Enabling SNC on SAP Connections

Goal

Secure Network Communications (SNC) provides stronger authentication and encryption mechanisms than the default security options of SAP.

This document explains how to enable Secure Network Communications (SNC) to secure the communications between Virtual DataPort and SAP. Take into account the following:

• In Virtual DataPort, you can enable SNC on the data sources that use SAP JCo (SAP Java Connector) to connect to SAP. These are:

• BAPI data sources.

• Multidimensional data sources with the adapters “SAP BI 7.x (BAPI)” or “SAP BW 3.x (BAPI)”.

SNC cannot be enabled in multidimensional data sources with the adapters “SAP BI 7.x (XMLA)” or “SAP BW 3.x (XMLA)”.

• SNC is used to secure the communications (Privacy Protection). However, the authentication of users is performed using their username and password and not their certificate.

Content

In the host where the Virtual DataPort server is installed, execute these steps:

1. Open a command line and execute the following commands to create the Personal Security Environment (PSE) file:

Note: For environments where Systemd used to start the Virtual DataPort server as a service. Add the assignment directly on to the service directive to ensure this environment variable is available for the process. This variable points to the location of the libraries and credentials file which is required for authentication and Virtual DataPort server process should be able to access it.

You will see something like the following and at the end of the process, you will obtain the pse file.

You will have to provide the PIN and the distinguished name (DN) of the user.

2. Export the pse file to a crt file:

3. Assign credentials to the user account that you will use for running Virtual DataPort server:

        For example,

        You will see something like:

Note: if user exists only in the system (it does not belong to a Windows domain), then execute:

4. Open SAP GUI and log-in.

5. Import the client certificate into SAP. To do this, follow these steps:

1. Start the transaction STRUST.

2. On the left side of the dialog, expand the node SNC SAPCryptolib and double-click on the server where you want to install the crt certificate generated in the previous steps.

3. If the certificate does not exist for this SAP Server, do the following:

1. Right-click System PSE 

2. Click Display <-> Change to enable the “Create” option.

4. Import the certificate by clicking the button , at the bottom of the dialog and select the file denodo_SAPSSLS.crt created before.

5. Click Add to Certificate List to add the imported certificate to the list of certificates of the System PSE. Now, the certificate will appear at “Certificate List” table.

6. Start the transaction SNC0. You will see a dialog like the following:

1. Click New entries. You will see a dialog like the following:

2. In the SNC Name box, enter the Distinguished Name (DN) you provided in the first step.

3. Select, at least, the Entry for ext. ID activated check box.

4. Click the Save button:

7. Go back to the STRUST transaction and do the following:

1. Expand the node SNC SAPCryptolib and double-click the host where the certificate was imported.

                You will see a dialog like the following:

2. In the “Certificate List”, select the subject of the certificate you want to export.
3. Click the button  to export the certificate. Use the option Base64.
   Store it with the name dnd_out.crt.

8. In the host where the Virtual DataPort server runs, execute the following to import the server “.crt”:

        You will see something like this:

9. In Virtual DataPort, open the configuration of the BAPI data source or a multidimensional data source with a BAPI adapter.

The user account used in the data source is a regular SAP user account without any special configuration. To see the SNC configuration of a user, do the following:

1. In SAP GUI, start the transaction SU01.

2. Enter the name of a user and click the “Display” icon: .

3. Then, click the tab SNC to see the SNC configuration for that particular user.  You will see a dialog like the following:

10. In Virtual DataPort, in the dialog to configure the data source, click Advanced and follow these steps (the steps to enable SNC are the same for both types of data sources):

4. Enter the path to the SAP Cryptographic Library. That is, the path to the file sapcrypto.dll (if the Server runs on Windows) or to libsapcrypto.so (if the Server runs on Linux). You can download this library from the SAP website.

5. Enter the Partner name. That is, the distinguished name of the SAP server. For example, p:CN=SNC,CN=ERP.

6. Select the Security level. SAP offers three levels of configuration and in addition, you have these options:

1. Use the value from snc/data_protection/use: uses the default security level set by the SAP server.
2. Use the value from snc/data_protection/max: uses the maximum level of security offered by the SAP server.

After creating the data source, you can use a network packets analyzer (e.g. WireShark) to check that the messages are encrypted:

Appendix A: Configuration Properties of SAP

At the SAP server, the profile configuration file (in our scenario: C:\usr\sap\ERP\SYS\profile\ERP_DVEBMGS03) has to have the following properties.

The following link explains in more detail the meaning of these properties:  Profile Parameter Settings on AS ABAP.