Network and Transport Layer Security
Key Storage and Maintenance
Establishing Trust
SSL Scenario 1: Establishing Trust for Server-Side Authenticatio
SSL Scenario 2: Establishing Trust for Mutual Authentication
SNC Scenario 1: Using a Single Key Pair for ALL Components
SNC Scenario 2: Using Individual Key Pairs for Components
Transport Layer Security on the AS ABAP
Configuring the AS ABAP for Supporting SSL
Installing the SAP Cryptographic Library on the AS ABAP
Setting the Profile Parameters for Using SSL
Creating an SSL Server PSE
Generating Certificate Requests for the SSL Server PSEs
Sending the Certificate Requests to a CA
Importing the Certificate Request Response
Maintaining the SSL Server PSE's Certificate List
Creating the Standard SSL Client PSE
Creating the Anonymous SSL Client PSE
Creating Individual SSL Client PSEs
Specifying that a Connection Should Use SSL
Maintaining the User Mapping for Incoming Connections that Use A
Testing the SSL Configuration
Making Sure the SSL Port is Set up Correctly
Testing the Connection for SSL Server Authentication
Testing the Connection for SSL Client Authentication
Secure Network Communications (SNC)
SNC in the SAP System Architecture
Terminology
Integration of SNC and an External Security Product in SAP Syste
External Security Products
Communication Paths that Support SNC
General Comments Pertaining to the SNC Configuration
Recommendations
Configuring SNC on AS ABAP
Prerequisites for Using SNC
Profile Parameter Settings on AS ABAP
snc/enable
snc/gssapi_lib
snc/identity/as
snc/data_protection/max
snc/data_protection/min
snc/data_protection/use
snc/r3int_rfc_secure
snc/r3int_rfc_qop
snc/accept_insecure_cpic
snc/accept_insecure_gui
snc/accept_insecure_r3int_rfc
snc/accept_insecure_rfc
snc/permit_insecure_start
snc/force_login_screen
Sample Profile Parameter Settings for SNC
Profile Parameter Settings on the Gateway
Customizing Activities on AS ABAP for Using SNC
Upgrade from 3.0/3.1
Access Control Lists (ACL)
Network Communication Partners
Transporting the Customizing Configuration
User Maintenance on AS ABAP
Maintaining SNC Information for Dialog Users
Maintaining SNC Information for Non-Dialog Users
Suppressing the Logon Screen
Configuring the Communication Partners to Use SNC
Configuring SNC: SAP GUI ( AS ABAP
Configuring SNC: SAP GUI when Using Direct Start
Configuring SNC: SAP GUI when Using SAP Logon
Configuring SNC: SAP GUI When Using SAP Shortcuts
Processing the Logon
Configuring SNC: External Programs ( AS ABAP
Configuring SNC: External Programs to AS ABAP Using RFC
Configuring SNC: External Programs ( AS ABAP Using CPIC
Configuring SNC: Using RFC from AS ABAP
Maintaining RFC Destinations and their SNC Options Using Transac
RFC: AS ABAP ( AS ABAP
RFC: Internal Destinations
RFC: Logical Destinations
RFC: TCP/IP Connection - Start an External Program on an Applica
RFC: TCP/IP Connection - Start an External Program on an Explici
RFC: TCP/IP Connection - Start an External Program over SAP GUI
RFC: TCP/IP Connection - Registered Program
Remote Logon Using Transaction SM51
Special Destinations and RFC Groups
Configuring SNC: Using CPIC from AS ABAP
Maintaining CPIC Destinations and Their SNC Options Using Transa
CPIC: AS ABAP ( AS ABAP
CPIC: Start an External Program over a Gateway
CPIC: Registered Program
Configuring SNC: Printing
Configuring SNC: SAProuter ( SAProuter
Special Cases
Single Sign-On with Microsoft Kerberos SSP
Preparing the Primary Application Server Instance
Configuring the SAP Front End
Configuring the SAP Logon
Mapping Windows Users to SAP Users for Kerberos SSO
Single Sign-On with Microsoft NT LAN Manager SSP
Starting the Windows LM Security Support Provider Service
Configuring the Application Server
Configuring SAP GUI and SAP Logon for Single Sign-On
Mapping Windows Users to SAP Users for NTLM SSO
C Program Interfaces
Interfaces to External CPIC Programs
Interfaces to External RFC Programs
Appendixes
Sample SNC Scenario
SNC-Related Tables on AS ABAP
Maintenance Utilities on AS ABAP
SNC Messages on AS ABAP
Using the SAP Cryptographic Library for SNC
Scenarios
SNC Scenario 1: Using a Single Key Pair for ALL Components
SNC Scenario 2: Using Individual Key Pairs for Components
Configuring the Use of the SAP Cryptographic Library for SNC
The SAP Cryptographic Library Installation Package
Recommended Locations of Files
Configuring SNC for Using the SAPCRYPTOLIB on the AS ABAP
Installing the SAP Cryptographic Library on the AS ABAP
Setting the Trust Manager Profile Parameters
Creating the SNC PSE
Importing the SNC PSE
Exporting the SNC PSE
Exchanging Public-Key Certificates Starting on the AS ABAP
Exporting the AS ABAP's Public-Key Certificate
Importing Public-Key Certificates on the AS ABAP
Connection-Specific Configurations
Making the Access Control List Entries on the Application Server
Setting the SNC Profile Parameters
Configuring SNC for Using the SAPCRYPTOLIB Using SAPGENPSE
Installing the SAP Cryptographic Library on an Arbitrary Server
Creating a PSE for the Server Using SAPGENPSE
Creating the Server's Credentials Using SAPGENPSE
Checking the Application Server's User (Windows)
Exchanging Public-Key Certificates
Exporting the Server's Certificate Using SAPGENPSE
Maintaining the Server's Certificate List Using SAPGENPSE
Connection-Specific Configurations
Additional Functions
Deleting the Server's Credentials
Changing the PIN
Renewing the Server's Certificate
Exporting a PKCS#12 File
Importing a PKCS#12 File
The Configuration Tool's Generic Command Line Options
Using SNC Client Encryption for Password Logon
Preparing SAP NetWeaver AS ABAP
Installing SNC Client Encryption
Configuring SAP GUI for Windows
How SNC Client Encryption Works
Additional Information
SNC Names, SSO, and User Mapping
Performing an Unattended Installation
Confirming SNC Connections
Troubleshooting SNC Client Encryption
Enabling Traces for SNC Client Encryption
Transport Layer Security on the AS Java
Configuring the Use of SSL on the AS Java
Installing the SAP Cryptographic Library for SSL
Maintaining ICM Parameters for Using SSL
Additional SSL Ports
Configuration of the AS Java Keystore Views for SSL
Configuring the SSL Key Pair and Trusted X.509 Certificates
Adding New SSL Access Points
Maintaining SSL Access Points
Creating a Client PSE
Testing the SSL Connection
Using SSL With an Intermediary Server
Configuring SSL When the SAP Web Dispatcher is the Intermediary
Configuring the SAP Web Dispatcher to Terminate the SSL Connecti
Configuring SNC: AS Java ( AS ABAP
Installing the SAP Cryptographic Library on the AS Java for SNC
Creating an SNC PSE for the AS Java
Creating Credentials for the AS Java
Exchanging Public-Key Certificates
Maintaining the System ACL on the AS ABAP
Setting the SNC Parameters
Configuring SNC Between the UME and an ABAP-Based System
Requirements for the System User for UME-ABAP Communication
Configuring SNC Between an iView and an ABAP System
Destination Service
Maintaining HTTP Destinations
Maintaining RFC Destinations
Destination Service API
Interfaces and Classes for Using the Destination Service API
Examples for Using the Destination Service API
Configuring SSL Between the UME and an LDAP Directory
Importing the Root Certificate of the LDAP Directory
Changing the UME LDAP Configuration
Troubleshooting
Secure Connection Factory API for HTTPS Clients
Interfaces and Classes for Using the Secure Connection Factory
Examples for Using the Secure Connection Factory
Transport Layer Security When Using the SAP Web Dispatcher
Configuring the SAP Web Dispatcher to Support SSL
Installing the SAP Cryptographic Library on the SAP Web Dispatch
Creating the PSEs and Certificate Requests
Sending the Certificate Requests to a CA
Importing the Certificate Request Responses
Creating Credentials for the SAP Web Dispatcher
Setting the SSL Relevant Profile Parameters for the SAP Web Disp
Sample Profile for the SAP Web Dispatcher When Terminating SSL
Testing the SSL Connection to the AS ABAP over the SAP Web Dispa
Reference
Additional Keystore and Cryptographic Functions
Managing Key Storage Views
Managing Entries
Creating a Key Pair and Public-Key Certificate
Managing Code-Based Permissions
Managing the Credentials and Trusted Certificates to Use SSL
Managing Cryptography Providers
The SAP Cryptographic Library Installation Package