Skip to Content
Technical Articles
Author's profile photo dylan drummond

Notes on installing SAPGUI for Java for macOS


These notes might help people with the eponymous task; they are not as wide-ranging and thorough as the official instructions and guides from SAP, instead these are just some remarks based on author’s recent experience, which might be helpful 👌 (or might not 😱 ).

This blog assumes you have local admin rights to your MacBook (though everything might work out without admin rights, I haven’t tested that); the ability to use Terminal for basic commands is needed for the JAR method of installing, and useful for modifying files in the main config folder (though you could use Finder instead for that).

You will want to get hold of the installation media of SAPGUI for Java version 7.70 or later (the freeware version 7.50 from e.g. SAP NetWeaver Developer Edition, has a different installation procedure (requires separate OpenJFX 11 library), and anyway the version 7.50 is well out of date at time of writing, March 2022). We will show how S-users and P-users can get hold of the relevant media (also we show how anyone can get an SAP Community P-user).

If you need SAP Secure Login Client, we show how an S-user can get hold of the installation media for that (this particular software might not be available to P-users, but then again SSO tends to be found more in organisations than in the SAP POC world of SAP Community developers).


Installing the SAPGUI for Java for MacBook software

First of all, we should note that nowadays it’s not actually required to have an existing JVM nor to install any JVM, in the case where you will install SAPGUI for Java via the DMG package… as SAP put it: 

“The platform-dependent installation programs use the inbuilt SapMachine during the installation, thus no installed Java Virtual Machine is required. Depending on your platform, the following files are applicable:

  • Linux platform: PlatinGUI-Linux-Installation-<version>
  • macOS platform: PlatinGUI-MacOSX-Installation-<version>.dmg
  • Windows platform: PlatinGUI-Windows-Installation-<version>.exe”

So, if you intend to install using the DMG, then you can ignore all the advice below about manually getting hold of SapMachine JVM and configuring JAVA_HOME and so on.

Note that as of June 2022, the DMG available for P-users [version 7,70rev1] only installs on Intel-based MacBooks and does not work for M1 MacBooks; so, the DMG approach is only for those who either (a) have an Intel-based MacBook, or (b) have an M1 MacBook and can get hold of a working DMG [later versions such as 7,70rev6 works fine for M1 MacBook] via an S-user.

Manual setup of SapMachine JVM

To run the jar file which then installs the SAPGUI client on your MacBook, you will need a suitable Java SDK (a.k.a. JDK). (Note that you only need this JDK for installing – the SAPGUI client contains its own “internal” JVM that it runs on itself). Get the most suitable one free from SAP themselves: the JDK you need is available here – no registration required, just download the stuff you need:

Choose a latest stable version, choose JDK, choose the right kind of processor (for M1 Macs, that is “macOS aarch64”; for Intel Macs you would choose “macOS x64”), then take the latest minor version of the stable version. In March 2022 when this was written, the choices for an M1 Mac look like so:

Then download it. A dmg file is downloaded. Double-click on it, you should get a Finder window with the main folder shown. Now you can move those files into somewhere that makes sense on your computer, I made a folder under home drive called “SAPGUIforJava” and then created subdirectories “opt” and “jdk” and put the sapmachine-jdk folder there.

Next, it will be convenient to tell our computer the value of the JAVA_HOME environment variable, and to add the java binary directory to the main PATH environment variable, every time we login. (If you have already your own JVM and JDK preferences, then relax, this is only a temporary change that can be removed after installing SAPGUI client). We can do that as follows…

Open Terminal application. It should open by default to your home directory. To check the directory you are in, you can use:


To move to your home directory, you can use the “cd” command with no options, that returns you from wherever you are in the directory tree to your home directory:


Check if the file called “.zshrc” exists:

ls -al

If it doesn’t yet exist, create it:

touch .zshrc

Once it is existing, we edit the file by adding two lines. So first open the file:

open .zshrc

Then add the paths that match to your locations of JDK’s “Home” and “bin” folders, like so:

export JAVA_HOME=/Users/myhomedir/SAPGUIforJava/opt/jdk/sapmachine-jdk-17.0.2.jdk/Contents/Home

export PATH=”/Users/myhomedir/SAPGUIforJava/opt/jdk/sapmachine-jdk-17.0.2.jdk/Contents/Home/bin:$PATH”

Save and close. Now you need to logout and login again, so that the info in this file is picked up.

Then you can open a Terminal again, and check that the following commands work fine:

java -version

javac -version

You should get similar results.

Ways to get hold of the installation media

Next, we need to get hold of the JAR archive or the DMG from SAP, for installing the SAPGUI for Java for macOS client on your MacBook.

There are three main ways to do this. The first way, if you have an SAP S-User with the appropriate permissions for downloading SAP software, is described below. The second way is if you do not have such S-user with special powers, but maybe you work in the same organisation as someone with such an S-user, and they may be able to provide you with the needed JAR archive or DMG. The third way works if you have a P-user (only for JAR archive), and is also described below (thanks to Declan McArdle for pointing out this third way in the Comments section).

Using an S-user to download the SAPGUI for Java media

So using an S-user… go to: and click on the “Software Downloads” tile, which takes you here:

Now, this is not the most intuitive software repository ever, so the author can say it took a couple of hours to find the needed software.

To find the JAR archive… In the Search box enter the text “PlatinGUI770” and hit <Enter>. (In March 2022 7.70 was the latest version, you may want to search the SAP Help to check what is the latest version when you come to do this installation and adjust your search term accordingly). From the list, scroll down to get the highest version and revision that is suitable for Mac OS, e.g. at the time (11.02.2022) of screenshot-taking that was version 7.70 revision 4 (in March 2022 when this blog was published, revision 5 had become available, as kindly pointed out by Henning Marquard in the Comments section… always good to check for latest versions and revisions, yes):

To find the DMG… In the Search box enter the text “GUI770Inst” and hit <Enter>. (Here we assume that “770” is the latest version, again you should check from SAP Help and adjust that number to match the latest version). And scroll down to find the latest version+revision combination which is a DMG:

If you already have a working SAPGUI for Java client installed, you can get to the right set of downloadable software without needing a Search term (thanks to Mauro Martelli for providing this info in the Comments section): from the SAPGUI top menu, choose Help -> SAP Software Downloads. This takes you to the SAP Support Launchpad and returns a list of packages that might be useful. But it can happen that the linked page opens with Linux selected as the OS… so remember kids, check which OS is selected and if needed change to use “MAC OS”:

… then you get a list, and you can choose either the latest DMG or the latest JAR from that list:

Update October 2022: SAP now releases processor-architecture specific versions of both DMG and JAR archives, so if you have an Mn-based MacBook (e.g. M1, M2,…), you should choose the “MACOS ARM64 64BIT” from the Drop-Down List Box, while if you have an older Intel-based MacBook, you choose “MACOS on X86_64BIT”. (The X86_64 version ran for me ok on an M1 MacBook via the inbuilt Rosetta emulation of MacBook, but it’s always wiser to choose the “native for processor version”):


Easiest way to download stuff (no SAP Download Basket installation required) is to click on the I-Ching like icon and go to the “Content Info” link that appears, and from there hit the Download icon:


Using a P-user to download the SAPGUI for Java media

To get an SAP P-user, which is like an SAP Community ID for Private individuals (i.e. not linked to an SAP Customer or Partner number as the S-users are), go to and register there for a P-user. Once you have the P-user, go to:

From the top right you can login to this SAP site using your P-user, so do that as only logged in users can download the software available on this site, In March 2022 you need to scroll near to the end of this page, you are looking for the package called SAPGUI for Java:

Accept the license terms and download the RAR archive. The native MacBook unzip tool doesn’t know how to extract RAR archives, but no worries – in App Store, search for an excellent free tool called The Unarchiver:

So get that app and install it. If you want to check or modify which kinds of files The Unarchiver should extract, open the app and in Preferences you can review the options, make sure that “RAR Archive”-checkbox is ticked:

Now you can unpack the SAP_GUI_for_Java.RAR by e.g. right-click -> Open With -> The As of March 2022, the version 7.70 revision 1 was what was available for the P-users, and that’s fine for us:

Note that smoke-tests of this DMG in March 2022 (on M1 MacBook and on an Intel MacBook) to install SAPGUI didn’t work (macOS complained that the is damaged); however a new smoketest on the Intel MacBook in October 2022 using the same DMG was successful… so, for people using this P-user-path to get hold of installation media, using the JAR may (or may not) be the only feasible option.

Installing SAPGUI using the DMG

Double-click on the DMG file, which opens to display a SAPGUI for Java Installer icon; double-click on the icon to proceed (you may get a prompt warning that this installer-app was downloaded from the Internet – choose “Open” to continue):

The GUI-Installer starts up… skip forward a few lines to the section “Click through GUI Installer steps to install” below.

Installing SAPGUI using the JAR

So you have the relevant JAR on your local machine. You can put the downloaded JAR for safekeeping in some folder, or you can leave it in the Downloads folder. Anyway, open a Terminal, and using the “cd” command move to the directory the jar is in, e.g. since I put the jar in “SAPGUIforJava” then the command could be:

cd /Users/myhomedir/SAPGUIforJava

Then execute the jar… if your jar is called PlatinGUI770_4-70004682.JAR then:

java -jar PlatinGUI770_4-70004682.JAR

The GUI-Installer starts up…

Click through GUI Installer steps to install

So this is just like any easy GUI-based installation: click through the steps then press “Install”…

… and hope it installs ok. Here is what success looks like:

You can now open it like any app in Applications (from Launchpad -> SAP Clients, or Spotlight, or Applications directory)… although it will look a bit empty…

…so, from MacBook upper menu (or from Dock-icon menu via Secondary Click) you can Quit SAPGUI (since we have other stuff to do still, and then you would need to restart SAPGUI later in any case). By the way, menu-based Quit is the correct way to close SAPGUI; it doesn’t close properly if you just close the window, and then you are left wondering how to get the window back – spoiler: you cannot, until you really Quit… so remember kids, just use the menu-based Quit and make your own life easier 😄 .

[For those who used the JAR method to install: if you like, you can open .zshrc file again and either comment out (using the ‘#’-character as the first character of a line) or delete the lines setting JAVA_HOME and PATH environment variables. Your SAPGUI client doesn’t need these variables set, as it has its own JVM instead. (In the past, the SAPGUI for Java clients relied on the local machine’s default JVM, which caused problems, especially for developers, or for everyone in case the corporate policy determined a non-compatible to SAPGUI for Java JVM… so this “internally packaged JVM” solution that arrived maybe in the late 2010s, is rather neat and useful)].


Configuring the SAPGUI client

Now there are two main ways to proceed here, which have their own advantages and disadvantages, so you can choose how you like from The Server Option or from The Local Option.

The Server Option

The Server Option means using Finder (or Terminal) to connect to the server on which the organisation’s SAPUI xml files are stored, and then specifying in the SAPGUI for Java app which server file you want to use, where the file is typically either accessible via NFS (from a Unix or Linux server), or if the file is on a Windows server then access is via the mounted directory in /Volumes of your local machine. (Below we will consider the case of a Windows server, as this is a rather common setup in organisations, including most of those the author has worked for in the last twenty years. If your organisation uses NFS, then you should be able to scour the internet for good advice about connecting using the “nfs://…” prefix, and then you can test how that plays out when specifying a file in Preferences of SAPGUI).

The advantage of The Server Option is that you are doing what the majority of SAP users do – using the remote “One Source of Current Truth” file maintained on the organisation’s network-servers; this way, you should always have an up to date set of SAP connection items in your SAPGUI client.

A main disadvantage for MacBook users is that you will often or always need to manually connect to the relevant company server and folder each time you have logged in to the company network. It’s possible to mitigate this by adding the server in question to your login items (shown also below), however this isn’t a perfect workaround, particularly if you sometimes work away from the office and thus need to connect to VPN before (manually) reconnecting to the company server with its SAPUI files.

The other disadvantage (affects the author, but probably not too many other people) is that if you are yourself doing various proof-of-concept activities around SAPGUI for Java, then it gets a bit complex when the local config is used on top of the server config option (more on that later).

Although MacBooks come with default support for the Samba protocol (“smb://…”), however according to my smoketesting and according to the below discussion on, the SAPGUI for Java for MacBook app does not support Samba:

As the SAP employee replies to the questioner:

“according to chapter “3.4.1 Providing Connection” of the manual:

Depending on the location of the configuration file, you can enter either a full pathname (for a local file) or an URL (for a file located on an intranet web server).

Latter means http or https URL.

smb:// is not supported. What might work is to have the share already mounted and use something like file:/Volumes/whereitismounted/configfile.txt

But this assumes it is already mounted and is expected to be not really reliable.”

If in your organisation there would be an identified need for the MacBook SAPGUI users to get their Landscape file from a server without having to assign the network location to /Volumes manually, then it would likely be a server running a lightweight HTTP server, so that we could use the HTTP protocol. Technically this is not so difficult to achieve, though there are many ways and many OS choices to make here. As a toy example for demo purposes only: on local machine, using python, we can tell a folder called “folder-for-http” containing a test xml file to act as our HTTP server, and let’s choose port 7777 (why? because we can 😄 ):

cd ~/SAP/folder-for-http

python3 -m http.server 7777

Then in Preferences of SAPGUI we can specify the URL http://localhost:7777/SAPGUILandscapeTestHttp.xml and SAPGUI successfully discovers then uploads the relevant xml file:


So that was the HTTP approach. Let’s turn now to using the Volumes approach for Samba protocol. So imagine that the location of the xml files is here:



The equivalent URL in Samba format [Unix/Linux:]


In MacBook, from Finder use the top-bar menu Go -> Connect to Server… connection string is in the Samba format; now you will be connecting to some Windows share or folder using Samba protocol, and what happens here is that macOS mounts the share or folder in question to /Volumes on your local MacBook.

For command-line aficionados, there are also ways to accomplish this connection and mounting to /Volumes from Terminal, the simplest is probably this way:

open smb://orga.nisat.ion/some-drive/001/SAPstuff/SAPUILandscape/

So with the relevant SAPUILandscape folder on the server mounted to /Volumes, now we can from SAPGUI app go to top-bar menu SAPGUI -> Preferences and in the Configuration -> Logon screen we put the Volumes-based filepath as value of the field “SAP UI Landscape” and press Apply, and then our client gets its Landscape file from the Windows server like almost everyone else does. So if the server “drive” is defined as (the last directory in path):


…then the filepath in Volumes to a relevant xml file will be something like this:


(If you used NFS to connect to your server, then it could be that you can specify the “nfs://…” formatted filepath, or maybe just the plain filepath without prefix, in SAPGUI Preferences – I cannot test this at the time of writing, but if anyone does that test then feel free to leave a comment with the results and then we can modify this paragraph).

Detour about side-effects of explicitly specifying the xml file to use


It seems that after specifying own file (whether on the server, or even just your own local file) in Preferences, then trying to switch back to use another file, nothing found, or old default location file still there and that is what gets modified instead of our specified file… also it can be difficult to go back to “empty” state as no way to remove the “uploaded file” data … all seems a bit strange.

So the logic of this, how to explain (even to myself 😂 )… for example if I create (as a copy of default file) the SAPGUILandscapecopy.xml and explicitly reference it in SAPGUI Preferences, and (say) delete the SAPGUILandscape.xml file, then what happens is that the SAPGUILandscapecopy.xml file that is specified in Preferences becomes an “Included [read-only] file” for the new (if just deleted) or updated (if still existing) default SAPGUILandscape.xml file:

Note the part that says

Include url=“file:/Users/myhomedir/Library/Preferences/SAP/SAPGUILandscapecopy.xml”

[BTW we don’t usually want to start specifying our own custom names of local files, the above was just for demonstration purposes; usually it just gets messy, having e.g. one read-only local file included as a reference from the default other local file].

So what the Include-logic means is that for items of the Included file, you cannot edit or delete any such items. On the other hand, you can still create new items or create a duplicate of existing items, and any such new or duplicated items are then editable and deletable.

So typically you would have the remote server file being specified in Preferences, and then any new or copied-then-modified items that you create, are being saved locally in SAPGUILandscape.xml (though most users will not need or want to make new entries).

But if you ever make the mistake of putting the local SAPGUILandscape.xml file itself as the file in Preferences, then that whole file becomes read-only and you cannot do anything with it, and it seems not to even save any new additions – I suspect it becomes somehow syntactically broken from the point of view of our client SAPGUI app as it is including itself as read-only.

Still, you can still get out of traps like this: here is the workaround for any situation where it is difficult to “fully reset”… you’ll need either a remote server filepath via /Volumes, or a non-corrupted local backup file (unless you want to go back to having an “initial” local file like just after installation). Proceed as follows: empty the Preferences field for SAP UI Landscape and Apply; then close SAPGUI for Java. Then delete the useless or non-fully-writable or otherwise unwanted SAPGUILandscape.xml file. Now reopen SAPGUI, you will see that a new empty default file is “under creation” (saved to file when you close SAPGUI again):

Now you can either specify the remote file again (the Server Option); or, you can close SAPGUI, rename some appropriate backup file (that has no Include references) to be the SAPGUILandscape.xml file (if you are going for The Local Option), and open SAPGUI again – in that case the restored local file is once again fully writable.

Anyway, the main idea is that since in Preferences you would be more likely to specify a file on the corporate server, then this file should of course be read-only (since changes made to the file on the server would affect all SAP users, i.e. thousands of people)… probably that is why the rule is, that any specified file in Preferences field “SAP UI Landscape” becomes an included, read-only file which is then “called” or “read in” by a created or updated (local) SAPGUILandscape.xml file, the default local file which is always existing (recreated by the app if necessary).

So in summary: the local file wraps the specified “remote” file, and changes can only be made by creating new items (including duplications of read-only items), where all the new items are saved to the local file.



To reconnect the server to /Volumes when logging in, you can do that as follows – open System Preferences -> Users & Groups -> Login Items. From Finder where you can see e.g. the SAPUILandscape Drive-icon, so click and drag that icon into Login Items. You end up with something like this:

Remember though that this automatic reconnection is only going to work if you already have a connection to the organisation’s network from more or less as soon you logged in to your MacBook, in practice that usually means being on the Office LAN i.e. on-site; typically when off-site, connecting e.g. via VPN to company network involves manual steps requiring 2FA, so in these cases the connection will not happen immediately after logging in to MacBook, and hence the reconnection to server fails:

… in these cases, you can still connect manually to the server using the ways described above, after you have established a VPN connection.

To find the SAPUILandscape folder as a Volume, you can do that by going to the root drive (e.g. Monterey HD, usually the name reflects the version of macOS), then make hidden folders visible (Command-Shift-<the dot character>), and from there you find /Volumes and your mounted drive (folder).

You can skip forward now to the section “Visibility of items tip”, or you can read the following section about other main option for getting the xml file with the SAP system details.

The Local Option

The main advantage of The Local Option is that you don’t need to think about making sure, every time you login, that the folder you need access to is mounted to /Volumes.

Another advantage for a few people – mainly SAP Developers and SAP Basis techies – is that keeping everything in the local file and using backups properly, is the neatest way for doing any POC work with the xml file.

The main disadvantage of the local option, is that eventually your local file contents will diverge from the server-maintained file, so if e.g. the logon details change for some SAP system on the server file, and you have only stale local information, you could be wondering “why can I not connect when everyone else can?”… so that’s something to bear in mind, that occasionally you might want to retrieve from the server the latest version of the relevant SAPUI xml file, and make that the new local file using move or copy commands (shown below).

[We note here that in SAPGUI for Java documentation, and for the actual default local file used by the SAPGUI for Java app, the main xml filename begins “SAPGUI…”; whereas in SAPGUI for Windows documentation, the main xml filename begins “SAPUI…” (<- no “G”). The thing to remember, is that we are using SAPGUI for Java, and therefore we must keep our local SAPGUI client software happy, by sticking with the “SAPGUI…” naming convention here; in fact the locally generated default file of the SAPGUI for Java app, is always called “SAPGUILandscape.xml”].

So let’s assume that you copy-pasted from the remote server, the SAPUILandscapeGlobal.xml file or whatever file it is you need. Once you have that “SAPUI…” xml file, in Terminal go to location ~/Library/Preferences/SAP:

cd ~/Library/Preferences/SAP

First backup the existing file in this directory, which is called “SAPGUILandscape.xml”, by renaming it to something like “SAPGUILandscape.xml_bac”:

mv SAPGUILandscape.xml SAPGUILandscape.xml_bac

If your SAPUILandscapeGlobal.xml file is, say, in Downloads, then copy it across to our SAP Preferences directory we are in, like so:

cp ~/Downloads/SAPUILandscapeGlobal.xml .

(Note the space followed by a dot character “ .” after the name of the file to be copied, this space plus dot tells the computer to copy the file to the current working directory the user is in).

Then, rename the copied file to be the new “SAPGUILandscape.xml” file, e.g.:

mv SAPUILandscapeGlobal.xml SAPGUILandscape.xml

See the “Detour” section above for advice about using the Preferences Logon tab… I strongly recommend that if you are using the Local Option, you don’t explicitly specify any file in that Logon tab, instead you should just leave it empty. If you want to work with multiple local files, the best way to manage this, is to have custom names for those files; then backup the current SAPGUILandscape.xml file, and copy the custom file you want to work with to become the current default file… for example:

mv SAPGUILandscape.xml SAPGUILandscape.xml_bac_20220304_v01

cp SAPGUILandscapeMyPrecious002.xml SAPGUILandscape.xml

In other words, you switch among your files in such a way, that the SAPGUI client app is always using the default file SAPGUILandscape.xml – this way you avoid the “Include [read-only]” complexities mentioned in the “Detour” section.

Visibility of items tip

Now, if you have specified either via The Server Option or The Local Option a list of SAP systems in the xml file, and you open SAPGUI, it can happen that only some empty workspace appears; if this happens, then go to View -> Show All Workspaces, and then the full list of SAP systems should be visible under the relevant workspace(s).

If you are not using SSO to login to SAP systems, then now you can double-click on the SAP system you want to logon to… in that case you can skip forward to the section “And Logon…”

Local-local workspaces

If you would like to create your own local workspaces and folders separately to the “local copy of server file”, so that e.g. when replacing with a newer local copy of the server file, you can still keep your “truly local” workspaces, folders, and connection items, then this is possible. My advice based on bitter experience is that it is better to begin by directly modifying the XML file, instead of using the SAPGUI client… use any good XML Editor e.g. Visual Studio Code with some XML Tools add-on installed, and then format the Landscape file. Then you can manually create a Workspace line directly under the tag <Workspaces default=”somelonguuidd01b4cf34″>, such as:

<Workspace expanded="1" name="AardvarkSpace" uuid="12345678" description="Local items" hidden="0">


Save the file, and open SAPGUI for Java client. Now what should happen is that you see your new workspace as a top-level node in Hierarchy view… if not, it might be that SAPGUI didn’t like the uuid you provided e.g. it contained non-hexadecimal characters [outside {[0-9],[a-f]}] and so the SAPGUI client might generate a “real uuid” and decide that your new Workspace is just a (folder) Node under some existing workspace. Not to worry – quit SAPGUI, format/prettify the XML file, copy the generated uuid from <Node … name=”AardvarkSpace” …/>, then remove that node and rebuild your new Workspace under Workspaces tag as before, e.g:
<Workspace expanded="1" name="AardvarkSpace" uuid="10c1db2c-9ba4-483d-a708-e6b2f902fd4d" description="Local items" hidden="0">
Save again… this time when you reopen SAPGUI for Java, your Workspace should be a top-level node, and you can then right-click on it to create a subfolder, and then e.g. from the subfolder you can right-click and make a New connection, and so on:
Once you quit SAPGUI, your changes will be persisted to the Landscape file SAPGUILandscape.xml as usual (and the nice formatting will be replaced by minimalist format). But in your code editor you can always reformat and check to see that all your local workspace changes have been persisted:
Later, when you decide to replace the copy of the server-file with a newer local copy, then from the older backed up file you can copy-paste this code into the new local copy i.e. restore your local workspace into the new SAPUILandscape file under Workspaces tag.


Note that in case you have Item lines in your local workspace i.e. connection items, as in our example we have one, then you also need to copy-paste their relevant Service lines across; to do this you search the xml on the serviceid value from the Item, and then copy the relevant Service line into the Services block, in our case we need this line:
<Service name="NPL NetWeaver 752 SP04" expert="1" uuid="cc6b04cf-9be0-428a-a7fe-a2aa552a999e" type="SAPGUI" server="" mode="1"/>

[There is a remote but non-zero chance, of uuid clash between your new main file and the uuids of your local-local xml lines, if you are paranoid you could search for clashing uuids before pasting in your local-local lines]. So all in all, a wee bit tricky yeh, but still in the realm of the possible 😅 … good luck if you choose that path.


SAP Secure Login Client

If your organisation is using SAP SNC (Secure Network Connection) to enable SSO (Single Sign-On) then it means you need to do some SPNego/Kerberos type of negotiation between SAP Secure Login Client (3.0 as of Feb 2022) and the corporation’s authentication-servers. In such SSO-scenarios, trying to login to SAP without having the SAP Secure Login Client installed will fail (with an error message referring to SNC).

So what we need to get hold of in such cases, is this thing the cool kids are calling “SAP Secure Login Client”. I’m not aware of this being available for P-users, so what follows assumes you have an S-user or you know someone in your ogranisation who has an S-user and wants to help you.

So as an S-user, from the SAP site:

we can use search term “SAP Single” and from the Categories offered choose latest main version of SAP Single Sign On (3.0 as of March 2022), with the “Maintenance Product” type, like so:

From there choose “Comprised Software Component Versions”, and from there “Secure Login Client 3.0”. Then make sure to choose “MAC OS” in the dropdown box, since “WIN 32” will not at all get you the stuff you need here 🤣 … and choose the latest version, and download it using I-Ching icon or Download Basket:

Once you unzip the downloaded file, you can see it contains an installer pkg. So, double-click on it and follow the installer steps, it should install ok.

Next, I recommend to logout, and log back in again. If you are working remotely, make sure after logging in again that you have (re-)connected to the corporate network using VPN. (Because it is only if your computer is connected to corporate network, that the Secure Login Client is going to be able to get the stuff it needs to do secure login).

Once connected to corporate network, you can (if you like, but see below) open the new app “Secure Login Client”. Just remember to keep it open for as long as you intend to use SAPGUI SNC connections to SAP systems.

But actually, you don’t even need to open the Secure Login Client manually. Instead you can just leave it alone, then when via SAPGUI you double-click on some SAP system you want to logon to, SAPGUI itself realises that it has to open Secure Logon Client, and it does that successfully, so you should see the Secure Logon Client logo (a white tick on blue background) in the MacBook top menu bar:

..and thanks to the Secure Login Client, you should now be able to logon to your SAP systems.


And Logon…

Note that the first time that you logon to an SAP system from SAPGUI for Java, you are asked to assign a Trust Level Classification to the system you are accessing… for example you could accept the default value “Internal: Generally trusted…” and continue by pressing “OK”:

This Trust Level Classification for an SAP system can be edited later (when a user session in SAPGUI is open for said SAP system), either by menu path (SAPGUI top bar menu) File -> Edit Trust Level, or by using the Edit Connection button and go to Security tab. For example, you might want or need an SAP system to be able to download or upload files on your MacBook – generally, it is ok to assume that SAP systems of your own organisation have no malicious intent towards you.

If you want to investigate and/or configure the Trust Level concept in greater detail, go to SAPGUI -> Preferences -> Trust Level Editor.

So anyway, the main result here of interest is that now we can really connect to SAP systems using SAPGUI for Java for macOS… quod erat demonstrandum:

If you are using SSO via SAP Secure Login Client, but you get redirected to the Sign-In Screen of the SAP System instead of seeing the main landing screen, it means that SSO failed; the usual reason would be because you have no SAP user ID associated with the default client of the SAP System you are trying to log into. In that case, you should contact your organisation’s SAP Authorisations team for advice.

By the way, if you try to Quit SAPGUI when there is a SAPGUI user session open for one or more SAP systems, you get a popup warning that you might lose data. Also, if you go ahead and close SAPGUI without logging off SAP, those sessions are left “headless” until usually they time-out, so the wise procedure is to always first logoff SAP sessions in the normal manner (System -> Log Off) before shutting down the SAPGUI client.


Reinstalling the SAPGUI for Java for MacBook software

In case you want or need to reinstall SAPGUI for Java (e.g. you got in a mess with the Server and/or Local Options and files), then here are the steps:

(a) Delete the SAP Clients folder containing the SAPGUI for Java app components from Applications folder

(b) Delete all the config (but make sure to first take backups of any local xml file you want to use later) – you can delete the config this way:

rm -rf ~/Library/Preferences/SAP/

(c) Reinstall the SAPGUI client (e.g. as shown above in this blog; if using the JAR method then make sure you have suitable java and javac versions available and environment variables set); then get any needed local xml files back into the (regenerated via install) folder: ~/Library/Preferences/SAP/


Assigned Tags

      You must be Logged on to comment or reply to a post.
      Author's profile photo Declan McArdle
      Declan McArdle

      People without an S-user account can get SAP GUI for Java 7.70 rev 1 (there is a .dmg inside the archive for Mac users) at

      Second-last heading from the bottom: ABAP Platform 1909 Developer Edition on SAP HANA 2.0

      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author

      Thanks Declan for the info, that's very useful. So based on your hint:

      • adjusted the intro and couple of other parts of the blog, including crediting yourself for providing the info about the existence of this P-user Way.
      • included a new sub-section "Using a P-user to download the SAPGUI for Java media", with a shout-out to The Unarchiver as a recommended unrar tool.

      For whatever reason the dmg installer option didn't work for me (" is damaged and can't be opened. You should eject the disk image"), but as the P-user media also includes a JAR, so it was easy enough to smoke-test installing this version 7.70 rev 1 successfully.

      Author's profile photo Henning Marquard
      Henning Marquard

      Just a short hint:

      Release 7.70 Rev. 5 (Montag, 14. Februar 2022)

      is available and works fine.

      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author

      Good to know. I guess I downloaded the 7.70 rev 4 on 11th February 2022 so I've been working with that one the last couple of weeks. Updated blog and credited the advice on revision 5 to yourself. Time for me to also install the most recent version then!

      Author's profile photo MAURO MARTELLI

      Thanks for all the valuable infos provided: having one of the latest SAPGUI in place the menu item "SAP Software Downloads" points to the latest MacOS versions in the SAP Software Download page.

      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author

      Thanks for the info, I never realised that option existed before - updated the blog to provide this hint to everyone, and credited yourself for advice. Plus noted that it might be the Mac user has to switch choice of OS to ensure they get the correct packages. (In the past I have sometimes myself forgotten to do this and tried to install the Linux version on MacBook... 😂 ).

      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author

      Actually, now I just realised by testing with a DMG, that this blog needed quite a bit of modification to accommodate people who prefer the nice n easy DMG method for installing. So quite a few changes made. E.g. a new Search-string for those who don't have an existing SAPGUI client and need to wade through the Software Downloads site using Search.

      For P-users, since the DMG available seems unusable, so only the JAR method is still a valid option for them. For the S-users or those who get their installation media via an S-user, the DMG method is the simpler one

      Author's profile photo Shai Sinai
      Shai Sinai

      It seems that the download of SAP Single Sign-On client is available only for customers who purchased this product.

      Is there any alternative for download of SAP Secure Login Client?

      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author


      I don't work for SAP so I can only tell you what I have observed, which is that the organisation I work for has licensed SAP SSO, and that I downloaded the client (as shown in the blog) from SAP Software Downloads using that organisation's S-user that is assigned to me.

      I think that the official SAP Software Downloads site is the only authorised location from which you could get this client. But, you would need to talk to someone from SAP if you need to check this further.

      Author's profile photo Frank Lacher
      Frank Lacher

      Dear Dylan,

      thanks for your excellent post. I was also struggling with the installation of SAP GUI for Java on MacOs - and honestly still haven't solved the problem yet - means I still use a Windows with SAPGui to connect to the SAP backend.

      My main issues are:

      a) The SAP Secure Login Client is not available for me as my organisation did not buy it. From what I read in some SAP notes it should be free of license costs if you use only encrypted communication from SAPGui to the SAP backend, but anyway it is not available for download

      b) Initially I failed to find th snclib that is required for connection to a SNC secured backend, but I managed to get the sap crypto lib to be plugged in. An important step was tos et an environment variable called SNC_LIB_64 to that lib to enable SAPGui for java to find it.

      Anyway I failed, because I could not make the system certificate available to the SAPGui for Java on MacOS. (I tried to import it in the preferences... of the SAPGui, but it raised an error.) I tried the MacOS keychain as well and imported it there, but it seems not be used by the SAPGUI.

      So I'm still failing there. Do you have any hints on that topic how I could succeed with the certificates?


      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author


      For issue (a) it is difficult for me to confirm that the SLC is not available for download for non-SAP-SSO subscribers, as the organisation I work for has subscribed to the SSO product, so as we see in the blog I can easily download the SLC. (As a law-abiding citizen I am not going to distribute SAP's property onwards, so people need to work out themselves what are the allowed ways to get this software).

      For issue (b), I haven't got as far as you have with this, but it sounds like you are trying to do something similar to a mini-project I have been considering, which is to encrypt SAPGUI communication without any AD/SSO layer on top. I started checking some stuff for that a couple of months ago but then work and family and books about science took over my free time so it's shelved till the autumn probably.

      So, I don't have any hints for you, but if I ever get round to working on my own mini-project and if I succeed, then likely there would be a blog about that. Or maybe you will crack the case first and then I'll get to read the instructions in a future blog from you... anyway, good luck with your project!

      (You could also maybe ask SAP personnel for help, or post a question to the forum as a new thread, see if anyone in the community has better help).

      Author's profile photo Johannes Goerlich
      Johannes Goerlich

      Thank you Dylan for this comprehensive write up. Having this a few years ago would have saved me many hours of research, since all the details and finesses are not documented by SAP.

      Maybe worth to mention, for SLC you can define settings like CAPI filters and SNC modes in /Library/Preferences/ This is helpful to hide invalid certificates or certificate with non-matching key usage types from the profiles list.



      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author

      Ok that is good to know, thanks Joe for this information.

      Author's profile photo Johannes Goerlich
      Johannes Goerlich

      And regarding the “Included [read-only]" thing:

      For me it was necessary to also edit my ~/Library/Preferences/SAP/settings file and remove the lines starting with @SAPUILANDSCAPE and @LandscapeLastCentralLS before I could reset with a fresh ~/Library/Preferences/SAP/SAPGUILandscape.xml.



      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author

      Ok. Yep, i tend to go for the overkill of

      rm -rf ~/Library/Preferences/SAP/

      then reinstall the whole client. But good that you found a more focused way to get out of the "Read-only trap".

      Author's profile photo Rob Liversage
      Rob Liversage


      I managed to get SNC working on a Linux VM. We are wanting to use SNC without SSO for now. I still need to test if this approach would work on a MAC - I don't readily have access to one.

      Initial attempts to use use SNC with SAP GUI for Linux fails - error: cannot find file I downloaded the SAPCRYPTO Library and will use the file by setting the environment variable  SNC_LIB to point to it in my users .profile file - I put all content of SAR in my ~/sec directory. (A possible alternative might be to create a soft-link called pointing to - have not tried). You will also need to use the sapgenpse utility.

      SAPCRYPTOLIBP_8544-20011697.SAR                SAPCryptoLib for Linux 64-bit

      SAPCRYPTOLIBP_8544-70002813.SAR                SAPCryptoLib for MACOS X 64-bit

      Create a PSE in your ~/sec directory (or, alternatively you can use different directory but you would need to also set the SECUDIR environment variable). Seems like you need to use the name SAPSNCS.pse for the PSE file (I tried different name and that did not appear to work):

      sapgenpse get_pse -s 2048 -p SAPSNCS.pse "CN=sapsnc, O=...."

      Our SNC PSE's on our servers are CA signed - imported the root (and intermediate certificates if necessary) into the PSE using:

      sapgenpse maintain_pk -v -a <CA_cert> -p SAPSNCS.pse

      Export your PSE's certificate (this will need to be added to every systems' SNC SAPCryptolib PSE certificate list where you want to connect to, in STRUST):

      sapgenpse export_own_cert -p SAPSNCS.pse


      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author

      Good work there.

      If you get access to a Mac and get this "SNC without Secure Login Client" working, let us know. I am not sure if or when I would get round to investigating that myself, was planning at some point to do so but other non-work projects have overtaken this one in the prioritisation.

      Author's profile photo Johannes Goerlich
      Johannes Goerlich

      I use SNC with SSO via Secure Login Client on my Macbook. After installation of SLC the environment variables SNC_LIB and SNC_LIB_64 point to /Applications/Secure Login

      Currently I'm a bit unsure, but I assume the intermediate CAs are taken from the keychain as there was no need to create a PSE.




      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author


      I finally got round to testing Robert's advice on SNC without SSO for SAPGUI for Java on Linux (Xubuntu 22.04, since you didn't ask 😀), and... it works! Thanks for this.

      Then I decided to try SSO login... and that worked as well. I suppose because the client certificate that is in the SAP server's SAPCRYTPOLIB PSE's certificate list, has the correct CN etc matching the SNC Name in that SAP user's SNC data.

      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author


      I made a non-concise rambling version of your advice Robert, added a section for full SSO, and published it:

      Credit where credit is due department, included the following text in the Intro to the blog:

      "Note: this blog is the verbose-and-extended version of the excellent advice (which I followed) from Rob Liversage that he provided in a comment elsewhere on this SAP website – so if you prefer the concise original advice on how to get this stuff working, then it’s here:  "

      If you want me to modify that text, then I'll do that. In any case thanks for showing the way ahead!

      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author

      Now I made a blog about setting up Encryption-Only and SSO Logons for SAPGUI for MacBook users:

      Author's profile photo Mehmet Ali Ekingen
      Mehmet Ali Ekingen



      I can not connect with my MAC to sap. Please see below screen for my windows application

      Could you please send me the instruction on how to login through my mac

      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author


      this blog isn't really about the details of setting up Connection Items (though we describe a simple case for smoketesting); however if you search the internet you can find examples that cover your use case where you want to use SAProuter... here is one SAP Help page that describes how to construct the appropriate connection strings - as their example shows, the basic trick is to concatenate router information before target SAP system information. (The port number that SAPGUI uses for the target SAP system is related to the Instance Number as follows: 32nn, where nn is the two numerals denoting the instance number. So if Instance Number is 00, SAPGUI port is 3200). Good luck now:

      Example with two routers (, port 3299, and, port 3298), the first using a password (secret), for a connection to the application server, port 3200):


      <-------- 1st router ----------><---- 2nd router ----><------ app_server ------>

      Author's profile photo Gleb Kuzmin
      Gleb Kuzmin

      Unfortunately it mostly a glimpse of SAP GUI. It supports very little and for example for the area I need - BW, it pretty much completely useless. Lots of functionality went to fiori cockpit nowadays, but  still not everything. If you need a proper SAP GUI, windows is your only option.

      Author's profile photo dylan drummond
      dylan drummond
      Blog Post Author

      The title and content of the blog is: Notes on installing SAPGUI for Java for macOS

      So it’s a bit off-topic to comparatively discuss the merits and functional/feature scope of SAPGUI for Java vs. SAPGUI for Windows. After all, installation is about installing stuff and getting the things set up and running, so is neutral on scope/functional-use debates.

      However I can anecdotally note, that for Basis/Abap roles using SAP, SAPGUI for Java works just as well as SAPGUI for Windows in all my use cases. Similarly, when i sometimes need to use the FICO and/or Logistics main transactions (FB03, VA02, and so on), those all work fine for me in SAPGUI for Java. But, sure, as SAP themselves note, there is not exact feature correspondence between the SAPGUI variants, so if in your case there are things you need to do in BW systems that are only possible using SAPGUI for Windows, then of course that is what you should use. (BTW SAPGUI for Windows is IMHO a very good product, I have written cmd scripts that install and configure it and the registry using Active Setup for HKCU items, then testing that SAPGUI works ok… so this client software is stable and useful yes).

      My guess is that SAPGUI for Java is good enough for many SAP users, the reasoning for this guess is that SAP continue to release new versions and patches in their Software Downloads site, which suggests that the product is popular enough (only useful products get downloaded from the site frequently). But that is only my guessing, I don’t have privileged Access to SAP’s roadmaps.