Building the SAP Business One Cloud Landscape Part of the SAP Business One Cloud Landscape Workshop Version 3.2

Transcription

1 Building the SAP Business One Cloud Landscape Part of the SAP Business One Cloud Landscape Workshop Version 3.2

2 TABLE OF CONTENTS 1 INTRODUCTION LANDSCAPE DETAILS Server Details Landscape Security Information CONFIGURING THE SERVER LANDSCAPE Configure Windows Active Directory Configure a Windows Time Server Install a Windows Domain Controller Join the other servers into the newly created domain Configure Domain Users Configure the Domain User Roaming profile Creating Storage Creating the Software Repository Structure Creating Shared Folder for the Service Unit Creating Tenant Storage Creating User Storage Creating Implementation Repositories Creating Company Template Repositories Configure Microsoft Remote Desktop Services Install SSL Certification Install the Remote Desktop Web Access and Remote Desktop Gateway for Microsoft Remote Desktop Services Configure Microsoft Remote Desktop Web Access Configure Microsoft Remote Desktop Licensing Activate Microsoft Remote Desktop Licensing Configure the Presentation Server Configure the Microsoft Remote Desktop Session Host Enable Licensing on the Microsoft Remote Desktop Session Host... Error! Bookmark not defined Configure Administrator Privileges Configure the Microsoft Remote Desktop Connection Broker Configure Microsoft SQL Server Instance(s) Installation of Microsoft SQL Server 2008 R Creation of a second SQL Instance Configuration of Microsoft SQL Server 2008 R Enable TCP/IP Enable Firewall Port Configure the SQL Services Configure User Security in both SQL instances INSTALLING THE SAP BUSINESS ONE CLOUD SOFTWARE COMPONENTS Create a SAP Business One Software Repository Install SAP Business One Server Tools (License Server) and SAP Business One Mailer Install the SAP Business One Cloud Control Center Install the SAP Business One SLD Agent Install the User Access Portal Registry Configuration Working with Microsoft Office Integration Install IIS and WebDav Publishing on the User Share server Configure IIS and WebDav Publishing Enable Automatic Mapping of User Storage for Users Configure the Microsoft Office Integration Registry Key

3 1 INTRODUCTION This guide has been created for use as a part of the SAP Business One Cloud Landscape Workshop. Through the course of the workshop it will be used to assist participants in building their own Proof of Concept (PoC) landscape to aid their understanding of the technologies utilized. 2 LANDSCAPE DETAILS 2.1 Server Details Server Computer Name Private Address Domain Controller Central Management Server Presentation Server/User Access Portal Database Server DC CCC RDS SQL 2.2 Landscape Security Information Domain Name sapbusinessonecloud.net Administrator Password SAP Business One Site User Password 3 CONFIGURING THE SERVER LANDSCAPE 3.1 Configure Windows Active Directory Configure a Windows Time Server To configure the PDC master without using an external time source, change the announce flag on the PDC master. The PDC master is the server that holds the forest root PDC master role for the domain. This configuration forces the PDC master to announce itself as a reliable time source and uses the built-in complementary metal oxide semiconductor (CMOS) clock. To configure the PDC master by using an internal hardware clock, follow these steps: 1. Click Start, click Run, type regedit, and then click OK. 2. Locate and then click the following registry subkey: 3. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags 4. In the right-pane, right-click AnnounceFlags, and then click Modify. 5. In Edit DWORD Value, type A in the Value data box, and then click OK. 6. Close Registry Editor. 7. At the command prompt, type the following commands to restart the Windows Time service, and then press Enter: a. net stop w32time b. net start w32time Install a Windows Domain Controller Normally at this point you would install the Windows Domain Controller however in the interests of time we have already done that before the workshop. During the workshop you do not need to complete this section at all. The following instructions provide a reference for setting up the Windows Domain controller, this guide is only intended to set up the basic functionality required for a PoC SAP Business One Cloud Landscape. 1. Login to the domain controller server DC, then in Server Manager Roles, select Add Roles. 2. Check Active Directory Domain Services and proceed to install. 3

4 3. Open a command prompt, type dcpromo.exe and then press enter. 4. In the wizard, continue past the welcome and compatibility check pages. 5. On the Choose a Deployment Configuration page, select Create a new domain in a new forest. 6. Input FQDN (Fully Qualified Domain Name) of the forest root domain, this domain name has to be the same with applied external domain name, sapbusinessonecloud.net 7. Click next for the confirmation of the NETBIOS domain name as SAPBUSINESSONEC. 8. In Set Forest Functional Level select Windows Server 2008 R2. 9. Continue advancing through the wizard to Directory Services Restore Mode Administrator Password, input administrator password and confirm. 10. On successful completion, restart the server. 11. When logging back into the server change the logon user to sapbusinessonecloud.net\administrator Best Practice Guideline: In order to organize and manage the domain users and their associated security privileges, domain Groups and Organizational Units should be used to create a structure to categorize users in the landscape. Cloud Operators: A cloud operator is an administrator in the SAP Business One Cloud Control Center, managing infrastructure resources, customers and tenants in the SAP Business One Cloud Landscape. Cloud operators should be defined in their own Organizational Unit: 1. Create a new Organizational Unit (OU) called Cloud Operator in the domain. 2. Create a new Group within the Cloud Operator OU called Cloud Infrastructure Operators, this will contain all of the domain users that manage the infrastructure components of the landscape. 3. For the purposes of the workshop it is not necessary to create further Cloud Operator groups as we will not be creating that many users. In a productive environment you will want to use the below groups to manage access in the landscape. 4. Create a new Group in this OU called Cloud Application Operators, this will contain all of the domain users that manage the customer and tenant components of the landscape. 5. Create a new Group in this OU called Cloud Consulting Operators, this will contain all of the domain users that use the Support User functionality or perform consulting in the implementation and support of tenants. Customer Users: A customer is a named user that has access to SAP Business One Cloud and each customer should be licensed correctly according the subscription contract they have purchased. Customer users should be defined in their own Organization Unit: 1. Create a new Organizational Unit (OU) called Customer Organization in the domain. 2. Create a new Organization Unit called Service Units OU within the Customer Organization OU. 3. Create a new Group (or set of Groups) in the Service Units OU to reflect the deployed Service Units in the landscape, e.g. SU1, SU2 etc. 4. Create a new Organizational Unit within the Customer Organization OU named after the customer you are creating an OU for, e.g. ABC Corp OU. 5. Create a new Group in the customer OU, e.g. ABC Corp Group in ABC Corp OU and assign to the correct Service Unit group(s) that were created. 6. Create the required domain users and assign them to the ABC Corp Group. 7. Now whenever permissions need to be assigned for a customer use the customer Group to assign them for all customer users Join the other servers into the newly created domain Now that there is a domain for the cloud landscape, each server in our landscape as detailed in 2.1 Server Details needs to be configured to be part of it. 1. Logon to each of the servers; change the network settings so that the address of the Preferred DNS Server is configured to be the IP address of the Domain Controller that has just been configured. 2. Change the computer name and domain in System Properties, the domain has to be sapbusinessonecloud.net. 3. Change the delegation of each computer: 4

5 a. Logon to the Domain Controller, in Server Manager navigate to Roles Active Directory Domain Services Active Directory Users and Computers Computers b. In the pane on the right side, right click on each of the computers listed, select Properties and navigate to the Delegation tab page and select the check box Trust this computer for delegation to any service (Kerberos only) Configure Domain Users To enable the initial configuration of the SAP Business One Cloud Landscape you will need to create two users as detailed below. For more information concerning the recommended best practice for SAP Business One Cloud Domain users please see accompanying course material. 1. Create SAP Business One Cloud service user: a. In Server Manager Roles Active Directory Domain Services Active Directory Users and Computers sapbusinessonecloud.net Users, create a new domain user (the SAP Business One Cloud Service User), SAPServiceB1C. Specify its password to Initial0, and check User cannot change password and Password never expires. 2. The SAP Business One Cloud Service User needs to be a local administrator on the machines that have SAP Business One components on them, we could set this on each machine but it is easier to use the following Group Policy method: a. In Server Manager Roles Active Directory Domain Services Active Directory Users and Computers sapbusinessonecloud.net Computers, create a new Security Group, SAP Business One Computers GP. Add the RDS, SQL and CCC computers to this group. b. In Server Manager Roles Active Directory Domain Services Active Directory Users and Computers sapbusinessonecloud.net Users, create a new Security Group, SAP Business One Service User GP. Add the SAPServiceB1C user to this group c. Open Start Administrative Tools Group Policy Management d. Expand the tree and right-click on the sapbusinessonecloud.net domain, click on Create a GPO in this domain, and Link it here e. Call the GPO, Local Admins, f. With the Local Admins GPO highlighted in the right-hand pane under Security Filtering click Add, then add the SAP Business One Computers GP g. Highlight Authenticated Users and click Remove h. Right-click on the Local Admins GPO and select Edit i. Expand Computer Configuration Policies Windows Settings Security Settings Restricted Groups j. In the right pane of Restricted Groups, right-click and select Add Group k. Click Browse and find the SAP Business One Service User GP that you just added. l. Click Add under The group is a member of: and then click Browse and select the Administrators group. (Then also add the Remote Desktop Users group). m. Close the Group Policy Management Editor and Management windows. 3. For a GPO to take effect you may have to wait up to 15 minutes, however you can force a group policy update by logging on to one of the machines we have targeted, opening a command prompt and typing gpupdate /force. If the SAPServiceB1C password changes after initial configuration you must also reconfigure the SAP Business One SLD Service and SAP Business One SLD Agent windows Services. 4. The SAP Business One Cloud Service User needs to be able to log on as a service on the machines that have SAP Business One components on them, we could set this on each machine but it is easier to use the following Group Policy method: a. Open Start Administrative Tools Group Policy Management b. Expand the tree and right-click on the sapbusinessonecloud.net domain, click on Create a GPO in this domain, and Link it here c. Call the GPO, Log on as a Service, d. With the Log on as a Service GPO highlighted in the right-hand pane under Security Filtering click Add, then add the SAP Business One Computers GP e. Highlight Authenticated Users and click Remove f. Right-click on the Log on as a Service GPO and select Edit g. Expand Computer Configuration Policies Windows Settings Security Settings Local Policies User Rights Assignment h. Find Log on as a service in the right-hand pane, right-click on it and select Properties i. Check the Define policy setting box if not already checked. 5

6 j. Click Add User or Group, then click Browse and select the SAP Business One Service User GP that you just added. k. Close the Group Policy Management Editor and Management windows. 5. Create the initial Cloud Control Operator: a. In Server Manager Roles Active Directory Domain Services Active Directory Users and Computers sapbusinessonecloud.net Users, create a new domain user b1cadm. Make this user a member of the Infrastructure Operator Group Configure the Domain User Roaming profile The Windows roaming user profile is used to stored user data, so that it can follow users as they log on to different computers within the domain. Roaming user profiles are stored in a central server location. To configure the roaming folder of each domain user create the following GPO: 1. Login to the domain controller server DC 2. Create a Windows shared folder, e.g. new folder in the file system named Share. 3. Create the root directory of the roaming folder and share it to everyone, e.g. create folder UserProfile in the directory Share share it, the shared network path should be \\DC\\Share\UserProfile. 4. Open Start Administrative Tools Group Policy Management 5. Expand the tree and right-click on the sapbusinessonecloud.net domain, click on Create a GPO in this domain, and Link it here 6. Call the GPO, Roaming Profiles. 7. Right-click on the Roaming Profiles GPO and select Edit 8. Expand Computer Configuration Policies Administrative Templates System User Profiles 9. In the right-hand pane right-click on Set roaming profile for all users logging onto this computer and select Edit 10. Click the Enabled option 11. In the roaming path text box enter \\DC\share\UserProfile\%username% 12. Click OK 13. Close the Group Policy Management Editor and Management windows. 3.2 Creating Storage SAP Business One Cloud requires a storage area to store data related to tenants, users and implementation. To create the shared folder structure do the following: 1. Logon to Central Components server CCC. 2. Create a Windows shared folder, e.g. new folder in the file system named share and share this folder to Everyone with Read permission. Sharing path will be \\CCC\share Creating the Software Repository Structure Each version of SAP Business One Cloud in use in the landscape needs to be stored in a repository. To create a folder to store the different versions of SAP Business One Cloud, do the following: 1. Navigate to the folder \\CCC\share 2. Create a Windows shared folder called SAPB1 Packages and share this folder assigning SAPServiceB1C with Read/Write permissions Creating Shared Folder for the Service Unit 1. Navigate to the folder \\CCC\share 2. Create a Windows shared folder called SharedFolderSU1 and share this folder assigning SAPServiceB1C with Read/Write permissions Creating Tenant Storage 1. Navigate to the folder \\CCC\share 2. Create a Windows shared folder called TenantStorage and share this folder assigning SAPServiceB1C with Read/Write permissions. 6

7 Creating User Storage 1. Create a new Windows shared folder called UserStorage on server CCC and share this folder assigning SAPServiceB1C with Read/Write permissions Creating Implementation Repositories 1. Navigate to the folder \\CCC\share 2. Create a Windows shared folder called ImplementationRepository and share this folder assigning Read permissions to Everyone Creating Company Template Repositories 1. Navigate to the folder \\CCC\share 2. Create a Windows shared folder called CompanyTemplateRepository and share this folder assigning Read permissions to Everyone 3.3 Configure Microsoft Remote Desktop Services SAP Business One Cloud uses remote desktop technology in order to provide the end-user experience of SAP Business One Cloud. This guide covers the configuration of Microsoft Remote Desktop Services, if you are using another remote desktop technology please refer to the correct third party documentation for your product. Ensure the following steps are completed on the correct server, RDS in most instances (in the case of the workshop) Install SSL Certification Here we are installing the certificates all on the Presentation Server (RDS ) server. In a productive environment the IIS certificate needs to be installed where the User Access Portal will be deployed. Information taken from 1. To install the intermediate certificate, click Start, and then click Run Type mmc, and then click OK. The Microsoft Management Console (Console) window opens. 3. In the Console1 window, click the File menu, and then select Add/Remove Snap-in. 4. In the Add or Remove Snap-in window, select Certificates, and then click Add. 5. In the Certificates snap-in window, select Computer Account, and then click Next. 6. In the Select Computer window, select Local Computer, and then click Finish. 7. In the Add or Remove Snap-in window, click OK. 8. In the Console1 window, click + to expand the folder. 9. Right-click Intermediate Certification Authorities, mouse-over All Tasks, and then click Import. 10. In the Certificate Import Wizard window, click Next. 11. Click Browse to find the intermediate certificate file. 12. In the Open window, change the file extension filter to PKCS #7 Certificates (*.spc;*.p7b), select the *_iis_intermediates.p7bfile, and then click Open. 13. In the Certificate Import Wizard window, click Next. 14. Select Place all certificates in the following store, and then click Browse. 15. In the Select Certificate Store window, select Intermediate Certification Authorities, and then click OK. 16. In the Certificate Import Wizard window, click Next. 17. Click Finish. 18. Click OK. 19. Close the Console 1 window, and then click No to remove the console settings Install the Remote Desktop Web Access and Remote Desktop Gateway for Microsoft Remote Desktop Services To enhance the user experience SAP Business One Cloud provides a User Access Portal for users to log in through. 1. Login to the Presentation Server (RDS) server, open Server Manager, expand the Server Manager (Computer Name), right-click Roles and click Add Roles. 2. Select Remote Desktop Services and click next twice. 3. Select Remote Desktop Gateway and Remote Desktop Web Access. 4. Click to confirm to add required services in pop-up window. 7

8 5. Check Choose an existing certificate for SSL encryption (recommended). Click Import button to import the certification issue to RDS.sapbusinessonecloud.net (you will need to enter a password), otherwise if the correct SSL certificate is configured on this server, select it and click Next and select it in the grid. 6. Select Now for Create authorization policies. a. Click Add button to add Domain Users b. Enter a name for the RD CAP: Default value is TS_CAP_01. c. Enter a name for the RD RAP: Default value is TS_RAP_01 ; Select Allow users to connect to any computer on the network. 7. Keep default setting, click Next, 8. Keep the remaining default settings and click Next until you are able to click Install on the last step. 9. Restart the server after installation Configure Microsoft Remote Desktop Licensing 1. Logon to the Central Components (CCC) server, open Server Manager, expand the Server Manager (Computer Name), right-click Roles and click Add Roles. 2. Select Remote Desktop Services. 3. Select Remote Desktop Licensing. 4. Check Configure a discovery scope for this license server. 5. Proceed with the remaining steps to install Configure Microsoft Remote Desktop Web Access 1. Logon to the Presentation Server (RDS) server, open Server Manager, navigate to Roles Remote Desktop Services RD Session Host Configuration. 2. Double click on RDP-Tcp in the Connections table. In the General tab page of popup, click Select button to choose the SSL certification issued to <rds.sapbusinessonecloud.net>. 3. Click ok to close the pop-up window. 4. Double click the item Remote Desktop license servers in Edit settings Licensing, in the pop-up window click the Add button to input the license server of Remote Desktop Services, in this case use the computer name of the Central Components server CCC 5. In Server Manager, navigate to Roles Web Server(IIS) Internet Information Service, select Application Pools in the tree list, choose RDWebAccess in the Application Pools, click Advance Settings in the right pane. 6. In the pop-up window change the Identity to sapbusinessonecloud.net\sapserviceb1c and provide the credentials when requested. 7. Expand the Sites in the tree list, navigate to Default Web Site and select Bindings from the right-hand pane. 8. Select https and click the Edit button from the pop up. Choose the SSL certification issued to this server from the drop down box (it will be the certificate title sapbusinessonecloud.net. 9. Expand the Sites in the tree list, navigate to Default Web Site RDWeb and select Basic Settings from the right-hand pane. 10. In the pop up window click Connect as and specify the user sapbusinessonecloud.net\sapserviceb1c and provide the credentials when requested Activate Microsoft Remote Desktop Licensing This section is provided for reference only, it cannot be completed in the sandboxed Cloud Landscape environment. 1. On the Microsoft Remote Desktop License Server (Central Components), open Remote Desktop Licensing Manager. To open Remote Desktop Licensing Manager, click Start, select Administrative Tools, then Remote Desktop Services, and then click Remote Desktop Licensing Manager. 2. Right-click the license server that you want to activate, and then click Activate Server. The Activate Server Wizard starts. 3. Click Next. 4. On the Connection Method page, in the Connection method list, select Automatic connection (recommended), and then click Next. 5. On the Company Information page, type your name and company, select your country or region, and then click Next. 6. Specify any other information that you want to provide, such as and company address. This information is optional. 7. Click Next. Your license server is activated. 8. On the Completing the Activate Server Wizard page, do one of the following: 8

9 To install Remote Desktop Services client access licenses (RDS CALs) onto your license server, ensure that the Start Install Licenses Wizard now check box is selected, click Next, and then follow the instructions. To install RDS CALs later, clear the Start Install Licenses Wizard now check box, and then click Finish Configure the Presentation Server The Microsoft Remote Desktop Session Host is the RDS Server in our PoC configuration. The Presentation Server runs the SAP Business One client for the end users Configure the Microsoft Remote Desktop Session Host 1. Logon to the Presentation Server (RDS) server, open Server Manager, expand the Server Manager (Computer Name), right-click Remote Desktop Services and click Add Role Services. 2. Check Remote Desktop Session Host and click Next. 3. Select Do not require Network Level Authentication and next. 4. Choose Per User and click Next. 5. In Select User Groups Allowed Access To This RD Session Host Server wizard page, click button Add and input the group created for Service Unit 1 to continue. 6. Continue the next wizard pages to install. 7. Restart the server after the installation completes. 8. After the restart, open Server Manager and navigate to Roles Remote Desktop Services RemoteApp Manager, and click RD Session Host Server Settings in the right-hand pane. 9. In the pop up window, configure the following: In RD Session Host Server tab page, input the Fully Qualified Domain Name (FQDN) of the Presentation Server into Server Name box, here it should be RDS.sapbusinessonecloud.net. In RD Gateway tab page, select Use these RD gateway server settings and input the FQDN of User Access Portal, here it should be RDS.sapbusinessonecloud.net. In Digital Signature tab page, check Sign with a digital certificate and click the button Change to select the SSL certification issued to the Presentation Server. 10. Open Server Manager, navigate to Configuration Local Users and Groups Group, double click on TS Web Access Computers, click on Add button. In the popup, click Object Types button to check Computers and input RDS to add the User Access Portal server into the web access computers group. 11. Open Server Manager, click Configure Remote Desktop on the right. Click Select User button and add Domain Users and Service Unit 1 for the remote access Configure Administrator Privileges 1. Grant local server administrator privileges to the SAPServiceB1C account for each Presentation Server (in the case of the workshop we only have one presentation server, the RDS server): a. In Windows, choose Start Control Panel Administra ve Tools Computer Management. b. In the Computer Management window, expand Local Users and Groups Groups. c. Right-click the Administrators group and choose Add to Group. d. In the Administrator s Properties window, add the SAPServiceB1C account. 9

10 3.3.7 Configure the Microsoft Remote Desktop Connection Broker Remote Desktop Connection Broker (RD Connection Broker), formerly Terminal Services Session Broker (TS Session Broker), is a role service that provides the following functionality: Allows users to reconnect to their existing sessions in a load-balanced RD Session Host server farm. This prevents a user with a disconnected session from being connected to a different RD Session Host server in the farm and starting a new session. Enables you to evenly distribute the session load among RD Session Host servers in a load-balanced RD Session Host server farm. Provides users access to virtual desktops hosted on RD Virtualization Host servers and to RemoteApp programs hosted on RD Session Host servers through RemoteApp and Desktop Connection. 1. Logon to the server where you will install the Microsoft Remote Desktop Connection Broker (in this case the RDS server, open Server Manager, expand Server Manager (Computer name), expand Roles, right click Remote Desktop Services, and then click Add Role Services. 2. Check Remote Desktop Connection Broker and click Next. 3. Click Install to continue and then complete the installation 4. Open Server Manager, navigate to Configuration Local Users and Groups Group, double click on Session Broker Computers, click on Add button. In the popup, click Object Types button to check Computers and input RDS to add the User Access Portal server into the web access computers group. 5. In Server Manager, navigate to Roles Remote Desktop Service RD Session Host Configuration, and double-click Member of farm in RD Connection Broker in the Edit Settings table. 6. Click Change Settings in the RD Connection Broker tab 7. In the RD Connection Broker Settings pop-up window, select Farm Member and enter RDS.sapbusinessonecloud.net into the RD Connection Broker server name field and enter SU1 Farm into the Farm Name field. 8. Click ok 9. Select the IP checkbox at the bottom of the window (otherwise it will force you to pick after you click ok) 10. Click ok. 3.4 Configure Microsoft SQL Server Instance(s) In this SAP Business One Cloud Landscape there are two database instances required: A database instance for the SAP Business One Cloud System Landscape Directory (SLD) A database instance for the Service Unit Sections are provided for reference as the Microsoft SQL Server instances will have been created prior to the workshop to save time Installation of Microsoft SQL Server 2008 R2 1. Logon to the Database Server and launch the installation of SQL Server 2008 R2. 2. Advance to the Feature Selection page and select to install Database Engine Services and Management Tools Basic, click Next. 3. Advance to the page in the installation wizard titled Instance Configuration, choose Default Instance and click Next. 4. In the Server Configuration page click Use the same account for all SQL Server services and select the Network Service account. 5. On the same page select the Collation tab and check the collation is SQL_Latin1_General_CP1_CI_AS. 6. Continue to the page Database Engine Configuration, select Mixed Mode (SQL Server authentication and Windows authentication), input a password (use the same as your administrator password for the PoC landscape) and confirm it. Click the button Add to add domain user SAPServiceB1C into the SQL Server Administrators. 7. Click Next to install. 8. For more details on installing Microsoft SQL Server for SAP Business One see section in the SAP Business One Administrator Guide for SQL Creation of a second SQL Instance 1. Launch the installation of SQL Server 2008 R2 again 2. Follow the steps in Installation of Microsoft SQL Server 2008 R2 above, selecting New installation or add shared features on the Installation Type page. And on the Instance Configuration page, specify the Named Instance as SLD. 10

11 3.4.3 Configuration of Microsoft SQL Server 2008 R Enable TCP/IP 1. Run SQL Server Configuration Manager (Start Microsoft SQL Server 2008 R2 Configuration Tools), expand the node titled SQL Server Configuration Manager SQL Server Network Configuration, in Protocols for SU1 and Protocols for SLD, enable Named Pipes and TCP/IP. In the node SQL Server Services, restart SQL Server (SU1) and SQL Server (SLD). 2. Configure the port on the SLD instance to port number You need to configure any additional named instances to have a specific port in the same way due to the way that JVM accesses SQL databases. (You need to do this by going to IPALL in the TCP/IP properties, remove the number in Dynamic Ports and enter in the TCP Port text box.) Enable Firewall Port NB In the workshop we will disable all internal firewalls for ease of configuration so go directly to the next step. 1. Open the Control Panel and navigate to Check firewall status Advanced Settings. 2. Click Add new Inbound Rules, then follow the wizard and specify port 1433 to be an exception and name the rule as SQL Server 1433 to allow for easy future identification. 3. Alternatively, turn off Windows firewall on Domain network location. 4. Don t forget the second instance, you need to configure the port and allow it through the firewall too. (Port 14331) 5. Also create an Inbound rule for the SQL Server Browser (UDP Port 1434) 6. See for more details Configure the SQL Services in all SQL instances 1. Change the logon account for the SQL Server service to SAPServiceB1C 2. Navigate to Administrative Tools in the Start Menu, then open Services. 3. Double-click on SQL Server Browser to change the Startup type to Automatic. 4. Switch to the Log On tab page and change the logon account to SAPServiceB1C. 5. Ensure the services are started Configure User Security in all SQL instances 2. In Microsoft SQL Server Management Studio grant Microsoft SQL Server security privileges to cloud operators: a. Add the SAPServiceB1C user as a SQL Server logins. b. For the SAPServiceB1C account, set the server roles as public and sysadmin 3. Grant local server administrator privileges to the SAPServiceB1C account for each database instance: a. In Windows, choose Start Control Panel Administra ve Tools Computer Management. b. In the Computer Management window, expand Local Users and Groups Groups. c. Right-click the Administrators group and choose Add to Group. d. In the Administrator s Properties window, add the SAPServiceB1C account. 4 INSTALLING THE SAP BUSINESS ONE CLOUD SOFTWARE COMPONENTS 4.1 Create a SAP Business One Software Repository 1. Logon to Central Components server CCC. 2. Navigate to the folder \\CCC\share\SAPB1Packages 3. Create a folder called for a specific version of SAP Business One, e.g. SAPB1 Packages\882PL11\UpgradeCD 4. Extract the SAP Business One upgrade package to this folder. 5. Share this folder, the share will then be accessible with \\CCC\Share\SAPB1 Packages\882PL Install SAP Business One Server Tools (License Server) and SAP Business One Mailer 1. Logon to Central Components server CCC 2. Navigate to the folder \\CCC\share\SAPB1Packages\<B1_Version\UpgradeCD\Packages\Server Tools 3. Install Business One Server Tools, selecting a custom install and choosing License manager and Mailer as the options. Make a note of the SAP Business One Site User password, then confirm. (Normally the Mailer would not be installed here as one is required per Service Unit but in this case we are only going to have one Mailer) 11

12 4. Run Service Manager after installed. Choose License Manager in Service dropdown list and select Start when operating system starts. 5. Remember the Hardware Key which will be used to request license file. 6. After completing the license server installation process, change the logon account for the corresponding Windows service to SAPServiceB1C. 4.3 Install the SAP Business One Cloud Control Center To install the SLD and Cloud Control Center, do the following: 1. Logon to Central Components server CCC 2. Navigate to the root folder of the installation package, right-click the SLD_x64.exe file, and choose Run as administrator. 3. In the SAP Business One SLD Service InstallShield Wizard window that appears, choose the Next button. 4. In the System Landscape Directory Service Configuration window, specify the user name as the SAPServiceB1C user and input the appropriate password. The user that is used to run the SLD Service must be assigned as the local administrator of the server that it is installed on and must have the sysadmin role on the SLD Database Instance. 5. In the Web Protocol window, select the radio button of the web protocol you want the SLD to use for connections. a. In our PoC scenario select HTTP, we do not have to supply a certificate with this configuration. For security reasons the recommendation for a live implementation of the SAP Business One Cloud Landscape is to use the HTTPS option 6. In the Cloud Control Center Site Configuration window, specify the site name, IP address, and TCP/IP port of the Cloud Control Center. Select the checkboxes for default values. 7. In the System Landscape Directory Database Configuration window, specify the database server as SQL\SLD, accept the default name for the database and select Windows Authentication, then click next. 8. In the Cloud Control Center Default Account Configuration window, enter b1cadm as the user name you want to use as the default account for accessing the Cloud Control Center. 9. In the Ready to Install Components window, click the Install button to complete the installation. 10. After the wizard finishes restart the server to complete the installation. 11. After completing the installation process it is recommended to back up the keytools.dat and SLD.KEYSTORE files located in <INSTALLDIR>\apache-tomcat \work\Catalina\localhost\sld\WEB-INF\classes\META-INF\. (This is not necessary for the workshop prototype landscape) 4.4 Install the SAP Business One SLD Agent In addition to the SLD and Cloud Control Center, you must install the SLD Agent Service. This agent service executes tasks on behalf of the SLD, such as performing database upgrades. You can manually install the SLD Agent Service on servers individually using the process described below, alternatively in larger environments you can perform the installation automatically using a Group Policy Object, details on this approach can be found in the document Using Group Policy Objects in the Cloud Landscape The SLD Agent Service needs to be installed on the Central Components (CCC), Database (SQL) and Presentation Server (RDS). Logon to each of them in turn to install the SLD Agent Service using the provided installer and do the following: 1. Navigate to the root folder of the SAP Business One Cloud installation package. In the SLDAgentMSI_x64 folder, right-click the SLDAgent_x64.exe file, and the choose Run as administrator. 2. In the SAP Business One Cloud SLD Agent Service InstallShield Wizard window that appears, choose the Next button. 3. In the SLD Agent Service Configuration window, specify the user name as SAPServiceB1C and input the corresponding password. The user that is used to run the SLD Service Agent must be assigned as the local administrator of the server that it is installed on and must be assigned User Rights to Log on as a Service. 4. In the System Landscape Directory Configuration window, enter the URL of the System Landscape Directory, in this case it is 5. In the Ready to Install Components window, click the Install button 6. Restart the SLD Service on the Central Management Server (CCC). 4.5 Install the User Access Portal To install the user access portal, do the following: 12

13 1. Logon to the User Access Portal server (RDS). 2. Navigate to the root folder of the SAP Business One Cloud installation package, right-click the UserAccessPortal.exe file, and choose Run as administrator. 3. In the SAP Business One Cloud User Access Portal InstallShield Wizard window that appears, choose the Next button. 4. In the Setup Type window, select to use Remote Desktop Service for SAP Business One User Access Portal 5. In the Microsoft Internet Information Services Configuration window, specify the User Name as SAPServiceB1C and provide the correct password. 6. In the System Landscape Directory Configuration window, enter 7. In the Ready to Install Components window, choose the Install button. 8. In the Complete window, choose the Finish button. SAP only provides there User Access Portal as a template and not for productive use. 4.6 Registry Configuration For the SAP Business One Cloud Landscape components to function correctly specific settings must be added to the Windows Registry of the servers that exist in the SAP Business One Cloud Landscape. In this PoC we will set up the entries manually, however it is more efficient to deliver the registry entries automatically to each server using a Group Policy Object, full details can be found in Using Group Policy Objects in the Cloud Landscape 1. Two new registry key values need to be created inhkey_local_machine\software\wow6432node\sap\sap Manage: a. Create one new key called Hosting of type Dword, with a value of 1 b. Create a second key called SLDAddress of type String with a value of 2. Implement this registry change to each computer in the landscape. 4.7 Working with Microsoft Office Integration To provide integration with Microsoft Office, do the following: Install IIS and WebDav Publishing on the User Share server 1. Logon on to Logon to Central Components server CCC 2. Open Server Manager, expand the Server Manager (Computer Name), right-click Roles and click Add Roles. 3. Select Web Server (IIS) in the wizard page and click the Next button 4. In Select Role Services, check WebDav Publishing and Digest Authentication. 5. Complete the installation of IIS. 6. Once installed change the port IIS uses from port 80 to something else (e.g. 81) if the SLD installed on the CCC is already using port Configure IIS and WebDav Publishing Enable users to access their personal sub-folders in the user storage using the WebDAV protocol. 1. In Windows, choose Start Administrative Tools Server Manager. 2. In the Console Tree, expand Roles Web Server (IIS) Internet Informa on Services (IIS) Manager. 3. In the Connections pane, expand the Sites node in the tree, right-click Default Web Site, and then select Add Virtual Directory from the context menu. 4. In the Add Virtual Directory window, set the Alias as UserStorage and Physical Path as \\CCC\Share\UserStorage 5. Double-click on the newly created Virtual Directory named UserStorage and select Authentication from the IIS area menu on the right. 6. Edit the Authentication to disable Anonymous Authentication and enable Digest Authentication. 7. Configure the WebDAV authoring rules: a. In the Connections pane, expand Sites Default Web Site User Storage. b. In the IIS area, double-click WebDAV Authoring Rules. c. In the Actions pane, choose Add Authoring Rule. d. In the Add Authoring Rule window, do the following: o In the Allow access to area, select the All Content radio button. o In the Allow access to this content to area, select the All users radio button, o In the Permissions area, select the Read, Source, and Write checkboxes. 13

14 4.7.3 Enable Automatic Mapping of User Storage for Users To enable the automatic mapping of user storage to the Z drive when users log on to SAP Business One Cloud, use a group policy object to configure drive mapping for each domain user: 1. Logon to the Domain Controller server, DC 2. In Windows, choose Start Run 3. Enter gpmc.msc and launch Group Policy Management 4. Expand 'Forest...'> 'Domains'> sapbusinessonecloud.net > 'Group Policy Objects' 5. Right-click 'Group Policy Objects'> 'New' 6. Call the GPO User Storage Drive Mapping 7. Right-click and edit the new GPO 8. Expand 'User Configuration'> 'Preferences' 9. Right-click 'Drive Maps'> 'New'> 'Mapped Drive' 10. After 'Action,' select 'Replace' 11. In the 'Location' field, type the UNC to \\<StorageServer>\UserStorage\%USERNAME% 12. Select 'Reconnect' to ensure this drive is persistent 13. Specify Z as the Drive Letter 14. Click the 'Common' tab 15. Fill the checkbox for 'Run in logged-on user's security context (user policy option) 16. Click the option 'Item-level targeting' checkbox, then click the 'Targeting...' button. 17. Click on 'New Item'> 'Security Group' 18. Click on the '...' button to browse for your computer group on your domain. Ensure your 'Locations...' field shows the correct domain for your user group, type Domain Users in the 'Enter the object name to select' field and click 'OK.' 19. Click OK to close the window. 20. To apply the policy right-click on the relevant OU s (e.g. Customer Organization OU) and select Link an existing GPO, selecting the newly created GPO. 21. Note that Group Policies by default take around 90 minutes to refresh...you can force it to update on a client computer by going to a command prompt and typing 'gpupdate /force' (press enter) Configure the Microsoft Office Integration Registry Key For SAP Business One Cloud to operate the Microsoft Office Integration correctly a registry value needs to be entered into the registry of all Presentation Servers. In this PoC we will set up the entries manually, however it is more efficient to deliver the registry entries automatically to each server using a Group Policy Object, full details can be found in Using Group Policy Objects in the Cloud Landscape. 1. In the registry findhkey_local_machine\software\wow6432node\sap\sap Manage 2. Create a registry key called DirectExcelExport of type Dword and set the value to After configuration restart the RDS server 14

15 SAP AG or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP AG and its affiliated companies ( SAP Group ) for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Please see for additional trademark information and notices.