EasyDMS and Single Sign On (SSO)

Use

 Some customer just want to turn off the logon screen for EasyDMS and use the Single Sign On function like for the SAPGUI (using SNC). In case you are trying this on 64bit computer you might face connection error in EasyDMS

Reason:

The reason for this behavior is due to the files 'gsskrb5.dll' or 'gx64krb5.dll'. gsskrb5.dll is the 32-bit version,  gx64krb5.dll the 64-bit version (x64/AMD64), please refer to note 352295 .

From our SNC experts (component BC-SEC-SNC) I got the following additional information from a former message. Therefore I also SAP note 150380 , which describes SAP's support for MIT
Kerberos 5 in general and the test tool GSSTEST. The problem is that the parameter SNC_LIB twice needs to be set twice. In this case the value C:\Windows\system32\gsskrb5.dll is the leading
entry. Unfortunately a 64-bit application will not work with this library.

So if you want use EasyDMS(64-bit) Client via SNC then he has to set SNC_LIB to value C:\Windows\system32\gx64krb5.dll. This value shoul be the leading value. Unfortunately SAP GUI will not work then because this is a 32-bit application and requires gsskrb5.dll.

Solution proposal I

Single sign on (SSO) feature can be enabled for Automatic logon in EasyDMS if single sign on feature is enabled and is properly functional in SAP GUI.
 

Steps:

1. Make sure that Single sign on is configured and is properly functional in SAP GUI.( Hint: "Activate Secure network Communication" should be checked for the system )
2. Select/Enter the system, client and user name in EasyDMS and Login (keep the password blank as now we are using SSO).You will be able to successfully login.
3.  If you do not want the login screen displayed again next time when you log in select "Logon Automatically Next Time" check box.
4. At any point you need to get the login screen again (e.g. To login to another system) press SHIFT + CTRL while login to EasyDMS. Else, after login you can uncheck Menu->Preferences->System(Tab)->Logon to SAP Automatically.

Alternate Possibility:

 SAP Logon Tickets (MYSAPSSO2) can be used as an alternate to SNC for single sign on in EasyDMS.For this you have to copy the SSO ticket generated in SAP back-end system.

Steps:

1. In Txn RZ11,set System Parameter login/create_sso2_ticket = 1 and login/accept_sso2_ticket = 1
2. You need to extract the ticket generated and set the value into registry HKEY_CURRENT_USER\Software\SAP\EasyDms\RfcCache\<SID>\ConnectionParameters\MYSAPSSO2.Also set HKEY_CURRENT_USER\Software\SAP\EasyDms\RfcCache\SID\<CLIENT>\LogonParameters\Userpwd to empty.You may have to use the help of a custom program to automate this process.

 Solution Proposal II

The following steps describe the workaround that should solve the issue to enable SSO for both SAP GUI and SAP EasyDMS:

1. Search and copy the file gx64krb5.dll to directory C:\SAP
2. Start EasyDMS
3. Click the small button next to the systems
   
4. Click NEW or EDIT
   
5. Choose the system name you want and click OK
6. Enter the client-nr and the description. I used the same description as in the saplogon.ini file
   GED [di-ged] ERP Development SSO
   GEP [ci-gep] ERP Production SSO
   GEQ [di-geq] ERP Quality Assurance SSO
   GES [di-ges] ERP Sandbox SSO
   GEX [di-gex] ERP Expermental Sandbox SSO
7. Click NEW, select “SAPLOGON_ID” if this is not present and enter the same value as in step 5 and click OK
8. Click again NEW, select “SNC_LIB” and type in the path to the SSO file e.g. C:\SAP\gx64krb5.dll and press OK afterwards
9. Now it should look like this, if so, click OK
   
10. Test EasyDMS with SSO. Select the system you want.

Related References:

Back