Security & GRCbeginner

SNC and SSO Fundamentals for SAP GUI and RFC

Key takeaway

Understand how Secure Network Communications protects classic SAP GUI or RFC traffic and how single sign-on maps a trusted external identity to an SAP user.

Explanation

📌 KEY POINTS
✅ SNC secures the CONNECTION (encryption, integrity, authentication); PFCG authorization still decides what the user can do.
⚠️ Encryption and SSO are related but separate — a connection can be encrypted while the user still types a password.
💡 A successful SSO rollout can fail suddenly if the trust chain or certificate mapping expires — lifecycle matters as much as setup.

━━━━━━━━━━━━━━━━━━━━
▶ 1. WHAT SNC DOES

Adds encryption, integrity protection, and authentication to classic SAP GUI/RFC traffic — via Kerberos or certificate-based mechanisms depending on the security product

━━━━━━━━━━━━━━━━━━━━
▶ 2. SSO vs. ENCRYPTION

SSO means the trusted identity maps to the SAP user — no repeated password entry
These are related but separate: encrypted ≠ SSO, and vice versa

━━━━━━━━━━━━━━━━━━━━
⚠️ 3. WHAT IT NEVER REPLACES

RFC destinations can use SNC too, but the target system still runs its own authorization checks after authentication
SNC never replaces PFCG roles

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP (TROUBLESHOOTING)

Network / SNC establishment — is the secure channel up at all?
Identity / certificate mapping — does the trusted identity map to the right SAP user?
SAP authorization — does that user actually have the roles?

━━━━━━━━━━━━━━━━━━━━
▶ 4. PRODUCTION DISCIPLINE

Track SNC identities, Kerberos service principals, or certificates with clear ownership and expiry monitoring — a working rollout can break silently when trust expires unmonitored

✅ CHECKPOINT: name the three troubleshooting layers, in order.

Real project scenario

A user's SAP GUI session is encrypted but still prompts for a password. The network security works; the missing piece is identity mapping for SSO.

Common mistakes

Treating encryption and SSO as identical.
Expecting SNC to grant SAP authorizations.
Ignoring certificate or Kerberos expiry.
Sharing powerful RFC users because the channel is encrypted.
Debugging PFCG before proving authentication.

Best practices

Separate authentication and authorization.
Monitor certificates and trust.
Protect RFC as well as GUI where needed.
Use least-privilege SAP roles.
Diagnose in layers.

Interview angle

Explain what SNC protects and why successful SSO still requires normal SAP authorization.

Practice this lesson

Quick check

1. In the lesson "SNC and SSO Fundamentals for SAP GUI and RFC", consider this project situation: A user's SAP GUI session is encrypted but still prompts for a password. Which statement is correct?

2. A team proposes this shortcut while working on SNC and SSO for SAP GUI and RFC: Trust, Kerberos and Certificates: "Sharing one powerful RFC user because the channel is encrypted." Which alternative should you recommend?

3. A review of SNC and SSO for SAP GUI and RFC: Trust, Kerberos and Certificates finds this risky pattern: "Sharing one powerful RFC user because the channel is encrypted.". Which corrective action is strongest?

Interview questions

1. Using this SAP project situation — A user's SAP GUI session is encrypted but still prompts for a password — explain SNC and SSO Fundamentals for SAP GUI and RFC. What should happen, which concepts or process steps matter, and what common mistake would you avoid?

Answer it in your own words first, then compare.

2. You are the senior consultant/architect responsible for SNC and SSO for SAP GUI and RFC: Trust, Kerberos and Certificates. The project situation is: Users could establish an SNC-encrypted SAP GUI connection but still received a password prompt. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?