{"id":1529,"date":"2017-01-12T09:00:41","date_gmt":"2017-01-12T08:00:41","guid":{"rendered":"https:\/\/www.xiting.us\/?p=1529"},"modified":"2025-10-01T10:41:33","modified_gmt":"2025-10-01T08:41:33","slug":"sap-single-sign-insider-tips-volume-1","status":"publish","type":"post","link":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/","title":{"rendered":"SAP Single Sign-On Insider Tips &#8211; Volume #1"},"content":{"rendered":"<p>&#8220;Insider Tips&#8221; talks about some of the lesser known configuration options of SAP Single Sign-On. In volume #1, we will look at how to handle X.509 server certificates that contain special characters in the Distinguished Name (DN). We will also find out how to enable Secure Network Communications (SNC) to encrypt data using the Secure Login Client (SLC) but without enabling Single Sign-On or leveraging Kerberos. Thanks to my colleague Carsten Olt and former colleague Markus N\u00fcsseler for those tips.<\/p>\n<p>I was recently working with a customer who had SLC 3.0 deployed and wanted to use it to encrypt data, transferred between SAP GUI and AS ABAP but without enabling Single Sign-On or leveraging Secure Login Server (SLS). In the past, such a use case could only be covered by either configuring SLS to issue short-term user certificates that would expire immediately after each successful authentication attempt, or by leveraging Kerberos. Starting with SAP Single Sign-On 3.0, and more specifically with the CommonCryptoLib (CCL) 8.5.4+, there is a third option: <strong>Encryption-only mode<\/strong>.<\/p>\n<figure id=\"attachment_1531\" aria-describedby=\"caption-attachment-1531\" style=\"width: 985px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/www.xiting.us\/wp-content\/uploads\/2016\/12\/slc-encryption-only-mode.png\"><img fetchpriority=\"high\" decoding=\"async\" class=\"size-large wp-image-1531\" src=\"https:\/\/www.xiting.us\/wp-content\/uploads\/2016\/12\/slc-encryption-only-mode-985x1024.png\" alt=\"SLC encryption-only mode\" width=\"985\" height=\"1024\"><\/a><figcaption id=\"caption-attachment-1531\" class=\"wp-caption-text\">Secure Login Client: Encryption-only mode<\/figcaption><\/figure>\n<h2>Encryption-only mode<\/h2>\n<p>The encryption-only mode is a feature of SLC and thus requires a separate SAP Single Sign-On license. Enabling this mode is relatively straightforward and requires a valid SNC PSE (Personal Security Environment) on the AS ABAP. Ideally, the PSE used on AS ABAP was issued by a Certification Authority (CA) that your users&#8217; computers already trust, even though manual server trust is an option. The big advantage of this approach is that it doesn&#8217;t require any additional backend infrastructure and doesn&#8217;t change how users log in to SAP. At the same time, this mode ensures that all data, transferred between SAP GUI is AS ABAP is encrypted.<\/p>\n<p>In comparison, the setting &#8220;<em>SNC <\/em>logon<em> with user\/password (no Single Sign-On)&#8221;<\/em> in SAP GUI requires Kerberos (Active Directory) as the underlying authentication mechanism.<\/p>\n<figure id=\"attachment_1532\" aria-describedby=\"caption-attachment-1532\" style=\"width: 1024px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/www.xiting.us\/wp-content\/uploads\/2016\/12\/sap-gui-no-single-sign-on.png\"><img decoding=\"async\" class=\"size-large wp-image-1532\" src=\"https:\/\/www.xiting.us\/wp-content\/uploads\/2016\/12\/sap-gui-no-single-sign-on-1024x1020.png\" alt=\"SAP GUI - No Single Sign-On\" width=\"1024\" height=\"1020\"><\/a><figcaption id=\"caption-attachment-1532\" class=\"wp-caption-text\">SAP GUI: SNC logon with username\/password<\/figcaption><\/figure>\n<h2>How to handle special characters in server certificates<\/h2>\n<p>If your organization operates its own CA and if you would like to leverage that CA to provide digital certificates for your SAP Single Sign-On infrastructure, you may run into unexpected issues. A common problem I have seen is certificates that contain special characters in their distinguished name (also known as the&nbsp;subject name). As of this writing, the latest release of SAP GUI cannot connect to an AS ABAP via SNC if the server has a certificate (PSE file) that contains a quotation mark, for example.<\/p>\n<p>In the context of single sign-on, a certificate&#8217;s subject name is referred to as the SNC name. A typical SNC name of an AS ABAP may look similar to this: <em>CN=ABC, O=Acme, L=Tampa, C=US.<\/em>&nbsp;But depending on the configuration of the certificate templates of your CA, your certificates may have a subject name similar to this: <em>CN=ABC, OU=Finance, O=Acme, L=&#8221;Tampa, Florida&#8221;, SP=&#8221;Tampa, Florida&#8221;, C=US<\/em>.<\/p>\n<p>A subject name like in the above example will cause the SNC name parser in SAP GUI to fail, thus preventing a successful connection to the AS ABAP. Fortunately, there is an easy workaround to this problem, by replacing the quotation mark (&#8220;) with its UNICODE counterpart. In our example, the resulting SNC name that SAP GUI can correctly parse&nbsp;would be:&nbsp;<em>CN=ABC, OU=Finance, O=Acme,&nbsp;L=\\u0022Tampa,&nbsp;Florida\\u0022,&nbsp;SP=\\u0022Tampa,&nbsp;Florida\\u0022, C=US.<\/em><\/p>\n<blockquote><p>The prefix \\u indicates that a UNICODE code will follow and 0022 is the UNICODE equivalent of the quotation mark (&#8220;). For a complete list of possible characters go to <a href=\"http:\/\/unicode.org\/charts\/PDF\/U0000.pdf\">unicode.com<\/a>.<\/p><\/blockquote>\n<p>Stay tuned for volume #2 of Xiting&#8217;s Insider Tips for SAP Single Sign-On!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;Insider Tips&#8221; talks about some of the lesser known configuration options of SAP Single Sign-On. In volume #1, we will look at how to handle X.509 server certificates that contain special characters in the Distinguished Name (DN). We will also find out how to enable Secure Network Communications (SNC) to encrypt data using the Secure [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":9462,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[1835],"tags":[108,150,151],"class_list":["post-1529","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-commoncryptolib","tag-sap-single-sign-on-en","tag-sso-en"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.2 (Yoast SEO v28.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>SAP Single Sign-On Insider Tips &#8211; Volume #1 | Xiting<\/title>\n<meta name=\"description\" content=\"&quot;Insider Tips&quot; talks about some of the lesser known configuration options of SAP Single Sign-On. In volume #1, we will look at how to handle X.509...\" \/>\n<meta name=\"robots\" content=\"noindex, nofollow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SAP Single Sign-On Insider Tips &#8211; Volume #1\" \/>\n<meta property=\"og:description\" content=\"&quot;Insider Tips&quot; talks about some of the lesser known configuration options of SAP Single Sign-On. In volume #1, we will look at how to handle X.509 server\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiting\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/XitingAG\" \/>\n<meta property=\"article:published_time\" content=\"2017-01-12T08:00:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-01T08:41:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiting.com\/wp-content\/uploads\/2017\/10\/sap-security-blog-sso.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"964\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Carsten Olt\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@jsterr@xiting.de\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Carsten Olt\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/\"},\"author\":{\"name\":\"Carsten Olt\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#\\\/schema\\\/person\\\/3c32c7de1132d012e263720a9f3300a2\"},\"headline\":\"SAP Single Sign-On Insider Tips &#8211; Volume #1\",\"datePublished\":\"2017-01-12T08:00:41+00:00\",\"dateModified\":\"2025-10-01T08:41:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/\"},\"wordCount\":636,\"publisher\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2017\\\/10\\\/sap-security-blog-sso.jpg\",\"keywords\":[\"CommonCryptoLib\",\"SAP Single Sign-On\",\"SSO\"],\"articleSection\":[\"SAP Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/\",\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/\",\"name\":\"SAP Single Sign-On Insider Tips &#8211; Volume #1 | Xiting\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2017\\\/10\\\/sap-security-blog-sso.jpg\",\"datePublished\":\"2017-01-12T08:00:41+00:00\",\"dateModified\":\"2025-10-01T08:41:33+00:00\",\"description\":\"\\\"Insider Tips\\\" talks about some of the lesser known configuration options of SAP Single Sign-On. In volume #1, we will look at how to handle X.509...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/#primaryimage\",\"url\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2017\\\/10\\\/sap-security-blog-sso.jpg\",\"contentUrl\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2017\\\/10\\\/sap-security-blog-sso.jpg\",\"width\":964,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/sap-single-sign-insider-tips-volume-1\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/xiting.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SAP Single Sign-On Insider Tips &#8211; Volume #1\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/\",\"name\":\"Xiting\",\"description\":\"Your Expert for SAP Security\",\"publisher\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/xiting.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#organization\",\"name\":\"Xiting\",\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2025\\\/08\\\/xiting-logo.png\",\"contentUrl\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2025\\\/08\\\/xiting-logo.png\",\"width\":960,\"height\":504,\"caption\":\"Xiting\"},\"image\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/XitingAG\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/1345129\\\/\",\"https:\\\/\\\/www.instagram.com\\\/xiting.global\\\/\",\"https:\\\/\\\/www.crunchbase.com\\\/organization\\\/xiting\",\"https:\\\/\\\/www.youtube.com\\\/@Xiting\"],\"description\":\"Xiting wurde 2008 von erfahrenen SAP-Beratern in der Schweiz gegr\u00fcndet. Heute besch\u00e4ftigt das Unternehmen 140 Mitarbeitende an mehreren Standorten weltweit. Die SAP Security Consultants von Xiting bringen tiefes Fachwissen aus der Projektpraxis mit und betreuen \u00fcber 700 nationale und internationale Kunden \u2013 remote und vor Ort.\",\"email\":\"info@xiting.ch\",\"telephone\":\"+41 43422 8803\",\"legalName\":\"Xiting AG\",\"foundingDate\":\"2008-06-01\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"51\",\"maxValue\":\"200\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#\\\/schema\\\/person\\\/3c32c7de1132d012e263720a9f3300a2\",\"name\":\"Carsten Olt\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c35c3b7ce5d81579234be25ef570938712ba95e2cb8e87f2a79b81be928499a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c35c3b7ce5d81579234be25ef570938712ba95e2cb8e87f2a79b81be928499a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c35c3b7ce5d81579234be25ef570938712ba95e2cb8e87f2a79b81be928499a?s=96&d=mm&r=g\",\"caption\":\"Carsten Olt\"},\"description\":\"Carsten Olt has been working as a Managing SAP Security Consultant since 2016, responsible for Secure Authentication &amp; SSO and SAP Cloud Security Services at Xiting in Germany. As a member of the IAM team, he is also a team leader who conveys the company's goals and strategies to employees and has organizational responsibility. With a security-minded approach, Carsten has international project and IT security experience in many industries. He has been working in IT-Security since 2001, specializing in SAP security since 2010. He is a subject matter expert for SAP Single Sign-On 3.0 and a trainer for the WDESSO course. His current focus is on supporting customers in solving authentication and security challenges within hybrid SAP landscapes, as well as designing and implementing holistic authentication concepts. Carsten is an ISACA CISA and a former MCP and RHCE with an ISP background, and he looks at security from different angles. He also translates between SAP and IT security vocabulary. Carsten has in-depth experience in multi-vendor architectures and MSFT\\\/Azure components, dealing with all the requirements concerning SAML 2.0, OAuth, OpenID Connect, SCIM, X.509 CBA &amp; PKI, MFA, SAP SSO, and Secure Network Communications, Kerberos\\\/SPNEGO, data security and encryption, as well as digital signatures. Carsten is experienced in SAP on-premises components such as S\\\/4HANA, ABAP, and Java, as well as security solutions like SSO 3.0. Since 2019, he has focused on SAP-Cloudified environments, specifically the SAP Cloud Identity Services and SAP BTP, as well as SaaS integrations concerning IAM. He deals with hybrid SAP security in conjunction with Azure Active Directory, ADDS, ADFS, ADCS, Reverse Proxies\\\/WAF, SAP Web Dispatcher, SAP Cloud Connector, third-party products, and infrastructure components.\",\"sameAs\":[\"https:\\\/\\\/x.com\\\/jsterr@xiting.de\"],\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/author\\\/carsten-olt\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SAP Single Sign-On Insider Tips &#8211; Volume #1 | Xiting","description":"\"Insider Tips\" talks about some of the lesser known configuration options of SAP Single Sign-On. In volume #1, we will look at how to handle X.509...","robots":{"index":"noindex","follow":"nofollow"},"og_locale":"en_US","og_type":"article","og_title":"SAP Single Sign-On Insider Tips &#8211; Volume #1","og_description":"\"Insider Tips\" talks about some of the lesser known configuration options of SAP Single Sign-On. In volume #1, we will look at how to handle X.509 server","og_url":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/","og_site_name":"Xiting","article_publisher":"https:\/\/www.facebook.com\/XitingAG","article_published_time":"2017-01-12T08:00:41+00:00","article_modified_time":"2025-10-01T08:41:33+00:00","og_image":[{"width":964,"height":600,"url":"https:\/\/xiting.com\/wp-content\/uploads\/2017\/10\/sap-security-blog-sso.jpg","type":"image\/jpeg"}],"author":"Carsten Olt","twitter_card":"summary_large_image","twitter_creator":"@jsterr@xiting.de","twitter_misc":{"Written by":"Carsten Olt","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/#article","isPartOf":{"@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/"},"author":{"name":"Carsten Olt","@id":"https:\/\/xiting.com\/en\/#\/schema\/person\/3c32c7de1132d012e263720a9f3300a2"},"headline":"SAP Single Sign-On Insider Tips &#8211; Volume #1","datePublished":"2017-01-12T08:00:41+00:00","dateModified":"2025-10-01T08:41:33+00:00","mainEntityOfPage":{"@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/"},"wordCount":636,"publisher":{"@id":"https:\/\/xiting.com\/en\/#organization"},"image":{"@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/#primaryimage"},"thumbnailUrl":"https:\/\/xiting.com\/wp-content\/uploads\/2017\/10\/sap-security-blog-sso.jpg","keywords":["CommonCryptoLib","SAP Single Sign-On","SSO"],"articleSection":["SAP Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/","url":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/","name":"SAP Single Sign-On Insider Tips &#8211; Volume #1 | Xiting","isPartOf":{"@id":"https:\/\/xiting.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/#primaryimage"},"image":{"@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/#primaryimage"},"thumbnailUrl":"https:\/\/xiting.com\/wp-content\/uploads\/2017\/10\/sap-security-blog-sso.jpg","datePublished":"2017-01-12T08:00:41+00:00","dateModified":"2025-10-01T08:41:33+00:00","description":"\"Insider Tips\" talks about some of the lesser known configuration options of SAP Single Sign-On. In volume #1, we will look at how to handle X.509...","breadcrumb":{"@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/#primaryimage","url":"https:\/\/xiting.com\/wp-content\/uploads\/2017\/10\/sap-security-blog-sso.jpg","contentUrl":"https:\/\/xiting.com\/wp-content\/uploads\/2017\/10\/sap-security-blog-sso.jpg","width":964,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/xiting.com\/en\/sap-single-sign-insider-tips-volume-1\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiting.com\/en\/"},{"@type":"ListItem","position":2,"name":"SAP Single Sign-On Insider Tips &#8211; Volume #1"}]},{"@type":"WebSite","@id":"https:\/\/xiting.com\/en\/#website","url":"https:\/\/xiting.com\/en\/","name":"Xiting","description":"Your Expert for SAP Security","publisher":{"@id":"https:\/\/xiting.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiting.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiting.com\/en\/#organization","name":"Xiting","url":"https:\/\/xiting.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiting.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/xiting.com\/wp-content\/uploads\/2025\/08\/xiting-logo.png","contentUrl":"https:\/\/xiting.com\/wp-content\/uploads\/2025\/08\/xiting-logo.png","width":960,"height":504,"caption":"Xiting"},"image":{"@id":"https:\/\/xiting.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/XitingAG","https:\/\/www.linkedin.com\/company\/1345129\/","https:\/\/www.instagram.com\/xiting.global\/","https:\/\/www.crunchbase.com\/organization\/xiting","https:\/\/www.youtube.com\/@Xiting"],"description":"Xiting wurde 2008 von erfahrenen SAP-Beratern in der Schweiz gegr\u00fcndet. Heute besch\u00e4ftigt das Unternehmen 140 Mitarbeitende an mehreren Standorten weltweit. Die SAP Security Consultants von Xiting bringen tiefes Fachwissen aus der Projektpraxis mit und betreuen \u00fcber 700 nationale und internationale Kunden \u2013 remote und vor Ort.","email":"info@xiting.ch","telephone":"+41 43422 8803","legalName":"Xiting AG","foundingDate":"2008-06-01","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"51","maxValue":"200"}},{"@type":"Person","@id":"https:\/\/xiting.com\/en\/#\/schema\/person\/3c32c7de1132d012e263720a9f3300a2","name":"Carsten Olt","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c35c3b7ce5d81579234be25ef570938712ba95e2cb8e87f2a79b81be928499a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c35c3b7ce5d81579234be25ef570938712ba95e2cb8e87f2a79b81be928499a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c35c3b7ce5d81579234be25ef570938712ba95e2cb8e87f2a79b81be928499a?s=96&d=mm&r=g","caption":"Carsten Olt"},"description":"Carsten Olt has been working as a Managing SAP Security Consultant since 2016, responsible for Secure Authentication &amp; SSO and SAP Cloud Security Services at Xiting in Germany. As a member of the IAM team, he is also a team leader who conveys the company's goals and strategies to employees and has organizational responsibility. With a security-minded approach, Carsten has international project and IT security experience in many industries. He has been working in IT-Security since 2001, specializing in SAP security since 2010. He is a subject matter expert for SAP Single Sign-On 3.0 and a trainer for the WDESSO course. His current focus is on supporting customers in solving authentication and security challenges within hybrid SAP landscapes, as well as designing and implementing holistic authentication concepts. Carsten is an ISACA CISA and a former MCP and RHCE with an ISP background, and he looks at security from different angles. He also translates between SAP and IT security vocabulary. Carsten has in-depth experience in multi-vendor architectures and MSFT\/Azure components, dealing with all the requirements concerning SAML 2.0, OAuth, OpenID Connect, SCIM, X.509 CBA &amp; PKI, MFA, SAP SSO, and Secure Network Communications, Kerberos\/SPNEGO, data security and encryption, as well as digital signatures. Carsten is experienced in SAP on-premises components such as S\/4HANA, ABAP, and Java, as well as security solutions like SSO 3.0. Since 2019, he has focused on SAP-Cloudified environments, specifically the SAP Cloud Identity Services and SAP BTP, as well as SaaS integrations concerning IAM. He deals with hybrid SAP security in conjunction with Azure Active Directory, ADDS, ADFS, ADCS, Reverse Proxies\/WAF, SAP Web Dispatcher, SAP Cloud Connector, third-party products, and infrastructure components.","sameAs":["https:\/\/x.com\/jsterr@xiting.de"],"url":"https:\/\/xiting.com\/en\/author\/carsten-olt\/"}]}},"_links":{"self":[{"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/posts\/1529","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/comments?post=1529"}],"version-history":[{"count":0,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/posts\/1529\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/media\/9462"}],"wp:attachment":[{"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/media?parent=1529"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/categories?post=1529"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/tags?post=1529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}