Single Sign-On – SAPGUI Front-End - General SAP Guides

Single Sign-On – SAPGUI Front-End

SAPGUI is a graphical user interface client in the SAP ERP’s three-tier architecture of database, application servers and clients. It requires installation in a local desktop that run on Windows or macOS or Linux.

In order to achieve Single-Sign-On for SAPGUI in RISE with SAP, we must use either Kerberos or X.509 method. Kerberos is not recommended by AWS, because it requires user to always be connected to the corporate network and authenticated against a Microsoft Active Directory which reduce their mobility. Due to this, X509 is recommended.

SAPGUI Single-Sign-On with X509 can be achieved with SAP Secure Login Service on BTP, the image below describes how the integration works.

SSO for SAPGUI Front-End

Authentication flow

  1. User accesses SAP Fiori via an Internet browser.

  2. SAP S/4HANA will redirect authentication request to SAP Secure Login Service

  3. SAP Secure Login Service will delegate the authentication to SAP Cloud Identity Service.

  4. When SAP Cloud Identity Service is integrated to IdP (i.e. Azure AD, Okta, Ping, etc.), then IdP will authenticate the user.

  5. User is authenticated by IdP and X509 is provided by SAP Secure Login Service to the SAPGUI.

  6. User can access to SAP S/4HANA in RISE with SAP VPC.

For more information on how to do this, you can refer to Securing SAP GUI with SAP Secure Login Service.