Intranet Access Management

Open the Microsoft Management Console (MMC) for Active Directory Users and Computers with user privileges to manage user accounts.

In the console tree, click the Users organizational unit (OU).

Right-click the Users OU, point to New, and then click User.

In the New Object-User dialog box, type the following information (leave all other information at the default values).

First name: <Solaris_User_First name>

Last name: <Solaris_User_Last name>

User logon name: <Solaris_User_UNIX_Account_Name>

User logon name (pre-Windows 2000): <Solaris_User_UNIX_Account_Name>

Click Next.

In the New Object-User dialog box, type the following information.

Password: <Alphanumeric_Password>

Confirm password: <Alphanumeric_Password>

Click Next, and then click Finish.

Open the Active Directory Users and Computers MMC with user privileges to manage user accounts.

Right-click na.corp.contoso.com, point to New, and then click Organization Unit.

In the New Object-Organizational Unit dialog box, type Solaris Workstations and then click OK.

Right-click Solaris Workstations, point to New, and then click User.

In the New Object-User dialog box, type the following information (leave all other information at the default values).

First name: <Solaris_Workstation_Name>

User logon name: <Solaris_Workstation_Name>

User logon name (pre-Windows 2000): <Solaris_Workstation_Name>

In the New Object–User dialog box, click Next, and then type the following information:

Password: <Alphanumeric_Password>

Confirm password: <Alphanumeric_Password>

In the same dialog box, clear the User must change password at next logon check box, and select the Password never expires check box.

Click Next, and then click Finish.

Log on to the domain controller as Administrator.

Click Start, click Run, type cmd and then press ENTER to open the command prompt.

At the command prompt, run the ktpass utility with the command line switches specified in this step with the following modifications.

ktpass -princ 
host/<Solaris_Workstation_Name>.na.corp.contoso.com@
NA.CORP.CONTOSO.COM -mapuser <Solaris_Workstation_Name> 
-pass password -out <Solaris_Workstation_Name>.keytab

Press ENTER, and the following output should appear.

Note   Some of the lines in the following code have been displayed on multiple lines for better readability.

Targeting domain controller: GRNCDC01.na.corp.contoso.com
Successfully mapped host/ 
Solaris_Workstation_Name.na.corp.contoso.com to 
Solaris_Workstation_Name.
Key created.
Output keytab to Solaris_Workstation_Name.keytab:
Keytab version: 0x502
keysize 79 host/ Solaris_Workstation_Name.na.corp.contoso.com@
NA.CORP.CONTOSO.COM ptype 1 (KRB5_NT_PRINCIPAL) vno 3 
etype 0x3 (DES-CBC-MD5) keylength 8 (0x0e9bd5da314f5bad)
Account Solaris_Workstation_Name has been set for 
DES-only encryption.

Use File Transfer Protocol (FTP) to send the keytab file created on the domain controller to the Solaris 9 operating system running on the UNIX workstation.

Important   Because you are going to exchange data between a computer running Windows Server 2003 and a Solaris 9 host, ensure that the transfer mode is set to binary for the FTP session.

Log on to the UNIX workstation as root.

Verify that DNS is installed. The /etc/resolv.conf file should include the following information.

domain na.corp.contoso.com
nameserver 10.1.103.13

At the # prompt, type ktutil and then press ENTER.

At the ktutil: command prompt, type rkt Solaris_Workstation_Name.keytab and then press ENTER.

At the ktutil: command prompt, type list, press ENTER, and the following output should appear.

ktutil: list
slot KVNO Principal
1 3 host/ffl-na-sun-01.na.corp.contoso.com@NA.CORP.CONTOSO.COM

At the ktutil: command prompt, type wkt /etc/krb5/krb5.keytab and then press ENTER.

At the ktutil: command prompt, type q and then press ENTER.

Log on to the UNIX workstation as root

Make a backup by copying the default /etc/pam.conf file and renaming the backup file /etc/pam.conf.old

The Tools and Templates folder that downloads with this paper contains an example of a pam.conf file that is used on the UNIX workstation to enable authentication using the Kerberos version 5 protocol.

Copy the provided file to the UNIX workstation or modify the existing /etc/pam.conf file to match the following information in the configuration file.

#
# PAM configuration
#
#
# Contoso's pam.conf to enable Kerberos
#
# Authentication
#
other   auth sufficient         pam_krb5.so.1
other   auth sufficient         pam_unix.so.1 try_first_pass
#
# Password
#
other   password sufficient     pam_krb5.so.1
other   password sufficient     pam_unix.so.1
#
# Account 
#
other   account optional        pam_krb5.so.1
other   account optional        pam_unix.so.1
#
# session
#
other   session optional        pam_krb5.so.1
other   session optional        pam_unix.so.1

Log on to the UNIX workstation as root

Make a backup by copying the default /etc/krb5/krb5.conf file and then rename the backup file /etc/krb5/krb5.conf.old

Customize the krb5.conf file in the Tools and Templates folder that downloads with this paper for your environment, and then copy it to the /etc/krb5/krb5.conf file on the UNIX workstation. An example of information contained in this configuration file that Contoso used follows:

Note   Some of the lines in the following code have been displayed on multiple lines for better readability.

[libdefaults]
    default_realm = NA.CORP.CONTOSO.COM
[realms]
    NA.CORP.CONTOSO.COM = {
    kdc = ffl-na-dc-01.na.corp.contoso.com
    admin_server = ffl-na-dc-01.na.corp.contoso.com
        kpasswd_protocol = SET_CHANGE
    }
[domain_realm]
    .na.corp.contoso.com = NA.CORP.CONTOSO.COM
[logging]
    default = FILE:/var/krb5/kdc.log
    kdc = FILE:/var/krb5/kdc.log
    kdc_rotate = {
# How often to rotate kdc.log. Logs will get rotated
# no more
# often than the period, and less often if the KDC is
# not used# frequently.
    period = 1d
# how many versions of kdc.log to keep around 
# (kdc.log.0, kdc.log.1, ...)
    version = 10
}
[appdefaults]
    kinit = {
    renewable = true
    forwardable= true
    }
    gkadmin = {
        help_url = http://docs.sun.com:80/ab2/coll.384.1
		/SEAM/@AB2PageView/1195
    }

Confirm that the UNIX workstation system clock is synchronized with the domain controller clock. Run the date command on the UNIX system, and run the time command on the Windows domain controller. After accounting for any difference in time zone settings, adjust the time on the UNIX system to within 5 minutes of the time reported by the domain controller.

Important   This is a Kerberos version 5 protocol requirement. The system clocks cannot be more than 5 minutes out of synchronization.

Log on to the UNIX workstation as root

Open the /etc/shadow file in a text editor.

Find the entry for the Active Directory user, and then delete the entire line for it.

Open the Active Directory Users and Computers MMC with user privileges to manage user accounts.

In the console tree, right-click the Users OU, point to New, and then click User.

In the New Object-User dialog box, type the following information.

First name: SAP

Last name: Logon

User logon name: sapacct@na.corp.contoso.com

User logon name (pre-Windows 2000): sapacct

Note   Do not change any other default value information in this dialog box.

Click Next, and then in the New Object-User dialog box, type the following information:

Password: <Alphanumeric_Password>

Confirm password: <Alphanumeric_Password>

Locate the setspn.exe utility on the Windows 2003 Server Resource Kit CD or download it from the Windows 2000 Resource Kit Tool: Setspn.exe page.

While logged on as a domain administrator, type the following at the command prompt: SETSPN -A SAPService/<host computer name> NA\sapacct

Note   This task is necessary on Windows Server 2003 because the KDC will invoke the Kerberos user2user protocol for any account that does not have an SPN. Because the SPN is not actually used by the SAP client when requesting Kerberos service tickets for the SAP R/3 Application Server, the only part of the SPN that must be correct is the principal name of the SAP service user account.

Open the Computer Management MMC with domain administration privileges on the SAP R/3 Application Server.

In the console tree, double-click System Tools, click Local Users and Groups, and then click Groups.

Right-click the Administrators group, and then click Add to Group.

In the Administrator Properties dialog box, click Add.

In the Select Users, Computers or Group dialog box, go to the Enter the object names to select (examples) box, and then type sapacct@na.corp.contoso.com 

Log on to the SAP R/3 Application Server as sapacct@na.corp.contoso.com

Copy the Gsskrb5.dll file to %windir%\system32.

Click Control Panel, and then click System.

Click the Advanced tab, click Environment Variables, and then in the Environment Variables dialog box, under the System variables, click New.

In the New System Variable dialog box, type the following information.

Variable Name: SNC_LIB

Variable Value: %windir%\system32\gsskrb5.dll

Note   These variable values define the location for the Gsskrb5.dll file.

Log on to the SAP R/3 Application Server as sapacct@na.corp.contoso.com.

Note   The SAP R/3 Application Server system is case-sensitive. For this reason, you must log on by typing the logon name of the user account in Active Directory exactly as it appears here.

Open the <SAP R/3 Web Server Drive:>\MBS\MBS_D00.pfl file by using Notepad.exe, and then add the following parameters to the end of the file.

#language
zcsa/system_language = EN
#Kerberos
snc/enable =1
snc/accept_insecure_cpic =1
snc/accept_insecure_gui =1
snc/accept_insecure_r3int_rfc =1
snc/accept_insecure_rfc =1
snc/data_protection/max =1
snc/data_protection/min =1
snc/data_protection/use =1
# Location of the dll used for kerberos
snc/gssapi_lib = C:\windows\system32\gsskrb5.dll
snc/permit_insecure_start =1
# The Windows User Account used to run SAP Server
snc/identity/as = p:sapacct@na.corp.contoso.com
snc/r3int_rfc_secure = 0

Note   The parameters in this file are case-sensitive. For example, the value of the parameter snc/identity/as =p:sapacct@na.corp.contoso.com is case-sensitive and must match the case of the user logon name in Active Directory.

The exact location of the Windows installation should be used in place of C:\Windows in the snc/gssapi_lib parameter.

A line feed [empty line] should be added at the end of the configuration file MBS_D00.pfl. If an empty line is not present, warnings are generated while running the MBS.

Substitute the actual directory used for the Windows installation if different from "C:\Windows."

Double-click <SAP R/3 Web Server Drive>\MBS\runmbs.cmd to start the SAP MBS System.

Log on to the SAP R/3 Application Server as Administrator

Type the Transaction Code SU01 to go to the User Maintenance: Initial Screen.

In the User box, type sap1 the name of the SAP R/3 Application Server user.

Click the User Names menu, click Change to make the Maintain User screen appear, and then click the SNC tab.

In the SNC Name text box, type p:sap1@NA.CORP.CONTOSO.COM

Note   Remember, SAP R/3 Web server user information is case-sensitive. Mapping the SAP R/3 Web server to this Active Directory account name for the user logon sap1 in the domain NA.CORP.CONTOSO.COM must exactly match this logon name in Active Directory.

Select the Unsecure Communication permitted (user-specific) check box.

Click Save on the menu bar to preserve these changes.

To verify that the canonical name is valid, click the User Names menu, click Display, and then click the SNC tab.

On the SNC Data property sheet, a check mark should appear next to the message Canonical name determined.

Log on to the Windows XP client as the Local Administrator.

Copy the Gsskrb5.dll file to %windir%\system32.

Click Control Panel, and then click System.

Click the Advanced tab, click Environment Variables, and then in the Environment Variables dialog box, under System variables, click New.

In the New System Variable dialog box, type the following information.

Variable Name: SNC_LIB

Variable Value: %windir%\system32\gsskrb5.dll

Note   These variable values define the location for the Gsskrb5.dll file.

Log on to the Windows XP Client as the Local Administrator.

Open SAPlogon, and then click New.

On the New Entry screen, enter the following information.

Description: <My_Name_For_Kerberos_Connection>

Application Server: <Fully Qualified Domain Name_For SAP R/3_Application_Server>

System number: 00

Enable SAP System: R/3

Click Advanced, and then in the Advanced Options pane, select the Enable Secure Network Communication check box, and in the SNC Name box, type p:sapacct@na.corp.contoso.com

Note   This is the Active Directory user with the logon name sapacct in the domain na.corp.contoso.com who will run the SAP System. Because the SAP R/3 Application Server is case-sensitive, the user name for this must match the user account name in Active Directory.

Select the Max. available option.

Log on to the Windows XP client as sap1@na.corp.contoso.com

Open SAPlogon.

On the SAP Logon 620 screen, select <My_Name_For_Kerberos_Connection>, and then click Logon.

These steps should log you on to the SAP R/3 Application Server system without being asked for logon credentials.