Hi Experts,
We have to implement SSO for one of our customers where we have ECC, EP, BI &GRC systems. They are looking to achieve this using
- Kerberos with SNC for AS-ABAP
- Kerberos with SPNEGO for AS-JAVA
Also the AD User and SAP User ID's are not the same.
So here's are my queries:
1. As the users are not the same in SAP and AD, I have to set the CN Name according to the AD User in SU01 of the respective SAP Id, but as I have around 1000 users is there any way that I can set it for all the users at one shot ?
2. One risk I could see is that if anyone who can edit the CN name of a SAP ID to his respective Kerberos Token ID, he would be able to access any user !!! so can this be avoided by any means ??
3. Are there any other disadvantages associated with the above approach with Kerberos for AS-ABAP and AS-JAVA and with different AD and SAP User ID's
Thanks in Advance !!!
Regards,
Srikanth G