SAP shibboleth connect

[Jan Keirse]

On Wed, Aug 3, 2016 at 7:14 AM, Varga Géza <Varga.Geza at fornax.hu> wrote:

> Hi,
>
>
>
> Our client plant to use in case of SSO the Shibboleth.
>
> In this environment server based on SAP WebAS ABAP 7.31.
>
> Client reach SAP by SAP GUI for Html (explorer - http/https).
>
> This scenarion is supported or not by  Shibboleth?
>
>
> If yes please send me configuartion and best-practise guide.
>
> Regards
>
>
> ​
supported is a heavy term: Shibboleth IdP is opensource and support is on a
voluntary best effort basis, so to set expectations properly: you can't
enter an incident somewhere and expect an answer or solution within a
predefined period of time according to some EULA. There are third party
consultants that do offer commercial support if you need it . There is also
a list here: https://shibboleth.net/community/consultants.html I have no
idea if this list is up-to-date and if they do have an EULA or what level
of support is available.
That said, if you are willing to invest some time to detail your problems
(if any) when you try to configure your IdP, usually the community is very
helpful, just no guarantees.
​If you really intended to ask 'is Shibboleth IdP known or expected to work
with SAP'  then I can say that yes we have it configured and it works for
us, but YMMV. I'm afraid I won't be able to provide a best-practise guide
or sample configuration because we have a rather complex configuration and
I'm not entirely sure what was set up for SAP and what was for other SP's,
I also don't have access to the SAP part of the configuration. Also we're
still on IdP 2 and you really ought to use 3 for a new configuration
(actually we should upgrade.)
I can say that we had some trouble getting it to work, SAP is very specific
about the format of the SAML answer it wants to receive. Eventually we
looked up (on google) the responses SAP expected to receive and then
figured out how we could force Shibboleth to send exactly that. IF one of
the consultants has significant experience with SAP and Shib IdP my advise
would be to use their skills, it may be the difference between an hour of
work (if they know exactly what to do) and a few days of frustration (if
like us, you have to figure it out yourself, .)

Good luck,

Jan​

-- 


**** DISCLAIMER ****

http://www.tvh.com/glob/en/email-disclaimer

"This message is delivered to all addressees subject to the conditions
set forth in the attached disclaimer, which is an integral part of this
message."
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160803/28896c79/attachment.html>