SAP Control Center can authenticate user logins through an LDAP server, through the operating system, or both.

Although you can create native user accounts in SCC, this approach to authentication is not recommended. It is simpler and safer to configure SCC to authenticate using existing LDAP, Windows, or UNIX login accounts.

SAP strongly recommends that you use a common authentication provider for SCC and for SAP database products managed by SCC. A common authentication provider ensures that single sign-on works for users of SAP Control Center and its managed servers.

SCC requires each authenticated login account to have a predefined role. When a login is authenticated, roles for the login are retrieved by the security module and are mapped to SCC predefined roles. Authorization is resolved through the mappings between the security module native roles and SCC roles. You can enable mappings by creating a “sybase” group in your operating system or LDAP server and adding all SCC users, or by modifying the SCC role-mapping.xml file to configure the mapping of native roles to SCC roles. The security module authenticates the logins and authorizes access to managed resources.

SAP Control Center provides a set of predefined login modules for authentication. All login modules are defined in the <install_location>/SCC-3_3/conf/csi_config.xml file. The syntax is defined by the SAP Common Security Infrastructure (CSI) framework. You can configure the different login modules to customize security strength. The login modules are:
Related tasks
Configuring a Pluggable Authentication Module (PAM) for UNIX
Configuring an LDAP Authentication Module
Mapping SAP Control Center Roles to LDAP or OS Groups