Configuring an SAP Secure Network Communication Connection with Kerberos

Create a service user sidadm in Active Directory.

Select Password never expires and deselect Use DES encryption types for this account.

Create a Service Principal Name (SPN) SAPService/sapdev@SSODOMAIN.LAB for the sidadm user in Active Directory.

Run the following command to export the keytab for this SPN from Active Directory. The password is the password to set for the keytab and the SID is the file name of the keytab.

Configure the krb5.conf file using the KDC address and the realm information (SSODOMAIN.LAB). The krb5.conf file is created by default in the etc directory.

[libdefaults]
    # "dns_canonicalize_hostname" and "rdns" are better set to false for improved security.
    # If set to true, the canonicalization mechanism performed by Kerberos client may
    # allow service impersonification, the consequence is similar to conducting TLS certificate
    # verification without checking host name.
    # If left unspecified, the two parameters will have default value true, which is less secure.
    dns_canonicalize_hostname = false
    rdns = false
    #   default_realm = EXAMPLE.COM
        default_realm = SSODOMAIN.LAB

[realms]
    #       EXAMPLE.COM = {
    #                kdc = kerberos.example.com
    #               admin_server = kerberos.example.com
    #       }
SSODOMAIN.LAB = {
                kdc = DC.SSODOMAIN.LAB
               admin_server = dc.SSODOMAIN.LAB
       }
[domain_realm]
  .ssodomain.lab = SSODOMAIN.LAB
   ssodomain.lab = SSODOMAIN.LAB

[logging]
    kdc = FILE:/var/log/krb5/krb5kdc.log
    admin_server = FILE:/var/log/krb5/kadmind.log
    default = SYSLOG:NOTICE:DAEMON

[libdefaults]
    default_ccache_name = FILE:/tmp/krb5cc_%{uid}

Run the following commands to import the key to the etc directory:

Obtain a Kerberos Ticket Granting Ticket (TGT):

Run the following commands to change the permissions for the keytab:

Set up automatic renewal for the Kerberos TGT:

Locate the GSS-API library on the SAP server (in this example, it is under the /usr/lib64/libgssapi_krb5.so.2 path), configure the parameters for SNC with Kerberos in the default profile, and then restart SAP.

Create sidadm as a user in SAP and set the SNC name using the transaction SU01.

For the RFC destination, use the transaction SM59. On the Logon and Security tab, enable the SNC option and add the SPN name as a partner.

Access Anypoint Studio.

Select SAP in the Studio canvas.

Click the plus sign (+) next to the Connector configuration field to access the global element configuration fields.

Configure the Kerberos connection: