Integrating SAP with Microsoft Entra ID for Single Sign-On (SSO) can appear straightforward when SAML 2.0 is available as an authentication option.
However, the actual implementation depends on which SAP interface users are accessing.
In a recent customer environment assessment, the requirement was to enable SSO between Microsoft Entra ID and SAP GUI for Windows 7.70.
The initial approach considered a SAML 2.0-based integration. During the technical assessment, we found an important architectural distinction:
SAML 2.0 can be used for applicable SAP web authentication scenarios, but SAP GUI desktop authentication to an SAP ABAP backend follows an SNC-based authentication path.
This article explains what was checked, what was found, why the initial approach could not proceed with the currently available components, and what needs to be validated before implementing SAP GUI SSO.
- Requirement
The customer requirement was to provide Single Sign-On for SAP users using their Microsoft Entra ID identity.
The expected user experience was:
User
↓
Microsoft Entra ID
↓
SSO
↓
SAP GUI
↓
SAP ABAP
The customer environment does not have traditional on-premises Active Directory.
The SAP application is accessed through SAP GUI for Windows 7.70.
This point was important because SAP GUI and browser-based SAP applications do not use the same authentication path.
- Environment Identified
During the assessment, the following environment details were identified:
Component Finding
Identity Provider Microsoft Entra ID
SAP Client SAP GUI for Windows 7.70
SAP Backend SAP ABAP
SAP System MSD
SAP Instance D00
Operating System Windows client / Linux SAP server
On-premises AD Not available
SNC Enabled
SAP CommonCryptoLib Present
sapgenpse Available
SNC PSE Present
Secure Login Client Not identified on tested workstation
- First Important Check — What SAP Client Is Being Used?
The first step in an SAP SSO project should be identifying the actual client used by end users.
There is a major difference between:
SAP GUI for Windows
SAP GUI for HTML
SAP Fiori
SAP web applications
In this environment, the users are accessing SAP through:
SAP GUI for Windows 7.70
Therefore, the authentication architecture needs to support the SAP GUI connection to the SAP ABAP backend.
- SAML 2.0 vs SAP GUI Authentication
Microsoft Entra ID supports SAML 2.0 integration with applicable SAP NetWeaver web authentication scenarios.
However, SAP GUI desktop authentication is different.
SAP GUI communicates with the SAP ABAP backend using Secure Network Communication (SNC) when SNC is configured.
Therefore, the following should not be assumed to be the same:
Browser SAP SSO
↓
SAML 2.0
and:
SAP GUI SSO
↓
SNC
↓
X.509 / Kerberos
This was the key architectural finding during the assessment.
- Checking the SAP Backend
The SAP server configuration was reviewed to determine whether SNC was already configured.
The following configuration was identified:
snc/enable = 1
This confirms that SNC is enabled on the SAP application server.
The configured SNC identity was also identified:
p:CN=MSP
This indicates that the SAP server already has an SNC identity configured.
- SAP Cryptographic Components
The SAP server was also checked for the required cryptographic components.
The following were identified:
libsapcrypto.so
sapgenpse
SAP CommonCryptoLib provides cryptographic functionality used by SAP SNC.
The presence of these components was a positive finding because the SAP backend already has the underlying SNC cryptographic capability.
- SNC PSE
An SAP SNC PSE was also identified:
SAPSNCS.pse
The PSE contains the cryptographic identity used by the SAP server.
A certificate associated with the SAP SNC configuration was also identified.
However, an important distinction needs to be made:
The SAP server's SNC certificate is not the same as an individual user's SSO certificate.
Having a server-side SNC PSE does not automatically provide SSO for SAP users.
- User-Level SNC Configuration
The next important check is the SAP user configuration.
For certificate-based authentication, the individual SAP user needs to be associated with the appropriate SNC identity.
This is typically checked through:
SU01
↓
User
↓
SNC
In the assessed environment, the test user did not have the required SNC identity mapping configured.
Therefore, even though SNC was enabled on the server, the complete user authentication chain was not established.
- SAP Secure Login Client Check
The Windows workstation used for testing was also checked.
SAP Secure Login Client was not identified on the tested workstation.
This is significant because an SAP GUI certificate-based SSO architecture may require a client-side Secure Login component to provide the appropriate credential to SAP GUI/SNC.
The availability and licensing of the required SAP Secure Login components therefore needs to be confirmed with the SAP/Basis team.
- Why the Initial SAML Approach Could Not Proceed
The initial assumption was:
Microsoft Entra ID
↓
SAML 2.0
↓
SAP GUI
However, SAP GUI does not simply consume a SAML assertion as its direct authentication mechanism to the ABAP backend.
The relevant authentication path is based on SNC.
A certificate-based architecture would instead involve a flow similar to:
Microsoft Entra ID
↓
Authentication / Identity Layer
↓
X.509 User Certificate
↓
SAP Secure Login Client
↓
SAP GUI
↓
SNC
↓
SAP ABAP
The exact components in this architecture must be validated against the customer's SAP version, licensing and available services.
- Current Blockers
Based on the assessment, the following blockers were identified.
Blocker 1 — Secure Login Component
The required SAP Secure Login component/service referenced during the assessment is not currently available/confirmed.
Blocker 2 — Secure Login Client
SAP Secure Login Client was not identified on the tested SAP GUI workstation.
Blocker 3 — User Certificate
No established mechanism for issuing individual X.509 authentication certificates to SAP GUI users was identified.
Blocker 4 — SAP User Mapping
The test SAP user does not currently have the required SNC identity mapping.
Blocker 5 — No On-Premises Active Directory
The customer does not have on-premises Active Directory.
Therefore, a traditional AD/Kerberos-based SAP GUI SSO architecture cannot be assumed for this environment.
Blocker 6 — SAP Licensing / Service Availability
The availability and licensing of the required SAP Secure Login/SAP SSO components have not yet been confirmed.
- Important Clarification
The finding should not be interpreted as:
SAP does not support SAML 2.0.
That statement would be too broad.
The correct interpretation is:
SAP supports SAML 2.0 for applicable authentication scenarios, including supported SAP web-based scenarios. However, SAP GUI desktop authentication to the SAP ABAP backend follows the SNC authentication path.
Therefore, Microsoft Entra ID SAML configuration by itself does not complete the SAP GUI SSO implementation.
- What Is Already Available?
The assessment did identify several useful components in the existing environment.
Available
SAP GUI 7.70
SAP ABAP backend
SNC enabled
SAP CommonCryptoLib
sapgenpse
SAP SNC PSE
SAP server SNC identity
Not Available / Not Confirmed
SAP Secure Login Client
User X.509 certificate mechanism
SAP user SNC identity mapping
Enterprise PKI/CA
SAP Secure Login Service availability
SAP SSO licensing
Complete user certificate authentication flow
This means the SAP backend is not starting from zero.
The existing SNC infrastructure can be investigated further once the missing components and requirements are confirmed.
- Information Required From the SAP/Basis Team
Before any production configuration changes are made, the following should be confirmed with the SAP team:
Exact SAP ABAP/NetWeaver version.
Exact SAP kernel version.
Whether the current SAP version supports the required X.509/SNC SSO architecture.
Whether SAP Secure Login Service is available.
Whether SAP Single Sign-On 3.0 is licensed.
Whether SAP Secure Login Client is required.
Whether SAP Secure Login Client is supported with SAP GUI 7.70.
Whether an enterprise PKI/CA is available.
Who issues user authentication certificates.
Required certificate format.
Required certificate Subject/SAN.
Required SNC name format.
How the X.509 identity should be mapped to the SAP user.
Whether the existing SAP SNC PSE can be reused.
Whether any additional SAP components or licenses are required.
- Recommended Validation Flow
Once the SAP-side prerequisites are confirmed, the implementation should be validated using a single test user.
The validation flow should be:
Microsoft Entra ID
↓
User Authentication
↓
Certificate / Secure Login
↓
SAP GUI
↓
SNC
↓
SAP ABAP
↓
SAP User Mapping
The first objective should be to prove SSO for one test user before considering wider deployment.
- Troubleshooting Checklist
For future SAP GUI SSO troubleshooting, validate the following in order:
[ ] Confirm SAP GUI version
[ ] Confirm SAP backend version
[ ] Confirm SAP GUI vs browser access
[ ] Check snc/enable
[ ] Check snc/identity/as
[ ] Check CommonCryptoLib
[ ] Check SAP SNC PSE
[ ] Check server certificate
[ ] Check SAP user SNC mapping
[ ] Check client SNC configuration
[ ] Check Secure Login Client
[ ] Check user certificate
[ ] Check certificate trust
[ ] Check PKI/CA
[ ] Check SAP licensing
[ ] Perform single-user pilot
This sequence helps avoid spending time configuring Microsoft Entra SAML before confirming that the SAP GUI authentication path is ready.
- Security Considerations
SAP environments contain highly sensitive infrastructure information.
When troubleshooting or documenting SAP SSO, avoid publishing:
SAP usernames
Internal IP addresses
Internal hostnames
SAP system passwords
PSE passwords
Private keys
Certificate private material
Customer tenant identifiers
Internal URLs
Production configuration secrets
If screenshots are used in documentation, sensitive customer information should be removed or blurred.
- Key Lessons Lesson 1 — Identify the SAP client first
Always determine whether users are accessing SAP through SAP GUI, Fiori, SAP GUI for HTML, or another web interface.
Lesson 2 — Do not assume SAML solves every SAP SSO scenario
The identity provider may support SAML while the SAP client uses a different authentication protocol.
Lesson 3 — Server SNC is not user SSO
An SNC PSE on the SAP server establishes server-side cryptographic identity.
It does not automatically create user-level SSO.
Lesson 4 — User mapping is critical
Certificate-based authentication requires the certificate identity to be correctly associated with the SAP user.
Lesson 5 — Validate before changing production
Existing SAP SNC and PSE configurations should be understood before making production changes.
- Conclusion
The assessment demonstrated that the customer already has an SNC-enabled SAP backend with SAP CommonCryptoLib, sapgenpse, an SNC PSE and a configured SAP server identity.
However, the complete user authentication path required for SAP GUI SSO is not currently established.
The key finding is:
Microsoft Entra ID SAML 2.0 configuration alone is not sufficient to provide SSO to the existing SAP GUI desktop client.
For SAP GUI, the authentication architecture needs to account for SNC and an appropriate user authentication credential, such as an X.509 certificate or another supported mechanism.
The availability of SAP Secure Login components, PKI, licensing and SAP-side user mapping must therefore be validated before the implementation can proceed.
Official References
Microsoft Learn — Configure SAP NetWeaver for Single Sign-On with Microsoft Entra ID
SAP Help — SAP Secure Login Service for SAP GUI
SAP Help — SNC and X.509 certificate authentication
SAP Help — SAP user SNC identity mapping
Top comments (0)