Exporting and Importing BW Certificates

Use

The BW certificate must be generated in and exported from the BW system so it can subsequently be imported into the portal. The BW certificate is required on the portal so that portal content can be displayed in the BW system, such as the portal roles in BEx Web Application Designer.

Procedure

Exporting the BW Certificate

  1. Run transaction STRUSTSSO2 ( Trust Manager for Single Sign-On with Logon Ticket ).

  2. Choose your own certificate. This is located in the Own Certificate field under System PSE .. To display the certificate, double-click the field value under Certificate .

  3. In the menu, choose Start of the navigation pathCertificate Next navigation step ExportEnd of the navigation path.

  4. Enter the file path <BW_SID>_certificate.crt (<BW_SID> is the system ID of the BW system).

  5. Choose Binary as the file format.

Check

You can view the <BW_SID>_certificate.crt file using Windows Explorer.

Importing the BW Certificate

To import the BW certificate to the Application Server Java, complete the following steps:

  1. Start SAP NetWeaver Administrator at http://<host>:<httpport>/nwa .

  2. Choose Start of the navigation pathConfiguration Next navigation step Security Next navigation step Certificates and KeysEnd of the navigation path.

  3. Under Keystore Views , select the TicketKeystore view.

  4. Under Display Entries , choose Import Entry .

  5. Open the <BW_SID>_certificate.crt file.

Perform the following steps to ensure that the Application Server Java accepts the SAP Logon Tickets from the BW system as an external system.

  1. In the SAP NetWeaver Administrator, choose Start of the navigation pathConfiguration Next navigation step Security Next navigation step Authentication and Single Sign-OnEnd of the navigation path.

  2. On the Authentication tab page, choose ticket under Components .

  3. In the Details of policy configuration "ticket" on the Login Module Stack tab page, change the options for EvaluateTicketLoginModule and add the following values. You need the following values once for client 000 and once for client 00X (where X is the number of the client you define).

    • trustedsys<Number>=<BW_SID>, <BW_CLIENT> (z.B. BWP , 000 )

    • trustediss<Number>=<ISSUER_DISTINGUISHED_NAME> (for example CN= BWP , OU=I0020114583 , OU=SAPWeb AS , O=SAP Trust Community , C=DE )

    • trusteddn<Number>=<SUBJECT_DISTINGUISHED_NAME> (for example CN= BWP , OU=I0020114583 , OU=SAP Web AS , O=SAP Trust Community , C=DE )

You also have to maintain the values under evaluate_assertion_ticket :

  1. On the Authentication tab page, choose evaluate_assertion_ticket under Components .

  2. In the Details of policy configuration "evaluate_assertion_ticket" on the Login Module Stack tab page, change the options for EvaluateAssertionTicketLoginModule and add the following values. You need the following values once for client 000 and once for client 00X (where X is the number of the client you define).

    • trustedsys<Number>=<BW_SID>, <BW_CLIENT> (z.B. BWP , 000 )

    • trustediss<Number>=<ISSUER_DISTINGUISHED_NAME> (for example CN= BWP , OU=I0020114583 , OU=SAPWeb AS , O=SAP Trust Community , C=DE )

    • trusteddn<Number>=<SUBJECT_DISTINGUISHED_NAME> (for example CN= BWP , OU=I0020114583 , OU=SAPWeb AS , O=SAP Trust Community , C=DE )