How to Configure Message Level Security in SAP XI_3 0

7/29/2019 How to Configure Message Level Security in SAP XI_3 0

1/40

How-to Guide

SAP NetWeaver 04

How ToConfigureMessage LevelSecurity in SAP

XI 3.0Version 1.00 May 2005

Applicable Releases:

SAP NetWeaver 04


2/40

Copyright 2005 SAP AG. All rights reserved.

No part of this publication may be reproduced ortransmitted in any form or for any purpose without the

express permission of SAP AG. The information

contained herein may be changed without prior notice.

Some software products marketed by SAP AG and its

distributors contain proprietary software components of

other software vendors.

Microsoft, Windows, Outlook,and PowerPoint

are

registered trademarks of Microsoft Corporation.

IBM, DB2, DB2 Universal Database, OS/2, Parallel

Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400,

iSeries, pSeries, xSeries, zSeries, z/OS, AFP, Intelligent

Miner, WebSphere, Netfinity, Tivoli, and Informix are

trademarks or registered trademarks of IBM Corporation

in the United States and/or other countries.

Oracle is a registered trademark of Oracle Corporation.

UNIX, X/Open, OSF/1, and Motif are registered

trademarks of the Open Group.

Citrix, ICA, Program Neighborhood, MetaFrame,

WinFrame, VideoFrame, and MultiWinare trademarks

or registered trademarks of Citrix Systems, Inc.

HTML, XML, XHTML and W3C are trademarks or

registered trademarks of W3C, World Wide Web

Consortium, Massachusetts Institute of Technology.

Java is a registered trademark of Sun Microsystems, Inc.

JavaScript is a registered trademark of Sun Microsystems,Inc., used under license for technology invented and

implemented by Netscape.

MaxDB is a trademark of MySQL AB, Sweden.

SAP, R/3, mySAP, mySAP.com, xApps, xApp, SAP

NetWeaver, and other SAP products and services

mentioned herein as well as their respective logos are

trademarks or registered trademarks of SAP AG in

Germany and in several other countries all over the

world. All other product and service names mentionedare the trademarks of their respective companies. Data

contained in this document serves informational

purposes only. National product specifications may vary.

These materials are subject to change without notice.

These materials are provided by SAP AG and its affiliated

companies ("SAP Group") for informational purposes

only, without representation or warranty of any

kind, and SAP Group shall not be liable for errors or

omissions with respect to the materials. The only

warranties for SAP Group products and services are those

that are set forth in the express warranty statements

accompanying such products and services, if any.

Nothing herein should be construed as constituting an

additional warranty.

These materials are provided as is without a warranty

of any kind, either express or implied, including but not

limited to, the implied warranties of merchantability,

fitness for a particular purpose, or non-infringement.

SAP shall not be liable for damages of any kind including

without limitation direct, special, indirect, or

consequential damages that may result from the use of

these materials.

SAP does not warrant the accuracy or completeness of

the information, text, graphics, links or other items

contained within these materials. SAP has no control

over the information that you may access through the

use of hot links contained in these materials and does not

endorse your use of third party web pages nor provide

any warranty whatsoever relating to third party web

pages.

SAP NetWeaver How-to Guides are intended to

simplify the product implementation. While specific

product features and procedures typically are explained

in a practical business context, it is not implied that those

features and procedures are the only approach in solving

a specific business problem using SAP NetWeaver. Shouldyou wish to receive additional information, clarification

or support, please refer to SAP Consulting.

Any software coding and/or code lines / strings (Code)

included in this documentation are only examples and

are not intended to be used in a productive system

environment. The Code is only intended better explain

and visualize the syntax and phrasing rules of certain

coding. SAP does not warrant the correctness and

completeness of the Code given herein, and SAP shall

not be liable for errors or damages caused by the usage of

the Code, except if such damages were caused by SAPintentionally or grossly negligent.


3/40


4/40

Table of Contents

1 Scenario................................................................................................................1 2 Introduction ...........................................................................................................2

2.1 Important SAP Notes....................................................................................22.2 History of Changes.......................................................................................2

3 The Step By Step Solution....................................................................................33.1 Configuring Web service security in the ABAP stack...................................33.2 Configure Web Service Security in the Java Stack......................................53.3 Configure Business System PCK.................................................................83.4 Configure Business System IS...................................................................143.5 Configuring Message Archiving for the IS and PCK...................................19

4 Appendix.............................................................................................................234.1 Apply the JCE Unlimited Strength Jurisdiction Policy.................................234.2 Deploy the Cryptographic Library IAIK on the IS........................................234.3 Troubleshooting..........................................................................................23 4.4 Roundtrip Configuration .............................................................................24

4.4.1 Integration Directory ...............................................................................254.4.2 Partner Connectivity Kit ..........................................................................30

4.5 References.................................................................................................34


5/40

- 1 -

1 Scenario

If messages are exchanged between the SAP Partner Connectivity Kit (PCK) and theIntegration Server (IS) over unsecured networks, for example the Internet, it should be

ensured that the messages can neither be read nor changed by a third party. In additionto communication channel encryption (HTTPS protocol), it is possible to digitally signand/or encrypt the message. Signing/encryption of messages is known as message levelsecurity (MLS).

This guide describes the implementation of MLS between the PCK and the IS as partof SAP Exchange Infrastructure (XI) 3.0.

Message level security can be used for the XI-XML protocol, that is, for communicationbetween

PCK and IS

IS and IS (SAP XI and SAP XI)Besides the message level security for the XI-XML protocol, it is possible to exchangemessages between SAP XI and other components in a secure manner using differentadapters, for example the RNIF adapter. For more information, see SAP Help Portal athelp.sap.com/nw04 Process Integration SAP Exchange Infrastructure Runtime

Connectivity Adapters.

The step-by-step example describes how Party A sends messages from the PCK usingthe XI-XML protocol to the IS, and how message level security is used to sign/encryptthe message. The way the message is forwarded to Party B can be configuredaccordingly.


6/40

- 2 -

2 Introduction

This How-To Guide helps SAP XI and security experts to enable MLS quickly. For moreinformation, see the SAP Exchange Infrastructure Security Guide available on ServiceMarketplace at service.sap.com/securitySecurity in DetailSAP Security Guides

To set up the example scenario using message level security described in this guide, thefollowing prerequisites must be fulfilled:

SAP PCK is installed

Refer to the Installation Guide SAP Partner Connectivity Kit, available onService Marketplace at service.sap.com/instguidesNW04Installation

SAP XI 3.0 SP09 or higher is installed

The JCE file has been applied to the corresponding JRE (see appendix)

The cryptographic library IAIK has been deployed on the J2EE Engine of the ISand the PCK (see appendix)

For message level security, the transport protocol between the PCK and the IS does notnecessarily have to be HTTPS/SSL. To be able to send and receive messages usingHTTPS/SSL, the SAP J2EE Engine of the PCK and the ABAP stack of the IS must beconfigured to support HTTPS. For more information, see SAP Help Portal athelp.sap.com/nw04SecurityNetwork and Transport Layer SecurityUsing the

Secure Sockets Layer Protocol with the SAP Web AS ABAP Transport Layer Security on theSAP J2EE Engine

Note that encryption of messages is only supported with SAP NetWeaver 04 SP9 or higher.

2.1 Important SAP Notes

SAP Note Number Title

713508 SAP XI: Message Security Settings

Check regularly which SAP Notes are available.

2.2 History of Changes

Make sure you use the current version of this How-To Guide.

You can find the current version of this How-To Guide on SAP Service Marketplace atservice.sap.com/nw-howtoguidesSAP NetWeaverMedia LibraryHow-to

Guides Exchange Infrastructure.

The following table provides an overview of the most important changes in prior versions.

Version Important Changes

1.00 First version of document


7/40

- 3 -

3 The Step By Step Solution

Message level security is based on the Web service security services provided by the

J2EE Engine. These Web service security services are used by both the PCK and IS forsigning/validating and encrypting/decrypting messages.

Therefore, MLS configuration must be done in both the ABAP and the JAVA stack ofSAP XI 3.0.

The IS ABAP stack must be configured as a consumer for the Web servicesecurity of the J2EE Engine.

The J2EE Engine of both the PCK and the IS must be configured for MLS interms of certificates and authorization.

Archiving of messages is the last security-relevant topic described in this chapter.

The sender and receiver parties and services definition must be the same in thePCK and the IS. Party mapping is not part of this example configuration.

3.1 Configuring Web service security in the ABAP stack

The Web service security services of each J2EE Engine can be used by the IS ABAPstack for message level security. In this example, the J2EE Engine of the IS is used.

To configure Web service security in the ABAP stack of the SAP Web Application Server(SAP Web AS), follow the steps below:

1. Create and configure an RFCconnection for the Web servicesecurity services (connects IS andJ2EE).

Use transaction SM59 to create anew destination of type HTTPConnections to Ext. Server(connection type G).

Specify the following technicalsettings:

Target Host: Host name of theIS.

Service No.: HTTP/HTTPS portof the IS (Java stack).

Path Prefix: Path prefix specifiedin the following step.

Select the appropriatelogon/security settings.

If a different J2EE Engine is used,specify the corresponding host


8/40

- 4 -

name and port.

The user specified in thelogon/security settings must exist on

the J2EE Engine (see step 4).

2. Specify the path prefix for thedestination of the Web servicesecurity services.

Depending on the logon procedureor security settings, you must set thepath prefix as follows:

For the logon procedure BasicAuthentication orSend SAP logticket:

o With the SSL optiondeselected, enter thefollowing path prefix:

/wssproc/plain?style=

document

o With the SSL optionselected, enter the followingpath prefix:

/wssproc/ssl?style=do

cument

For the SSL Client Certificatelogon procedure, enter thefollowing path prefix:

/wssproc/cert?style=docu

ment

3. Configure the logical port for theWeb service security services.

The proxyCO_WSSEWSSPROCESSOR_VI_

DOCUMEN is used by theIntegration Engine to access theWeb service security services ifmessage level security is activatedin a specific sender or receiveragreement.

Use transaction LPCONFIG toconfigure the logical port byspecifying the following attributes:

Proxy class:CO_WSSEWSSPROCESSOR_VI_DOCUMEN


9/40

- 5 -

Logical port: BASIC

Description: Any description

Default port: Select the checkbox

Runtime: Select Web ServiceInfrastructure

Call parameter HTTPDestination: Enter thedestination configured above

Save and activate the logical port.

3.2 Configure Web Service Security in the Java Stack

The Web service security in the Java stack must be configured for the J2EE Engines ofboth the IS and the PCK by applying the following steps:

Generate a local keystore hosting the keys/certificates used for MLS andgenerate the actual keys/certificates as needed (step 5).

Exchange public key certificates as needed (step 7).

Additionally, in the J2EE engine used by the IS, a user for the RFC connection of theABAP stack must be created (step 4) and a security role must be assigned to this user(step 6).

Public Key Certificates

Message encryption

The sender (PCK) encrypts the message for the receiver (IS) using the receiverspublic key certificate (ISmls-cert, see Step 2). The receiver uses its own privatekey (ISmls) for decrypting the message.

Message signature

The sender (PCK) signs the message using its own private key (PCKmls). Thereceiver (IS) verifies the signature using the distinguished name of the privatekey, which is part of the Signature, and either the CAs certificate or the public

key certificate (PCKmls-cert) in case of self-signed certificates.

For message encryption and ease of use in later configuration, the certificates used formessage level security must be exchanged between the J2EE Engines of the PCK andthe IS (the latter one being the J2EE Engine that the IS ABAP stack is using for MLS).


10/40

- 6 -

1. Create a user for the RFCconnection

a. Standalone J2EE Engine

Select the service Security

Provideron the correspondingserver.

UnderUser Management,choose Create Userand enter and .

b. SAP Web AS double stack

Create the user in the ABAPstack using transaction SU01.

The user name must be at least 5characters long.

This step must be carried out onlyfor the J2EE Engine that the ISABAP stack is using for MLS.

2. Generate local keystore andkey/certificate

Root certificates are stored in the

keystore of the TrustedCA.

For private certificates, it isrecommended that you create anew keystore view.

Select the service Key Storage,choose Create View, and enterthe name of the new localkeystore view.

For the example, create the

keystore PCKlocal on the PCK

and ISlocal on the IS J2EEEngine.

Create private and public keysfor the newly created view:

o Select the view and chooseEntry Create.

o Make the relevant entries asshown below, select Storecertificate and chooseGenerate.

In the example, enter thefollowing common name and


11/40

- 7 -

entry name:

o PCKmls in the PCK

o ISmls in the IS J2EEEngine

3. Assign security roles

Use the J2EE Visual Administratoron the IS J2EE Engine to assignsecurity roles as follows:

Select the service SecurityProvideron the correspondingserver.

UnderPolicy Configurationselect the component

sap.com/tc~sec~wssec~app

*wssprocess.jar

Assign the security roleWSSecurityProcessingto theuser you specified in the above-maintained RFC destination forlogging on to the IS.

Assign the security roleKeystoreAdministratorof thenewly generated keystore view(for example, ISlocal) to the you specified inthe above-maintained RFCdestination for logging on to theIS:

o Select the serviceSecurity Provider

o UnderComponentsselect keystore view, forexample keystore viewISlocal

o Select tab page SecurityRoles

o Select security roleKeystoreAdministrator

o Select radio buttonSecurity

o Add user

If the private key and public root

certificate of any keystore vieware not contained in the


12/40

- 8 -

TrustedCA or DEFAULT view,assign the security roleKeystoreAdministratorof thiskeystore view component to theuser you specified in the above-maintained RFC destination.

4. Exchange public key certificates

For message encryption ordecryption and signature validationconfiguration, the public keycertificates must be exchangedbetween the PCK and the IS J2EEEngine. If a message is sentencrypted from the PCK to the IS,the PCK encrypts the messageusing the public key certificate of

the IS.

In the J2EE Visual Administratornavigate to ServerKeystore andselect the corresponding keystoreview.

Export

In the Entry section, select thecertificate to be exported. Next,choose Export, and save thecertificate to the hard disk of

your J2EE Engine server.

For the example, export:

o PCKmls-cert on the PCK

o ISmls-cert on the IS

J2EE Engine

Import

After physically copying thecertificates from one server tothe other, choose Loadand

import the certificates.For the example, import:

o ISmls-cert on the PCK

o PCKmls-cert on the IS

J2EE Engine

3.3 Configure Business System PCK

Party A sends files from a file system File System A to its business partner Party XI.

The following configuration objects are required on the PCK: Sender


13/40

- 9 -

o The sender collaboration profile including party, service, channel (Fileadapter in this example).

o Sender agreement (SA1)

Receiver

o The receiver collaboration profile including party, service, communicationchannel (XI adapter in this example).

Message level security will be activated in the communication channel.

o Receiver Agreement (RA1)

Message level security is configured in the sender agreement.

For more information about configuring the PCK, see SAP Help Portal athelp.sap.com/nw04 SAP NetWeaver Process Integration SAP Exchange

Infrastructure Runtime Connectivity Partner Connectivity Kit

1. Access the PCK configuration tool

Call the PCK by entering

http://:/pck/start in your Web browser.

Choose Configuration PCK(youmay need to set the proxy inJava Web Start to NONE).

EnterUser Name and Passwordfor the SAP J2EE Engine.


14/40

- 10 -

2. Configure the communication fromthe file system to the PCK

To enable the file system toexchange data with the IS, you must

create the following objects in thePCK:

Party and service for File System Athat sends the files with acommunication channel of typeSenderand FILE to the PCK.

Create a Communication PartyParty, for example PartnerA

Create the correspondingService, for example FileService

Create a SenderCommunication Channel toconfigure the File adapter:

o Enter the correspondingPartyand Service.

o Enter a name for theCommunication Channel, forexample FileIn, and chooseCreate.

o Select File as adapter type.

o Select Sender.

o Enter the appropriate data toconfigure the File adapter,for example, SourceDirectory, Filename and soon.


15/40

- 11 -

3. Create the receiver communicationparty

Create a Communication PartyParty, for example PartnerXI.

Create the correspondingService, for example SR4.

Create a ReceiverCommunication Channelof typeXIto configure the connectionbetween the PCK and the IS.

o Enter the corresponding

Partyand Service.o Enter a name for the

Communication Channel, forexample XI, and chooseCreate.

o SelectXIas the adaptertype.

o Enter the appropriate data toconfigure the XI adapter.

Select Receiver.

Transport Protocol.


16/40

- 12 -

Select theXIas themessage protocol..

UnderURL, enter the IStarget URL:http(s)://

:/sap/xi/engine?type=entry

User Name

Password

Language

Client

To enable message levelsecurity, select MessageSecurity.


17/40

- 13 -

4. Create the sender agreement

Define a Sender Agreementfor theabove-specified sender andreceiver parties.

Enter appropriate values forInterface and Namespace.

Select the File adaptercommunication channel, for

example FileIn, as the SenderCommunication Channel.


18/40

- 14 -

5. Define the receiver agreement andconfigure message level security

Define a Receiver Agreementforthe above-specified sender and

receiver parties. Specify Interface and

Namespace. Asterisks (*) canbe used for the ReceiverAgreement.

Select the XI adapter as theReceiver CommunicationChannel, for example XI.

IfMessage Securityis chosen in

the communication channelconfiguration, message levelsecurity must be configured.

o In the Security Profile field,select whether the messageshould be signedorencryptedorsigned andencrypted.

o Certificate for Signature

Select the keystore, for

example PCKlocal, and thecertificate, for example

PCKmls-cert, created for

the PCK.

o Certificate for Encryption

Choose the keystore, for

example PCKlocal and the

imported certificate, for

example ISmls-cert, from

the receiver.

3.4 Configure Business System IS

The message from Party A is transferred to the IS of Party XI. Party XI might forward themessage to Party B (not part of this guide).


19/40

- 15 -

To receive the message, the following objects are required in the IS:

Party and service of Party A, which sends the message. If there is a signatureand you want it to be validated or if the message needs to be decrypted, youmust also define a communication channel of type Sender and XIand acorresponding sender agreement (SA2).

To forward the message to a receiver, the following objects need to be created in theIS. These objects are not part of this guide. Refer to the appendix for the roundtripconfiguration.

Party and service of Party B, which receives the message. You must define acommunication channel of type Receiver and XI.

A receiver determination (RD) to determine the receiver of the message.

An interface determination (ID) to define the inbound interface for the outboundinterface of the sender.

A receiver agreement (RA3) to transfer the message from the IS to the PCK ofParty B.


20/40

- 16 -

1. Access the Integration Directory (onthe IS)

Call the IS by enteringhttp://:/rep

in your Web browser. Choose Integration Directory

(you may need to set the proxyin Java Web Start to NONE).

EnterUser Name and Passwordfor the SAP J2EE Engine orABAP stack.

2. Create and configure a new

scenario (optional)

Choose ObjectNewfrom themenu.

Choose Scenario.

Enter the relevant scenarioname and description.

Choose Create.

Save the scenario.

3. Create a sender collaborationprofile

Choose Create Object.

Create a new Party, for examplePartnerA.

Create a Business Service forthis party, for example

FileService.

Create a senderCommunicationChannel, for example FromPCK,with the following specifications:

o Adapter type:XI

o Select Sender

o Message Protocol:XI 3.0

o Select Message Security

You only have to create the


21/40

- 17 -

communication channel if youwant to apply message levelsecurity.


22/40

- 18 -

4. Create sender agreement

The sender agreement isnecessary if the message signaturemust be validated or if themessage must be decrypted.

Define Sender Party, Service,Namespace and Interface.

For message level security, thecheckbox Sender Uses VirtualReceivermust be selected.

For receiver party and service,enter at least an asterisk (*) orspecify the virtual receiver.

If a message is received fromthe PCK or from another SAP XIsystem, the receiver party andservice is set. If the checkboxSender Uses Virtual Receiverisnot selected, the senderagreement will not be taken intoaccount.

Certificate for SignatureValidation

The Issuerand the Subjectofthe certificate used for signingthe message on the sendersystem are required. If thecertificate is imported into aJ2EE Engine keystore, you coulduse the input help to select thecorrect certificate.

For the example, select the

PCKmls-cert in keystoreISlocal.

Certification Authority

Enter the keystore view thatcontains the trusted rootcertificate for the certificate usedfor signing the message. If themessage is signed with a self-signed certificate, enter thekeystore which contains theimported certificate.

For the example, enter keystore


23/40

- 19 -

ISlocal.

Certificate for Decryption

Select the private key of thecertificate which was used in the

sender system to encrypt themessage (note that thiscertificate must be imported intothe PCKs J2EE Engine).

For the example, select the

keystore ISlocal and the

private key ISmls.

5. Create a receiver collaborationprofile

For a complete scenario, it is

necessary to configure the receivercollaboration profile, the interfacedetermination, the receiverdetermination, and the receiveragreement.

However, the IS is able to acceptthe message sent by the PCK ifonly the sender collaboration profileand the sender agreement isdefined as shown in the previousstep.

If you send messages to the ISwithout a receiver, configuredmessage level security is applied tothe message, but you will receivethe error OUTBOUND_BINDING_NOT_FOUND.

You find the receiver configurationin the appendix.

3.5 Configuring Message Archiving for the IS and PCKTo enable message archiving for the PCK, the following post-installation steps arerequired for the SAP XML Data Archiving Service (DAS) of the SAP J2EE Engine:

Configuration of the XML DAS administration destination

Definition of the archive store

Synchronization and display of the home path of archiving objects


24/40

- 20 -

1. Configuration of the XML DASadministration destination

Use the Destinations service of theJ2EE Visual Administrator of the

PCK to configure an HTTPdestination for the XML DASadministration by specifying thefollowing values:

Name: DASdefault

URL:http://:/DataArchivingService/DAS

Authentication: BASIC

User name: XMLDAS

Password: XMLDAS

You must use this user andpassword combination at present.

Save and check that theDestinations service is activated.

2. Definition of an archive store

To define an archive store, perform

the following steps:

Launch the XML DAS using theURL and logon data maintainedfor the HTTP destination above.

Choose Define Archive Storesand then choose Newandspecify the following parameters:

o Archive Store

Name of your archive store,for example, Archive Stores.

o Storage System

Name of your storagesystem, for example AS1.

o Store Type

Select File System.

o WebDAV Root or Win Root

If your SAP J2EE Engineruns on a Windows operatingsystem, enter the archive filepath as, for example,C:\Archive. This folder must


25/40

- 21 -

have been created on the filesystem beforehand.

o Unix Root

If your SAP J2EE Engineruns on a Unix or Linuxoperating system, enter thearchive file path as, forexample,/usr/sap/Y6D/home/arc

hive. This folder must have

been created on the filesystem beforehand.

o Proxy Host

Leave this parameter empty.

o Proxy Port

Leave this parameter empty.

Choose Insert Archive Store,return to Home, and test yournew archive store by choosingTest Archive Stores.

3. Synchronization and display of thehome path of archiving objects

To synchronize and display thehome path of archiving objects,perform the following steps:

Choose Synchronize Home Path

and enter the followingparameters:

o Home Path

Enter the archive path.

o Action

Select Insert New HomeCollection.

o Context

Enter any context name.

o Archive Store


26/40

- 22 -

Select the archive storecreated above.

Choose Execute. A successmessage will appear.

Choose List Archive Paths toverify that your home path isassigned to your archive store.

Call the Message Display Tool athttp://:/mdt

and authenticate with userAdministratorfor the SAP J2EEEngine of the PCK.

Choose Security Archiving.

Set the archiving settings (forexample, the archiving Interval)according to your efforts.


27/40

- 23 -

4 Appendix

4.1 Apply the JCE Unlimited Strength Jurisdiction Policy

The JCE file has been applied to the corresponding JRE. Therefore, exchange thefollowing files in directory \jre\lib\security with the respective files you candownload from http://java.sun.com.

US_export_policy.jar

local_policy.jar

4.2 Deploy the Cryptographic Library IAIK on the IS

The IAIK software can be downloaded from the SAP Service Marketplace atservice.sap.com/swdc DownloadSAP Cryptographic Software.

Extract the included car file.

Deploy the _sec_java_crypto_signed_fs_lib_630SP1.sda file with the SoftwareDeployment Manager (SDM).

For more information, see SAP Help Portal at help.sap.com/nw04Security

Network and Transport Layer SecurityTransport Layer Security on the SAP J2EE

Engine Configuring the Use of SSL on the SAP J2EE Engine Deploying the SAPJava Cryptographic Toolkit.

4.3 Troubleshooting

Basically the following monitoring tools and log files are of interest for troubleshootingmessage level security:

PCK

o Message Monitoring Tool

For messages in state WAIT, see Chapter 3.2. These aremessages that are rejected by the IS, for example, because ofmissing authorization for the Web service security services or forthe keystore on the J2EE Engine.

Choose Error Logto show errors for messages that have not yetbeen processed by the messaging system and therefore not yet

shown in the message monitor directly.o Default Trace

If errors occur during the message level security processing, theyare traced in the default trace file. Use the J2EE VisualAdministratorLog Viewerservice to access the default trace.

Integration Engines J2EE Server

o Message monitoring tool, transaction SXMB_MONI

Verify that the sender agreement was taken into account thatcontains the message level security configuration. For an inboundmessage, two additional attachments are created:

MessageLevelSecurityBinaryStream


28/40

- 24 -

MessageLevelSecurityXML

If these attachments are missing, the sender agreement has notbeen found by the IS.

o Security Log

All security-relevant logs and traces are written into the securitylog. Access the security log by using the J2EE VisualAdministrators Log Viewer.

1. Missing authorization for

As described in Step 3, the userspecified in the ABAP RFCdestination that points to the J2EEEngines Web security servicesneeds authorization for the Web

service security itself and for thekeystore.

If the keystore authorization is notsufficient, the message sent fromthe PCK with MSL is rejected by theIS.

In the message monitoring tool ofthe PCK, you find a correspondingentry Received Response Code500.

In the J2EE security log of theIntegration Engine you find theexception shown here. Access thelog file by using the log viewer(which is part of the J2EE Visual

Administrator), section Cluster

Server

/JC

j2ee/cluster/server0 log

system security.log.

4.4 Roundtrip Configuration

To complete the roundtrip, the message is sent from the IS to the PartnerB businessservice PCK. On the PCK, the message is then routed to the File adapter.

For this purpose, several configuration objects have to be created in the IntegrationDirectory and in the receiving PCK:

Integration Directory

o Collaboration profile for PartnerXI and PartnerBo Logical routing objects


29/40

- 25 -

o Collaboration agreement

PCK

o Collaboration profile for PartnerA and PartnerB

o Collaboration agreement

4.4.1 Integration Directory

2. Access the Integration Directory

Call the PCK by enteringhttp://:/rep

/start in your Web browser.

Choose Integration Directory.

Enter your user name andpassword.

3. Collaboration profile PartnerXI

Since PartnerXI is configured asreceiver in the sender PCK, thecollaboration profile of PartnerXImust be created in the Integration

Directory.

Create Party, for examplePartnerXI.

Create Business Service, forexample SR4.

Assign Inbound Interface to thebusiness service, for example,http://test.as/simpleTests,SimpleInterfaceIn.

The interface can be created inthe Integration Repositorybeforehand.


30/40

- 26 -

4. Collaboration profile PartnerB

The receiver should be PartnerBrather than PartnerXI. The ISshould only route the message tothe correct receiver.

Create Party, for examplePartnerB.

Create Business Service, forexample PCK.

Assign Inbound Interface to thebusiness service, for example,http://test.as/simpleTests,SimpleInterfaceIn.

Create a senderCommunicationChannelof type XI, for exampleToPCK.

oAdapter Type XI

o Select Receiver

o Transport Protocolcan be

either HTTP or HTTPSo Message ProtocolXI 3.0

oAddressing Type can beeitherURL Address orHTTPDestination.

If you choose URL Address,enterTarget Host, ServiceNumber, and Pathaccordingly.

If you choose URL Address,

select Use Logon Data forNon-SAP System for the


31/40

- 27 -

Authentication Type.

User Name

User configured in PCKas receiver user, normally

pckreceiver.

Password

o If you want to use messagelevel security between the ISand the PCK, selectMessage Security.


32/40

- 28 -

5. Logical routing objects

Interface determination

Sender Party, for examplePartnerA

Sender Service, for exampleFileService

Interface, for exampleSimpleInterfaceOut

Namespace, for examplehttp://test.as/simpleTests

Receiver Party, for examplePartnerB

Receiver Service, for example

PCK

Configured Inbound Interface,for examplehttp://test.as/simpleTests,SimpleInterfaceIn

Receiver determination



Interface, for exampleSimpleInterfaceOut


Check Sender uses virtualReceiver

Receiver Party, for examplePartnerXI


SR4

Configured Receivers, forexample PartnerB, PCK


33/40

- 29 -

6. Collaboration agreement

Create a receiver agreement



Receiver Party, for examplePartnerB


PCK

Interface, for exampleSimpleInterfaceIn



34/40

- 30 -

4.4.2 Partner Connectivity KitEnsure that the JCE Unlimited Strength Jurisdiction and the SAP Cryptographic libraryIAIK are deployed on the receiver PCK; refer to the appendix for more details.

Exchange the Public Key Certificates used for Signing and Encrypting Messagesbetween the ISs J2EE Engine and the PCK as described in Step 4.

7. Access the PCK Configuration Tool

Call the PCK by enteringhttp://:/pck

/start in your Web browser.

Choose Configuration PCK (youmay need to set the proxy inJava Web Start to NONE).

Enter User Name and Passwordfor SAP J2EE Engine.


35/40

- 31 -

8. Collaboration Profile PartnerA

If message level security isconfigured between the IS and thereceiving PCK, the collaboration

profile of PartnerA must beconfigured in the receiving PCK aswell, because MLS is activated inthe communication channel andconfigured in the senderagreement.

Create Party, for examplePartnerA.

Create Service, for exampleFileService.

Create a senderCommunicationChannelof type XI.

o Select Sender.

o Select Message Security.


36/40

- 32 -

9. Collaboration profile PartnerBPartnerB is the receiver of themessage; the message should berouted to the File adapter.

Create Party, for examplePartnerB.

Create Service, for examplePCK.

The service name must be thesame as configured in theIntegration Directory.

Create a receiverCommunication Channelof typeFile Adapter.

o Select Receiver

o Configure File Adapter

Target Directory

File Name Schema Construction Mode

File Type


37/40

- 33 -

10. Collaboration agreement

The sender agreement is necessaryto configure message level security.The receiver agreement assigns theFile adapter communicationchannel to the logical routing.

Sender agreement

Sender Party, for examplePartnerA.

Sender Service, for exampleFileService.

Interface: Enter at least anasterisk (*).

Namespace: Enter at least anasterisk (*).

Sender Communication


38/40

- 34 -

Channel: Select the XI channelcreated before, for exampleFromXI.

Specify the Security Settings,for example Validate

Certificate for SignatureValidation: Select the importedpublic key certificate of the IS,

for example ISmls-cert in

Keystore PCKlocal.

Certification Authority: Selectthe keystore that contains thetrusted root certificate of thecertificate used for thesignature. In case of self-signedcertificates, as used during theexample, select the keystorewhich contains the importedpublic key certificate of the IS,

for example PCKlocal.

Receiver agreement

Receiver Party: Enter at least anasterisk (*).

Receiver Service: Enter at leastan asterisk (*).

Interface: Enter at least anasterisk (*).

Namespace: Enter at least anasterisk (*).

Sender Party, for examplePartnerB.

Sender Service: PCK

Receiver CommunicationChannel: Select the File adaptercommunication channel created

before, for example ToFile.

4.5 References

SAP Exchange Infrastructure service.sap.com/xi

SAP Partner Connectivity Kit help.sap.com/nw04SAP NetWeaverProcess

IntegrationSAP Exchange InfrastructureRuntime


39/40

- 35 -

ConnectivityPartner Connectivity Kit

SAP XI Configuration Guide service.sap.com/instguidesNW04InstallationSAP XI

SAP Security Guide service.sap.com/securitySecurity in DetailSAPSecurity Guides

SAP Security Guide XI service.sap.com/security Security in Detail

SAP Security Guides SAP Exchange Infrastructure (XI)Security Guides

Digital Signatures and Encryption help.sap.com/nw04SecurityDigital Signatures andEncryption

Network and Transport Layer Security help.sap.com/nw04SecurityNetwork and TransportLayer Security

SAP Network Integration Guide service.sap.com/network


40/40

www.sdn.sap.com/irj/sdn/howtoguides

How to Configure Message Level Security in SAP XI_3 0

Documents

Transcript of How to Configure Message Level Security in SAP XI_3 0