On the Linux client machine, you need to download (or copy over to the machine) the SAPCRYPTOLIB archive… so for this, you need an S-user with Software Download rights (or you need to know someone in your organisation with such rights – ask them nicely for help, explain your use case and business case, etcetera etcetera). Note: this blog is the verbose-and-extended version of the excellent advice (which I followed) from Rob Liversage that he provided in a comment elsewhere on this SAP website – so if you prefer the concise original advice on how to get this stuff working, then it’s here: [A blog I wrote that shows how to do the SNCwizard setup for server-side config is here: We don’t consider much about what SAP server-side config should look like for this client-side logon method to work (beyond some necessary activity in tcode STRUST) – instead, we just assume that the SAP system is setup for SNC in the right way already.

(We can thus consider SSO-over-SNC as a functionality-superset of Encryption-over-SNC). The idea of SSO is that the client machine presents a (public key) certificate identifying a SAP user by their SNC name to the target SAP system, and if that certificate is in the trusted certificate list of the SAP system’s SAP Cryptolib PSE, then the SAP system will allow the logon attempt. Then in a second iteration of the setup (section “Using SSO”) we set up the full SSO for SAPGUI over SNC, using an X.509 certificate to logon. The idea of encryption is that as both the client machine and the SAP server can use the SAPCRYPTOLIB, and the public key certificate presented by the client machine is in the trusted certificate list of the SAP system’s SAP Cryptolib PSE, then the SAPGUI-traffic between client and server is encrypted and thus protected from being deciphered by bad actors. We first consider getting encryption-via-SNC working, so that even when doing manual (password-based) logins, at least the communication is encrypted, and thus not vulnerable to being deciphered by Wireshark or whatever. Encryption and SSO (Single Sign-On) for SAPGUI logins from a Linux client machine can be set up using X.509 certificates.

Sapcar exe download