Logon Procedures & Single Sign-On

In the AS Java JAAS implementation, what is a login module and how does it relate to an authentication stack?

Of the AS Java logon procedures, which are SAP-proprietary rather than open standards?

Which authentication stack is delivered as the standard logon procedure for Web Dynpro and most AS Java applications, and why does that matter to an admin?

You need two Web Dynpro Java applications on the same AS Java to use different logon procedures. Can you configure them separately?

Walk through how the standard ticket stack (EvaluateTicketLoginModule SUFFICIENT, BasicPasswordLoginModule REQUISITE, CreateTicketLoginModule OPTIONAL) authenticates a user.

For login module flags, what is the difference between SUFFICIENT and REQUISITE in how control returns to the application?

Which AS Java login module issues logon tickets and which one verifies tickets issued by other servers?

How does a logon ticket issued by AS Java enable Single Sign-On to other systems?

In Kerberos logon to AS Java, what does SPNego stand for and what is its actual job?

Trace the message flow when a Windows user opens an AS Java application configured for Kerberos (SPNego) SSO, with Active Directory as the KDC.

What does X.509 client-certificate authentication give AS Java that makes it suitable for Single Sign-On?

An administrator finishes setting up X.509 logon and the very first certificate logon fails. Does that mean the configuration is wrong?

What is the delivered, recommended way to configure Kerberos (SPNego) logon on AS Java rather than wiring the login modules by hand?

Technically, where is a logon ticket stored, and what must be true of the user for SSO with it to work?

How does an assertion ticket differ from a logon ticket, and when is it used?