Quick guide for SSFS on windows

[Former Member]

The procedure works for both ABAB for JAVA system.

For implement  Password storage for primary database connect you need to do 5 step

1. Create directory structure
2. Give permission
3. Set windows registry keys
4. Changethe default profile
5. Excecute rsecssfx

Create directory structure

Log on to SAPGLOBALHOST to the operating system as user <sid>adm and open a command box or a powershell.

Execute the following commands:

mkdir <dir_global>\security

mkdir <dir_global>\security\rsecssfs

mkdir <dir_global>\security\rsecssfs\data

mkdir <dir_global>\security\rsecssfs\key

Alternatively, you can also create the directory structure via the Windows file explorer.

Give permission

Proceed as follows:

Log on to SAPGLOBALHOST as a user with administration authorizations.

Open the explorer and right-click the folder <dir_global>/security/rsecssfs. Choose "Properties" from the context menu.

Go to the "Security" tab page and choose "Advanced", and choose "Change Permissions..." in the window that is then displayed.

First, deselect the option "Include inheritable permissions from this object's parent" and choose "Add" in the warning message that is then displayed to transfer all of the existing authorizations for this directory.

Remove all of the entries from the "Permission entries" table, except the following:

o SAP_<sid>_LocalAdmin (only for non-HA installations)

o SAP_<sid>_GlobalAdmin

o SYSTEM

o Administrators

Edit the existing list entries so that there is an entry with the following values for each of the aforementioned authorized groups:

o Type: "Allow"

o Permission: "Full control"

o Apply To: "This folder, subfolder and files"

Finally, select the option "Replace all child object permissions with inheritable permissions from object".

Confirm all changes.

Set windows registry keys

Open a command box as <sid>adm and execute the following commands:

setx RSEC_SSFS_DATAPATH <dir_global>\security\rsecssfs\data
setx RSEC_SSFS_KEYPATH <dir_global>\security\rsecssfs\key
setx rsdb/ssfs_connect  1

Change DEFAULT profile

Change DEFAULT.PFL profile of SAP system and insert follow parameter

rsec/ssfs_datapath = $(DIR_GLOBAL)\security\rsecssfs\data
rsec/ssfs_keypath  = $(DIR_GLOBAL)\security\rsecssfs\key
rsdb/ssfs_connect = 1

Excecute rsecssfx

Open a command box as <sid>adm and execute the following commands:

rsecssfx put DB_CONNECT/DEFAULT_DB_USER <DB_USER> -plain

rsecssfx put DB_CONNECT/DEFAULT_DB_PASSWORD <your_password>

Restart the server , not only SAP !

From the note 1639578