Configuration: Digital Signing of Documents

Use

The following section provides an overview of the Customizing and configuration settings for the digital signature and for the verification of documents and incoming post items (e-mails with digital signed attachments) in the component Records and Case Management. You carry out the required steps in Records and Case Management, in the SSF settings ( Secure Store and Forward) of the SAP system, and for the external security product.

Settings in the Component Public Sector Records Management

  1. Define the registry settings for documents with digital signatures in an element type. You do this in Customizing of Start of the navigation pathRecords and Case Management Next navigation step Document Next navigation step Digital Signature Next navigation step Define Digital Signature of DocumentsEnd of the navigation path. For more information, see the IMG documentation.

  2. Activate the OCSP (Online Certificate Status Protocol) in Customizing under Start of the navigation pathRecords and Case Management Next navigation step Basic Settings Next navigation step Global ParametersEnd of the navigation path with the parameter PSOCSPAC.

  3. Register all the file types that represent the digitally signed attachments of incoming post items in the table TOADD under the MIME type application/pkcs7-signature.

Settings in the Component Secure Store and Forward (SSF) Server

Server

  1. From the SAP Easy Access Menu, choose Start of the navigation pathTools Next navigation step CCMS Next navigation step Configuration Next navigation step System ProfileEnd of the navigation path and define the two SSF products SAPSECULIB and SECUDE in the profile of the application server by setting the following parameters:

    ssf/name

    SAPSECULIB

    ssf/ssfapi_lib

    <complete path of sapsecu.dll>

    ssf2/name

    SECUDE

    ssf2/ssfapi_lib

    <complete path of secude.dll>

  2. Configure SNC on the AS ABAP.

    For more information, see SNC Configuration on Application Server (SAP Web AS).

  3. Specify the settings for the SSF application PSRM Public Sector Records Management in Customizing under Start of the navigation pathSAP Customizing Implementation Guide Next navigation step SAP NetWeaver Next navigation step SAP Web Application Server Next navigation step System Administration Next navigation step Maintain Public-Key Information of Systems Next navigation step Maintaining Application-Dependent SSFEnd of the navigation path.

  4. Set the following parameters:

    Parameters for SSF Application PSRM Public Sector Records Management

    Security Product

    SAPSECULIB

    SSF Format

    PKCS7

    Private Address Book

    <your file name of SSF-PSE>

    SSF Profile Name

    <your file name of SSF-PSE>

    SSF Profile ID (opt.)

    <blank>

    Hash Algorithm

    SHA1

    Include Certificates

    X

    Digital Signature with Data

    X

    Distribute PSE (only SAPSECULIB)

    <blank>

  5. Specify the following settings for all SAP users who want to use their smart card for digital signatures. You do this in user maintenance (SU01) on the tab page Address under Other Communications for the parameter SSF:

    SSF Parameters for User Signature

    SSF-ID

    <holder name (subject) of smart card>

    SSF Profile

    toksw:mem://securelogin/<profile_name>:

    Destination

    SAP_SSFATGUI

  6. In transaction SU01, enter the SNC name for each SAP user who want to log on to the system using a smart card.

  7. Choose Start of the navigation pathTools Next navigation step Administration Next navigation step Management Next navigation step Networks Next navigation step RFC DestinationsEnd of the navigation path and activate SNC for the RFC destination SAP_SSFATGUI under Start of the navigation pathRegistration/Security Next navigation step Security Options Next navigation step SNC ActiveEnd of the navigation path.

Client

  1. Install the Secure Login Client software and if necessary of the driver for the smart card reader and the smart card in the client.

  2. Load the SNC issuer certificate of the application server and import it into the Microsoft Certificate Store of the client PC. Now you should be able to log on to the SAP system with SNC.