The following sections cover the installation and configuration of SNC.
Extract the contents of the SAP Cryptographic Library installation package.
Copy the library file and the configuration tool (sapgenpse.exe) to the directory specified by the application server's profile parameter DIR_EXECUTABLE.
In the following example, this directory is represented with the notation $(DIR_EXECUTABLE).
Windows NT:
DIR_EXECUTABLE: <DRIVE>:\usr\sap\<SID>\SYS\exe\run\
Location of SAP Cryptographic Library: <DRIVE>:\usr\sap\<SID>\SYS\exe\run\sapcrypto.dll
Check the file permissions for the SAP Cryptographic Library. Make sure that <sid> adm (or SAPService <SID> under Windows NT) is able to execute the library's functions.
Copy the ticket file to the sec sub-directory in the instance directory $(DIR_INSTANCE).
Windows NT:
DIR_INSTANCE: <DRIVE>:\usr\sap\<SID>\<instance>
Location of the ticket: <DRIVE>:\usr\sap\<SID>\<instance>\sec\ticket
Set the environment variable SECUDIR to the sec sub-directory.
The application server uses this variable to locate the ticket and its credentials at run-time. If you set the environment variable using the command line, then the value may not be applied to the server's processes. Therefore, setting SECUDIR in the start-up profile for the server's user or in the registry (Windows NT) is recommended.
These instructions are available at http://help.sap.com/saphelp_erp2004/helpdata/en/96/709b3ad94e8a3de10000000a11402f/frameset.htm
Start transaction RZ10 and select the instance profile used by the server start-up.
Add the instance parameter "snc/identity/as".
Set the instance parameter "snc/identity/as" to the specific name of the server.
For example: "snc/identity/as p:CN=IDS, OU=IT, O=CSW, C=DE" (Do not forget to add "p:" in front of the name, as shown below).
While specifying the distinguished name for your Client/Server PSE "CN=xx, OU=xx, O=xx, C=xx", the cryptographic tool validates the country code for the "C=xx" attribute.
This example shows an X.500 Name. It is formed from different elements that represent a hierarchical name space. Where CN = Common Name, OU = Organizational Unit, O = Organization and C = Country.
Restart your server.
After restarting your server you can now create the SNC PSE.
Start the STRUST transaction, right click on "SNC (SAPCryptolib)," and choose Create.
Accept the SNC ID which is taken from the instance parameter "snc/identity/as."
Double click "SNC (SAPCryptolib)" and choose "Assign Password" to add a password for the "SNC (SAPCryptolib)" PSE.
Type in a password.
The Password can contain both letters and numbers. Without the password the server would not start when you set the instance parameter "snc/enable" to 1.
Save the settings.
Start transaction RZ10 and select the instance profile used by the server start-up.
Set the parameters as listed in the table below.
Setting the profile parameter snc/enable to 1 activates SNC on the application server. If this parameter is set but the SNC PSE and credentials do not exist, then the application server will not start. Therefore, setting the SNC parameters should be the last step in the configuration procedure.
These values will enable you to connect to the system without encryption.
Save the settings.
Restart the application server again.
To use SNC for securing connections that connect via the SAP gateway, you also need to set the appropriate parameters in the gateway profile. The gateway itself does not directly use the routines from the security product; however, it does supply the SNC configuration parameters to the programs that it starts. Release 3.1 does not offer SNC protection for the RFC and CPIC communication protocols. In Release 3.1, you need to set the profile parameter snc/permit_insecure_comm to the value "1".
The rest of the description in this section applies only as of Release 4.0.
The following profile parameters are relevant for the gateway settings:
snc/enable — For a gateway to accept SNC-protected connections, you need to set the profile parameter snc/enable to the value 1. The gateway then knows that an SNC environment is in operation and takes the following precautions: - In addition to the standard port (sapgw<nn>), it opens a "secured" port (sapgw<nn>s), where it accepts only connections that use SNC protection. - It starts programs only when SNC protection for the communication is used. You may explicitly allow the starting of programs without using SNC protection by setting the parameter snc/permit_insecure_start (see the description below)
snc/gssapi_lib — As with the application server, if snc/enable = 1, then the parameter snc/gssapi_lib must contain the path and file name of the external library. The gateway passes this information to the external programs that it starts.
snc/permit_insecure_start (snc/permit_insecure_comm in Release 3.1) — If snc/enable = 1, then the gateway does not start or register any external programs without using SNC-protected communications (as default). You can explicitly override this configuration by setting the parameter snc/permit_insecure_start to the value "1". The gateway will then start or register programs even if SNC protection is not used for the communication. The parameter is only necessary if programs without SNC protection are to be directly started by or registered on the gateway. If the gateway is started directly on an application server, it uses the application server's profile settings. In this case, the parameters snc/enable and snc/gssapi_lib are set in the application server's profile. For the gateway, you then only need to consider the parameter snc/permit_insecure_start (or snc/permit_insecure_comm). If a gateway is to be started independent of the SAP System application server ("Stand Alone Gateway"), then you need to consider all of the above mentioned parameters.
Create a directory on your system to store the PSE.
Copy the ticket license file and the SAP Certified Client Cryptographic library (ex. SECUDE) to the directory you just created.
Make sure you set the SECUDIR environment variable to this directory, copy the library to a different directory, and add this path to your "PATH" environment variable.
Execute the following command to generate the PSE
The client PSE is named as RFC.pse. From the command line, you can specify the distinguished name. For example: "CN=RFC, OU=IT, O=CSW, C=DE"
> sapgenpse gen_pse -v -p RFC.pse
Got absolute PSE path "<your path>/RFC.pse".
Please enter PIN: ********
Please reenter PIN: ********
get_pse: Distinguished name of PSE owner: CN=RFC, OU=IT, O=CSW, C=DE
Supplied distinguished name: "CN=RFC, OU=IT, O=CSW, C=DE"
Generating key (RSA, 1024-bits) ... succeeded.
certificate creation... ok
PSE update... ok
PKRoot... ok
Generating certificate request... ok.
PKCS#10 certificate request for "<your path>/RFC.pse"
Execute the following command to export the Client Certificate of the newly created PSE.
The exported certificate is named as RFC.crt.
> sapgenpse export_own_cert -v -p RFC.pse -o RFC.crt
Opening PSE your path>/RFC.pse"...
No SSO credentials found for this PSE.
Please enter PIN: ********
PSE open ok.
Retrieving my certificate... ok.
writing to file ...... ok
Import the Client Certificate to Server PSE.
You can import the client Certificate via Transaction STRUST.
Export the Server Certificate.
Export the Server Certificate via the Transaction STRUST.
Import the Server Certificate to the Client PSE
On the command line run:
> sapgenpse maintain_pk -v -a SNC.crt -p RFC.pse
Opening PSE your path>/RFC.pse"...
No SSO credentials found for this PSE.
Please enter PIN: ********
PSE open ok.
Adding new certificate from file "SNC.crt"
----------------------------------------------------------------------------
Subject : CN=IDS, OU=IT, O=CSW, C=DE
Issuer : CN=IDS, OU=IT, O=CSW, C=DE
Serialno: 00
KeyInfo : RSA, 2048-bit
Validity - NotBefore: Wed Mar 6 21:37:32 2008 (060927193732Z)
NotAfter: Fri Jan 1 01:00:01 2038 (380101000001Z)
-----------------------------------------------------------------------------
PKList updated (1 entries total, 1 newly added)
Create the cred_v2 file.
After setting up the client PSE you must create a file called cred_v2 which is used to securely give the RFC Program access to the PSE without providing the password for the PSE.
On the command line run:
> sapgenpse seclogin -p RFC.pse -O root running seclogin with USER="root"
creatingcredentials for yourself (USER="root")...
Please enter PIN: ********
Added SSO-credentials for PSE "<your path>/RFC.pse"
"CN=RFC, OU=IT, O=CSW, C=DE"
When you generate the cred_v2 file, the seclogin must be carried out under the account of the <sid>adm.
Allow SNC RFC Connection.
Now you need to map the x.509 certificates that were created for the user accounts on the SAP Server.
Start Transaction SM30 and enter the view VSNCSYSACL.
This view is used to restrict the SNC RFC Connections by an Access Control List (ACL). You will see an alert window pop-up, just click on the "right" symbol.
Choose "E" for the Type of ACL entry.
Enter System ID and SNC name.
Do not forget the "p:" in front of the DN.
Check the boxes according to the following figure.
Save the entry.
When trying to edit the entry, you might see an alert window pop-up. Just click on the "right" symbol and make your changes.
Map the X.509 Certificate to the User.
The X.509 Certificate must be accepted for a successful Login.