Help Center>Foundation Help

(missing or bad snippet)

Configuring Winshuttle Foundation SAP Integration Server 11.2.12 to work with SAP Single Sign-On

Additional Information

The following instructions guide administrators through the process of configuring Winshuttle Foundation SAP Integration Server 11.2.12 and later to work with SAP SSO (Single Sign-On).

On this page

  1. Configure the 64-bit Secure Login Library on the Winshuttle SAP Integration Server machine
  2. Set the Server's Environment Variables (SECUDIR and SNC_LIB)
  3. Configure the PSE (Personal Security Environment) and certificates
  4. Configure the SAP ABAP server and import the Client Certificate
  5. Verify the configuration
  6. Completing the ABAP Server configuration

SAP Cryptolib is already setup and used as an SNCSecure Network Communication (SNC) is a software layer in the SAP System architecture that provides an interface to an external security product. SAP Systems provide basic security measures like SAP authorization and user authentication based on passwords. library on the SAP Application Server ABAPABAP (Advanced Business Application Programming) is a programming language for developing applications for the SAP R/3 system, a widely-installed business application subsystem. The latest version, ABAP Objects, is object-oriented programming. (Advanced Business Application Programming) system that the Winshuttle Foundation product is connecting to it when running SAP RFCs. We need to configure trust relationship between SAP server and Winshuttle Foundation SAP Integration Server. It will be server to server trust using sap cryptolib.

1. Configure the 64-bit Secure Login Library on the Winshuttle SAP Integration Server machine

(missing or bad snippet)

The 64-bit SLL is required to work with the Winshuttle Foundation SAP Integration Server Server Worker.

  1. On the SAPIS machine, create a directory called SNC1.
  2. Copy SLL (Secure Login Library) files into the SNC1 folder (sapcrypto, sapnwsso, slcryptokernel).
  3. Copy the sapgenpse file into the SNC1 folder.

Configure the 32-bit Secure Login Library on the Winshuttle SAP Integration Server machine

The 32-bit SLL is required to work with SAP Integration Server LaunchGUI module.

  1. In the SNC1 folder, create a sub-directory called 32BIT.
  2. Copy the 32-bit SLL files (sapcrypto, sapnwsso, slcryptokernel) into the 32BIT subdirectory .

Using the latest version of these files is recommended.

2. Set the Server's Environment Variables (SECUDIR and SNC_LIB)

(missing or bad snippet)

More information

Configure an Environment Variable Item for Windows Server (Technet)

On the Server where SAP Integration Server is installed, set the following environment variables:

  1. Go to Control Panel \System and Security\System.
  2. Click Change Settings.
  3. Go to the Advanced tab.
  4. Click Environment Variables. Set the following variables:
    • Set SECUDIR= path of SNC1 directory (C:\SNC1 is used for this example)
    • Set SNC_LIB= path of SNC1 directory (C:\SNC1 is used for this example)

3. Configure the PSE (Personal Security Environment) and certificates

(missing or bad snippet)
  1. ClosedOpen a command prompt with administrative privileges.
    1. Click Start, click All Programs, and then click Accessories.
    2. Right-click Command prompt, and then click Run as administrator.
    3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. In the command prompt, change to the C:\SNC1 directory.
  3. Run the following command to generate the PSEA personal security environment (PSE) is a secure location where the public-key information of a user or component is stored. The PSE for a user or component is typically located in a protected directory in the file system or on a smart card. (Personal Security Environment). Note: The PSE is named WS_SAPIS.pse

    sapgenpse gen_pse -v -p WS_SAPIS.pse

  4. Enter the Distinguished nameThe Distinguished Name for the SAP system is contained in the certificate that is installed on the SAP system. This is a hierarchal identifier as specified by the X.500 format. The Distinguished name is defined by adding the object's identifier to the Distinguished Name of its predecessor. for the PSE Owner.
    The Distinguished name can be CN=[machinename], C=[CountryCode] O=[Organization], OU=[Company]

Export WS_SAPIS Client Certificate

  1. In the command prompt window, run the following command to export the Client Certificate from the newly created PSE. For this example, the exported certificate is named WS_SAPIS.crt.

    sapgenpse export_own_cert -v -p WS_SAPIS.pse -o WS_SAPIS.crt

  2. Copy the certificate WS_SAPIS.crt created in the SNC1 directory to another machine. It will be copied to another directory in the next section (see below).

4. Configure the SAP ABAP server and import the Client Certificate

(missing or bad snippet)

The WS_SAPIS.crt file must be imported to the SAP Server’s Personal Security Environment so that SAP NW trusts the certificate used on Winshuttle SAPIS Server for the Winshuttle server identity.

Import the client Certificate via Transaction STRUST

(missing or bad snippet)
  1. Open the SAP Trust Manager (STRUST)
  2. Open the Node SNC (SAPCryptolib).
  3. Enter the SAPCryptolib password.
  4. Click Import certificate.
  5. Set the file format to Base64, and then select the file.
  6. Click Add to Certificate List.

In the example above, the Winshuttle SAPIS machine certificate configuration is as follows: CN=ws8-vs2012.wse.wsmain. local, C=IN, O=win, OU=WINSHUTTLE.

Export the Server Certificate of SAP server

(missing or bad snippet)
  1. Open TCode STRUST.
  2. From node SNC (SAPCryptolib), double-click your own certificate so it displays in the Certificate data/fields.
  3. Click Display change to enable the Export certificate button.
  4. Click Export certificate.
  5. Specify filename EH9 and file format as base64.
  6. Copy the exported SAP Server certificate to the to the C:\SNC1 folder created on the Winshuttle SAP Integration Server.
  7. On the Winshuttle SAP Integration Server where the certificate was imported, open a command prompt with administrative privileges.
  8. Run the following command to import the Server Certificate to the Client PSE ‘WS_SAPIS.pse’:

    sapgenpse maintain_pk -v -a EH9_SAP_Server.crt -p WS_SAPIS.pse

Create the cred_v2 file

After certificates are imported to the PSE file, you must use the file cred_v2 to securely give the RFC Program access to the PSE without providing the password for the PSE.

  1. On the Winshuttle SAP Integration Server, open a command prompt with administrative privileges.
  2. Run the following command to create the cred_v2 file using the same user credentials under which Winshuttle SAP Integration Server will run:

    sapgenpse seclogin -p WS_SAPIS.pse –O sapisadmin

    *sapisadmin = The administrator account for the SAP Integration Server

5. Verify the configuration

(missing or bad snippet)
  1. On the Winshuttle SAP Integration Server, open a command prompt with administrative privileges.
  2. Run the following command to view who registered the certificates and the name of the PSE:

    sapgenpse seclogin –l

The Certificate files status for the folder C:\SNC1 should contain the following 4 files:

  • [SAPServer].crt
  • WS_SAPIS.crt
  • WS_SAPIS.pse
  • cred_v2

6. Completing the ABAP Server configuration

(missing or bad snippet)

On the SAP ABAP Server, in Tcode snc0 set the SNC name as shown in the screenshot below.

Setup is complete.

A trust should be established between the SAP Server and Winshuttle Foundation SAP Integration Server. Code run on the Winshuttle SAPIS server can now run RFCA Remote Function Call (RFC) is the call or remote execution of a Remote Function Module in an external system. In the SAP system, these functions are provided by the RFC interface system. The RFC interface system enables function calls between two SAP systems.s on this SAP system.