Configuring the Use of Client Certificates via an Intermediary Server 

Use

If users are to connect to the SAP J2EE Engine via an intermediary server that terminates the connection, for example, a Web proxy, then the user’s SSL client certificate cannot be directly used for authentication on the SAP J2EE Engine. In this case, the intermediary server passes the user’s certificate to the SAP J2EE Engine in a header variable and the SAP J2EE Engine accepts this certificate based on its trust relationship to the intermediary server.

Although you do have the option to use HTTP for the connection between the intermediary server and the SAP J2EE Engine, we recommend using HTTPS for this connection also.

Access via the ICM

If the SAP J2EE Engine is accessed via the ICM, then the user’s certificate is passed using the protocol between the ICM and the SAP J2EE Engine. If this connection also uses SSL, then the certificate is automatically passed to the J2EE Engine. Otherwise, set the parameter AcceptClientCertWithoutSSL to true. For more information, see Communication Between the ICM and J2EE Engine.

Access via the SAP Web Dispatcher

The Web dispatcher supports certificate forwarding in HTTP header fields. Set the parameter icm/HTTPS/forward_ccert_as_header = true for the Web dispatcher before proceeding with the procedure below. For more information, see X.509-Based Logon to Web AS from SAP Web Dispatcher.

Prerequisites

·        To use HTTPS for the connection between the intermediary server and the SAP J2EE Engine, then the SAP J2EE Engine must be configured to support SSL.

·        To use SSL with mutual authentication between the intermediary server and the SAP J2EE Engine, then the intermediary server possesses a public-key certificate to use for SSL.

·        The intermediary server is configured to pass the user’s client certificate to the SAP J2EE Engine.

·        You know the name of the header variable that contains the user’s certificate.

Procedure

...

       1.      Using the HTTP Provider service, enter the corresponding information in the following property keys.

Property Keys and Their Values

Key	Value	Comment
AcceptClientCertWithoutSSL	<true, false>	Enter true if you want to accept HTTP without using SSL for the connection between the intermediary server and the SAP J2EE Engine. Default=false.
ProxyServersCertificates	{{<Proxy_Cert_1>}, <Proxy_Cert_2>, ...)}	List containing the Distinguished Name for the trusted proxy server(s).

Use the following syntax for the list of proxy Distinguished Names:

{{Distiguished_Name_1},{Distinguished_Name_2},..., {Distinguished_Name_n}}

Example of a list with one element:

{{CN=proxy, O=MyCompany, C=US}}

Example of a list with several elements:

{{CN=proxy_1, O=MyCompany, C=US},{CN=proxy_2, O=MyCompany, C=US},{CN=proxy_3, O=MyCompany, C=US}}

       2.      Maintain the user’s certificate information in his or her user account on the SAP J2EE Engine.

Result

The intermediary server passes the user’s client certificate to the SAP J2EE Engine to use for authentication.

Additional Property Keys

Additional property keys are set per default to the names of the HTTP header variables that contain information about the user’s certificate. If your proxy server is configured otherwise, then adjust these parameters accordingly.

Additional Property Keys

Key	Comment
ClientCertificateChainHeaderPrefix	Name of the header variable that contains the prefix used for CA certificate chains. The chain is set up from 1 to n, whereby n+1 is the last CA root certificate in the chain, which is not sent to the server. Default: SSL_CLIENT_CERT_CHAIN_ The server then finds the CA chained certificates in the variables SSL_CLIENT_CERT_CHAIN_1, SSL_CLIENT_CERT_CHAIN_2, etc. The CA root certificate, which is the last certificate in the chain, is not sent to the server in a header variable. It must exist as a trusted CA in the SSL Provider server.
ClientCertificateHeaderName	Name of the header variable that contains the user’s certificate. Default: SSL_CLIENT_CERT
ClientCipherSuiteHeaderName	Name of the header variable that contains the cipher suite used. Default: SSL_CIPHER_SUITE
ClientKeySizeHeaderName	Name of the header variable that contains the key size used. Default: SSL_CIPHER_USEKEYSIZE