Configuring SAP SSO for Winshuttle SAP Integration Server 11.x

Winshuttle Server Workers connect with SAP to upload and download data, and SAP SSO (Single Sign On) logon for Autorun functionality, or for using published Winshuttle Transaction and Winshuttle Query web services used by Winshuttle Forms.

On this page

Note: Full Kerberos SSO is not supported end to end and Windows credentials are needed.

Configuring SAP SSO

If a published web service does not use the ‘RunWithSapCreds’ method, an extra parameter (‘WindowsCreds’) is added to the ‘Run’ method. In this case the user will need to enter Windows credentials for this parameter.

In case of AutoRun, Windows Credentials need to be filled in Winshuttle Foundation.

Notes:
For SAP SSO logon scenarios, all users posting data using published web services or AutoRun in Winshuttle Server must have basic logon access rights on the machines where Winshuttle worker is installed.

When using Kerberos-based SSO, both SAP and Windows credentials need to be provided. For more information, see Winshuttle Foundation settings—Manage Credentials.

Because it is not practical to add all the users on all worker machines, it is recommended that you create a permissions group with the users, and then provide the group with logon access rights on all worker machines.

Note: In Winshuttle SAP Integration Server 11.1, SSO and Non SSO modes can be used simultaneously with SAP SSO setting done on Worker machines.

Note: If you are using Negotiate Provider only, create a new Aname (e.g., <companyname>wfcentraladmin) and bind it to the SharePoint front-end machine 1 IP address. Then create a Cname (wfworkflowadmin.wse.wsmain.local) and bind it to the Aname. WIN-20706

Configuring 64-bit Worker Kerberos SAP SSO

Environment Variables screen
  1. Deploy SAP SSO logon on the machine where Winshuttle Worker is deployed.
  2. The SAP SSO logon deployment creates an environment variable named SNC_LIB as a user environment variable. (See example at right.)
  3. Under System Variables, click New, and then create the same SNC_LIB environment variable (Winshuttle Worker is a windows service and services use System environment variables.) Set its values as the path to gx64krb5.dll.

Alternative method: Define the path to the SNC library in the Worker configuration file. For more information, see the SNC_LIB section of the Configuring Winshuttle Server Worker to set the SNC_Lib parameter.

Note: If the SNC_LIB path is defined in the system environment variables and the Worker configuration file (i.e. you use both Options described above), the system environment variable will be ignored. Instead, the value defined in the Worker configuration file will be used when logging on to SAP from Winshuttle Server.

  1. For a 64-bit machine, copy the 64-bit SSO logon DLL to C:\Windows\system32, and then set its value to the path of the System environment variable.
  2. If you defined environment variables the previous step(s), restart the machine for the changes to take effect.

Configuring 32-bit Worker Kerberos SAP SSO

Environment Variables screen
  1. Deploy SAP SSO logon on the machine where Winshuttle Worker Launch GUI is deployed.
  2. The SAP SSO logon deployment creates an environment variable named SNC_LIB as a user environment variable.
  3. Under System Variables, click New, and then create the same SNC_LIB environment variable. (Winshuttle Worker Launch Gui is a windows service and services use System environment variables.) Set its values as the path to gsskrb5.dll.

Alternative method: Define the path to the SNC library in the Worker Launch Gui configuration file. For more information, see the SNC_Lib section of Configuring Worker Launch Gui to set the SNC_Lib parameter.

Note: If the SNC_LIB path is defined in the system environment variables and the Worker configuration file (i.e. you use both Option 1 and Option 2), the system environment variable is ignored. Instead, the value defined in the Worker Launch Gui configuration file will be used when logging on to SAP from Winshuttle Server.

  1. If you defined environment variables the previous step(s), restart the machine for the changes to take effect.

Configuring 64-bit Worker SAP Netweaver SSO

Environment Variables screen for 64-bit Netweaver configuration

For a SAP NetWeaver SSO configuration, a secure Login Library is used to logon to the SAP system.

To configure SAP NetWeaver Kerberos-based SSO, do the following:

  1. Download the 64-bit Secure Login Library. (You can download these libraries from the SAP Support Portal.)
  2. Copy the libraries to a folder on the machine(s) where Winshuttle Workers are installed. For example: C:\SLL\64-bit\
  3. Set the SNC_LIB path. You can do this 1 of 2 ways:
  • Option 1: Create both User and System variables for SNC_LIB, and then set its value as the path to secgss.dll. (See example at right).
  • Option 2: Define the path to the SNC library in the Worker configuration file. For more information, see the SNC_LIB section of the Configuring Winshuttle Server Worker to set the SNC_Lib parameter.

Note: If the SNC_LIB path is defined in the system environment variables and the Worker configuration file (i.e. you use both Option 1 and Option 2), the system environment variable is ignored. Instead, the value defined in the Worker configuration file will be used when logging on to SAP from Winshuttle Server.

  1. If you defined environment variables the previous step(s), restart the machine for the changes to take effect.

Configuring 32-bit Worker SAP Netweaver SSO

Environment Variables screen

For an SAP NetWeaver SSO configuration, a secure Login Library is used to logon to the SAP system.

To configure SAP NetWeaver Kerberos-based SSO for a 32-bit machine, do the following:

  1. Download the 32-bit Secure Login Library. (You can download these libraries from the SAP Support Portal.)
  2. Copy the libraries to a folder on the machine(s) where Winshuttle Worker (Launch Gui) are installed. For example: C:\SLL\32-bit\
  3. Set the SNC_LIB path using one of the following options:.

Note: If both Winshuttle Worker and Worker Launch GUI are installed, then use Option 2 to define the value of the SNC_LIB in both configuration files.

  • Option 1: Create both User and System variables for SNC_LIB, and then set its value as the path to secgss.dll.
  • Option 2: Define the path to the SNC library in the Worker configuration file. For more information, see the SNC_LIB section of the Configuring Winshuttle Server Worker to set the SNC_Lib parameter.

Note: If the SNC_LIB path is defined in the system environment variables and the Worker configuration file (i.e. you use both Option 1 and Option 2), the system environment variable is ignored. Instead, the value defined in the Worker configuration file will be used when logging on to SAP from Winshuttle Server.

4. If you defined environment variables in step 3, restart the machine for the changes to take effect.