---
schema_version: "1"
id: 02539e7ccc3ebc44ad3d11a0e0e454bb394d2bc5c63cda0d37cf3d4025d1db16
title: Configuring an SAP Secure Network Communication Connection with Kerberos
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/sap-connector/latest/sap-connector-config-snc-kerberos.md
canonical_url: https://docs.mulesoft.com/sap-connector/latest/sap-connector-config-snc-kerberos
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 3c5451c1836af2caf266a83c6cb9c0bd6cc0e043b0959b9227e5510848dbbf3a
description: MuleSoft Documentation Site
release: "5.9"
latest: true
---
---
product: SAP Connector
version: 5.9
is-latest-version: true
---

# Configuring an SAP Secure Network Communication Connection with Kerberos

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Configure an SAP Secure Network Communication (SNC) with Kerberos to take advantage of security
features such as secure data communication between the SAP system client and server,
application-level end-to-end security, and the ability to change security products without impacting
your SAP business applications. To enable SNC with Kerberos, configure the client environment, the
SAP server, and Anypoint Connector for SAP (SAP Connector).

> [!NOTE] SAP does not provide support for third-party solutions.

## Before You Begin

To configure an SAP SNC with Kerberos, you must have access to:

- The SAP GUI application

  To install this client, Java must already be installed on your machine. Then, download the
  installer for your operating system from SAP.

- An SAP ECC instance that can use SNC system variables

- The following transactions:

  - `STRUST` (Trust Manager)

  - `SM30` (Table Maintenance)

  - `SNC1` (Generate SNC name for user)

  - `SU01` (User Maintenance)

  - `SM59` (RFC Destinations)

## Configure Active Directory

To configure Active Directory, create a new Service Principal Name (SPN) according to the operating
system you are using and export the keytab.

If you are using Windows, follow these steps:

1.  Create a service user `sidadm` in Active Directory.

2.  Select **Password never expires** and deselect **Use DES encryption types for this account**.

3.  Create a Service Principal Name (SPN) `SAPService/sapdev@SSODOMAIN.LAB` for the `sidadm` user in
    Active Directory.

    `setspn -A SAPService/sapdev@SSODOMAIN.LAB DOMAIN_SHORT\sidadm`

4.  Run the following command to export the keytab for this SPN from Active Directory. The password
    is the password to set for the keytab and the SID is the file name of the keytab.

    `ktpass -princ SAPService/sapdev@SSODOMAIN.LAB -mapuser DOMAIN_SHORT\sidadm -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -mapop set -pass <*password*> -out <SID>aes.keytab`

## Configure the SAP Server

To configure the SAP server, change the domain and the KDC in the operating system of the SAP server
to set up Kerberos and add the parameters and the library that authorize you to use SNC:

1.  Configure the `krb5.conf` file using the KDC address and the realm information (SSODOMAIN.LAB).
    The `krb5.conf` file is created by default in the `etc` directory.

    \[libdefaults\] # "dns\_canonicalize\_hostname" and "rdns" are better set to false for improved
    security. # If set to true, the canonicalization mechanism performed by Kerberos client may #
    allow service impersonification, the consequence is similar to conducting TLS certificate #
    verification without checking host name. # If left unspecified, the two parameters will have
    default value true, which is less secure. dns\_canonicalize\_hostname = false rdns = false #
    default\_realm = EXAMPLE.COM default\_realm = SSODOMAIN.LAB

    \[realms\] # EXAMPLE.COM = { # kdc = kerberos.example.com # admin\_server =
    kerberos.example.com # } SSODOMAIN.LAB = { kdc = DC.SSODOMAIN.LAB admin\_server =
    dc.SSODOMAIN.LAB } \[domain\_realm\] .ssodomain.lab = SSODOMAIN.LAB ssodomain.lab =
    SSODOMAIN.LAB

    \[logging\] kdc = FILE:/var/log/krb5/krb5kdc.log admin\_server = FILE:/var/log/krb5/kadmind.log
    default = SYSLOG:NOTICE:DAEMON

    \[libdefaults\] default\_ccache\_name = FILE:/tmp/krb5cc\_%{uid}

2.  Run the following commands to import the key to the `etc` directory:

    `ktutil`

    `wkt /etc/krb5.keytab`

    `q`

3.  Obtain a Kerberos Ticket Granting Ticket (TGT):

    `kinit -V SAPService/sapdev@SSODOMAIN.LAB`

4.  Run the following commands to change the permissions for the keytab:

    `chgrp sapsys /etc/krb5.keytab`

    `chmod 640 /etc/krb5.keytab`

5.  Set up automatic renewal for the Kerberos TGT:

    `crontab -e 01 0,6,12,18 * * * /usr/bin/kinit -R SAPService/sapdev@SSODOMAIN.LAB`

6.  Locate the GSS-API library on the SAP server (in this example, it is under the
    `/usr/lib64/libgssapi_krb5.so.2` path), configure the parameters for SNC with Kerberos in the
    default profile, and then restart SAP.

    - `snc/permit_insecure_start = 1`

    - `snc/data_protection/use = 3`

    - `snc/data_protection/max = 3`

    - `snc/data_protection/min = 1`

    - `snc/accept_insecure_r3int_rfc = 1`

    - `snc/accept_insecure_rfc = 1`

    - `snc/accept_insecure_cpic = 1`

    - `snc/accept_insecure_gui = 1`

    - `snc/gssapi_lib = /usr/lib64/libgssapi_krb5.so.2`

    - `snc/enable = 1`

    - `snc/identity/as = p:SAPService/sapdev@SSODOMAIN.LAB`

    - `login/password_change_for_SSO = 0`

7.  Create `sidadm` as a user in SAP and set the SNC name using the transaction `SU01`.

8.  For the RFC destination, use the transaction `SM59`. On the **Logon and Security** tab, enable
    the SNC option and add the SPN name as a partner.

## Configure SAP Connector

To configure SAP Connector, enable SNC with Kerberos:

1.  Access Anypoint Studio.

2.  Select **SAP** in the Studio canvas.

3.  Click the plus sign (+) next to the **Connector configuration** field to access the global
    element configuration fields.

4.  Configure the Kerberos connection:

    1.  In the **Connection** field, select `Kerberos`.

    2.  On the **General** tab, configure these fields:

        - **SAP system number**

        - **SAP client ID**

        - **Application server host**

        - **Kerberos Config File Path**

          Path to the `krb5.conf` file using the KDC address and the realm information
          (SSODOMAIN.LAB)

        - **Keytab File Path**

          Path to the keytab for the SPN from Active Directory.

          The keytab must contain only the entry for the **Principal** (`sidadm`). If you use an
          existing keytab, you must remove the existing entry first. To remove the existing entry,
          run the following command:

          `ktutil -k <replace_with_keytab_name>.keytab remove -p <replace_with_principal_name>@<replace_with_domain>`

          To create a new keytab, run the following command:

          `ktutil --keytab=<replace_with_keytab_name>.keytab add -p <replace_with_principal_name>@<replace_with_domain> -w <replace_with_principal_password> -e aes256-cts-hmac-sha1-96 -V <replace_with_key _version_number>`

        - **GSS Library Path**

          Static value `/usr/lib64/libgssapi_krb5.so.2.2` for CloudHub and CloudHub 2.0 or Runtime
          Fabric when using images published after July 2025. Static value
          `/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2` for CloudHub 2.0 or Runtime Fabric when
          using images published before July 2025.

        - **Principal**

          Service user name from Active Directory, in this example `sidadm`

        - **Client SNC Partner Name**

          SPN name from Active Directory, in this example `p:SAPService/sapdev@SSODOMAIN.LAB`

        - **Client SNC My Name**

          SNC name that identifies the client in secure network communications, in this example
          `p:sidadm`

    3.  On the **Advanced** tab, you do not need to change the extended properties because the
        Kerberos configuration already sets them.

### SAP Extended Properties for Kerberos

The following tables show the default values for the SAP extended properties for Kerberos.

The connector sets the following common extended properties:

<table><colgroup><col> <col></colgroup><thead><tr><th>Property</th><th>Default Value</th></tr></thead><tbody><tr><td><div><div><p>jco.server.snc_mode</p></div></div></td><td><p><code>1</code></p></td></tr><tr><td><div><div><p>jco.server.snc_qop</p></div></div></td><td><p><code>3</code></p></td></tr></tbody></table>

The connector sets the following extended properties for operations:

<table><colgroup><col> <col></colgroup><thead><tr><th>Property</th><th>Default Value</th></tr></thead><tbody><tr><td><div><div><p>jco.client.user</p></div></div></td><td><p>The <strong>Principal</strong> set under <strong>Kerberos Parameters for Operations</strong> in the <strong>General</strong> tab</p></td></tr><tr><td><div><div><p>jco.client.snc_lib</p></div></div></td><td><p>The path from <strong>GSS Library Path</strong> set under <strong>Kerberos Common Parameters</strong> in the <strong>General</strong> tab</p></td></tr><tr><td><div><div><p>jco.client.snc_myname</p></div></div></td><td><p>The <strong>Client SNC My Name</strong> set under <strong>Kerberos Parameters for Operations</strong> in the <strong>General</strong> tab</p></td></tr><tr><td><div><div><p>jco.client.snc_partnername</p></div></div></td><td><p>The <strong>Client SNC Partner Name</strong> set under <strong>Kerberos Parameters for Operations</strong> in the <strong>General</strong> tab</p></td></tr></tbody></table>

The connector sets the following extended properties for sources:

<table><colgroup><col> <col></colgroup><thead><tr><th>Property</th><th>Default Value</th></tr></thead><tbody><tr><td><div><div><p>jco.server.snc_lib</p></div></div></td><td><p>The path from <strong>GSS Library Path</strong> set under <strong>Kerberos Common Parameters</strong> in the <strong>General</strong> tab</p></td></tr><tr><td><div><div><p>jco.server.snc_myname</p></div></div></td><td><p>The <strong>Server SNC My Name</strong> set under <strong>Kerberos Parameters for Sources</strong> in the <strong>General</strong> tab</p></td></tr><tr><td><div><div><p>jco.server.snc_partnername</p></div></div></td><td><p>The <strong>Server SNC Partner Name</strong> set under <strong>Kerberos Parameters for Sources</strong> in the <strong>General</strong> tab</p></td></tr></tbody></table>

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)