Network and Transport Layer Security

Using the Secure Sockets Layer Protocol with the AS ABAP

The Application Server's Personal Security Environments

SSL Server PSE

SSL Client PSEs

The SAP Cryptographic Library Installation Package

Configuring the SAP Web AS for Supporting SSL

Installing the SAP Cryptographic Library on the AS ABAP

Setting the Profile Parameters for Using SSL

Creating the SSL Server PSE

Generating Certificate Requests for the SSL Server PSEs

Sending the Certificate Requests to a CA

Importing the Certificate Request Response

Maintaining the SSL Server PSE's Certificate List

Creating the Standard SSL Client PSE

Creating the Anonymous SSL Client PSE

Creating Individual SSL Client PSEs

Specifying that a Connection Should Use SSL

Testing the SSL Configuration

Making Sure the SSL Port is Set up Correctly

Testing the Connection for SSL Server Authentication

Testing the Connection for SSL Client Authentication

Transport Layer Security on the SAP J2EE Engine

Configuring the Use of SSL on the J2EE Engine

Creating the Server's Key Pair to Use for SSL

Exporting the SSL Key Pair from the ABAP System

Assigning the Key Pair to Use for a Specific SSL Port

Testing the SSL Connection

Using SSL to the AS Java via the ICM

Using SSL With an Intermediary Server

Configuring SSL When the SAP Web Dispatcher is the Intermediary

Configuring the SAP Web Dispatcher to Terminate the SSL Connecti

Configuring SNC: AS Java ( AS ABAP

Installing the SAP Cryptographic Library on the AS Java

Creating an SNC PSE for the AS Java

Creating Credentials for the AS Java

Exchanging Public-Key Certificates

Maintaining the System ACL on the AS ABAP

Setting the SNC Parameters

Configuring SNC Between the UME and an ABAP-Based System

Requirements for the System User for UME-ABAP Communication

Configuring SNC Between a Java iView and an ABAP System

Destination Service

Maintaining HTTP and Web Service Destinations

Maintaining RFC Destinations

Destination Service API

Interfaces and Classes for Using the Destination Service API

Examples for Using the Destination Service API

Configuring SSL Between the UME and an LDAP Directory

Importing the Root Certificate of the LDAP Directory

Changing the UME LDAP Configuration

Troubleshooting

Additional Keystore and Cryptographic Functions

Managing Key Storage Views

Managing Entries

Creating a Key Pair and Public-Key Certificate

Managing Code Based Permissions

Managing the Credentials and Trusted Certificates to Use SSL

Managing Cryptography Providers

Secure Connection Factory API for HTTPS Clients

Interfaces and Classes for Using the Secure Connection Factory

Examples for Using the Secure Connection Factory

Configuring the SAP Web Dispatcher to Support SSL

Installing the SAP Cryptographic Library on the SAP Web Dispatch

Setting the SSL Profile Parameters for the SAP Web Dispatcher

Sample Profile for the SAP Web Dispatcher When Terminating SSL

Creating the PSEs and Certificate Requests

Sending the Certificate Requests to a CA

Importing the Certificate Request Responses

Creating Credentials for the SAP Web Dispatcher

Testing the SSL Connection to the SAP Web Dispatcher

Using an Intermediary Server to Connect to the AS Java

Configuring the Apache Web Server as the Intermediary Server

Secure Network Communications (SNC)

SNC in the SAP System Architecture

Terminology

Integration of SNC and an External Security Product in SAP Syste

External Security Products

Communication Paths that Support SNC

General Comments Pertaining to the SNC Configuration

Recommendations

Configuring SNC on AS ABAP

Prerequisites for Using SNC

Profile Parameter Settings on AS ABAP

snc/enable

snc/gssapi_lib

snc/identity/as

snc/data_protection/max

snc/data_protection/min

snc/data_protection/use

snc/r3int_rfc_secure

snc/r3int_rfc_qop

snc/accept_insecure_cpic

snc/accept_insecure_gui

snc/accept_insecure_r3int_rfc

snc/accept_insecure_rfc

snc/permit_insecure_start

snc/force_login_screen

Sample Profile Parameter Settings for SNC

Profile Parameter Settings on the Gateway

Customizing Activities on AS ABAP for Using SNC

Upgrade from 3.0/3.1

Access Control Lists (ACL)

Network Communication Partners

Transporting the Customizing Configuration

User Maintenance on AS ABAP

Maintaining SNC Information for Dialog Users

Maintaining SNC Information for Non-Dialog Users

Suppressing the Logon Screen

Configuring the Communication Partners to Use SNC

Configuring SNC: SAP GUI ( AS ABAP

Configuring SNC: SAP GUI when Using Direct Start

Configuring SNC: SAP GUI when Using SAP Logon

Configuring SNC: SAP GUI When Using SAP Shortcuts

Processing the Logon

Configuring SNC: External Programs ( AS ABAP

Configuring SNC: External Programs ( AS ABAP Using RFC

Configuring SNC: External Programs ( AS ABAP Using CPIC

Configuring SNC: Using RFC from AS ABAP

Maintaining RFC Destinations and their SNC Options Using Transac

RFC: AS ABAP ( AS ABAP

RFC: Internal Destinations

RFC: Logical Destinations

RFC: TCP/IP Connection - Start an External Program on an Applica

RFC: TCP/IP Connection - Start an External Program on an Explici

RFC: TCP/IP Connection - Start an External Program over SAP GUI

RFC: TCP/IP Connection - Registered Program

Remote Logon Using Transaction SM51

Special Destinations and RFC Groups

Configuring SNC: Using CPIC from AS ABAP

Maintaining CPIC Destinations and Their SNC Options Using Transa

CPIC: AS ABAP ( AS ABAP

CPIC: Start an External Program over a Gateway

CPIC: Registered Program

Configuring SNC: Printing

Configuring SNC: SAProuter ( SAProuter

Special Cases

Single Sign-On with Microsoft Kerberos SSP

Preparing the Primary Application Server Instance

Configuring the SAP Front End

Configuring the SAP Logon

Mapping Windows Users to SAP Users for Kerberos SSO

Single Sign-On with Microsoft NT LAN Manager SSP

Starting the Windows LM Security Support Provider Service

Configuring the Application Server

Configuring SAP GUI and SAP Logon for Single Sign-On

Mapping Windows Users to SAP Users for NTLM SSO

C Program Interfaces

Interfaces to External CPIC Programs

Interfaces to External RFC Programs

Appendixes

Sample SNC Scenario

SNC-Related Tables on AS ABAP

Maintenance Utilities on AS ABAP

SNC Messages on AS ABAP

Using the SAP Cryptographic Library for SNC

Using the SAP Cryptographic Library for SNC

Scenarios

Scenario 1: Using a Single PSE for ALL Components

Scenario 2: Using Individual PSEs for Components

Configuring the Use of the SAP Cryptographic Library for SNC

The SAP Cryptographic Library Installation Package

Recommended Locations of Files

Configuring SNC for Using the SAPCRYPTOLIB on the AS ABAP

Installing the SAP Cryptographic Library on the AS ABAP

Setting the Trust Manager Profile Parameters

Creating the SNC PSE

Importing the SNC PSE

Exporting the SNC PSE

Exchanging Public-Key Certificates Starting on the AS ABAP

Exporting the AS ABAP's Public-Key Certificate

Importing Public-Key Certificates on the AS ABAP

Connection-Specific Configurations

Making the Access Control List Entries on the Application Server

Setting the SNC Profile Parameters

Configuring SNC for Using the SAPCRPYTOLIB Using SAPGENPSE

Installing the SAP Cryptographic Library on an Arbitrary Server

Creating a PSE for the Server Using SAPGENPSE

Creating the Server's Credentials Using SAPGENPSE

Checking the Application Server's User (Windows)

Exchanging Public-Key Certificates

Exporting the Server's Certificate Using SAPGENPSE

Maintaining the Server's Certificate List Using SAPGENPSE

Connection-Specific Configurations

Additional Functions

Deleting the Server's Credentials

Changing the PIN

Renewing the Server's Certificate

Exporting a PKCS#12 File

Importing a PKCS#12 File

The Configuration Tool's Generic Command Line Options