Secure Communication Setup

To transfer application data and security credentials within your SAP Fiori system landscape, you must establish secure network communication and trust between the following components:

  • SAP Fiori Client

  • SAP Web Dispatcher

  • SAP Mobile Platform Server

  • SAP Fiori Front-End Server

Secure communication is established by using HTTPS. SSL technology provides data encryption, message integrity, server authentication, and optional client authentication for a TCP/IP connection.



One-Way SSL vs Mutual SSL

In one-way SSL, the server presents a certificate to the client to prove its identity. To establish the SSL connection, the client must authenticate the server, but the server accepts any client into the connection. In mutual SSL, the server presents a certificate to the client and the client presents a certificate to the server. Both the client and the server must validate the identity of the other to establish the SSL connection.

Depending on how you authenticate users, you have to set up either one-way or mutual SSL between components. For example:

Authentication Provider

SSL Setup

Configuration Steps

Basic authentication over HTTPS

Set up one-way SSL from the Fiori Client to the Fiori front-end server.

SSO with SAP Logon Tickets

X.509 user certificates

Set up mutual SSL between each component, all the way from the Fiori Client to the Fiori front-end server.

SSO with X.509 Authentication

SAML2

and

principal propagation

If you use SAML 2.0 to authenticate users, you can add the principal propagation module to forward the user principals and credentials to the back end. The SSL setup is as follows:

  • Set up one-way SSL between SAP Fiori Client, SAP Web Dispatcher, and SAP Mobile Platform Server.

  • Set up mutual SSL between SAP Mobile Platform Server and the Fiori front-end server. Mutual SSL is required between these components because the user principals and credentials are forwarded from SAP Mobile Platform Server to the back end through a process called principal propagation, in which temporary X.509 certificates are generated to be used on the Fiori front-end server. User mapping then takes place in the Fiori front-end server.

SSO with SAML2 Authentication