Success Story: Vetropack Group
Improved efficiency and significantly increased IT security through secure authentication with SAP Single Sign-On 3.0
The primary objective of the project at Vetropack Group, starting February 2021, was to significantly increase the security of the entire SAP application landscape in terms of confidentiality, authenticity, and integrity. By installing the SAP Single Sign-On 3.0, our customer was able to improve the user experience, ensure high security and reduce the service desk support. Despite the large number of SAP systems, the aforementioned requirements could be implemented in less than 15 days thanks to the proven Xiting project methodology. The optimal coordination of all activities and the efficient project management and collaboration between Vetropack and Xiting brought this project to a productive state within a few months.
„With the help of Xiting, we managed to connect our SAP systems to the SSO very quickly. The know-how of Xiting, which went beyond the pure matter of SAP SSO, was particularly welcome and contributed significantly to the fast and successful implementation of the project.“
Hartmut Schroff
SAP CCoE
Vetropack Group
Objectives
At the start of the project, the authentication between client and server was still partially unencrypted, while the authentication to SAP was based on usernames and individual passwords. The primary goal of the project carried out at the Vetropack Group was the implementation of the SAP solution Single Sign-On (SSO) for all SAP users and systems.
The aim was to configure all SAP systems for the Kerberos/SPNEGO-based login to subsequently obtain secure and easy access to the SAP applications and to achieve an end-to-end SSO experience for all user accesses. At the same time, the communication protocols should be encrypted, and all SAP applications should be integrated into the secure authentication process. The coordination of the SSO implementation with the SAP S/4HANA release upgrade was another objective.
Challenges
Starting with the implementation of the kick-off workshop, the analysis of the individual requirements as well as that of the components involved, the project went on with the comprehensive conception and POC setup. In addition, numerous activities, and configuration adjustments as well as down times had to be well coordinated between the different project stakeholders. After successful tests and the final adjustment of the parameters, the configuration specifications could be transferred to the further stages from pilot to roll-out.
Successes
Thanks to the structured approach and the detailed documentation, the project went into productive operation with little effort and within a short time. We achieved a significant reduction in password-related support requests and a simplification of the user workflow.
The implementation of SAP Single Sign-On 3.0 at Vetropack had a significant and immediate effect on users, administrators and the security of its SAP systems. The security of user identities and SAP systems has been massively improved, communication encryption implemented, while also minimizing the risk for potential attacks, given that the login now requires a security token from a central ID provider.
With a security-minded approach, Carsten has international project and IT security experience in many industries. He has been working in IT-Security since 2001, specializing in SAP security since 2010. He is a subject matter expert for SAP Single Sign-On 3.0 and a trainer for the WDESSO course. His current focus is on supporting customers in solving authentication and security challenges within hybrid SAP landscapes, as well as designing and implementing holistic authentication concepts. Carsten is an ISACA CISA and a former MCP and RHCE with an ISP background, and he looks at security from different angles. He also translates between SAP and IT security vocabulary.
Carsten has in-depth experience in multi-vendor architectures and MSFT/Azure components, dealing with all the requirements concerning SAML 2.0, OAuth, OpenID Connect, SCIM, X.509 CBA & PKI, MFA, SAP SSO, and Secure Network Communications, Kerberos/SPNEGO, data security and encryption, as well as digital signatures.
Carsten is experienced in SAP on-premises components such as S/4HANA, ABAP, and Java, as well as security solutions like SSO 3.0. Since 2019, he has focused on SAP-Cloudified environments, specifically the SAP Cloud Identity Services and SAP BTP, as well as SaaS integrations concerning IAM. He deals with hybrid SAP security in conjunction with Azure Active Directory, ADDS, ADFS, ADCS, Reverse Proxies/WAF, SAP Web Dispatcher, SAP Cloud Connector, third-party products, and infrastructure components.
- Cloud Integration Made Easy: Xiting Central Workflows (XCW) Meets SAP Cloud - 30. July 2024
- From Nostalgia to Excitement: The Impending End of SAP IDM - 15. March 2024
- 2024 SAP Cloud Identity Services & IAM Portfolio: What’s New? - 23. February 2024
