MOD EPURCHASING CATALOGUES SFTP RETRIEVAL TECHNICAL SPECIFICATION

Transcription

1 MOD EPURCHASHING CATALOGUES Version: : 1.8 Version Date : July 2015 Toltec 1120 Park Avenue Aztec West Almondsbury Bristol BS32 4TD Phone +44 (0) Fax +44 (0) Approved By Job Title Signature Date Approved Zac Marshall EAI Consultant Approved Electronically July 2013

2 Contents 1. Introduction 4 BACKGROUND 4 OBJECTIVES 4 SCOPE 4 2. Technical Detail 5 FUNCTIONAL REQUIREMENTS 5 OVERVIEW DIAGRAM 5 SECURITY REQUIREMENTS 6 3. Required Information 7 APPENDICES 8 Appendix A: SFTP Site Details Form 9 Appendix B: Glossary 10 Appendix C: Document Control 11 List of Tables Table 1 - Glossary of Terms 10 THIS DOCUMENT CONTAINS 11 PAGES INCLUDING TITLE PAGE Version 1.8 July of 11

3 DISCLAIMER All advice given and statements and recommendations made in this document are: (i) provided in good faith on the basis of information provided by you, third parties and/or otherwise generally available or known to Capgemini UK at the time of writing; and (ii) made strictly on the basis that in no circumstances shall they constitute or deemed to constitute a warranty by Capgemini UK as to their accuracy or completeness. Capgemini UK shall not be liable for any loss, expense, damage or claim arising out of, or in connection with, the making of them in this document or for any omission from them. Capgemini UK plc 2013 Version 1.8 July of 11

4 1. Introduction BACKGROUND 1.1. An alternative to the submission of Catalogue Content to the MOD epurchasing Catalogue Service via the Trading Partner Hub is by hosting the content on an SFTP site accessible over the Internet To use this alternative channel Suppliers must host their own SFTP site upon which the content is routinely placed. OBJECTIVES 1.3. The objective of this document is to outline the technical, security and business requirements that must be met by a Supplier wishing to host their own SFTP site and submit content via this channel. SCOPE 1.4. The scope of this document is to outline the requirements that must be met by a Supplier wishing to submit content via this channel This document does not provide technical detail as to how the Supplier should implement their SFTP site or content publishing infrastructure. Version 1.8 July of 11

5 2. Technical Detail FUNCTIONAL REQUIREMENTS 2.1. Suppliers wishing to provide Catalogue content to the epurchasing Service by making it available on an SFTP site must fulfil the following functional requirements: a. Content must be published on a daily basis and made available by 10 pm British Local Time each evening for retrieval by epurchasing at some time after 11pm British Local Time. b. Content must be produced as a series of deltas. I.e. only content or images that have changed since the last content was published should be extracted and made available on the supplier SFTP site. OVERVIEW DIAGRAM 2.2. Below is an overview diagram of the Catalogues content SFTP retrieval process: Internet epurchasing SFTP Client epurchasing Boundary Firewall Supplier Boundary Firewall Supplier SFTP Server Figure 1 - SFTP Retrieval Process Overview 2.3. The epurchasing Boundary Messaging Server will establish an SFTP connection daily at some point after 11 pm British Local Time to the Supplier hosted SFTP site. The address or IP address of this site will have been provided to epurchasing epurchasing will provide a public key to be installed on the Supplier s SFTP server which will allow epurchasing to connect to the server using the account name provided by the supplier epurchasing will navigate to a specified directory within which the updated Catalogue Content deltas will have previously been placed by the Supplier. The SFTP account will have read/write permissions on these files. The files produced will be consistent with templates supplied by Capgemini. Three different files can optionally be produced, once per day: a. <SupplierPrefix>Content<yyyymmdd>.zip (contains item data); b. <SupplierPrefix>Images<yyyymmdd>.zip (contains images); c. <SupplierPrefix>Attach<yyyymmdd>.zip (contains attachments). (where SupplierPrefix is a predefined unique prefix, e.g. "ATradingPartner" and yyyymmdd is a datestamp) 2.6. Within the zip archives the following naming convention must be followed: Version 1.8 July of 11

6 a. Content files must be named either <SupplierPrefix>Content<yyyymmdd>.xml or <SupplierPrefix>Content<yyyymmdd>.txt depending upon their content being either xml or tab-separated values b. Image files must be named: <SupplierName>_<Image name>.gif (or.jpg,.tiff) e.g. ATradingPartner_BluePenVr1.gif c. Attachment files must be named: <SupplierName>_<Attachment name>.pdf (or <SupplierName>_<Attachment name>..txt) e.g. ATradingPartner_ _ _BluePen.pdf 2.7. Zip archives should be produced using either PKZIP 2.04g or a compatible compress tool Once the files have been retrieved by epurchasing they will be renamed to include a timestamp down to the second that the file was retrieved. e.g. SupplierPrefixContent zip.old 2.9. The files will then be moved to a "Processed" subdirectory on the supplier SFTP site, which should have been created with read/write permissions. (This Processed directory should be created at the same directory level as the Output directory.) The historical files within the Processed directory should be housekept by the Supplier with the last 60 days being retained Note: Suppliers should be aware that any content files placed in the directory after the retrieval for that day will not be retrieved the following day. This is because epurchasing will specify the filenames to be retrieved to include today's date. Should this happen, content files should be renamed to the next available date for automatic retrieval, or the Capgemini epurchasing Service Desk contacted to arrange an ad-hoc retrieval. SECURITY REQUIREMENTS Catalogue Suppliers must ensure that the catalogue data destined for epurchasing is hosted on a secure site. This means that steps must be taken to ensure that the content placed on the site can only be retrieved or modified by authorised individuals The SFTP site must have a static IP address and operate on a fixed Port number Steps towards securing the site should include the following: a) The account to be used by the epurchasing retrieval system should be dedicated for use by epurchasing only; b) The public key provided by epurchasing will be installed for that account; c) epurchasing should be informed of any change that will affect the known host key. Version 1.8 July of 11

7 3. Required Information 3.1. A catalogues supplier who chooses to set up their own SFTP site must provide specific information to epurchasing, including: a. Name and contact details of a key technical contact within the supplier organisation who can assist with configuration and initial testing and with resolving any issues that subsequently arise with use of the site by epurchasing b. Technical details of the SFTP site, including IP address, account name and specific directory where files will be placed c. Supplier Prefix, which will always form the first part of the filename of files placed by the supplier in the SFTP outbound directory. Normal rules of UNIX filename construction apply, in particular the name should not contain spaces, tabs or any special characters. We recommend that the supplier prefix should be between 6 and 24 characters in length The SFTP Site Details Form attached in Appendix A below should be used to supply epurchasing with this information The completed form should be sent to the Capgemini epurchasing Supplier Adoption team account: epurchasing.registration.uk@capgemini.com. Version 1.8 July of 11

8 APPENDICES Version 1.8 July of 11

9 Appendix A: SFTP Site Details Form Please note that all fields are mandatory except where otherwise indicated. Please delete the examples shown (e.g. text ) when completing the form. Trading Partner Name (as registered at Companies House) SFTP Site Technical Contact Supplier Prefix (must not include spaces or special characters) e.g. Trading Partner Ltd Name Job Title Telephone Number Address e.g. TradingPartnerLtd SFTP Site static IP Address 1 e.g SFTP Hostname (optional) e.g. ftp.tplimited.com Dedicated SFTP Account Name e.g. decsftpuser1 Remote Directory that will contain content files e.g. "/" if files will be in SFTP user s home directory, or "/Output/" if the files will be in a sub-directory named "Output" Please the form to the Capgemini epurchasing Supplier Adoption Team: epurchasing.registration.uk@capgemini.com Shortly after receiving the form, our technical team will get in touch with the SFTP site technical contact to test use of the SFTP site. 1 For security reasons the IP address must be static (i.e. fixed) and must also use a fixed Port number for access. Version 1.8 July of 11

10 Appendix B: Glossary The following is a list of the terms, acronyms and abbreviations relevant to this document: Phrase Description epurchasing SFTP MOD XML Electronic Purchasing Service Secure File Transfer Protocol Ministry of Defence extensible Markup Language Table 1 - Glossary of Terms Version 1.8 July of 11

11 Appendix C: Document Control Version History Version Date Comments 0.1 April 2004 First draft prepared by John R Hill and based on CGREP_L.DOT (3.1). Produced to outline the MoD DECS Catalogues FTP Retrieval process for Catalogue Content. 1.0 April 2004 Updated by John R Hill with minor QC Review comments made by Robert Waller and Lisa Eckersley. 1.1 May 2004 Updated by John R Hill with minor comments made by Leyton Lark and Rob Waller. Also updated to include revised file naming convention. 1.2 May 2004 Updated by Lisa Eckersley to explicitly state the processed directory level in section August 2004 Added paragraph Amended Chapter 3 to include description of information that must be provided. Modified FTP Site Details Form to specify that IP address is mandatory and moved it to Appendix A. Clarified restrictions on sending passwords by and provided alternative options. 1.4 September 2004 Minor presentational changes following review feedback. Reduced distribution list. 1.5 June 2006 Updated by Bernard Lovell to correct fax numbers and add to distribution list. 1.6 July 2013 Updated by Sarah Nunn to rebrand from DECS to epurchasing 1.7 July 2013 Updated by Zac Marshall to change from FTP to SFTP 1.8 July 2015 Updated by Sarah Nunn to remove reference to Requisite Document Distribution Name Location Responsibility Action / Information Alison Holvey Toltec Supplier Services Manager Information Zac Marshall Toltec EAI Consultant Action Andy Tomlin Toltec epurchasing Security Manager Information Sarah Nunn Toltec Trading Partner Take on Information Document Reviewed By Name Location Responsibility Zac Marshall Toltec EAI Consultant Sarah Nunn Toltec Trading Partner Take on Source File Location PVCS:XIB EAI\Documentation\Technical Design\ePurchasing Catalogues\MOD epurchasing Catalogues SFTP Retrieval.doc Version 1.8 July of 11