HTTPS Configuration for SAP Connector 1993-2015 Informatica LLC. No part of this document may be reproduced or transmitted in any form, by any means (electronic, photocopying, recording or otherwise) without prior consent of Informatica LLC. All other company and product names may be trade names or trademarks of their respective owners and/or copyrighted materials of such owners.
Abstract This article explains how to configure SAP and Secure Agent systems for HTTPS and how to enable HTTPS when you configure SAP Table connections. After configuration, when you run Data Synchronization tasks and mappings to read SAP Table sources, the Secure Agent connects to SAP through HTTPS. Supported Versions Cloud R22 - Spring 2015 Table of Contents Abstract... 2 Supported Versions... 2 Table of Contents... 2 Overview... 2 Prerequisites... 3 Downloading OpenSSL... 3 Download the SAPGENPSE Tool... 3 HTTPS Configuration on the Secure Agent System... 3 Creating a Certificate... 3 Converting an OpenSSL Certificate to PSE format using the SAPGENPSE tool... 5 HTTPS Configuration on the SAP System... 6 Enabling the HTTPS Service on SAP System... 6 Import the Certificate to SAP System Trust Store... 6 HTTPS Configuration for the SAP Connector... 6 Enabling HTTPS while Configuring an SAP Table Connection... 6 Troubleshooting... 7 Configuring the SAP Parameters... 7 Setting Trace Level... 7 Data Synchronization Tasks or Mappings Fail with Error... 7 Overview To connect to SAP through HTTPS and read SAP table sources, you must configure the machine that hosts the Secure Agent and the machine that hosts the SAP system. You must also enable HTTPS when you configure an SAP Table connection in Informatica Cloud. 2
Prerequisites Before you configure HTTPS, make sure that you perform the SAP Table Connector administrator tasks. For information, see the SAP Table Connector Administration section in the Informatica Cloud Administrator Guide. 1. Download and install OpenSSL to a local directory on the Secure Agent machine. 2. Download and extract the SAPGENPSE tool to a local directory on the Secure Agent machine. Downloading OpenSSL 1. Download the OpenSSL binaries from https://www.openssl.org/community/binaries.html. 2. Click https://slproweb.com/products/win32openssl.html. 3. Click https://slproweb.com/download/win64openssl_light-1_0_2d.exe and save the file. 4. Run the exe file and follow the steps in the Install wizard. The openssl.exe, ssleay32.dll, libeay32.dll, and openssl.cfg files are available in the OpenSSL installation directory. Download the SAPGENPSE Tool Download the SAPGENPSE Cryptography tool as part of the SAP Cryptographic Library in the SAP Service Marketplace. For information, see Downloading the SAP Cryptographic Library. Verify the prerequisites in the document before proceeding. 1. Download the latest available patch for the SAPGENPSE tool based on the operating system on the Secure Agent machine. 2. At the command prompt, navigate to the directory that contains the SAPCAR.EXE file and the SAPCRYPTOLIB_*.SAR file. 3. Extract the SAR file. For example, enter the following command at the command prompt: sapcar.exe -xvf SAPCRYPTOLIB_39-10010895.SAR The SAPGENPSE files are extracted to the nt-x86_64 directory within the current directory. HTTPS Configuration on the Secure Agent System To configure HTTPS on the machine that hosts the Secure Agent, perform the following tasks: 1. Create a certificate using OpenSSL and JAVA KeyTool. 2. Convert the OpenSSL certificate (PKCS#12 certificate) to SAP specific format (PSE) using the SAPGENPSE tool. Currently, self-signed certificates are supported. Creating a Certificate Note: Replace variable enclosed in angle bracket with the actual value of the variable. For example, replace <rsakey_name> with the actual name you want to provide for the file. The convention applies to this entire document. To create an OpenSSL certificate, perform the following steps: 1. Set the OPENSSL_CONF variable to the absolute path to the openssl.cfg file. For example, at the command prompt, enter the following command: set OPENSSL_CONF= C:\OpenSSL-Win64\bin\openssl.cfg 2. Navigate the <openssl installation directory>\bin directory. Verify that the openssl.exe file is available in this directory. 3
3. To generate a 2048-bit RSA private key, enter the following command: openssl.exe req -new -newkey rsa:2048 -sha1 -keyout <rsakey_name>.key -out <rsakey_name>.csr 4. When prompted, enter the following values: - Private key password (PEM pass phrase). Enter a phrase that you want to use to encrypt the secret key. Re-enter the password for verification. Important: Make a note of this PEM password. You need to specify this value in some of the following steps. - Two letter code for country name. - State or province name. - Locality name. For example, you can enter the name of your city. - Organization name - Organization unit name. For example, the business unit in your organization. - Common name (CN). Mandatory. Enter the fully qualified host name of the machine that hosts the Secure Agent. - Email address. 5. Optionally, enter the following extra attributes you want to send along with the certificate request. - Challenge password. Enter a string, which is embedded in the CSR and is shared between you and the SSL issuer. If you ever need to reinstall your certificate for any reason, you will be required to enter that password for authentication. - Optional company name. A new RSA private key of 2048-bit size is created. The <rsakey_name>.key and <rsakey_name>.csr files are generated in the current location. 6. To generate a self-signed key using the RSA private key, enter the following command: openssl x509 -req -days 11499 -in <rsakey_name>.csr -signkey <rsakey_name>.key out <certificate_name>.crt 7. When prompted, enter the PEM pass phrase for the RSA private key. This is the same password you entered in step 4. The <certificate_name>.crt file is generated in the current location. 8. Concatenate the contents of the <certificate_name>.crt file and the <rsakey_name>.key file to a.pem file. - Open the <certificate_name>.crt file and the <rsakey_name>.key files in a Text editor. - Create a new file and save it as <PEM file name>.pem. - Copy the contents of the <certificate_name>.crt file and paste it in the.pem file. Copy text beginning from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----. - Copy the contents of the <rsakey_name>.key file and append it to the existing contents of the.pem file. Copy text beginning from -----BEGIN RSA PRIVATE KEY----- to -----END RSA PRIVATE KEY-----. - Save the <PEM file name>.pem file. 9. To create a PKCS#12 certificate, enter the following command at the command prompt: openssl pkcs12 -export -in <PEM file name>.pem -out <p12 file name>.p12 name domain name 4
10. When prompted, enter the following details: - PEM pass phrase for the.pem file. This is the same password you entered in step 4. - Export password that will be used to protect the P12 file. Re-enter the password for verification. Important: Make a note of this export password for the P12 file. You need to specify this value in some of the following steps and while creating the SAP Table connection in Informatica Cloud. The <p12 file name>.p12 file is generated in the current location. 11. To create a Java keystore file, enter the following command: keytool -v -importkeystore -srckeystore <p12 file name>.p12 -srcstoretype PKCS12 -destkeystore <JKS file name>.jks -deststoretype JKS -srcalias "unique alias associated with the source keystore" destalias "destination alias" 12. When prompted, enter the following details: - Password for the destination keystore, the JKS file. Important: Make a note of this password. You need to specify this password while creating the SAP Table connection in Informatica Cloud. - Password for the source keystore, the P12 file. Enter the Export password you specified for the P12 file in step 10. The <JKS file name>.jks file is generated in the current location. Important: While enabling HTTPS in an SAP Table connection, you must specify the name and location of this keystore file. You must also specify the destination keystore password as the Keystore Password and the source keystore password as the Private Key Password. Converting an OpenSSL Certificate to PSE format using the SAPGENPSE tool 1. At the command prompt, navigate to the <sapgenpse extraction directory> directory. Verify that the sapgenpse.exe file is available in this location. For example, navigate to the c:\sapgenpse\nt-x86_64 directory. 2. To generate a PSE file, enter the following command: sapgenpse import_p12 -p <directory where you want to generate the PSE file>\<pse file name>.pse <path to the P12 certificate file>\<p12 file name>.p12 3. When prompted, enter the following details: - Password for the P12 file. Enter the Export password you specified for the P12 file. - Personal identification number (PIN) to protect the PSE. Re-enter the PIN for verification. The <PSE file name>.pse file is generated in the specified directory. 4. To generate the certificate based on the PSE format, enter the following command: sapgenpse export_own_cert -p <path to the PSE file>\<pse file name>.pse -o <certificate name>.crt 5. When prompted, enter the PSE PIN number you specified in step 3 (previous step). The <certificate name>.crt file is generated in the current location. You have to import this certificate file to the SAP system. 5
HTTPS Configuration on the SAP System To configure HTTPS on the machine that hosts the SAP system, perform the following tasks: 1. Enable the HTTPS service on the SAP system. 2. Import the certificate in PSE format to SAP system trust store. Enabling the HTTPS Service on SAP System Enable the HTTPS service from the SMICM transaction. For more information, see HTTP(S) Settings in ICM. Import the Certificate to SAP System Trust Store 1. Login to SAP and go to the STRUST transaction. 2. Select the standard SSL client and specify the password. In the Import Certificate dialog, you may need to select Base64 format as the certificate file format. 3. Click the Import icon and select the <certificate name>.crt file you converted to PSE format using the SAPGENPSE tool. Note: You may need to add a DNS entry of the agent host on SAP app server if a user is on a different network. 4. Click Add to Certificate List. 5. Restart the SAP instance. For more information, see Importing the Certificate From the File System. HTTPS Configuration for the SAP Connector To enable the Secure Agent to connect to SAP through HTTPS, you must enable HTTPS and specify the keystore details when you configure an SAP Table connection. To read SAP table sources through HTTPS, specify an SAP Table connection configured for HTTPS when you create Data Synchronization tasks and mappings. Enabling HTTPS while Configuring an SAP Table Connection To configure an SAP Table connection and enable HTTPS, perform the following steps: 1. Click Configure > Connections. 2. Click New in the Connections page. The New Connection page appears. 3. Enter a name for the SAP Table connection. 4. Enter a description for the connection. 5. Select SAP Connector as the connection type. The SAP Connector Connection Properties appear. 6. Select the name of the runtime environment where you want to run the tasks. 7. Enter an SAP user name with the appropriate user authorization. 8. Enter the SAP password. 9. Enter the SAP client number. 10. Enter the language code that corresponds to the SAP language. 11. Enter the complete path to the saprfc.ini file. 12. Enter the Type A DEST in the saprfc.ini file. 6
13. Enter a range of HTTP port numbers that you can use. 14. Select Test Streaming, to test the connection with both RFC and HTTP protocol. Clear the field to test the connection with HTTP protocol. 15. Select Https Connection to connect to SAP through HTTPs protocol. 16. Enter the absolute path to the JKS keystore file. 17. To specify the destination keystore password as the Keystore Password, type the destination password specified for the.jks file. 18. To specify the source keystore password as the Private Key Password, type the Export password specified for the.p12 file. 19. Click Test to test the SAP Table connection. 20. Click OK to save the connection. Troubleshooting Configuring the SAP Parameters On the SAP system, verify that you set the following SAP parameters: icm/server_port ssl/ssl_lib sec/libsapsecu ssf/ssfapi_lib ssf/name icm/https/verify_client ssl/client_pse wdisp/ssl_encrypt Setting Trace Level 1. Logon to SAP and go to the SMICM transaction. 2. Select Goto > Trace Level > Set. 3. Enter 3 and press Enter to view detailed log. Data Synchronization Tasks or Mappings Fail with Error Data Synchronization tasks and mappings run successfully when you configure HTTPS properly. If the tasks or mappings fail, verify that you performed the following tasks correctly: Make sure that you specify the fully qualified name of the Secure Agent host machine for common name (CN) when you generate the 2048-bit RSA private key. After importing the certificate file to SAP, restart the SAP instance before running the tasks and mappings. Specify the destination keystore password as the Keystore Password when you configure the SAP Table connection. Specify the Export password of the.p12 file as the Private Key Password when you configure the SAP Table connection. Author Jyothi Jandhyala 7