How to configure x.509 authentication for SAP PI Systems to connect to/from SAP Cloud for Customers

Transcription

1 How-To Guide SAP NetWeaver Document Version: How to configure x.509 authentication for SAP PI Systems to connect to/from SAP Cloud for Customers

3 Table of Contents 1 Scenario Background Information Prerequisites Limitation Step-by-Step Procedure Export the outbound certificate from communication arrangements on SAP Cloud for Customers Export the root certificate used to sign the x.509 certificate Import the root certificate used to sign the certificate Load certificate into SSL Server standard for ABAP Load certificate in ICM_SSL_<instanceID>_<port> view for JAVA Set the value for VCLIENT on parameter icm/server_port_<xx> Adjust logging modules to accept certificates Enable mapping client certificates to user IDs in UME Maintain user certificate information Export client x.509 certificate from inbound communication arrangements from SAP Cloud for Customers Create a view in the Key Storage Load certificate into view on NWA Adjust PI Receiver communication channel to use certificates Table of Contents 2014 SAP AG or an SAP affiliate company. All rights reserved. 3

4 1 Scenario Use this procedure to configure the use of client certificates for authentication when connecting from SAP Cloud for Customer to an OnPremise system for an integration scenario. 2 Background Information Client certificates enable you to authenticate users without the need for a user name and password provided as part of the communication arrangement in. With this method the consumer proxy will be capable to connect to the SAP PI SOAP adapter providing a client x.509 certificate. 3 Prerequisites The AS Java is configured to support SSL with the given certificates on SAP PI OnPremise 4 Limitation This procedure is based in the manual storing of the certificate for the mapping of the certificate with the corresponding User ID on the UME of the SAP PI OnPremise system. 5 Step-by-Step Procedure 5.1 Export the outbound certificate from communication arrangements on 1. Logon to the using the following URL 2. Provide user and password to connect to Scenario 2014 SAP AG or an SAP affiliate company. All rights reserved. 4

5 3. Open the Administrator work center 4. Click in Communication Arrangements under Integration Section 5. Open for Edit any of the communication arrangements that were already configured by selecting it and clicking on Edit Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 5

6 6. Click in the Technical Data tab 7. In the Outbound communication click in the Download button for the Certificate Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 6

7 8. Save the x.509 certificate locally in the computer 5.2 Export the root certificate used to sign the SAP Cloud for Customers x.509 certificate 1. Open the certificate that was downloaded in the previous step 2. Click on the Certification Path tab Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 7

8 3. Select the root certificate and click in the View Certificate button 4. Select the Details tab and click in the Copy to File button Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 8

10 7. Specify the location on where the file will be stored and click Next 8. Click Finish 5.3 Import the root certificate used to sign the SAP Cloud for Customers certificate Depending of the configuration of the PI system and which is the PSE provider the location on where the root certificate has to be imported change. This is determined by the parameter ssl/pse_provider. If the parameter ssl/pse_provider is equal to ABAP proceed with section 5.3.1, if the parameter ssl/pse_provider is equal to JAVA or this is a SAP PI AEX (JAVA only) proceed with section Load certificate into SSL Server standard for ABAP 1. Using SAPGUI logon to the ABAP stack of the SAP PI system and open transaction STRUST Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 10

12 3. Select the location of the root certificate exported in the previous step and click Continue 4. Click the button Add to Certificate List 5. Save the changes Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 12

13 5.3.2 Load certificate in ICM_SSL_<instanceID>_<port> view for JAVA 6. Logon to the NWA of the SAP PI system using the following URL 7. Click in the Configuration Tab and then on Certificates and Keys Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 13

14 8. Verify if the root certificate used to sign the x.509 certificate is already imported into the ICM_SSL_<instanceID>_<port> view within the key storage 9. If the root certificate is not there it can be imported by clicking Import Entry from the View Entries tab 10. Select the entry type X.509 Certificate and then the location of the file that was saved in the previous step and click Import Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 14

15 5.4 Set the value for VCLIENT on parameter icm/server_port_<xx> Using the VCLIENT profile parameter of ICM will tell the ICM how to behave in regards of the use of certificates for client authentication, either using RZ10 transaction in the case of SAP PI dual stack or editing the instance profile directly in file editor for a SAP PI AEX adjust the parameter icm/server_port_<xx> for the corresponding SSL port used. Set the profile parameter to use VCLIENT = 1 like the following example 5.5 Adjust logging modules to accept certificates 1. Open the NWA and click in the menu Configuration Security Authentication and Single Sign-On 2. Click in Add to create a new customer policy configuration template Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 15

17 5. Under the Authentication Stack tab click in Add and add the following login modules ClientCertLoginModule EvaluateTicketLoginModule BasicPasswordLoginModule CreateTicketLoginModule SUFFICIENT SUFFICIENT REQUISITE OPTIONAL 6. Verify that the ClientCertLoginModule has the option Rule1.getUserFrom with the value wholecert configure 7. Click Save 8. Look for the SOAP adapter typing *SOAP* in the Policy Configuration Name and with the Type Web Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 17

18 9. Select the policy sap.com/com.sap.aii.adapter.soap.app*xisoapadapter and click Edit 10. Change the Used Template to the one previously created 11. Click Save Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 18

19 5.6 Enable mapping client certificates to user IDs in UME 1. Open the NWA and click in the menu Configuration Infrastructure Java System Properties 2. Click in the Service Tab Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 19

20 3. Search for the service *user* and select the service User Management Engine 4. Search for the property ume.logon.allow_cert 5. Change the value of the property to true by clicking in the modify button and click Set Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 20

21 6. Click in the Save button 7. Restart the JAVA stack 5.7 Maintain user certificate information 1. Connect to the UME on the JAVA stack of SAP PI using the following URL Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 21

22 2. Search for the user that will be used as service account in PI to connect from SAP Cloud for Customer to SAP PI 3. Select the account, click in the Certificates tab Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 22

23 4. Click modify and browse from the certificate that was exported from the and upload the certificate 5. Once uploaded click on the Save button 5.8 Export client x.509 certificate from inbound communication arrangements from SAP Cloud for Customers 1. Logon to the using the following URL Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 23

25 4. Click in Communication Arrangements under Integration Section 5. Open for Edit any of the communication arrangements that were already configured by selecting it and clicking on Edit Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 25

26 6. Click in the Technical Data tab 7. In the Inbound communication click in the Edit Credentials button 8. Click in the Certificate tab and then click in Create and Download Key Pair Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 26

27 9. Select the location where you want to save the keypair and click Save 10. Enter a password to secure the PKCS12 certificate and click OK 11. Click OK 12. Click in Save and Reactivate button to save the communication arrangement Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 27

28 5.9 Create a view in the Key Storage 1. Logon to the NWA of the SAP PI system using the following URL 2. Click in the Configuration Tab and then on Certificates and Keys 3. Click in the Add View button Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 28

29 4. Enter a name, description and click create 5.10 Load certificate into view on NWA 5. Having select the view created in the previous step click in Import Entry Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 29

30 6. Select the entry type PKCS#12 Key Pair, select the file and enter the password use while the key pair was created from the, then click Import 5.11 Adjust PI Receiver communication channel to use certificates. 1. From the Integration Builder open all the receiver communication channel that point to the SAP Cloud for Customers and adjust the authentication checking the option Configure Certificate Authentication 2. From the dropdown button select the KeyStore Entry that was imported and KeyStore View created in the previous steps 3. Save and activate the changes in the communication channel Step-by-Step Procedure 2014 SAP AG or an SAP affiliate company. All rights reserved. 30

31 SAP AG or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Please see index.epx for additional trademark information and notices.