SAP Single Sign-On 2.0 Overview Presentation

Transcription

1 SAP Single Sign-On 2.0 Overview Presentation June 2014 Public

2 Legal disclaimer This presentation is not subject to your license agreement or any other agreement with SAP. SAP has no obligation to pursue any course of business outlined in this presentation or to develop or release any functionality mentioned in this presentation. This presentation and SAP's strategy and possible future developments are subject to change and may be changed by SAP at any time for any reason without notice. This document is provided without a warranty of any kind, either express or implied, including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. SAP assumes no responsibility for errors or omissions in this document, except if such damages were caused by SAP intentionally or grossly negligent SAP AG or an SAP affiliate company. All rights reserved. Public 2

3 Agenda SAP Portfolio Overview SAP Single Sign-On Single Sign-On Scenarios Architecture What s New in Support Package 03 Recommendations Summary 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 3

4 SAP Portfolio

5 SAP Identity and Access Management Solutions Compliant Identity and Access Management Simplify and secure access Manage identities and permissions Identify and mitigate risks SAP Single Sign-On SAP Identity Management SAP Access Control 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 5

6 Overview SAP Single Sign-On

7 SAP Single Sign-On What is it about? Authenticate once and subsequently access SAP and non-sap applications in a secure and user-friendly way. Meet company and regulatory requirements. Improve security measures and protect your company SAP AG or an SAP affiliate company. All rights reserved. Public 7

8 SAP Single Sign-On Benefits Security Reduce Costs Simplicity 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 8

9 SAP Single Sign-On Benefits in Detail Solve security and compliance issues caused by Re-use of passwords Password patterns Trivial passwords Passwords on post-it notes Leaked passwords Solve productivity issues caused by Large number of manual logins Forgotten passwords Help desk calls Only one secure (!) password to remember Only one password to store and protect Automated login while you work 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 9

10 Single Sign-On Scenarios

11 Business User Expectations SAP NetWeaver Business Client SAP GUI SAP Business Explorer Web Browser Easy and secure access 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 11

12 SAP Single Sign-On 2.0 Key Capabilities Single sign-on for SAP and non-sap applications Support of proprietary SAP clients (e.g. SAP GUI) Secure network communication (SNC) SSO for cloud-based applications Based on standards like X.509 certificates, SPNEGO, Kerberos, SAML Password Manager SAP Single Sign-On SAP HANA and SAP NetWeaver SAP Business Suite SAP and non-sap applications Cloud and cross-company Password Manager 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 12

13 SAP Business Suite Single Sign-On Based on Kerberos / SPNEGO SAP Business Suite SAP client (native) Web client Secure Login Client Secure Login Library SPNEGO for ABAP SAP Business Suite Microsoft Active Directory Token: Kerberos SPNEGO only available in newer SAP NetWeaver releases SAP NetWeaver 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 13

14 SAP and Non-SAP Applications Single Sign-On Based on X.509 Certificates SAP client (native) Web client SAP and non- SAP applications Secure Login Client Secure Login Server Secure Login Library SAP Business Suite Microsoft Active Directory, LDAP, other login modules Token: X.509 certificate Non-SAP Legacy systems SAP NetWeaver This option supports most platforms and clients. Recommended for heterogeneous and intranet scenarios 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 14

15 Cloud and Cross-Company Single Sign-On and Identity Federation Based on SAML Web client SAP and non-sap applications SAML identity provider Microsoft Active Directory, LDAP, other login modules Cloud applications Token: SAML SAP / non-sap Web applications Web client SAML is a public standard for Web applications. The application server has to support the standard. Recommended for extranet scenarios, partner integration 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 15

16 Secure Storage of Remaining Passwords Password Manager SAP and non- SAP applications Password Manager Stand-alone Based on user name and password Secure storage of remaining passwords in a local client. Provides automatic capture of login credentials 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 16

17 Architecture

18 SAP Single Sign-On Components Secure Login Client Client application Manages security tokens (Kerberos tokens, X.509 certificates) Secure Login Server Central service on SAP NetWeaver AS Java Provides X.509 certificates to users and application servers Secure Login Library Cryptography and security library for SAP NetWeaver AS ABAP Identity Provider Central service on SAP NetWeaver AS Java Provides SAML 2.0 assertions for Web-based SSO 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 18

19 Single Sign-On Based on Kerberos / SPNEGO 2 Start SAP GUI or Browser Client SAP GUI / NWBC / Browser Secure Login Client In a Nutshell Relies on Integrated Windows Authentication Kerberos Security Token created by Microsoft Active Directory (AD) 1 Windows Authentication User Desktop Kerberos Token Microsoft Active Directory (AD) 3 DIAG, RFC (SNC) HTTPS (SPNEGO) HTTPS (SPNEGO) Single Sign-On and Secure Communication SAP NetWeaver AS ABAP Secure Login Library NW AS JAVA SAP NetWeaver AS Java No additional server required, low TCO SAP backend needs to trust the AD SPNEGO requires ABAP version 7.02 or higher Kerberos/SPNEGO SSO supported by e.g. AS ABAP, AS Java, HANA DB, 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 19

20 Single Sign-On Based on X.509 Certificates 2 Sign into Secure Login Client profile Authentication Server In a Nutshell 1 User Desktop Client SAP GUI / NWBC / SAP Browser GUI / Browser / NWBC Secure Login Client Secure Login Client Authenticate 5 3 Provide X.509 Certificate DIAG, RFC (SNC) HTTPS HTTPS NW AS JAVA SAP NetWeaver AS Java Secure Login Server (SLS) SAP NetWeaver AS ABAP Secure Login Library NW AS JAVA SAP NetWeaver AS Java 4 Verify User Credentials Relies on X.509 certificate, a very mature standard security token Certificates created by Secure Login Server (or other PKI) SLS provides short-lived certificates, no overhead for revocation management Multiple ways of user credential verification (SPNEGO, LDAP, ABAP, UME,...) Support for SAP backends, but also for legacy systems, 3rd party Web applications, 6 Single Sign-On and Secure Communication Secure Login Server requires AS Java 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 20

21 Single Sign-On Based on SAML NW AS JAVA Client 2 Authenticate SAP NetWeaver AS Java Authentication Server In a Nutshell Relies on Security Assertion Markup Language (SAML) assertions as security token Browser 4 Return SAML Assertion Identity Provider (IDP) 3 Verify User Credentials Industry standard for cloud and cross-company scenarios Assertions created by Identity Provider, running on AS Java 1 User Desktop 5 HTTPS HTTPS Single Sign-On and Secure Communication Service Service Provider Provider (SP) (SP) Service Service Provider Provider (SP) (SP) Authentication initiated by IDP or SP Multiple ways of user credential verification (SPNEGO, LDAP, ABAP, UME,..) 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 21

22 What s New in Support Package 03

23 Two-Factor Authentication with SAP Authenticator Two-Factor Authentication Authentication with One-Time Passwords (OTP) Provide two means of identification OTP required for login in addition to password or security token Second factor for high security scenarios Based on SAP Authenticator ios Application OTP (6-digit code) created on mobile device Usage Scenarios Integrated with Secure Login Server (X.509) and Identity Provider (SAML) Administrator configures SAP NetWeaver AS Java system to require two-factor authentication For Web and SAP GUI scenarios 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 23

24 SSO for SAP GUI for Java on Mac OS X Secure Login Client for Mac Client Computers Mac OS X 10.7 or higher Usage Scenarios Kerberos-based authentication X.509 certificates For SAP GUI scenarios 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 24

25 RFID-Based User Identification Identify Users with RFID Token (Radio Frequency Identification) Only privileged persons have physical access Instant user identification with RFID token Based on X.509 certificates Usage Scenarios Warehouse and production scenarios Kiosk/terminal computers 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 25

26 Hardware Security Module Support Hardware Security Module Support for Digital Signatures Store Private Keys in Hardware Protect Secure Login Server Certificate Authority Protect private keys for digital signatures (Secure Store and Forward, SSF) Performance acceleration Thales SafeNet 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 26

27 Recommendations

28 Recommendations Identify the most critical systems. Which systems contain your most sensitive business information? How many people have access to them? Define your overall single sign-on strategy and start with these critical business systems. Understand the different modules of SAP Single Sign-On and analyze your system landscape to determine which SSO standards can be used. If your organization does not have the appropriate resources and know-how, involve SAP Consulting or SAP partners. Passwords are often the weakest link in enterprises. Prevent the usage of passwords by relying on standards such as SAML, X.509 certificates, or Kerberos. SAP Single Sign-On offers solutions for all of these standards. Once you have implemented single sign-on, start enforcing strong passwords in the related systems. Mid-term strategy: Consider disabling user name/password authentication in critical business systems. Provide a tool to store remaining passwords (such as the Password Manager component of SAP Single Sign-On) SAP AG or an SAP affiliate company. All rights reserved. Public 28

29 Summary

30 Extensible Technology Ready for the Future Cloud and cross-company SAP and non-sap applications SAP Business Suite 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 30

31 Summary SAP Single Sign-On is a Single Sign-On Suite that supports SAP as well as non-sap applications. It offers Investment protection Flexibility Single sign-on for heterogeneous system landscapes What are the main business drivers? Protect business, reputation and trust Lower password related costs Simplicity and agility 2014 SAP AG or an SAP affiliate company. All rights reserved. Public 31

32 Get More Information Community Network Get more information, videos and updates SAP AG or an SAP affiliate company. All rights reserved. Public 32

33 Thank you Contact information: Product Management SAP AG 2014 SAP AG or an SAP affiliate company. All rights reserved.

34 2014 SAP AG or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG or an SAP affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG (or an SAP affiliate company) in Germany and other countries. Please see for additional trademark information and notices. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP AG or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP AG or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP AG or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. In particular, SAP AG or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP AG s or its affiliated companies strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP AG or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forwardlooking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions SAP AG or an SAP affiliate company. All rights reserved. Public 34