nap} Tiger_Woods i , {wq9itxm1} Cathy Freeman i , {12onxc85} AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 52

27 Agenda Introduction Why use single sign-on? Single sign-on with Without Enterprise Portal With Enterprise Portal Outlook Summary AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 53 Outlook JAAS logon modules SAML tickets AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 54

28 Agenda Introduction Why use single sign-on? Single sign-on with Without Enterprise Portal With Enterprise Portal Outlook Summary AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 55 Authentication Mechanisms External authentication / password X509 certificates Logon Tickets NTLM LDAP bind Radius Pluggable authentication adapter access management products Enterprise Portal Application s Jaas login module HTTP header variables AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 56

29 Summary You have learned to understand authentication and single sign-on options for solutions with and without the Enterprise Portal AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 57 Further Information Public : wwwsapcom/netweaver Key Capabilities Security Customer Services Network: wwwsapcom/services/ Consulting Contact Frank Rambo, NetWeaver Security Consulting (frankrambo@sapcom) Related Education Training Opportunities ADM960 Security in Environment AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 58

30 Questions? Q&A AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 59 Feedback Please complete your session evaluation and drop it in the box on your way out Thank You! The TechEd 03 Basel Team AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 60

31 Copyright 2003 AG All Rights Reserved No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of AG The information contained herein may be changed without prior notice Some software products marketed by AG and its distributors contain proprietary software components of other software vendors Microsoft, WINDOWS, NT, EXCEL, Word, PowerPoint and SQL Server are registered trademarks of Microsoft Corporation IBM, DB2, DB2 Universal Database, OS/2, Parallel Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400, iseries, pseries, xseries, zseries, z/os, AFP, Intelligent Miner, Sphere, Netfinity, Tivoli, Informix and Informix Dynamic Server TM are trademarks of IBM Corporation in USA and/or other countries ORACLE is a registered trademark of ORACLE Corporation UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group Citrix, the Citrix logo, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, MultiWin and other Citrix product names referenced herein are trademarks of Citrix s, Inc HTML, DHTML, XML, XHTML are trademarks or registered trademarks of W3C, World Wide Consortium, Massachusetts Institute of Technology JAVA is a registered trademark of Sun Microsystems, Inc JAVASCRIPT is a registered trademark of Sun Microsystems, Inc, used under license for technology invented and implemented by Netscape MarketSet and Enterprise Buyer are jointly owned trademarks of AG and Commerce One, R/3, my, mycom, xapps, xapp and other products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of AG in Germany and in several other countries all over the world All other product and service names mentioned are the trademarks of their respective companies AG 2003, TechED EMEA, SCUR251, Cristina Buchholz; Patrick Hildenbrand/ 61