Skip to Content

Secure Network Connection (SNC) is the SAP technology provided for Network and Transport Layer Security. In this Blog I will provide a how to guide how to enable data encryption for RFC connections to ABAP back ends.

How to avoid problems

  • Do only install SAP Cryptographic Library. SAP Cryptographic Library and libsapsecure will not work in parallel
  • You have to setup SNC before you can activate SNC with the parameter snc/enable = 1

Preparation

Please follow these steps of the SAP Documentation to install the SAP Cryptographic Library:

  1. Download the SAP Cryptographic Library from http://service.sap.com/download -> Download -> SAP Cryptographic Software
  2. Install the SAP Cryptographic Library
  3. Don’t forget to set the environment variable SECUDIR for the User which runs the SAP ABAP stack
  4. Now you can also set the Profile Parameters for Using SSL or use my Blog “Setup HTTPS (SSL) for the Sneak Preview SAP NetWeaver 04 ABAP Edition on Windows” to do that

Setup SNC on the ABAP Server

First we set the instance parameter “snc/identity/as” to the distinguished name the Server should get. I use “CN=IDS, OU=IT, O=CSW, C=DE”. Don’t forget to add “p:” in front of the DN:

snc/identity/as p:CN=IDS, OU=IT, O=CSW, C=DE

Create “SNC (SAPCryptolib)” PSE

After a restart of your server you can now create the SNC PSE. Start transaction STRUST or STRUSTSSO2 and right click on “SNC (SAPCryptolib)” choosing Create:

You just have to accept the SNC ID which is taken from the instance parameter “snc/identity/as”:

Please follow the next hint and add a password for the “SNC (SAPCryptolib)” PSE:

To do this double click “SNC (SAPCryptolib)” and choose “Assign Password”:

Type in a password which can contain letters and numbers:

Without the Password the Server would not start when you have set the parameter “snc/enable” to 1! Save the settings.

Set additional parameters

With the “SNC (SAPCryptolib)” PSE created we can now set this Instance Parameters:

snc/enable = 1
snc/accept_insecure_rfc = 1
snc/accept_insecure_gui = 1
snc/accept_insecure_cpic = 1
snc/permit_insecure_start = 1
snc/data_protection/min = 1
snc/extid_login_diag = 1
snc/extid_login_rfc = 1

I have chosen values which will enable you to still connect to the system without encryption. Done that, you have to restart the application server again.

Create PSE for RFC Client

I’ve decided to use a separate PSE for my RFC Client as described in Scenario 2: Using Individual PSEs for Components. To create this PSE I follow the instructions given in Creating an SNC PSE for the SAP J2EE Engine. The steps described show an example setup done on my Linux box. To test the connection I use the demo Programs coming with SAP Java Connector available at http://service.sap.com/connectors. I’ve extracted the connector in /usr/sap/jco.

Create sec directory for RFC Client PSE

To store the RFC Client PSE I create a subdirectory sec in “/usr/sap/jco/demo”:

zappod:~# cd /usr/sap/jco/demo/
zappod:/usr/sap/jco/demo# mkdir sec

Now switch to this directory and create the PSE:

zappod:~# cd sec

Create PSE

To run sapgenpse the directory containing the SAP Cryptographic Library (libsapcrypto.so on Linux) must be made available in the environment variable LD_LIBRARY_PATH:

export LD_LIBRARY_PATH=/usr/sap/jco/:/usr/sap/IDS/SYS/exe/run/

Also the just created directory “/usr/sap/jco/demo/sec” has to be set as the SECUDIR:

export SECUDIR=/usr/sap/jco/demo/sec

Before you can start creating the PSE you also have to copy the ticket license file to it:

cp /usr/sap/IDS/DVEBMGS00/sec/ticket .

Now we are ready to create the PSE:

zappod:/usr/sap/jco/demo/sec# /sapmnt/IDS/exe/sapgenpse gen_pse -v -p RFC.pse 
Got absolute PSE path "/usr/sap/IDS/DVEBMGS00/sec/RFC.pse". 
Please enter PIN: ******** 
Please reenter PIN: ******** 
get_pse: Distinguished name of PSE owner: CN=RFC, OU=IT, O=CSW, C=DE 
Supplied distinguished name: "CN=RFC, OU=IT, O=CSW, C=DE" 
Generating key (RSA, 1024-bits) ... succeeded. certificate creation... ok 
PSE update... ok 
PKRoot... ok 
Generating certificate request... ok. 
PKCS#10 certificate request for "/usr/sap/jco/demo/sec/RFC.pse":

Export Client Certificate

We have to export the Client Certificate of the just created PSE:

# /sapmnt/IDS/exe/sapgenpse export_own_cert -v -p RFC.pse –o RFC.crt 
Opening PSE "/usr/sap/jco/demo/sec/RFC.pse"... 
No SSO credentials found for this PSE. 
Please enter PIN: ******** 
PSE open ok. 
Retrieving my certificate... ok. 
writing to file ...... ok

Import Client Certificate to Server PSE

You can import the client Certificate via Transaction STRUST. First open the Node SNC (SAPCryptolib) again. You have to provide the password set before:

Click on “Import certificate”

Set the file format to Base64 and choose the file:

Finally click “Add to Certificate List”

Export Server Certificate

Now we have to export the Server Certificate. Already in the STRUST node SNC (SAPCryptolib) double click on your own certificate so it is displayed in the Certificate field. Click on Export certificate:

Choose also Base64 for the File format and provide a name for the file:

Import Server Certificate to Client PSE

That is done again on the command line:

# /sapmnt/IDS/exe/sapgenpse maintain_pk -v -a SNC.crt -p RFC.pse 
Opening PSE "/usr/sap/jco/demo/sec/RFC.pse"... 
No SSO credentials found for this PSE. 
Please enter PIN: ******** PSE open ok. 
Adding new certificate from file "SNC.crt" 
---------------------------------------------------------------------------- 
Subject : CN=IDS, OU=IT, O=CSW, C=DE Issuer : CN=IDS, OU=IT, O=CSW, C=DE 
Serialno: 00 
KeyInfo : RSA, 2048-bit 
Validity - NotBefore: Wed Sep 27 21:37:32 2006 (060927193732Z) 
NotAfter: Fri Jan 1 01:00:01 2038 (380101000001Z) ----------   
PKList updated (1 entries total, 1 newly added)

Create cred_v2 file

After we’ve now setup the RFC client PSE we have to create a file called cred_v2 which is used to securely give the RFC Program access to the PSE without providing the password for the PSE. On the command line run:

# /usr/sap/IDS/SYS/exe/run/sapgenpse seclogin -p RFC.pse -O root 
running seclogin with USER="root" creatingcredentials for yourself (USER="root")... 
Please enter PIN: ******** 
Added SSO-credentials for PSE "/usr/sap/jco/demo/sec/RFC.pse" "CN=RFC, OU=IT, O=CSW, C=DE"

Allow SNC RFC Connection

On the ABAP Server side we have now to maintain the View VSNCSYSACL which is used to restrict the SNC RFC Connections by an Access Control List (ACL). Start Transaction SM30, enter VSNCSYSACL and click Maintain. Accept the “The table is cross-client” information:

Choose “E” for the type of Type of ACL entry:

Enter System ID and SNC name. Don’t forget the “p:” in front of the DN! Check the boxes according to this screenshot:

Don’t forget to save this entry.

Map X.509 Certificate to User

To accept a X.509 Certificate for Login you have to maintain View VUSREXTID. Via this View you can setup a mapping between the Distinguished Name provided by a X.509 Certificate and an ABAP User. Start Transaction SM30, enter VUSREXTID and click Maintain. Choose DN for the External ID type:

Create a new entry and don’t forget to activate it:

Test connection

Now we have everything in place to test the connection! To login with the X.509 Certificate you have to concatenate the previously exported Certificate in one line without “—–BEGIN CERTIFICATE—–“ and “—–END CERTIFICATE—–“. All login information can be maintained in the “vericlient.properties” file in directory “/usr/sap/jco/demo. I’ve used these values:

jco.client.client=800
jco.client.x509cert=Base64 Encoded Certificate in one line 
jco.client.ashost=zappod.csw.local 
jco.client.sysnr=00 
jco.client.snc_mode=1 
jco.client.snc_partnername=p:CN=IDS, OU=IT, O=CSW, C=DE jco.client.snc_qop=3
jco.client.snc_myname=p:CN=RFC, OU=IT, O=CSW, C=DE 
jco.client.snc_lib=/usr/sap/IDS/SYS/exe/run/libsapcrypto.so

Compile the Class VeriClient:

javac VeriClient.java

And run it providing the properties file as a parameter:

java VeriClient vericlient.properties

Somewhere in the result you should also see:

------------------------------------------------------------------------------ Test ------------------------------------------------------ Status ---------- ------------------------------------------------------------------------------ JCO.createClient()..........................................ok client.connect()............................................ok

Outlook

With SNC enabled we can use the RFC Enabled Function Module SUSR_CHECK_LOGON_DATA to authenticate with an external ID. If the authentication was successful it will return a valid SSO2 Ticket. But that part of another Blog.

To report this post you need to login first.

16 Comments

You must be Logged on to comment or reply to a post.

      1. Sam Mesh
        Hello Gregor,

        Thank you for your answer.
        Sorry for delay – my coComment does not notifies me about the answers on SDN Blogs.
        Could you please recommend reliable way to track comments on SDN Blogs?


        Thanks,
        Sam Mesh

        (0) 
        1. Gregor Wolf Post author
          Hi Sam,

          unfortunately in the moment it is not possible to track Blog comments. Please search the Suggestions Forum if it is already on the ToDo List.

          Regards
          Gregor

          (0) 
    1. Gregor Wolf Post author
      Hi Hernando,

      the permissions should be as minimal as possible. But the User the Web Server is running has to have read rights.

      Regards
      Gregor

      (0) 
  1. ramesh kaluri
    hi , good morning

    i am ramesh from india
    the procedure which you have given.. does it fits for credit card masking?

    plz tell me …..
    thanks in advance

    (0) 
    1. Gregor Wolf Post author
      Hello Ramesh,

      I don’t think that this procedure can help you reagarding Payment Card Processing. Please have a look to the Doumentation for Payment Card Processing and to the SAP Implementation Guide (IMG) under Cross-Application Components -> Payment Cards -> Maintain Payment Card Type.

      Best regards
      Gregor

      (0) 
  2. Rajkumar Radhakrishnan

    Hello<br/>This is a great blog where I got as much information as I could get regarding RFC client with SNC.<br/><br/>I was able to setup SSL and the https link works good with internet browser and the x509 cert is authenticated. In VUSREXTID I have mapped my CN found in certificate to SAP id. example CN=myguid, User=0022200. I have no issues in it.<br/><br/>I want to connect a java application from users laptop JCO 3.0 to NW7 ABAP stack using x509 cert. In this blog I do not understand the client RFC PSE creation export import section. Could you please explain more. But I have followed the steps and created RFC pse and exported, imported.<br/><br/>In STRUST I created SNC SAPCryptolib node, <br/>snc/identity/as = p:CN=DV1, OU=PRJ, O=KS, C=US<br/>snc/enable = 1<br/>snc/gssapi_lib = /usr/sap/DV1/SYS/exe/run/libsapcrypto.so<br/>snc/accept_insecure_cpic = 1<br/>snc/accept_insecure_gui = 1<br/>snc/accept_insecure_rfc = 1<br/>snc/permit_insecure_start = 1<br/>snc/data_protection/min = 1<br/>snc/extid_login_diag = 1<br/>snc/extid_login_rfc = 1<br/><br/>Configured SNC0 and it has system ID and DV1 and SNC name as p:CN=RFC, OU=PRJ, O=KS, C=US  all check boxes are checked, Canonical Name Determined.<br/><br/>Below is the error got when jco app is connected from the laptop<br/>[Thr 5996] *** ERROR => SncPDLInit(): DlLoadLib(“/usr/sap/DV1/SYS/exe/run/libsapcrypto.so”)=DLENOACCESS<br/>[Thr 5996]  [Thr 5996] *** ERROR => SncPDLInit()==SNCERR_INIT, Adapter (#0) /usr/sap/DV1/SYS/exe/run/libsa<br/>pcrypto.so not loaded<br/>[Thr 5996]  com.sap.conn.jco.JCoException: (102) RFC_ERROR_COMMUNICATION: Connect to SAP gateway failedHow to make the java application from my laptop to connect to ABAP NW7.

    (0) 
  3. DAVID CHARLTON
    Hi Gregor

    Thank you very much for your blog.  I tried using your instructions for a scenario where I substituted a web service testing app (soapUI) for the RFC client.  I included creating a client cert using keytool.

    Unfortunately, when I test I get a HTTP 401 (unauthorized) error, and “Fehlercode: ICF-LE-https-c:001-l:-T:-C:5-U:-P:-L:6”

    Do you know what I might be doing wrong?  Would there be a different configuration option needed for my scenario?

    Many thanks for any help you can provide!

    Cheers
    Dave

    (0) 
  4. Mathias Pache
    Hallo,
    I try to connect a JCO-Client to a SAP test system NetWeaver 2004s.
    When I start my JCO-Client or the VeriClient.java I always get the following exception: com.sap.mw.jco.JCO$Exception: (103) RFC_ERROR_LOGON_FAILURE:  “No suitable SAP user found for X.509-client certificate”. The ABAP Program ZSSF_TEST_PSE works without error (Signature, Verification, Encryption and Decryption are ok). Ich compared the views VSNCSYSACL and VUSREXTID again with the blog’s data; I cannot see any difference. A JCO Server with the according SNC properties works without error. What is wrong?
    Thank you for your help
    (0) 
    1. Jens Engelke
      The problem was caused by too many entries with the same SNC name in the System ACL – in particular by one entry having the “Entry for certificate activated” and “Entry for ext.ID activated” checkboxes unchecked.
      (0) 

Leave a Reply