How To Fix TRUST079 - Define the PSE for Single Sign-On with logon ticket only in client 000

SAP Error Message - Details

• Message type: E = Error

• Message class: TRUST - Certificate Management

• Message number: 079

• Message text: Define the PSE for Single Sign-On with logon ticket only in client 000

What causes this issue?

The PSE for Single Sign-On with logon ticket is determined in client
000, since the client is not determined before logon. On the other hand,
the SSO access control list (ACL) is only evaluated after the logon, and
is therefore client-dependent.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

If you are not logged on in client 000. do not maintain the PSE for
Single Sign-On with logon ticket, but rather only the SSO access control
list (ACL).

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message TRUST079 - Define the PSE for Single Sign-On with logon ticket only in client 000 ?

  The SAP error message TRUST079 indicates that the system requires a PSE (Personal Security Environment) to be defined for Single Sign-On (SSO) using logon tickets, specifically in client 000. This error typically arises when the necessary configuration for SSO is not properly set up in the SAP system.
  Cause:
  The error occurs due to one of the following reasons:
  
  Missing PSE Configuration: The PSE for the SSO is not defined or is incorrectly configured in client 000.
  Incorrect Trust Relationship: The trust relationship between the SAP systems is not established correctly, which is necessary for SSO to function.
  Client-Specific Settings: The settings for SSO are not correctly maintained in the client where the error is encountered.
  
  Solution:
  To resolve the TRUST079 error, follow these steps:
  
  
  Create or Maintain the PSE:
  
  Log in to the SAP system in client 000.
  Use transaction code STRUST to access the Trust Manager.
  In the Trust Manager, check if a PSE exists for the system. If not, create a new PSE:
  
  Select the "SSL Client (Anonymous)" or "SSL Client (Server)" depending on your requirements.
  Click on "Create" to generate a new PSE.
  Follow the prompts to create the PSE, ensuring you provide the necessary details (like the key length, validity period, etc.).
  
  
  After creating the PSE, ensure that it is saved and activated.
  
  
  
  Configure SSO Settings:
  
  Ensure that the SSO settings are correctly configured in the system. This includes setting up the necessary parameters in the profile or using transaction RZ10 to adjust the instance profile.
  Check the parameters related to SSO, such as login/accept_sso2_ticket, and ensure they are set correctly.
  
  
  
  Check Trust Relationships:
  
  Verify that the trust relationship between the SAP systems is correctly established. This may involve configuring the necessary RFC destinations and ensuring that the appropriate certificates are exchanged and trusted.
  
  
  
  Test the Configuration:
  
  After making the necessary changes, test the SSO functionality to ensure that the error is resolved. You can do this by attempting to log in to the system using SSO.
  
  
  
  Documentation and Backup:
  
  Document the changes made for future reference and ensure that you have backups of the PSE and configuration settings.
  
  
  
  Related Information:
  
  PSE Types: Understand the different types of PSEs (e.g., SSL Client, SSL Server) and their purposes.
  SAP Notes: Check for relevant SAP Notes that may provide additional guidance or updates related to SSO and PSE configuration.
  Security Best Practices: Follow SAP security best practices when configuring SSO and managing PSEs to ensure the integrity and security of your SAP environment.
  
  If the issue persists after following these steps, consider reaching out to SAP support for further assistance.