> For the complete documentation index, see [llms.txt](https://docs.theconfigteam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.theconfigteam.com/prebilt-ewm/installation/single-sign-on-1.md).

# Single Sign On

### Overview

Single Sign-On (SSO) for PreBilt EWM relies on the standard SAP authentication mechanisms configured within your SAP landscape.

PreBilt EWM does not provide its own authentication service or identity provider. Instead, it leverages the existing SAP SSO configuration and uses redirection to authenticate users against SAP using the customer's chosen identity solution.

This means that SSO is configured and managed within SAP and supporting identity systems, while PreBilt EWM simply participates in the established authentication flow.

### How authentication works

1. A user accesses PreBilt EWM.
2. PreBilt redirects the user to the configured SAP authentication endpoint.
3. SAP authenticates the user using the configured SSO solution.
4. Upon successful authentication, SAP returns the authenticated session.
5. PreBilt EWM uses that session to grant application access.

{% hint style="info" %}
**Important**

PreBilt EWM does not replace or configure SAP Single Sign-On. Any required configuration involving Microsoft Entra ID, SAP Identity Authentication, Kerberos, SAML, certificates, or other identity technologies must be completed within the customer's SAP authentication landscape before enabling SSO within PreBilt EWM.
{% endhint %}

### Typical Architecture

```
User
    ↓
PreBilt for EWM
    ↓
Redirect
    ↓
SAP SSO 
    ↓
Identity Provider
(Entra ID, SAP IAS, etc.)
    ↓
SAP Session
    ↓
PreBilt for EWM
```

### Supported Authentication Approaches

The authentication mechanism depends on the customer's SAP landscape and security requirements. Common approaches include:

* SAML 2.0
* Kerberos
* X.509 Certificates
* SAP Logon Tickets

### Prerequisites

Before enabling SSO within PreBilt for EWM, the following should already be in place: 

* SAP SSO is configured and operational.
* User accounts are correctly mapped between SAP and the identity provider.
* Trust certificates have been established.
* Required SAP parameters have been configured.
* Authentication via SAP GUI or browser-based SAP applications has been validated.

### Enabling SSO in PreBilt

Once SAP SSO is operational, SSO can be enabled within the PreBilt frontend configuration. This setting assumes authentication is already functioning correctly within SAP.