Network and Transport Layer Security
Using the Secure Sockets Layer Protocol with the SAP Web AS ABAP
The Application Server's Personal Security Environments
SSL Server PSE
SSL Client PSEs
The SAP Cryptographic Library Installation Package
Configuring the SAP Web AS for Supporting SSL
Installing the SAP Cryptographic Library on the SAP Web AS
Setting the Profile Parameters for Using SSL
Creating the SSL Server PSE
Generating Certificate Requests for the SSL Server PSEs
Sending the Certificate Requests to a CA
Importing the Certificate Request Response
Maintaining the SSL Server PSE's Certificate List
Creating the Standard SSL Client PSE
Creating the Anonymous SSL Client PSE
Creating Individual SSL Client PSEs
Specifying that a Connection Should Use SSL
Testing the SSL Configuration
Making Sure the SSL Port is Set up Correctly
Testing the Connection for SSL Server Authentication
Testing the Connection for SSL Client Authentication
Transport Layer Security on the SAP J2EE Engine
Configuring the Use of SSL on the J2EE Engine
Deploying the SAP Java Cryptographic Toolkit
Changing the Startup Mode for the SSL Provider
Creating the Server's Key Pair to Use for SSL
Assigning the Key Pair to Use for a Specific SSL Port
Testing the SSL Connection
Using SSL to the SAP J2EE Engine via the ICM
Using SSL With an Intermediary Server
Configuring SSL When the SAP Web Dispatcher is the Intermediary
Configuring the SAP Web Dispatcher to Terminate the SSL Connecti
Configuring SSL When the IIS is the Intermediary Server
Backing Up an Existing IIS Configuration
Installing the IisProxy Module
Testing the IisProxy Module
Configuring the IisProxy Module to Support SSL
Reverting to the SAPJ2EE Module
Configuring SSL When an Other Device is the Intermediary Server
Configuring SNC: J2EE Engine ( AS ABAP
Installing the SAP Cryptographic Library on the SAP J2EE Engine
Creating an SNC PSE for the SAP J2EE Engine
Creating Credentials for the SAP J2EE Engine
Exchanging Public-Key Certificates
Maintaining the System ACL on the Application Server
Setting the SNC Parameters
Configuring SNC Between the UME and an ABAP-Based System
Requirements for System User SAPJSF_<SID> in ABAP Systems
Configuring SNC Between a Java iView and an ABAP System
Destination Service
Maintaining HTTP and Web Service Destinations
Maintaining RFC Destinations
Destination Service API
Interfaces and Classes for Using the Destination Service API
Examples for Using the Destination Service API
Configuring SSL Between the UME and an LDAP Directory
Importing the Root Certificate of the LDAP Directory
Changing the UME LDAP Configuration
Testing the SSL Connection
Troubleshooting
Additional Keystore and Cryptographic Functions
Managing Key Storage Views
Managing Entries
Creating a Key Pair and Public-Key Certificate
Managing Code Based Permissions
Managing the Credentials and Trusted Certificates to Use SSL
Managing Cryptography Providers
Secure Connection Factory API for HTTPS Clients
Interfaces and Classes for Using the Secure Connection Factory
Examples for Using the Secure Connection Factory
Configuring the SAP Web Dispatcher to Support SSL
Installing the SAP Cryptographic Library on the SAP Web Dispatch
Setting the SSL Profile Parameters for the SAP Web Dispatcher
Sample Profile for the SAP Web Dispatcher When Terminating SSL
Creating the PSEs and Certificate Requests
Sending the Certificate Requests to a CA
Importing the Certificate Request Responses
Creating Credentials for the SAP Web Dispatcher
Testing the SSL Connection to the SAP Web Dispatcher
Using an Intermediary Server to Connect to the J2EE Engine
Configuring the IIS as the Intermediary Server
Backing Up an Existing IIS Configuration
Installing the IisProxy Module
Testing the IisProxy Module
Configuring the IisProxy Module to Support SSL
Reverting to the SAPJ2EE Module
Log Levels for the IisProxy Module
Troubleshooting for the IisProxy Module
Configuring the Apache Web Server as the Intermediary Server
Secure Network Communications (SNC)
SNC in the SAP System Architecture
Terminology
Integration of SNC and an External Security Product in SAP Syste
External Security Products
Communication Paths that Support SNC
General Comments Pertaining to the SNC Configuration
Recommendations
Configuring SNC on AS ABAP
Prerequisites for Using SNC
Profile Parameter Settings on AS ABAP
snc/enable
snc/gssapi_lib
snc/identity/as
snc/data_protection/max
snc/data_protection/min
snc/data_protection/use
snc/r3int_rfc_secure
snc/r3int_rfc_qop
snc/accept_insecure_cpic
snc/accept_insecure_gui
snc/accept_insecure_r3int_rfc
snc/accept_insecure_rfc
snc/permit_insecure_start
snc/force_login_screen
Sample Profile Parameter Settings for SNC
Profile Parameter Settings on the Gateway
Customizing Activities on AS ABAP for Using SNC
Upgrade from 3.0/3.1
Access Control Lists (ACL)
Network Communication Partners
Transporting the Customizing Configuration
User Maintenance on AS ABAP
Maintaining SNC Information for Dialog Users
Maintaining SNC Information for Non-Dialog Users
Suppressing the Logon Screen
Configuring the Communication Partners to Use SNC
Configuring SNC: SAP GUI ( AS ABAP
Configuring SNC: SAP GUI when Using Direct Start
Configuring SNC: SAP GUI when Using SAP Logon
Configuring SNC: SAP GUI When Using SAP Shortcuts
Processing the Logon
Configuring SNC: External Programs ( AS ABAP
Configuring SNC: External Programs ( AS ABAP Using RFC
Configuring SNC: External Programs ( AS ABAP Using CPIC
Configuring SNC: Using RFC from AS ABAP
Maintaining RFC Destinations and their SNC Options Using Transac
RFC: AS ABAP ( AS ABAP
RFC: Internal Destinations
RFC: Logical Destinations
RFC: TCP/IP Connection - Start an External Program on an Applica
RFC: TCP/IP Connection - Start an External Program on an Explici
RFC: TCP/IP Connection - Start an External Program over SAP GUI
RFC: TCP/IP Connection - Registered Program
Remote Logon Using Transaction SM51
Special Destinations and RFC Groups
Configuring SNC: Using CPIC from AS ABAP
Maintaining CPIC Destinations and Their SNC Options Using Transa
CPIC: AS ABAP ( AS ABAP
CPIC: Start an External Program over a Gateway
CPIC: Registered Program
Configuring SNC: Printing
Configuring SNC: SAProuter ( SAProuter
Special Cases
Single Sign-On with Microsoft Kerberos SSP
Configuring the Application Server
Configuring the SAP Front End
Configuring the SAP Logon
Mapping Windows Users to SAP Users for Kerberos SSO
Single Sign-On with Microsoft NT LAN Manager SSP
Starting the Windows LM Security Support Provider Service
Configuring the Application Server
Configuring SAP GUI and SAP Logon for Single Sign-On
Mapping Windows Users to SAP Users for NTLM SSO
C Program Interfaces
Interfaces to External CPIC Programs
Interfaces to External RFC Programs
Appendixes
Sample SNC Scenario
SNC-Related Tables on AS ABAP
Maintenance Utilities on AS ABAP
SNC Messages on AS ABAP
Using the SAP Cryptographic Library for SNC
Using the SAP Cryptographic Library for SNC
Scenarios
Scenario 1: Using a Single PSE for ALL Components
Scenario 2: Using Individual PSEs for Components
Configuring the Use of the SAP Cryptographic Library for SNC
The SAP Cryptographic Library Installation Package
Recommended Locations of Files
Configuring SNC for Using the SAPCRYPTOLIB on the SAP Web AS
Installing the SAP Cryptographic Library on the SAP Web AS
Setting the Trust Manager Profile Parameters
Creating the SNC PSE
Importing the SNC PSE
Exporting the SNC PSE
Exchanging Public-Key Certificates Starting on the SAP Web AS
Exporting the SAP Web AS's Public-Key Certificate
Importing Public-Key Certificates on the SAP Web AS
Connection-Specific Configurations
Making the Access Control List Entries on the Application Server
Setting the SNC Profile Parameters
Configuring SNC for Using the SAPCRPYTOLIB Using SAPGENPSE
Installing the SAP Cryptographic Library on an Arbitrary Server
Creating a PSE for the Server Using SAPGENPSE
Creating the Server's Credentials Using SAPGENPSE
Checking the Application Server's User (Windows)
Checking the AGate's User (Windows)
Checking the WGate's User (Windows)
Exchanging Public-Key Certificates
Exporting the Server's Certificate Using SAPGENPSE
Maintaining the Server's Certificate List Using SAPGENPSE
Example: Exchanging Public-Key Certificates
Connection-Specific Configurations
Additional Functions
Deleting the Server's Credentials
Changing the PIN
Renewing the Server's Certificate
The Configuration Tool's Generic Command Line Options