Trusted X509 Authentication Support in SAP Busines...
Technology Blogs by SAP
Learn how to extend and personalize SAP applications. Follow the SAP technology blog for insights into SAP BTP, ABAP, SAP Analytics Cloud, SAP HANA, and more.
This is the second part of the blog series on how to achieve X509
authentication for REST SDK. In the first blog I have provided the steps for
certificate and keystore generation. In this post I will provide the steps needed to configure WACS (which hosts RESTful web-services ) and how to
resolve the errors reported by browsers
Note: We have tested 2 Factor Authentication login for BIL with the same approach. As long as the 2nd Factor returns a Valid X509 certificate of a user, and the certificate is available in Windows Certificate Store, user can same the same certificate for login
Step 1: Logon to CMC, and navigate to Servers -> WACS. Maintain the keystore details generated earlier under the properties as shown below:
Restart WACS.
Step 2: Navigate to CMC-> Authentication -> Enterprise
Unable the Trusted Authentication checkbox, maintain validity period.
Update the setting and download the Shared Secret
Copy the downloaded conf file in the path:
<Install Dir>/SAP BusinessObjects/SAP BusinessObjects Enterprise XI 4.0/java/pjs/container/bin/
And restart WACS
Step 3: Need to make sure the user account through which I want to X509 based trusted authentication exists in the BusinessObejcts Platform.
Example for my use case, the X509 certificate is in name of TestUser1
Step 4: Try to access the below url in your browser to achieve Trusted Authentication based on X509 certificate using REST SDK:
In case everything is fine, it should generate the logon token directly or it will ask to select the user certificate see below. In case of error refer next steps
And it will login with that user account. In my case: TestUser1
Step 5: In case browser displays the following error:
The security certificate presented by this website was not issued by a trusted certificate authority.
Perform this step mentioned below or moved to next step
This error indicates that browser does not trust the signing authority of the server certificate. To bypass this error, upload the server CA certificate to browsers Trusted Certificate Authority list.
Go to Internet Explorer ->Settings -> Internet options
Navigate to content tab and select Certificates.
Navigate to Trusted Root Certificate Authority Tab and select Import
Click on Browse and select the CA certificate created earlier:
Select Next, Next, Finish. And when it gives a confirmation window to install certificate. Select yes.
Note: You should not install certificates from unknown sources to your Trusted Root Certificate List, it may lead to security issues.