The SAP NetWeaver Developer Studio: Security Aspects 

 

Observe the following, to ensure that you can work with the SAP NetWeaver Developer Studio seamlessly and without encountering any problems – in particular, with respect to security for your project data:

General Note

You must ensure that the Developer Studio is not installed or used in “production” networks.

 

Project Resources and Security

The project resources are available as files – such as Java files, XML descriptor files, or graphics – and are integrated in the file system. By default, project contents are stored in the Eclipse workspace. Protection of project resources is thus subject to the security criteria of the operating system (such as Windows 2000 or XP). The computers, and in particular the relevant directories, must therefore be protected accordingly. This means, for example, that you – the developer – should not share project directories.

 

Remote Server Connections

Several tool sets in the Developer Studio may possibly open connections to remote servers. In most cases, these connections are based on the HTTP protocol, such as connections to Web service providers, to the Design Time Repository or to the System Landscape Directory. Some connections also use the RFC protocol to retrieve metadata from the ABAP systems. Furthermore, the connection to the Application Server’s Deploy Manager especially uses RMI over the P4 protocol.

 

Tool set	Protocol	Securable?
Deployment tools	RMI-P4	Yes, SSL
NWDI client tools	HTTP	Yes, HTTPS
Remote debugging	HTTP	Yes, HTTPS
	RFC	Yes, SNC
	JDWP (Java Debug Wire Protocol)	No
Web Dynpro	HTTP	Yes, HTTPS
	RFC	Yes, SNC
Composite Application Framework	HTTP	Yes, HTTPS
	RFC	Yes, SNC
Process Composer (BPM)	HTTP	Yes, HTTPS
Enterprise Service tools	HTTP	Yes, HTTPS
Portal development tools	HTTP	Yes, HTTPS

 

The passwords for all the connections are sent in encrypted form if SSL protocol is used as shown in the table above. For example, if the SSL protocol is not used for the process composer, then the passwords are sent in an unprotected way.

Provided that SSL is used, passwords are also encrypted whenever they are stored locally on the PC for later access. The latter is an option both, in the NWDI client tools, and in the Portal development toolset.

 

User Identification During Deployment

To be able to deploy project archives, such as EAR or SDA files, directly from the deploy or in a project view of the SAP NetWeaver Developer Studio on the SAP Web AS Java, you must establish a connection to the server. This connection is done with an explicit user identification. To deploy applications, you must be authenticated as a user from the administrators group. No other users have authorization to perform this action.