Configuring Content Collector for SAP for use with IBM FileNet P8 and securing and monitoring Content Collector for SAP

Transcription

1 IBM Content Collector for SAP Applications Version 4 Release 0 Configuring Content Collector for SAP for use with IBM FileNet P8 and securing and monitoring Content Collector for SAP

2

3 IBM Content Collector for SAP Applications Version 4 Release 0 Configuring Content Collector for SAP for use with IBM FileNet P8 and securing and monitoring Content Collector for SAP

4 Note Before using this information and the product it supports, read the information in Notices on page 235. Third edition (December 2015) This edition applies to version 4, release 0, modification 0 of IBM Content Collector for SAP Applications (product number 5725-B46) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2010, US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents About this information vii Intended audience vii Terminology and conventions used in this information vii Screen captures vii Accessibility features of Content Collector for SAP viii ibm.com and related resources viii Contacting IBM viii What's new in Version ix What s new in the third edition ix What s new in the second edition x Part 1. Configuring Chapter 1. Preparing your environment Preparing your environment for Collector Server Setting up a basic SAP system Creating a user with CPIC access Restricting the access of the CPIC user Creating a role and a profile for the CPIC user Assigning the role to the CPIC user Linking a logical system to the SAP client Defining a number range for SAP ArchiveLink Chapter 2. Configuring FileNet P8 for use with Content Collector for SAP Creating properties Configuring FileNet P8 for use with Image Services Replication direction of the document classes Replication direction of the properties Mapping of the Image Services properties to the FileNet P8 properties: Overview Chapter 3. Configuring IBM Content Navigator Configuring IBM Content Navigator for use with FileNet P Associating users with task manager roles Configuring IBM Content Navigator for linking FileNet P8 objects manually to SAP Chapter 4. Configuring a daemon Configuring the server authentication on Collector Server Configuring the client authentication Starting the daemon Configuring the server authentication on the web application server Chapter 5. Configuring Collector Server Getting started with Configuration Feature Importing the instance configuration from a server configuration profile Creating several instances of Collector Server: Hints and tips Configuring the communication with SAP, IBM Content Navigator, and the API Communication with SAP, IBM Content Navigator, and the API: Overview Configuring the communication with SAP Configuring SAP for an HTTP connection Creating an SAP ArchiveLink protocol for an HTTP connection Creating SAP ArchiveLink queues for an HTTP connection Creating a content repository for an HTTP connection Enabling the use of HTTP requests with a seckey Configuring SAP for an RFC connection Creating an RFC destination for an RFC connection Creating an SAP ArchiveLink protocol for an RFC connection Creating SAP ArchiveLink queues for an RFC connection Creating a content repository for an RFC connection Configuring the communication with IBM Content Navigator Configuring the server authentication Configuring the server authentication on Collector Server Configuring the server authentication on the web application server Configuring the client authentication 58 Chapter 6. Configuring your environment for basic tasks Configuring for archiving data Setting up the sample archiving object FI_BANKS Configuring the SAP ArchiveLink path Checking your data archiving configuration Creating test data for the sample archiving object Running an archiving session to test your archiving setup Copyright IBM Corp. 2010, 2015 iii

6 6.2 Configuring for archiving data and protecting archived data and documents by using BC-ILM Creating a user for ILM-enabled data archiving Creating a user for ILM-enabled data archiving if the user data is stored in the SAP J2EE database Creating a user for ILM-enabled data archiving if the user data is stored in the SAP ECC database Creating a root collection in the empty logical archive Creating a destination in XML Data Archiving Service (XML DAS) Creating an archive store in XML Data Archiving Service (XML DAS) Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS) Creating the home paths for the archiving objects in the logical archive Assigning the home paths to the archive store Configuring for archiving incoming documents Configuring for archiving incoming documents by processing their bar codes Configuring for archiving incoming documents by creating work items in an SAP workflow Associating documents with a specific SAP workflow Enabling the Collector Server instance to archive incoming documents Making the document classes available for property mapping Configuring for archiving outgoing documents Configuring for linking archived documents to SAP Enabling the Collector Server instance to link archived documents Creating P8 queues and workflows Associating documents with a specific SAP workflow Configuring for archiving and viewing print lists Defining an archive device Associating print lists with an SAP business object of type DRAW Creating an SAP ArchiveLink batch job Enabling extended ALF viewing Enabling print-list viewing Configuring for viewing archived documents with the SAP GUI Configuring for viewing archived objects with IBM Content Navigator Configuring for transferring index information 125 Chapter 7. Configuring your environment for more or advanced tasks Mapping the reserved names of properties Setting timeouts for the RFC or Java RFC dispatcher and the agents Setting the timeout for the RFC or Java RFC dispatcher Setting the timeout period for the agents Assigning fixed ports to the client dispatchers Configuring for preprocessing outgoing documents The preprocessor user exit Requirements for running a preprocessor The input for the preprocessor The result from the preprocessor The format of the result file The format of the result object The preprocessor Including the preprocessors in the archiving process Linking documents to SAP by using the Cold program Linking documents that are not archived yet by using the Cold program Linking archived documents by using the Cold program Integrating IBM Datacap and Content Collector for SAP Deploying the archiving capability on Datacap Deploying the archiving capability on Datacap Version Deploying the archiving capability on Datacap Version Setting up a secure connection to Collector Server and adapting the client configuration profile Setting the custom actions ICCAccessExit ICCAccessInit ICCAccessInit ICCAddArchiveProperty ICCAddSAPProperty ICCArchiveCreateWI ICCArchiveFileName ICCArchiveID ICCArchiveSendBarcode ICCDocType ICCFileExtension ICCFilePath ICCSetDLLTraceFile ICCSetDLLTraceLevel Configuring for linking documents and folders directly to an SAP business object Deploying the web service for the xft document connector Configuring the web service in the SOA Manager of SAP iv Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

7 7.8 Integrating Content Collector for SAP into the SAP Solution Manager Chapter 8. Running a Collector Server instance Starting a Collector Server instance Starting a Collector Server instance from IBM Content Navigator Starting a Collector Server instance from a command line Making an instance configuration available for use by Collector Server Exporting the instance configuration from Configuration Feature Downloading the instance configuration with the archcmd command Starting a Collector Server instance with the archpro command Starting a Collector Server instance that uses FileNet P8, with the archpro command Stopping a Collector Server instance Restarting a Collector Server instance Chapter 9. Running a Collector Server instance as a Windows service Installing a Collector Server instance as a service and starting the service Installing a Collector Server instance as a service and running the service from IBM Content Navigator Installing a Collector Server instance as a service and running the service from a command line Running several instances of Collector Server as services Uninstalling a service Hints and tips Part 2. Security Scenario 3: One certificate for several users in a private directory Scenario 4: One certificate for several users in a public directory Setting up a secure communication between the API and several Collector Server instances Chapter 13. Setting up an HTTPS communication with SAP Configuring the server authentication Configuring server authentication on Collector Server Creating an SSL keystore and a certificate for the Collector Server instance Having the certificate signed by a certificate authority Enabling the Collector Server instance for the server authentication Exporting the server certificate Configuring the server authentication in SAP Importing the Collector Server certificate into SAP Enabling SSL support for the content repositories Configuring the client authentication Exporting the SAP certificate Importing the SAP certificate into the SSL truststore Enabling the Collector Server instance for the client authentication Securing the communication with an entire Collector Server instance or with specific logical archives only Chapter 14. Configuring Content Collector for SAP for US government security standards Part 3. Monitoring Chapter 10. Changing the master key 179 Chapter 11. Changing the passwords in the password file Chapter 12. Setting up a secure communication with the API Setting up a secure connection on Collector Server Creating the keystores Enabling the Collector Server instance to communicate with the API Setting up a secure connection on the system with the API Scenario 1: One user uses the API Scenario 2: Several users where each user has a certificate Chapter 15. Monitoring the connection between Collector Server and the repositories Monitoring the connection between Collector Server and the repositories from IBM Content Navigator Monitoring the connection between Collector Server and the repositories by using the archcheck Java API Calling the archcheck Java API from a command line by using the archcheck program Calling the archcheck Java API from a Java application Contents v

8 Chapter 16. Monitoring the compliance with the license agreements Monitoring document retrieval requests with the IUVU tool Configuring the IUVU tool Activating the IUVU tool Deactivating the IUVU tool Monitoring the document retrieval requests The SAP tables containing the retrieval requests: Overview Creating an IUVU report regularly Creating an IUVU report at your request The IUVU report: Description Determining the S_WFAR_OBJ users Part 4. Appendixes Notices Trademarks Terms and conditions for product documentation 237 IBM Online Privacy Statement Glossary Index vi Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

9 About this information Intended audience This book shows how to configure IBM Content Collector for SAP Applications for use with FileNet P8 and how to secure and monitor Content Collector for SAP. For better guidance, it includes screen captures of the SAP windows. This book is intended for the administrators who are responsible for setting up IBM Content Collector for SAP Applications. Administrators should have an in-depth knowledge of SAP and the repositories that they intend to use. It is assumed that they are familiar with the three-tier architecture of SAP and that they have a basic understanding of document management and the repositories. In addition, they should have a good working knowledge of the underlying operating system. This book also addresses programmers who must create customized repository clients, and who must therefore familiarize themselves with the concepts of IBM Content Collector for SAP Applications and SAP so that they can modify and extend sample code. Terminology and conventions used in this information To facilitate reading, product names are abbreviated in this information, where applicable. v v IBM Content Collector for SAP Applications Version 4.0 is abbreviated to Content Collector for SAP. To improve readability, the following product names are often abbreviated as shown in the following table: Full name IBM FileNet Content Engine IBM FileNet Process Engine IBM FileNet Image Services Abbreviated name Content Engine Process Engine Image Services v denotes Configuration Feature. Screen captures v denotes a server configuration profile. Related reference: Glossary on page 239 The glossary explains terms that are used in this information. Terms that are shown in italics are defined elsewhere in this glossary. The explanation of the various configuration tasks is complemented by screen captures of SAP windows. The screen captures were taken on a Windows system. Most of the entries and selections in the screen captures are examples only that you can change according to your needs. Copyright IBM Corp. 2010, 2015 vii

10 The screen captures are based on SAP ERP Central Component (ECC) 6. If you use another version of SAP ECC, your windows might differ slightly. The entries and selections in the SAP windows are often surrounded by a rectangle so that they are easier to spot. Accessibility features of Content Collector for SAP The graphical user interface of Content Collector for SAP is deployed as a plug-in in IBM Content Navigator. Therefore, the accessibility features of IBM Content Navigator apply. For more information, go to the IBM Content Navigator product documentation ( and search for Accessibility features. ibm.com and related resources Product support and documentation are available from ibm.com. Support and assistance From ibm.com, click Support & downloads and select the type of support that you need. From the Support Portal, you can search for product information, download fixes, open service requests, and access other tools and resources. IBM Knowledge Center See your online product information in IBM Knowledge Center at contentcollectorforsap_welcome_4.0.0.html. PDF publications See the PDF publications for your product at docview.wss?rs=86&uid=swg Contacting IBM For general inquiries, call 800-IBM-4YOU ( ). To contact IBM customer service in the United States or Canada, call IBM-SERV ( ). For more information about how to contact IBM, including TTY service, see the Contact IBM website at viii Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

11 What's new in Version 4.0 Content Collector for SAP V4.0 provides advanced archiving capabilities that help SAP users run their businesses more efficiently. Content Collector for SAP is designed to provide access to a wide range of business information, transfer older information to lower-cost storage with optional SAP retention enforcement, and improve system performance. This section summarizes the significant improvements or enhancements over Content Collector for SAP Version 3.0 and refers you to the relevant topics for more information. What s new in the third edition This edition includes the following updates: Configuring v If FileNet P8 uses the DB2 database in Oracle compatibility mode or uses the Oracle database, and if you plan to link archived documents to SAP that are in a P8 queue, an additional property must be specified. For more information, see 2.1, Creating properties, on page 20. v If you want to view objects with IBM Content Navigator and the default viewer map of IBM Content Navigator does not fit your needs, you must define a custom viewer map. For more information, see 6.8, Configuring for viewing archived objects with IBM Content Navigator, on page 123. v IBM Datacap V9 is supported. For more information, see 7.6, Integrating IBM Datacap and Content Collector for SAP, on page 140. v If you have xft document connector installed, you can link documents and folders directly to an SAP business object. For more information, see 7.7, Configuring for linking documents and folders directly to an SAP business object, on page 154. v You can start and stop a Collector Server instance directly from IBM Content Navigator. For more information, see 8.1.1, Starting a Collector Server instance from IBM Content Navigator, on page 165. v You can install a Collector Server instance as a Windows service from IBM Content Navigator and start and stop the service from IBM Content Navigator. For more information, see 9.1.1, Installing a Collector Server instance as a service and running the service from IBM Content Navigator, on page 173. Security v You can create a master key also when you start a Collector Server instance from IBM Content Navigator. For more information, see Chapter 10, Changing the master key, on page 179. v The topic about how to change passwords in the password file has been updated. For more information, see Chapter 11, Changing the passwords in the password file, on page 181. Copyright IBM Corp. 2010, 2015 ix

12 Monitoring You can monitor the connection between Collector Server and the repositories from IBM Content Navigator. For more information, see 15.1, Monitoring the connection between Collector Server and the repositories from IBM Content Navigator, on page 211. Technical changes and major changes to the text are indicated by a vertical bar () to the left of each new or changed line of information. What s new in the second edition This edition includes the following updates: Configuring v To use IBM Content Navigator, you must also copy the iccsaptasks.jar file to the web application server where IBM Content Navigator is installed. For more information, see 3.1, Configuring IBM Content Navigator for use with FileNet P8, on page 31. v To use Operation Feature of Content Collector for SAP, you must associate the users with the predefined task manager roles. For more information, see 3.2, Associating users with task manager roles, on page 32. v The information about how to configure the communication between IBM Content Navigator and a Collector Server instance has been updated in various topics. For more information, see 5.2.3, Configuring the communication with IBM Content Navigator, on page 55. v The topic about fixed ports has been reworked. For more information, see 7.3, Assigning fixed ports to the client dispatchers, on page 131. v If you use IBM Datacap Version 8.1, you must ensure that the IBM Global Secure ToolKit (GSKit) libraries of Content Collector for SAP are used by Datacap. For more information, see 7.6.1, Deploying the archiving capability on Datacap, on page 142. v The client configuration profile must contain the keystore parameter. For more information, see 7.6.2, Setting up a secure connection to Collector Server and adapting the client configuration profile, on page 144. Security The information about how configure an HTTPS connection between SAP and a Collector Server instance has been updated in various topics. For more information, see Chapter 13, Setting up an HTTPS communication with SAP, on page 193. x Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

13 Part 1. Configuring Which components of Content Collector for SAP and which products you must configure depends on the tasks that you want to complete with Content Collector for SAP. All tasks require a running Collector Server instance. Thus, the following configuration steps are mandatory: 1. Chapter 1, Preparing your environment, on page 3 2. Chapter 2, Configuring FileNet P8 for use with Content Collector for SAP, on page Chapter 3, Configuring IBM Content Navigator, on page Fix Pack 1 To start and stop the Collector Server instances from IBM Content Navigator, complete this task: Chapter 4, Configuring a daemon, on page Chapter 5, Configuring Collector Server, on page 41 After you complete these steps, you have a basic Collector Server instance configuration. Decide which tasks you want to complete with Content Collector for SAP and go to the appropriate configuration topics under Chapter 6, Configuring your environment for basic tasks, on page 61 and, optionally, Chapter 7, Configuring your environment for more or advanced tasks, on page 129. Some of these tasks require additional configuration of Collector Server, the repositories, or SAP. Then, start the configured Collector Server instances. You complete all configuration tasks and you start the Collector Server instances in your role as Collector Server administrator. Restriction: Only SAP configuration tasks that are necessary for Content Collector for SAP to work successfully or that are required for the communication between SAP and Content Collector for SAP are described in this information. For all other SAP configuration tasks, see the SAP documentation. Copyright IBM Corp. 2010,

14 2 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

15 Chapter 1. Preparing your environment Content Collector for SAP requires at least one instance of Collector Server. Before you begin: You installed FileNet P8 and Content Collector for SAP. Procedure: , Preparing your environment for Collector Server , Setting up a basic SAP system, on page Preparing your environment for Collector Server Content Collector for SAP requires at least one instance of Collector Server. Each instance requires specific directories. Before you begin: Plan for a secure Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Procedure: 1. Log on as Collector Server administrator. 2. Linux UNIX Add the following call of the shell script to the.profile file, which is in the home directory of the Collector Server administrator:. InstallHome/server/bin/csenv.sh Note the space between the period (.) and InstallHome. 3. Create the following directories: a. Create an instance directory where all instance-related files are to be stored: v Linux UNIX Create the instance directory in the UserHome directory of the Collector Server administrator. For example: /home/iccsapadmin/instance1 v Windows It is good practice to create the instance directory in the env_var_appdata directory of the Collector Server administrator. For example: C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\instance1 Create as many instance directories as you plan to create Collector Server instances. Each instance must have its own instance directory. Make a note of the path to the instance directory. You must specify this path later when you configure Collector Server. b. In the instance directory, create a directory that is named SAPCertificates. The SAP certificates for the repositories are stored in this directory. c. In the instance directory, create a directory with the name queue for the job queues. If you want to store the job queues in different directory or if you expect many job queues, do not create this directory. Instead, specify a path of your choice when you configure Collector Server. Important: Fix Pack 1 Those directories are created for you when you start the Collector Server instance from IBM Content Navigator. Copyright IBM Corp. 2010,

16 What to do next: 1.2, Setting up a basic SAP system 1.2 Setting up a basic SAP system To perform any of the Content Collector for SAP tasks, a basic SAP system must exist. Before you begin: 1.1, Preparing your environment for Collector Server, on page 3 Procedure: , Creating a user with CPIC access , Linking a logical system to the SAP client, on page , Defining a number range for SAP ArchiveLink, on page Creating a user with CPIC access Create a user in the SAP client that you want to use with Content Collector for SAP. Create the sample user CPICUSER1 in SAP client 800. Procedure: 1. In the SAP GUI, enter the transaction code SU01 to open the User Maintenance: Initial Screen window. 2. In the User field, specify a name for the CPIC user that you want to create. For example, type: CPICUSER1 Note: SAP translates lowercase characters or a mixture of lowercase and uppercase characters into uppercase characters. Figure 1 shows the User Maintenance: Initial Screen window containing the sample user name CPICUSER1. Figure 1. User Maintenance: Initial Screen window containing the sample user name CPICUSER1 You must specify the CPIC user name later when you configure Collector Server. 3. Click the Create icon. The Maintain User window opens. 4. On the Address page, in the Last name field, type the surname of the user. 4 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

17 For example, type: CPICUSER1_family Figure 2 shows the Maintain User window containing CPICUSER1_family as sample surname for sample user CPICUSER1. Figure 2. Address page of Maintain User window containing the sample surname CPICUSER1_family 5. Click the Logon data tab and specify the following information. a. From the User Type field, select Communications Data. b. In the Initial password field, type a password for the user. c. Repeat this password in the Repeat password field. d. Optional: In the Valid from and Valid through fields, specify the start date and end date of the period during which this user is valid. Figure 3 on page 6 shows what the Logon data page of the Maintain User window might look like after you completed step 5. Chapter 1. Preparing your environment 5

18 Figure 3. Logon data page of the Maintain User window containing the necessary settings 6. Decide whether you want to give the CPIC user access to the entire SAP system or whether you want to give the CPIC user only those authorizations that are needed to archive, link, and view data, print lists, and documents. v To give the CPIC user access to the entire SAP system, complete the following steps: a. Click the Profiles tab. b. In the first line of the Profile column, type: SAP_ALL c. In the second line of the Profile column, type: SAP_NEW Figure 4 on page 7 shows the Profiles page of the Maintain User window containing the necessary authorizations for sample user CPICUSER1. 6 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

19 Figure 4. Profiles page of the Maintain User window containing the necessary authorizations for sample user CPICUSER1 v d. Click the Save icon to save your settings. To restrict the access of the CPIC user, complete these steps: a. Click the Save icon to save your settings. b , Restricting the access of the CPIC user What to do next: Depending on your decision regarding the authorizations of the CPIC user, continue with either of the following tasks: v , Restricting the access of the CPIC user v 1.2.2, Linking a logical system to the SAP client, on page Restricting the access of the CPIC user Instead of giving the CPIC user access to the entire SAP system, you can give the CPIC user only those authorizations that are needed to archive, link, and view data, print lists, and documents Creating a role and a profile for the CPIC user: You must create a role for the CPIC user. In addition, you must create a profile where you specify the necessary authorizations. Create the sample iccsap_user. Procedure: 1. In the SAP GUI, enter the transaction code PFCG to open the Role Maintenance window. 2. In the Role field, type a name for the role. For example, type: iccsap_user Chapter 1. Preparing your environment 7

20 Figure 5 shows the Role Maintenance window containing the sample role iccsap_user. Figure 5. Role Maintenance window containing the sample role iccsap_user 3. Click the Single Role icon. The Create Roles window opens. 4. In the Description field, type a description. Then, click the Save icon to save your settings. For example, type: Authorizations for Content Collector for SAP Figure 6 shows the Create Roles window containing the sample role description. Figure 6. Create Roles window containing the sample role description 5. Click the Authorizations tab. The title of the window changes to Change Roles. 6. Under Information About Authorization Profile, click the Propose Profile Names icon to the right of the Profile Name field. SAP generates a profile name and a description. Figure 7 on page 9 shows the Change Roles window containing the generated profile name and description. You can change the description. However, leave 8 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

21 the generated profile name. Figure 7. Change Roles window containing the generated profile name and description 7. Click the Save icon to save your settings. 8. Under Maintain Authorization Data and Generate Profiles, click the Change authorization data icon. See Figure In the Change role: Authorizations window, click the Do not select templates icon. 10. Click the Manually icon. 11. In the Manual selection of authorizations window, type the following authorizations in the right column, one authorization on each line: v S_WFAR_LOG v S_WFAR_LOP v S_WFAR_OBJ v S_WFAR_PRI v S_WFAR_RED v S_RFC Figure 8 on page 10 shows the Manual selection of authorizations window containing the necessary authorizations. Chapter 1. Preparing your environment 9

22 Figure 8. Manual selection of authorizations window showing the necessary authorizations 12. Click the Continue icon to save your specifications and to return to the Change role: Authorizations window. Figure 9 shows the Change role: Authorizations window containing the specified authorizations. Figure 9. Change role: Authorizations window showing the specified authorizations 10 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

23 13. Activate the individual authorizations: Expand all nodes and click each asterisk (*). The background color of the asterisks changes from blue to green. When all asterisks have a green background, the status of the nodes automatically changes from yellow to green. Figure 10 shows the Change role: Authorizations window where some authorizations are activated. Figure 11 on page 12 shows what the Change role: Authorizations window must look like after you activated all authorizations. Figure 10. Change role: Authorizations window showing some asterisks with a green background Chapter 1. Preparing your environment 11

24 Figure 11. Change role: Authorizations window after activating all authorizations 14. Click the Save icon to save your settings. 15. Click the Generate icon to create the role and thus the profile. What to do next: , Assigning the role to the CPIC user Assigning the role to the CPIC user: You must assign the role, including the profile, to the CPIC user. Assign the sample role iccsap_user to the sample user CPICUSER1. Before you begin: , Creating a role and a profile for the CPIC user, on page 7 Procedure: 1. In the SAP GUI, enter the transaction code SU01 to open the User Maintenance: Initial Screen window. 2. In the User field, specify the name of the CPIC user to which you want to assign the role. For example, type CPICUSER1 3. Click the Change icon. 4. In the Maintain User window, click the Roles tab. 5. In the Role column of the Role Assignments table, specify the name of the role that you want to assign and press Enter. For example, type: iccsap_user 12 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

25 Figure 12 shows the Roles page of the Maintain User window containing the specified role. Figure 12. Roles page of the Maintain User window showing the specified role after you press Enter 6. Click the Profiles tab to check whether the profile is shown in the Assigned Authorization Profiles table. You should see the name and the description of the profile that you created. For example, you should see T-E and Profile for role iccsap_user. Figure 13 on page 14 shows what the Profiles page of the Maintain User window might look like. Chapter 1. Preparing your environment 13

26 Figure 13. Profiles page of the Maintain User window showing the name and the description of the sample role 7. Click the Save icon to save your settings. The role and the profile are assigned to the CPIC user. You can now work with this user. What to do next: 1.2.2, Linking a logical system to the SAP client Linking a logical system to the SAP client Define a logical system and link it to the SAP client that you want to use with Content Collector for SAP. Define a logical system for each SAP client that you want to use. Before you begin: 1.2.1, Creating a user with CPIC access, on page 4 Create the sample logical system T90CLNT090 and link it to SAP client 800, for which you created user CPICUSER1. Procedure: 1. In the SAP GUI, enter the transaction code BD54 to open the Change View "Logical Systems": Overview window. If a window opens with the message Caution: The table is cross-client., press Enter. 2. If the table already contains logical systems, you can use one of them. If you want to use an existing logical system, continue with 4 on page 15. Note: Do not change the settings of an existing logical system. 3. If no logical system exists, create one by following these instructions. As an example, create the logical system T90CLNT090. a. In the Change View "Logical Systems": Overview window, click New Entries. The New Entries: Overview of Added Entries window opens. 14 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

27 b. In the first free row of the Log. System column, type a name for the logical system. For example, type: T90CLNT090 You must later specify this name when you configure Collector Server. c. Add a description in the Name column of the same row. For example, type: First logical system for SAP client 800 Figure 14 shows what the New Entries: Overview of Added Entries window might look like after you completed step 3b and step 3c. Figure 14. New Entries: Overview of Added Entries window containing a sample name for the logical system and a sample description d. Click the Save icon. e. In the Request field of the Prompt for Workbench request window, type the name of, or select, an existing request. If a request does not exist, create one by using the Create Request icon. 4. Link the logical system to the SAP client for which you created a user with CPIC access. To link the sample logical system T90CLNT090 to the sample SAP client 800, take these steps: a. Enter the transaction code SCC4 to open the Display View "Clients": Overview window. b. Click the Change icon. If a window opens with the message Caution: The table is cross-client., press Enter. c. Double-click the row in the Client column that contains the SAP client to which you want to link the logical system. For example, double-click the row in the Client column that contains the number 800. d. In the Change View "Clients": Details window, select the logical system from the Logical system list. For example, select T90CLNT090. Chapter 1. Preparing your environment 15

28 Figure 15 shows the Display View "Clients": Overview window containing your selection in step 4d on page 15. Figure 15. Display View "Clients": Overview window containing the name of the sample logical system that you want to link 5. Click the Save icon to save your settings. What to do next: 1.2.3, Defining a number range for SAP ArchiveLink Defining a number range for SAP ArchiveLink Define a range for SAP ArchiveLink, if this interval does not exist yet. Before you begin: 1.2.2, Linking a logical system to the SAP client, on page 14 Procedure: 1. In the SAP GUI, enter the transaction code OANR to open the SAP ArchiveLink Number range window. 2. Click the Change Intervals icon. Figure 16 on page 17 shows the Maintain Number Range Intervals window containing the required interval. 16 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

29 Figure 16. Maintain Number Range Intervals window containing the required interval 3. If the required interval does not exist, take these steps: a. In the Maintain Number Range Intervals window, click the Insert Interval icon. b. In the Insert Interval window, specify the following settings: 1) In the No column, type: 01 2) In the From number column, type: ) In the To number column, type: Do not change the setting in the Current number column. c. Click the Insert icon to insert the specified interval. The Maintain Number Range Intervals window should look similar to Figure Click the Save icon to save your settings. Chapter 1. Preparing your environment 17

30 18 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

31 Chapter 2. Configuring FileNet P8 for use with Content Collector for SAP Create the objects that you need to store outgoing documents in FileNet P8. For incoming documents, ensure that the document classes have the necessary properties. Some of the objects might exist and can be used. Make a note of the names of all objects that you create. You must later specify them in the server configuration profile when you configure Collector Server for use with FileNet P8. This information contains only the configuration steps that must be completed to use FileNet P8 with Content Collector for SAP. For more information, see the FileNet P8 Platform documentation ( SSNW2F/welcome). To configure FileNet P8: 1. Create a user that Content Collector for SAP can use to connect to FileNet P8. 2. Create a domain that contains the object stores where the documents are stored or are to be stored. 3. Create one or more object stores to hold the documents. 4. Create the properties for the document classes. For more information, see 2.1, Creating properties, on page Create the document classes, and assign the appropriate properties. Create at least one document class. Otherwise, no documents are stored. If you do not want to store all documents in one document class, create several document classes. You can create a document class for each MIME type. For each document class, add the user that you created in step 1, or the group to which this user belongs, to the Default Instance Security access control list (ACL) and specify Full Control as permission. With this permission, the user can view, create, modify, read, and delete the documents in the object stores. Note: If a user is #CREATOR-OWNER of all documents in this document class, this user does not have to be added to the ACL list 6. If the archived documents are to be organized in folders, create the folders that you need. For each folder, grant the Add to Folder security to the user that you created in step 1, or to the group to which this user belongs. In this way, you allow the user or the group to add documents to the folders. This security level includes the following necessary access rights: v File in folder v Unfile from folder v Read permissions What to do next: Chapter 5, Configuring Collector Server, on page 41 Copyright IBM Corp. 2010,

32 2.1 Creating properties Depending on the task that you want to perform with Content Collector for SAP, specific properties must be defined. Complete these steps: 1. To archive incoming or outgoing documents, Content Collector for SAP requires the properties that are shown in Table 1. Create them together with the necessary specifications. Table 1. Overview of the properties required for archiving documents Data Property name Description type Minimum size ALFdpages The total number of ALF description String 3 pages, if the document is paginated. ALFpages The total number of ALF pages, if the String 3 document is paginated. Barcode The bar code. String Maximum size: 40 PageSize The page size of a paginated String 239 document. SAPCompCharset The character sets in which the content String 239 of the components is encoded. SAPCompCreated The date and time, in Coordinated Universal Time (UTC) format, when the components were created. String 239 SAPCompModified The date and time, in UTC format, when the components were last modified. String 239 SAPComps The component IDs. String 239 SAPCompSize The component sizes. This property prevents the components from being retrieved to determine the component sizes. String 239 SAPCompVersion SAPContType SAPDocDate SAPDocId SAPDocProt SAPType The versions of the SAP applications that are used to create the components. The MIME type, such as text/plain or image/tiff. This property is needed for viewing the document. The date and time when the document was created. The time stamp is shown in UTC format. The SAP document ID. Specify this property as index property. The SAP document protection (create, read, update, delete). The SAP document class, such as TXT or TIF. This property is needed for processing the bar code. String 239 String 239 String 239 String 40 String 4 String 3 Important: 20 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

33 v v v The property names are reserved names. They are case-sensitive and cannot be changed. Do not define the properties to require a value. IsValueRequired must be set to false. Always store date and time information as data type string or integer. If you use data type date, you might see this information adapted to your time zone. v If you have documents with more than 16 components or documents with very long component names, a size of 239 characters is not sufficient for the following properties: SAPCompCharset SAPCompCreated SAPCompModified SAPComps SAPCompSize SAPCompVersion For these properties, calculate the size by using the following formula: 15 x (maximum number of components in a document) This formula is based on the following facts: Some of the affected properties hold time stamps. Time stamps have a fixed length of 14 characters and are usually longer than any other SAP metadata. The SAP metadata of all components are concatenated and separated by a colon. The maximum length of strings is determined by the underlying database and is characters. If you need longer strings to hold the SAP metadata for all components in a document, you must define the properties with the Use Long Column Width attribute. You can specify this attribute only when you create the properties. 2. Optional: You can improve the searchability of the archived documents by storing additional property values with the documents or by using the index transfer of Content Collector for SAP. If you want to store additional values during the archiving process and if your scanning application creates a description file, create the properties for which the description file provides values. If you want to use the index transfer, create the properties that match the attributes of the SAP business object to which the documents are to be linked. In Administration Feature of Content Collector for SAP, these custom properties must be mapped to the values in the description file or to the SAP attributes. Related tasks: 7.1, Mapping the reserved names of properties, on page 129 FileNet P8 properties that must be created for use by Content Collector for SAP, have reserved names. If you cannot use a reserved name, for example, because it exists in your environment, you must map the name of your choice to the reserved name. For this purpose, you must create a mapping file. 2.2 Configuring FileNet P8 for use with Image Services Collector Server can access Image Services documents after you make the metadata and the annotations of the Image Services documents available in the Content Engine catalog of FileNet P8. Chapter 2. Configuring FileNet P8 for use with Content Collector for SAP 21

34 Before you begin: On Image Services, ensure that the document classes of the documents that are to be reused are enabled for cataloging. If you use FileNet P8 Version 5.1, or later, and Image Services Version 4.2, you can decide, during configuration, where the metadata and the annotations of the documents are to be cataloged and where the document content is to be stored. If you use FileNet P8 Version 5.0 and Image Services Version 4.1.2, the metadata and the annotations of the Image Services documents are cataloged on Content Engine and the content of the Image Services documents remains on Image Services. For more information, go to the FileNet P8 product documentation ( and search for Configuring Content Federation Services for Image Services and CFS-IS Configuration Road Map. Procedure: 1. Create a FileNet P8 user that Content Collector for SAP can use to connect to FileNet P8. 2. Create a domain for the object stores, or use the default domain. 3. Create a fixed content device for each Image Services server that you want to access. 4. Create an external repository for each fixed content device. 5. Create one or more storage areas within existing object stores or create one or more object stores. You can select a storage area of your choice. If, however, you want to use a fixed storage area, select the fixed content device that you created. Add the users or group of users who must access the Image Services documents. Add at least the user that you created in step 1. If you do not specify a user, all FileNet P8 users who are not administrators can only read the Image Services documents. 6. If you use FileNet P8 Version 5.1, or later, and Image Services Version 4.2., create a replication group for each combination of object store and external repository. In the replication group, you specify which object store is associated with which external repository. In addition, you determine where the documents are to be cataloged: v If the documents are to be cataloged on both Image Services and Content Engine, select the Master mode for the object store. v If the documents are to be cataloged on Content Engine only, select the Slave mode for the object store. Note: Specific document types can be cataloged on Content Engine only. For more details, see 2.2.1, Replication direction of the document classes, on page Create the properties for the document classes. You must create all properties that are defined for the Image Services document classes. In addition, you must create all properties that Content Collector for SAP needs to archive and update documents. Otherwise, the Image Services documents can only be read or deleted. 22 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

35 For an overview of the properties that you must create, see 2.2.3, Mapping of the Image Services properties to the FileNet P8 properties: Overview, on page For each Image Services document class, create a document class in FileNet P8, and assign the properties that Content Collector for SAP needs and the custom properties. If possible, use the name of the Image Services document class for the FileNet P8 document class. For each FileNet P8 document class, add the user that you created in step 1 on page 22, or the group to which this user belongs, to the Default Instance Security access control list (ACL) and specify Full Control as permission. With this permission, the user can view, create, modify, read, and delete the Image Services documents. Note: If you use FileNet P8 Version 5.1, or later, and Image Services Version 4.2., ensure that no default replication group is specified for the FileNet P8 document classes that are to contain incoming documents. Otherwise, new versions of a document are automatically synchronized with Image Services. For details regarding the settings for outgoing documents, see 2.2.1, Replication direction of the document classes, on page Map the Image Services document classes to the FileNet P8 document classes. If you use FileNet P8 Version 5.1, or later, and Image Services Version 4.2., specify the replication direction for each document class mapping: v v If you want to continue cataloging documents on Image Services, you must synchronize the Image Services catalog with the Content Engine catalog. In this case, you must enable bidirectional federation for each document class mapping. Select Both as replication direction. If you want to keep only the Content Engine catalog up to date, select Inbound as replication direction. Note: The data type of the documents determines the replication direction. For more information, see 2.2.1, Replication direction of the document classes, on page Within each document class mapping, map the Image Services properties to the FileNet P8 properties. For an overview of which properties must be mapped, see 2.2.3, Mapping of the Image Services properties to the FileNet P8 properties: Overview, on page 27. If you use FileNet P8 Version 5.1, or later, and Image Services Version 4.2, specify the replication direction for each property mapping. The replication direction depends on the replication direction of the document class to which the properties belong. For information about which replication direction to select for the individual properties, see 2.2.2, Replication direction of the properties, on page For each object store or for each document class, create a storage policy where you define where the content of the documents is to be stored. Because the storage policy can affect the performance, use the policy that fits best your company policy and, at the same time, has the least impact on the performance. 12. Annotations of Image Services can be copied manually to the Content Engine catalog or can be cataloged at the same time as the metadata of the documents. To export the annotations together with the metadata, select the Export Annotations check box in the System Configuration Editor (fn_edit). Chapter 2. Configuring FileNet P8 for use with Content Collector for SAP 23

36 13. Export the metadata, and any annotations, of the Image Services documents to the Content Engine catalog. You use the IS Catalog Export Tool on the Remote Admin Console (RAC) workstation to perform this task. If you want to ensure that updates to the Image Services catalog are automatically exported to the Content Engine catalog, use the IS Catalog Export Tool to create default mappings between the Image Services document classes and the FileNet P8 object stores. 14. Enable the Content Engine catalog to be updated automatically: On the IS Import Agent page of the Enterprise Manager Properties window, select the Enable Dispatcher check box and adjust the import settings according to your needs Replication direction of the document classes The replication direction of the document classes depends on the document type. The document type also determines whether the updates to the documents must be cataloged on Image Services or in FileNet P8. Skip this topic if you use FileNet P8 Version 5.0 and Image Services Version General considerations FileNet P8 can handle several versions of a document. Image Services can catalog only the first version of a document. A new version is created, for example, by adding an SAP note to a document or by updating a document with ECL Viewer. Content Collector for SAP transfers index information only to the latest document version. Thus, if documents are to be cataloged on both Image Services and Content Engine, ensure that the documents have only one version. Bidirectional federation and index transfers are supported only for documents with one version. Incoming documents, such as documents of type TIFF or FAX Incoming documents can be cataloged on Content Engine only or on both Image Services and Content Engine. If you decide to catalog documents on Image Services, you can continue to use the applications that you developed for handling Image Services documents. You can transfer index information regardless of where the documents are cataloged. Adding SAP notes or updating the documents with ECL Viewer is not allowed. To synchronize the Content Engine catalog with the Image Services catalog, specify Both as replication direction. The following table provides a quick overview of the details: Table 2. Details for incoming documents Activity Catalog Replication direction Index transfer SAP notes Updates with ECL Viewer Settings Content Engine only or Image Services and Content Engine Both Allowed Not allowed Not allowed 24 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

37 Outgoing documents, such as documents of type PDF By default, outgoing documents are cataloged on Content Engine. However, you must specify Both as replication direction so that the updates to the documents are reflected in both the Content Engine catalog and the Image Services catalog. SAP notes, updates with ECL Viewer, and index transfer are allowed. However, you can transfer index information only as long as you do not add SAP notes or update the documents with ECL Viewer. If you want to continue cataloging outgoing documents on Image Services, you must specify the following settings: v v v Specify Both as replication direction to synchronize the Image Services catalog with the Content Engine catalog. Specify a default replication group for the document class: On the General page of the Class Properties window, select the appropriate replication group from the Default Replication Group list. When you create more versions of a document by adding SAP notes or by updating the document with ECL Viewer, each version gets the same SAP document ID (SAPDocId property). If you have applications that you developed for handling Image Services documents, check whether these applications can handle nonunique SAP document IDs. If they can handle only unique SAP document IDs, deactivate versioning: On the General page of the Class Properties window, clear the Support Versioning check box. Important: v You can transfer index information if the documents have only one version. v After you deactivate versioning, you can no longer update the documents or add SAP notes. If you try to add an SAP note nevertheless, the following error occurs in SAP: HTTP error: 500 Internal Server Error The trace files and log files that are created by Collector Server contain more details regarding this error.for more information, see the topic An SAP note produces an error in the Troubleshooting and support part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH The following tables summarize the details for the default handling of outgoing documents and the features that you can use if you continue keeping outgoing documents on Image Services. Table 3. Details for default handling of outgoing documents Activity Catalog Replication direction Index transfer SAP notes Updates with ECL Viewer Settings Content Engine only Both Allowed Allowed Allowed Chapter 2. Configuring FileNet P8 for use with Content Collector for SAP 25

38 Table 4. Details for keeping outgoing documents on Image Services Activity Settings Catalog Content Engine only or Image Services and Content Engine Replication direction Both Default replication group A valid group must be selected Index transfer Allowed if the documents have only one version SAP notes v Allowed if your applications can handle documents with the same SAP document ID. v Not allowed if your applications can handle only documents with unique SAP document IDs. In this case, deactivate versioning. Updates with ECL Viewer v Allowed if your applications can handle documents with the same SAP document ID. v Not allowed if your applications can handle only documents with unique SAP document IDs. In this case, deactivate versioning. Data, such as documents of type REO Data can be cataloged on Content Engine only. Therefore, you must specify Inbound as replication direction. Index transfers are allowed. SAP notes are allowed, but are unusual. The following table provides a quick overview of the details: Table 5. Details for data Activity Catalog Replication direction Index transfer SAP notes Settings Content Engine only Inbound Allowed Allowed but unusual Print lists, such as documents of type ALF Print lists can be cataloged on Content Engine only. Therefore, you must specify Inbound as replication direction. Index transfers and SAP notes are allowed. The following table provides a quick overview of the details: Table 6. Details for print lists Activity Catalog Replication direction Settings Content Engine only Inbound 26 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

39 Table 6. Details for print lists (continued) Activity Index transfer SAP notes Settings Allowed Allowed Replication direction of the properties When you map the Image Services properties to the FileNet P8 properties, you must specify in which direction the properties are to be replicated. The replication direction depends on the replication direction of the document class to which the property belongs. Skip this topic if you use FileNet P8 Version 5.0 and Image Services Version The following table shows the replication direction of the properties that are covered in 2.2.3, Mapping of the Image Services properties to the FileNet P8 properties: Overview. Image Services property name FileNet P8 property name Replication direction of property if replication direction of the document class is Both F_DOCNUMBER ISDocId Inbound Inbound ALFdpages ALFdpages Both Inbound ALFpages ALFpages Both Inbound PageSize PageSize Both Inbound SAPCompCreated SAPCompCreated Both Inbound SAPCompModified SAPCompModified Both Inbound SAPComps SAPComps Both Inbound SAPCompSize SAPCompSize Both Inbound SAPContType SAPContType Both Inbound SAPDocDate SAPDocDate Both Inbound SAPDocId SAPDocId Both Inbound SAPDocProt SAPDocProt Both Inbound SAPType SAPType Both Inbound any custom property Both Inbound Replication direction of property if replication direction of the document class is Inbound Mapping of the Image Services properties to the FileNet P8 properties: Overview Content Collector for SAP requires specific properties so that it can archive the documents. Of these properties, map all the properties that exist for your Image Services documents. In addition, map all custom properties. Notes: v Only classes with mapped properties are imported into FileNet P8. v Properties that are not mapped are not available in FileNet P8. Chapter 2. Configuring FileNet P8 for use with Content Collector for SAP 27

40 Mapping of the properties of outgoing documents Table 7 gives an overview of which Image Services properties must be mapped to which FileNet P8 properties. Table 7. Overview of the properties of outgoing documents Image Services property name FileNet P8 property name Description Data type F_DOCNUMBER ISDocId The original Image Services document ID. Specify this property as index property. ALFdpages ALFdpages The total number of ALF description pages, if the document is paginated. ALFpages ALFpages The total number of ALF pages, if the document is paginated. PageSize PageSize The page size of a paginated document. SAPCompCreated SAPCompCreated The date and time, in Coordinated Universal Time (UTC) format, when the components were created. SAPCompModified SAPCompModified The date and time, in UTC format, when the components were last modified. Float String 3 String 239 String 239 String 239 String 239 SAPComps SAPComps The component IDs. String 239 SAPCompSize SAPCompSize The component sizes. This property prevents the components from being retrieved only to determine the component sizes. String 239 SAPContType SAPContType The MIME type, such as text/plain or image/tiff. This property is needed for viewing the document. SAPDocDate SAPDocDate The date and time when the document was created. The time stamp is shown in UTC format. SAPDocId SAPDocId The SAP document ID. Specify this property as index property. SAPDocProt SAPDocProt The SAP document protection (create, read, update, delete). SAPType SAPType The SAP document class, such as TXT or TIF. This property is needed for processing the bar code. String 239 String 239 String 40 String 4 String 3 Minimum size of FileNet P8 property Mapping of the properties of incoming documents Table 8 on page 29 gives an overview of which Image Services properties are to be mapped to which FileNet P8 properties. 28 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

41 Table 8. Overview of the properties of incoming documents Image Services property name FileNet P8 property name Description FileNet P8 data type F_DOCNUMBER ISDocId The original Image Services document ID. Float Specify this property as index property. Document_Title DocumentTitle String Notes: v The mapping of the Document_Title property is optional. v Map also the properties that are listed in the table for outgoing documents. Chapter 2. Configuring FileNet P8 for use with Content Collector for SAP 29

42 30 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

43 Chapter 3. Configuring IBM Content Navigator To configure Collector Server, to archive or link incoming documents, and to transfer index information, you need IBM Content Navigator. Configure IBM Content Navigator for use with Content Collector for SAP. All of the following tasks must be completed by the IBM Content Navigator administrator. 3.1 Configuring IBM Content Navigator for use with FileNet P8 You must load the Content Collector for SAP plug-in into IBM Content Navigator and create the necessary desktops. Before you begin: Plan for configuring IBM Content Navigator. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Procedure: 1. Copy the JAR files that were installed with the base package and that are in the following directory: v Linux UNIX InstallHome/navigator_plugins v Windows InstallHome\navigator_plugins 2. Paste the JAR files to the web application server where IBM Content Navigator is installed, as follows: a. Paste the iccsapplugin.jar file to a directory of your choice. Ensure that IBM Content Navigator can access this file during run time. b. Paste the iccsaptasks.jar file to the following directory: v Linux UNIX profiles/profilename/installedapps/cellname/ navigator.ear/taskmanagerweb.war/web-inf/dropins v Windows profiles\profilename\installedapps\cellname\ navigator.ear\taskmanagerweb.war\web-inf\dropins 3. Open a web browser and then open IBM Content Navigator in administration view by typing the following URL: protocol://hostname:portnumber/context_root/?desktop=admin For example, type: 4. Log on as IBM Content Navigator administrator. 5. Load the Content Collector for SAP plug-in: a. In the navigation pane on the left, click Plug-ins. b. On the Plug-ins page, click New Plug-in. c. In the JAR file path field of the New Plug-in page, type the fully qualified path to the iccsapplugin.jar file and then click Load. d. Optional: From the Trace level list, select the trace level that you need. By default, Error is selected. Copyright IBM Corp. 2010,

44 The tracing information is written to the console of your web application server. On IBM WebSphere Application Server, for example, the console output is redirected to the SystemOut.log file in the WAS_profile_location/ logs/server directory. e. Click Save and Close. 6. Create the desktops that you need for Content Collector for SAP. The following steps guide you through the required desktop settings. You can adapt the desktop further, depending on your needs. a. In the navigation pane on the left, click Desktops. b. On the Desktops page, click New Desktop. c. In the General pane, specify a name and an ID for the new desktop and select the repository that you want to use with Content Collector for SAP. In addition, limit the access to those users or user groups that are to work with the desktop. d. In the Layout pane, under Displayed features, select the Content Collector for SAP features that the desktop is to contain. e. Click Save and Close. 3.2 Associating users with task manager roles Operation Feature of Content Collector for SAP, where you create and schedule tasks, uses the task manager component of IBM Content Navigator. You must associate all users who are allowed to use this feature with the predefined task manager roles. Associate the users with task manager roles. For details, see the following topics: v If the task manager component of IBM Content Navigator is deployed on IBM WebSphere Application Server, see Associating users with task manager roles (WebSphere Application Server) ( SSEUEX_2.0.3/com.ibm.installingeuc.doc/eucde057.htm) v If the task manager component of IBM Content Navigator is deployed on Oracle WebLogic Server, see Associating users with task manager roles (Oracle WebLogic Server) ( com.ibm.installingeuc.doc/eucde065.htm) 3.3 Configuring IBM Content Navigator for linking FileNet P8 objects manually to SAP You can link documents to SAP by creating and scheduling a document-linking task. Alternatively, you can link each document manually. FileNet P8 folders, search templates, and stored searches can be linked only manually. You specify the linking settings in a document-linking profile in Administration Feature. However, you must also configure IBM Content Navigator for manual linking. Before you begin: 3.1, Configuring IBM Content Navigator for use with FileNet P8, on page 31 Content Collector for SAP provides a link action that can be added to the context menus, to the toolbar menus, or to both types of menus. To add the link action to the default context menu, for example, complete these steps: 32 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

45 Procedure: 1. Open a web browser and then open IBM Content Navigator in administration view by typing the following URL: protocol://hostname:portnumber/context_root/?desktop=admin For example, type: 2. Log on as IBM Content Navigator administrator. 3. In the navigation pane, click Menus. v To add the link action to the view where you can select an object, take these steps: a. In the table, click Default document context menu. Then, click Copy. b. On the New Menu page, type a name and an ID. c. From the Available list, select Link to SAP and then click the arrow to move the option to the Selected list. d. Click Save and Close. v To add the link action to the view where you can select a document version, take these steps: a. In the table, click Default document version context menu. Then, click Copy. b. On the New Menu page, type a name and an ID. c. From the Available list, select Link to SAP and then click the arrow to move the option to the Selected list. d. Click Save and Close. 4. In the navigation pane, click Desktops. In the table, click the desktop that you created for linking documents manually. Then, click Edit. 5. In the selected desktop, open the Menu page. Go to Context menus > Content Context Menus and select the new menus from the Document context menu list and from the Document version context menu list. Chapter 3. Configuring IBM Content Navigator 33

46 34 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

47 Chapter 4. Configuring a daemon Fix Pack 1 To start and stop a Collector Server instance from IBM Content Navigator and to view logs and traces from IBM Content Navigator, you must configure a daemon on the system where Collector Server is installed. The daemon is used by IBM Content Navigator to control a Collector Server instance. Before you begin: Plan for running Collector Server instances. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH On the system where Collector Server is installed, take these steps: 1. Create a daemon path. All files that are created when the daemon is started, are stored in this path. You must have read/write access to this path. Strictly control the access to this path. For example, create the following path: /home/iccsapadmin/daemon 2. Create an instance base path. For example, create the following path: /home/iccsapadmin/instances All instance directories must be in this base path or in a subdirectory of this path , Configuring the server authentication on Collector Server , Configuring the client authentication, on page , Starting the daemon, on page , Configuring the server authentication on the web application server, on page Configuring the server authentication on Collector Server Fix Pack 1 Create a keystore and a certificate for Collector Server. Use the Java Keytool or the IBM Key Management Utility (IKEYMAN) to create the keystore, the private key, and the public key and to associate the public key with a certificate. The Java Keytool and IKEYMAN are both delivered with Content Collector for SAP as part of the IBM JRE and have the following fully qualified file names: v The Java Keytool: Linux UNIX InstallHome/java/jre/bin/keytool Windows InstallHome\java\jre\bin\keytool.exe v IKEYMAN: Linux UNIX InstallHome/java/jre/bin/ikeyman Windows InstallHome\java\jre\bin\ikeyman.exe Copyright IBM Corp. 2010,

48 To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: 1. Change to the daemon directory and then open a command line. For example, change to the following directory: /home/iccsapadmin/daemon 2. Enter the following command on one line: keytool -genkeypair -keyalg key_algorithm -keysize keysize -sigalg signature_algorithm -alias name -validity number_of_days -keystore keystore_file key_algorithm Specify the algorithm that is to be used to generate the key pair. Specify RSA. keysize Specify the size of the keys that are to be generated. signature_algorithm Specify the algorithm that is to be used to sign the certificate. Specify SHA256withRSA or SHA512WithRSA. name Specify a name of your choice for the certificate chain and the private key that are created with this command. The name must be unique in the keystore. number_of_days Specify for how many days the certificate is to be valid. keystore_file Specify the fully qualified file name for the keystore. The keystore must be stored in the daemon path. Example: keytool -genkeypair -keyalg RSA -keysize sigalg SHA256withRSA -alias iccsap1 -validity 365 -keystore /home/iccsapadmin/daemon/keystore.jks Important: Ensure that your web application server can handle the level of cryptography that you specify for the keys, such as the keysize parameter. To be on the safe side, install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files on your web application server. 3. Enter a password when you are prompted by this message: Enter keystore password: For example, enter: icc4sap 4. Enter an answer for each prompt for your organization information. For example: What is your first and last name? [Unknown]: server_name 36 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

49 What is the name of your organizational unit? [Unknown]: Myunit What is the name of your organization? [Unknown]: Myorg What is the name of your City or Locality? [Unknown]: Mycity What is the name of your State or Province? [Unknown]: Mystate What is the two-letter country-code for this unit? [Unknown]: US Is <CN=myserver.com, OU=Myunit, O=Myorg, L=Mycity, ST=Unknown, C=US> correct? [no]: yes Enter key password for server_name (Press Enter if you want to use the same password as for the keystore) For server_name, specify the fully qualified host name or the IP address of the system where Collector Server is installed. A self-signed server certificate is created. What to do next: 4.2, Configuring the client authentication 4.2 Configuring the client authentication Fix Pack 1 You must export the certificate of the web application server that hosts IBM Content Navigator and import it into a truststore on the system where Collector Server is installed. You create the truststore during the import. Before you begin: 4.1, Configuring the server authentication on Collector Server, on page 35 Procedure: 1. Export the certificate of the web application server. If IBM Content Navigator is installed on IBM WebSphere Application Server, use the following steps as guidance. If IBM Content Navigator is installed on another web application server or if you use custom security settings in WebSphere Application Server, refer to your web application server documentation for more information a. In the WebSphere Application Server administration console, click Security > SSL certificate and key management. b. Under Related items, click Keystores and certificates. c. Select the keystore that contains the certificate. The default name of this keystore is NodeDefaultTrustStore. For WebSphere Application Server Network Deployment, the default name is CellDefaultTrustStore. d. Under Additional properties, click Signer certificates. e. Select the check box next to the appropriate certificate and then click Extract. f. Specify a file name with the extension.der and select the Binary DER Data as data type. For example, type: root.der g. Click OK to extract the certificate. Make a note of fully qualified path that the file is extracted to. The path might look as follows: /opt/ibm/websphere/appserver/profiles/appsrv01/etc/root.der Chapter 4. Configuring a daemon 37

50 4.3 Starting the daemon 2. Copy the certificate file of the web application server to the system where Collector Server is installed. 3. Import the certificate of the web application server into the truststore by using the Java Keytool or IKEYMAN. The truststore is created during the import. To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: a. Change to the daemon directory and then open a command line. For example, change to the following directory: /home/iccsapadmin/daemon b. Enter the following command on one line: keytool -importcert -file certificate_file -alias name -keystore truststore_file certificate_file Specify the fully qualified file name of the certificate of the web application server. name Specify a name of your choice for the certificate. The name must be unique in the truststore that is to contain the certificate. truststore_file Specify a fully qualified file name for the truststore. The truststore must be stored in the daemon path. Example: keytool -importcert -file /home/iccsapadmin/root.der -alias was1 -keystore /home/iccsapadmin/daemon/truststore.jks What to do next: 4.3, Starting the daemon Fix Pack 1 Ensure that you created all necessary keystores and paths before you start the daemon. Before you begin: v 4.2, Configuring the client authentication, on page 37. v Windows If you run several Content Collector for SAP versions on one Windows system, check the PATH environment variable on a command prompt. Procedure: 1. Change to the daemon directory and then open a command line. For example, change to the following directory: /home/iccsapadmin/daemon 2. Enter the following command: v Linux UNIX archcmd.sh com.ibm.esd.configplugin.daemon.daemon v Windows 38 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

51 archcmd.bat com.ibm.esd.configplugin.daemon.daemon 3. Specify the information that you are prompted for. When you enter a path, always specify the fully qualified path. Do not use any environment variables or shell expansions as part of a path. For example, enter the following information: Keystore file: /home/iccsapadmin/daemon/keystore.jks Keystore password: icc4sap Truststore file: /home/iccsapadmin/daemon/truststore.jks Truststore password: was Daemon port: 5000 Instance base path: /home/iccsapadmin/instances When you restart the daemon, you do not have to enter any of these values again. Tip: Windows If you have instance directories already and if they are on several partitions, enter <<ALL FILES>> as instance base path. The daemon is started. To stop the daemon, use the method that is provided by your operating system to end a process. What to do next: 4.4, Configuring the server authentication on the web application server 4.4 Configuring the server authentication on the web application server Fix Pack 1 Import the server certificate into the web application server that hosts IBM Content Navigator. Before you begin: 4.3, Starting the daemon, on page 38 Procedure: 1. Open the WebSphere Application Server administration console and log on as an administrator. 2. Click Security > SSL certificate and key management. 3. Under Related items, click Keystores and certificates. 4. Select the keystore that the server certificate is to be imported into. The default name of this keystore is NodeDefaultTrustStore. For WebSphere Application Server Network Deployment, the default name is CellDefaultTrustStore. 5. Under Additional properties, click Signer certificates. Chapter 4. Configuring a daemon 39

52 6. On the next page, click Retrieve from port. 7. Complete the following information: a. In the Host field, type the fully qualified host name or the IP address of the system where Collector Server is installed. b. In the Port field, type the daemon port. c. In the Alias field, specify a name of your choice for the certificate. The name must be unique in the keystore that is to contain the certificate. For example, type: iccsap1 8. Click Retrieve Signer Information to review the information about the server certificate. Then, click OK. 9. Click Save to store the server certificate in the keystore. 40 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

53 Chapter 5. Configuring Collector Server You must configure at least one instance of Collector Server. You create and manage your instances in Configuration Feature of Content Collector for SAP. Before you begin: 1. Plan for configuring Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Chapter 1, Preparing your environment, on page 3 3. Chapter 2, Configuring FileNet P8 for use with Content Collector for SAP, on page Chapter 3, Configuring IBM Content Navigator, on page Fix Pack 1 Chapter 4, Configuring a daemon, on page 35 Figure 17 shows which parts of the Content Collector for SAP environment belong to a Collector Server instance. Figure 17. Configuration of Collector Server Start with a basic instance configuration as follows: In Configuration Feature, complete all mandatory fields and configure the appropriate communication with SAP, IBM Content Navigator, and the repositories. In addition, define the logical archives for your repositories. Chapter 6, Configuring your environment for basic tasks, on page 61 and Chapter 7, Configuring your environment for more or advanced tasks, on page 129 show which additional information must be specified in the instance configuration for the tasks that you can complete with Content Collector for SAP. Copyright IBM Corp. 2010,

54 5.1 Getting started with Configuration Feature You can configure a Collector Server instance from scratch, or you can edit the instance configuration that you imported from an existing server configuration profile. Before you begin: Chapter 3, Configuring IBM Content Navigator, on page 31 Procedure: 1. Open a web browser and then open the IBM Content Navigator desktop for the Collector Server administrator, by typing the following URL: protocol://hostname:portnumber/context_root/?desktop=desktop_id You must have access to this desktop. For example, type: 2. Log on as Collector Server administrator. 3. In the plug-in pane on the left, click the IBM Content Collector for SAP Applications Configuration Feature icon. The Manage Collector Server Instances page opens where you start the configuration of Collector Server instances and manage your configurations. 4. In the upper right corner, you can change the view from Basic settings to Extended settings. InBasic settings view, you see all sections and controls that you must complete to create a basic instance configuration. The Extended settings view shows all available configuration sections and configuration options. Fix Pack 1 IBM Content Navigator remembers your selection until you change it again. 5. Configure as many instances of Collector Server as you need. Fix Pack 1 If you plan to start and stop the Collector Server instances from IBM Content Navigator, do not specify environment variables or shell expansions as part of a path in the instance configurations. Always specify the fully qualified paths Importing the instance configuration from a server configuration profile If you want to reuse a server configuration profile from a previous version of Content Collector for SAP, you must import the instance configuration from the profile into the IBM Content Navigator database. A Collector Server instance that is used for an archiving, a document-linking, or an index-transfer task must be available in the IBM Content Navigator database. To import an instance configuration that is specified in a server configuration profile, into the IBM Content Navigator database, complete these steps in Configuration Feature: 1. On the Manage Collector Server Instances page, click Import. 2. Select the server configuration profile that the instance configuration is to be imported from and then click Open. 3. In the Import Configuration from a Server Configuration Profile window, click OK. If the import was completed with warnings, a window opens where you find more details. Click Close. 42 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

55 4. Go through the imported configuration, check the imported values, and add any missing values. The configuration panes that require values for mandatory fields are highlighted in the navigation pane. Fix Pack 1 If you plan to start and stop the Collector Server instances from IBM Content Navigator, ensure that the paths in the instance configurations do not contain any environment variables or shell expansions. Replace paths that contain environment variables or shell expansions with fully qualified paths. 5. After you finish, click Save Creating several instances of Collector Server: Hints and tips You might need more than one instance of Collector Server. The following tables give an overview of which paths and ports must differ for each instance. Paths that must differ for each instance Instance path Path to job queues The job queues must be stored in the queue directory within the instance path or in a path of your choice, as specified in the instance configuration. Where to find the path in Configuration Feature Basic Configuration > General > Instance path Basic Configuration > Paths > Paths > Job queues Temporary files Basic Configuration > Paths > Paths > Temporary files Path to master key file Basic Configuration > Security > General > Master key file Ports that must differ for each instance Collector Server port Basic Configuration > Communication > Ports > Collector Server port Web port Basic Configuration > Communication > HTTP or HTTPS Communication with SAP > Web port SSL web port Basic Configuration > Communication > HTTP or HTTPS Communication with SAP > SSL web port Web client port Basic Configuration > Communication > HTTPS Communication with IBM Content Navigator > Web client port 5.2 Configuring the communication with SAP, IBM Content Navigator, and the API Define how a Collector Server instance communicates with SAP, IBM Content Navigator, and the API of Content Collector for SAP. Chapter 5. Configuring Collector Server 43

56 Task Before you begin: Plan for a secure communication. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Communication with SAP, IBM Content Navigator, and the API: Overview How a Collector Server instance communicates with SAP, IBM Content Navigator, and the API and whether Java RFC dispatchers must be started depend on the task that you want to perform. The following table provides an overview. HTTP or HTTPS With SAP RFC With IBM Content Navigator With the API Java RFC dispatcher Remarks Archiving data x x Either an HTTP/HTTPS connection or an RFC connection is required. Archiving data and protecting archived data and documents by using BC-ILM 3.0 Archiving incoming documents by creating work items in an SAP workflow Archiving incoming documents by processing their bar codes Archiving outgoing documents Archiving and viewing print lists Viewing archived documents and print lists with the SAP GUI Viewing FileNet P8 objects with IBM Content Navigator Transferring index information Communicating with external applications, such as IBM Datacap x x x x x Only the web dispatcher is used. The bar code is sent directly to SAP. x x Either an HTTP/HTTPS connection or an RFC connection is required. x x An RFC connection can be used for print lists only. x The IBM Content Navigator desktop for viewing objects is used. The communication with this desktop is specified in the logical FileNet P8 archives. x x The Java RFC dispatcher is required if you want to archive the documents by creating work items in an SAP workflow 44 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

57 5.2.2 Configuring the communication with SAP To enable an SAP system to communicate with a Collector Server instance, you must specify an HTTP connection or an RFC connection in the instance configuration. In addition, you must configure SAP. Before you begin: Plan for a secure communication with SAP. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH To configure the instance for the appropriate connection, go to the Communication pane of Configuration Feature. To configure SAP, complete either of the following tasks: v , Configuring SAP for an HTTP connection v , Configuring SAP for an RFC connection, on page Configuring SAP for an HTTP connection You use the SAP GUI to configure SAP for an HTTP connection. Procedure: , Creating an SAP ArchiveLink protocol for an HTTP connection , Creating SAP ArchiveLink queues for an HTTP connection, on page , Creating a content repository for an HTTP connection, on page , Enabling the use of HTTP requests with a seckey, on page Creating an SAP ArchiveLink protocol for an HTTP connection: Create a protocol for the general SAP ArchiveLink interface to the HTTP content server. Create the sample protocol HTTP1. Procedure: 1. In the SAP GUI, enter the transaction code OAA3 to open the ArchiveLink: Communications Interface Administration window. 2. Click the New protocol icon. 3. In the Create New Protocol window, specify the following settings: Field Description Example Protocol Type a name for the protocol. Type: HTTP1 Version Description Specify the version of the SAP ArchiveLink HTTP Content Server Interface. Normally, 0045 is sufficient. However, if a cache server is used, specify Specify information about this protocol. Type: 0045 Type: Demo_HTTP Figure 18 on page 46 shows the Create New Protocol window containing the Chapter 5. Configuring Collector Server 45

58 sample specifications. Figure 18. Create New Protocol window containing the sample protocol name, the version, and a sample description The ArchiveLink: Communications Interface Administration window lists the new protocol. What to do next: , Creating SAP ArchiveLink queues for an HTTP connection Creating SAP ArchiveLink queues for an HTTP connection: Complete the following steps to create SAP ArchiveLink queues. Before you begin: , Creating an SAP ArchiveLink protocol for an HTTP connection, on page 45 Procedure: 1. In the SAP GUI, enter the transaction code OAQI to open the SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window. 2. Make sure that all fields except for Queue Administrator contain an X. 3. In the Queue Administrator field, type the logon ID of an SAP user who should receive error notifications. By default, the current logon ID is inserted. For example, type: ADMIN 4. Click the Execute icon. Figure 19 shows the SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window containing the required settings. Figure 19. SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window containing the required settings 46 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

59 What to do next: , Creating a content repository for an HTTP connection Creating a content repository for an HTTP connection: For each logical archive that is defined in the instance configuration, you must create a content repository in SAP. With a content repository, you establish the connection between an SAP system and a logical archive. Create the sample content repository A2 for the sample SAP ArchiveLink protocol HTTP1. Before you begin: , Creating SAP ArchiveLink queues for an HTTP connection, on page 46 Procedure: 1. In the SAP GUI, enter the transaction code OAC0 to open the Display Content Repositories: Overview window. 2. Click the Change icon. 3. In the Change Content Repositories: Overview window, click the Create icon. 4. In the Change Content Repositories: Detail window, click Full administration. 5. Specify the following information: Field Description Example Content Rep. Type the ID of the logical archive that you create the content repository for. Type: A2 Description Document area Storage type Protocol Version no. HTTP server Type a short description for the content repository. Select ArchiveLink. Select HTTP content server. Select the SAP ArchiveLink protocol that you created. Select the version of the SAP ArchiveLink HTTP Content Server Interface, which you specified in the SAP ArchiveLink protocol. Type the fully qualified host name or IP address of the system where Collector Server is installed. Important: If the logical archive is to be used for documents that you want to view with IBM Content Navigator and if a common user is to be used for the logon, you must specify the fully qualified host name. Type: Sample archive A2 Select HTTP1. Select Type: myhost.yourdomain.com Chapter 5. Configuring Collector Server 47

60 Field Description Example Port Number Type the port number of the TCP/IP port through which the web dispatcher of Collector Server gets its requests. Type: 5580 HTTP Script Basic Path Archive Path OutputDevice No signature Specify the same port number as in the following field in Configuration Feature: Basic Configuration > Communication > HTTP or HTTPS Communication with SAP > Web port. Type: cs Type the full path to the exchange directory where your SAP applications are to store the files that are to be archived by Content Collector for SAP. The path must end with a delimiter, which is \ on Windows and / on Linux and UNIX systems. Make sure that both servers can access this directory. Type the full path to the directory where Collector Server and SAP can retrieve the archived files. The path must end with a delimiter, which is \ on Windows and / on Linux and UNIX systems. It is usually the same path as for the Basic Path field. Select ARCH. If selected, no signature is used. Generally, use it for test purposes only. Type: D:\SAPSERVER\transfer\base\ Type: D:\SAPSERVER\transfer\arch\ Figure 20 on page 49 shows the Change Content Repositories: Detail window containing your specifications. 48 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

61 Figure 20. Change Content Repositories: Detail window containing your specifications 6. Click the Save icon to save your settings. What to do next: , Enabling the use of HTTP requests with a seckey Enabling the use of HTTP requests with a seckey: HTTP requests from SAP usually contain the seckey parameter. The value of this parameter is an encrypted hash sum of selected URL parameters. To ensure that an SAP request was not manipulated, Collector Server uses the SAP certificate to evaluate the hash sum. An SAP certificate must be available for each logical archive that is defined in the Collector Server instance configuration and that the SAP system communicates with. Before you begin: , Creating a content repository for an HTTP connection, on page 47 Complete these steps to transfer an SAP certificate to the Collector Server instance: 1. In the SAP GUI, use either of the following procedures: v In the Change Content Repositories: Detail window, click the Send certificate icon. v Enter the transaction code OAHT to open the Send certificates to HTTP content server window. Double-click the content repository that defines the connection to a logical archive. For example, double-click A2. The corresponding Collector Server instance receives the SAP certificate and saves it in the SAPCertificates directory. For example, the SAP certificate for logical archive A2 would be stored as A2.pse.fingerprint.TO_BE_CONFIRMED. fingerprint stands for the hash value that uniquely identifies the SAP certificate. Chapter 5. Configuring Collector Server 49

62 2. To accept the SAP certificate, complete these steps: a. Open a command line and change to the directory where the server configuration profile that contains the logical archive is stored. b. Enter the following command: archcert -a archive_id archive_id stands for the logical archive ID. For example, A2. For more information about this command and the parameters that you can specify, see the topic archcert in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH c. The content of the SAP certificate is displayed. Review it. d. If you decide to accept the SAP certificate, enter YES. Collector Server saves the SAP certificate in the SAPCertificates directory as archive_id.pse.fingerprint, for example, A2.pse.fingerprint. You can verify the SAP certificate in SAP by comparing the fingerprint to the one in the Trust Manager (transaction code STRUST) Configuring SAP for an RFC connection You use the SAP GUI to configure SAP for a Remote Function Call (RFC) connection. Procedure: , Creating an RFC destination for an RFC connection , Creating an SAP ArchiveLink protocol for an RFC connection, on page , Creating SAP ArchiveLink queues for an RFC connection, on page , Creating a content repository for an RFC connection, on page Creating an RFC destination for an RFC connection: Create the sample RFC destination KD7.iccsap. Procedure: 1. In the SAP GUI, enter the transaction code SM59 to open the Configuration of RFC Connections window. 2. In the RFC Connections column, click TCP/IP connections and then click Create icon. 3. In the RFC Destination field of the RFC Destination window, type a name for the RFC destination. You can use a name of your choice. However, you might want to use the same name as in the Program ID field, which you specify in step 7 on page 51. For example, type: KD7.iccsap 4. Under Description, type a description in one or more of the Description fields. For example, type: RFC Connection 1 5. Click the Technical Settings tab. 6. Under Activation Type, click Registered Server Program. 50 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

63 7. In the Program ID field, type the program ID under which the dispatcher is registered on the SAP Gateway. Important: If the RFC destination is to be used by SAP Document Finder, append the number 1 to the ID. For example, if the program ID is KD7.iccsap, type KD7.iccsap1 in the Program ID field. For example, type: KD7.iccsap1 This program ID must also be specified in the following field in Configuration Feature: SAP System > General > General > Program ID. In Configuration Feature, the number 1 must be omitted. 8. Click the Save icon to save your settings. Figure 21 shows what the RFC Destination window might look like after you completed step 3 on page 50 through step 7. Figure 21. RFC Destination window containing the sample name of the RFC destination, the connection type, the sample description for the connection, the activation type, and the sample program ID What to do next: , Creating an SAP ArchiveLink protocol for an RFC connection Creating an SAP ArchiveLink protocol for an RFC connection: Create a protocol for the general SAP ArchiveLink interface to the RFC content server. Create the sample protocol RFC1. Chapter 5. Configuring Collector Server 51

64 Before you begin: , Creating an RFC destination for an RFC connection, on page 50 Procedure: 1. In the SAP GUI, enter the transaction code OAA3 to open the ArchiveLink: Communications Interface Administration window. 2. Click the New protocol icon. 3. In the Create New Protocol window, specify the following settings: Field Description Example Protocol Type a name for the protocol. Type: RFC1 Version Description Specify the version of the SAP ArchiveLink Interface, namely Specify information about this protocol. Type: Demo_RFC Figure 22 shows what the Create New Protocol window might look like after you typed the necessary information. Figure 22. Create New Protocol window containing the protocol name, the version, and a sample description 4. Click the Save icon to save your settings. What to do next: , Creating SAP ArchiveLink queues for an RFC connection Creating SAP ArchiveLink queues for an RFC connection: Complete the following steps to create SAP ArchiveLink queues. Before you begin: , Creating an SAP ArchiveLink protocol for an RFC connection, on page 51 Procedure: 1. In the SAP GUI, enter the transaction code OAQI to open the SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window. 2. Make sure that all fields except for Queue Administrator contain an X. 3. In the Queue Administrator field, type the logon ID of an SAP user who should receive error notifications. By default, the current logon ID is inserted. For example, type: ADMIN 4. Click the Execute icon. 52 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

65 Figure 23 shows the SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window containing the required settings. Figure 23. SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window containing the required settings What to do next: , Creating a content repository for an RFC connection Creating a content repository for an RFC connection: For each logical archive that is defined in the instance configuration, you must create a content repository in SAP. With a content repository, you establish the connection between an SAP system and a logical archive. Create the sample content repository A1 for the sample SAP ArchiveLink protocol RFC1. Before you begin: , Creating SAP ArchiveLink queues for an RFC connection, on page 52 Procedure: 1. In the SAP GUI, enter the transaction code OAC0 to open the Display Content Repositories: Overview window. 2. Click the Change icon. 3. In the Change Content Repositories: Overview window, click the Create icon. 4. In the Change Content Repositories: Detail window, click Full administration. 5. Specify the following information: Field Description Example Content Rep. Description Document area Storage type Protocol Type the ID of the logical archive that you create the content repository for. Type a short description for the content repository. Select ArchiveLink. Select RFC Archive id. Select the SAP ArchiveLink protocol that you created. Type: A1 Type: Sample archive A1 Select RFC1. Chapter 5. Configuring Collector Server 53

66 Field Description Example Version no. Select RFC destination Select the RFC destination that you Select KD7.iccsap. previously created. Basic Path Type the full path to the exchange directory where your SAP applications are to store the files that are to be archived by Content Collector for SAP. Type: D:\SAPSERVER\transfer\ base\ The path must end with a delimiter, which is \ on Windows and / on Linux and UNIX systems. Archive Path OutputDevice Specify the same path as in the following field in Configuration Feature: Basic Configuration > Communication > RFC Communication with SAP > Basic path. Type the full path to the directory where Collector Server and SAP can retrieve the archived files. The path must end with a delimiter, which is \ on Windows and / on Linux and UNIX systems. Specify the same path as in the following field in Configuration Feature: Basic Configuration > Communication > RFC Communication with SAP > Archive path. It is usually the same path as for the Basic Path field. Select ARCH. Type: D:\SAPSERVER\transfer\ arch\ Figure 24 on page 55 shows the Change Content Repositories: Detail window containing your specifications. 54 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

67 Figure 24. Change Content Repositories: Detail window containing your specifications 6. Click the Save icon to save your settings Configuring the communication with IBM Content Navigator You must configure the Collector Server instance for the communication with IBM Content Navigator. In addition, you must configure server authentication and client authentication on Collector Server and on the web application server that hosts IBM Content Navigator. Before you begin: Plan for a secure Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH To configure the instance for the communication with IBM Content Navigator, go to the Communication pane of Configuration Feature. To configure server authentication and client authentication, complete these tasks: Procedure: , Configuring the server authentication , Configuring the client authentication, on page Configuring the server authentication You must configure the server authentication on Collector Server and on the web application server that hosts IBM Content Navigator. Configure the server authentication on the web application server after you start the Collector Server instance Configuring the server authentication on Collector Server: Create an SSL keystore and a certificate for the Collector Server instance. Chapter 5. Configuring Collector Server 55

68 If you already created a server certificate for an HTTPS communication with an SAP system, you must use this certificate for the communication with IBM Content Navigator. In this case, skip the following procedure and continue with , Configuring the client authentication, on page 58. The Java Keytool and IKEYMAN are both delivered with Content Collector for SAP as part of the IBM JRE and have the following fully qualified file names: v The Java Keytool: Linux UNIX InstallHome/java/jre/bin/keytool Windows InstallHome\java\jre\bin\keytool.exe v IKEYMAN: Linux UNIX InstallHome/java/jre/bin/ikeyman Windows InstallHome\java\jre\bin\ikeyman.exe To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: 1. Open a command line on the system where the Collector Server instance runs. 2. Enter the following command on one line: keytool -genkeypair -keyalg key_algorithm -keysize keysize -sigalg signature_algorithm -alias name -validity number_of_days -keystore ssl_keystore_file key_algorithm Specify the algorithm that is to be used to generate the key pair. Specify RSA. keysize Specify the size of the keys that are to be generated. signature_algorithm Specify the algorithm that is to be used to sign the certificate. Specify SHA256withRSA or SHA512WithRSA. name Specify a name of your choice for the certificate chain and the private key that are created with this command. The name must be unique in the keystore. number_of_days Specify for how many days the certificate is to be valid. ssl_keystore_file Specify a fully qualified file name for the SSL keystore. Tip: Because an SSL keystore is required for each instance of Collector Server, it is good practice to create the SSL keystore in the instance directory. For example, specify: v Linux UNIX /home/iccsapadmin/instance1/security/https/ keystore.jks v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\ instance1\security\https\keystore.jks 56 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

69 Example: keytool -genkeypair -keyalg RSA -keysize sigalg SHA256withRSA -alias iccsap_instance1 -validity 365 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks Important: Ensure that your web application server can handle the level of cryptography that you specify for the keys, such as the keysize parameter. To be on the safe side, install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files on your web application server. 3. Enter a password when you are prompted by this message: Enter keystore password: For example, enter: icc4sap 4. Enter an answer for each prompt for your organization information. For example: What is your first and last name? [Unknown]: server_name What is the name of your organizational unit? [Unknown]: Myunit What is the name of your organization? [Unknown]: Myorg What is the name of your City or Locality? [Unknown]: Mycity What is the name of your State or Province? [Unknown]: Mystate What is the two-letter country-code for this unit? [Unknown]: US Is <CN=myserver.com, OU=Myunit, O=Myorg, L=Mycity, ST=Unknown, C=US> correct? [no]: yes Enter key password for server_name (Press Enter if you want to use the same password as for the keystore) For server_name, specify the fully qualified host name or the IP address of the system where Collector Server is installed. A self-signed server certificate is created. What to do next: , Configuring the client authentication, on page Configuring the server authentication on the web application server: Import the server certificate in the truststore of your web application server and enable SSL support for the IBM Content Navigator server. Before you begin: 8.1, Starting a Collector Server instance, on page 165 You use your web application server administration tools for this task. If IBM Content Navigator is installed on IBM WebSphere Application Server, use the following steps as guidance. If IBM Content Navigator is installed on another web application server or if you use custom security settings in WebSphere Application Server, refer to your web application server documentation for more information. Chapter 5. Configuring Collector Server 57

70 Procedure: 1. Start the Collector Server instance that is to communicate with IBM Content Navigator. 2. Open the WebSphere Application Server administration console and log on as an administrator. 3. Click Security > SSL certificate and key management. 4. Under Related items, click Keystores and certificates. 5. Select the keystore that the server certificate is to be imported into. The default name of this keystore is NodeDefaultTrustStore. For WebSphere Application Server Network Deployment, the default name is CellDefaultTrustStore. 6. Under Additional properties, click Signer certificates. 7. On the next page, click Retrieve from port. 8. Complete the following information: a. In the Host field, type the fully qualified host name or the IP address of the system where Collector Server is installed. b. In the Port field, type the web client port, which IBM Content Navigator uses to communicate with the Collector Server instance. c. In the Alias field, specify a name of your choice for the certificate. The name must be unique in the keystore that is to contain the certificate. For example, type: iccsap_instance1 9. Click Retrieve Signer Information to review the information about the server certificate. Then, click OK. 10. Click Save to store the server certificate in the keystore. What to do next: , Configuring the client authentication Configuring the client authentication You must export the certificate of the web application server that hosts IBM Content Navigator and import it into the SSL truststore of the Collector Server instance. Before you begin: , Configuring the server authentication, on page 55 Procedure: 1. Export the certificate of the web application server. If IBM Content Navigator is installed on IBM WebSphere Application Server, use the following steps as guidance. If IBM Content Navigator is installed on another web application server or if you use custom security settings in WebSphere Application Server, refer to your web application server documentation for more information a. In the WebSphere Application Server administration console, click Security > SSL certificate and key management. b. Under Related items, click Keystores and certificates. c. Select the keystore that contains the certificate. The default name of this keystore is NodeDefaultTrustStore. For WebSphere Application Server Network Deployment, the default name is CellDefaultTrustStore. d. Under Additional properties, click Signer certificates. e. Select the check box next to the appropriate certificate and then click Extract. 58 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

71 f. Specify a file name with the extension.der and select the Binary DER Data as data type. For example, type: root.der g. Click OK to extract the certificate. Make a note of fully qualified path that the file is extracted to. The path might look as follows: /opt/ibm/websphere/appserver/profiles/appsrv01/etc/root.der 2. Copy the certificate file of the web application server to the system where Collector Server is installed. 3. Import the certificate of the web application server into the SSL truststore by using the Java Keytool or IKEYMAN. The SSL truststore is created during the import. To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: a. Open a command line on the system where the server instance runs. b. Enter the following command on one line: keytool -importcert -file certificate_file -alias name -keystore ssl_truststore_file certificate_file Specify the fully qualified file name of the certificate of the web application server. name Specify a name of your choice for the certificate. The name must be unique in the truststore that is to contain the certificate. ssl_truststore_file Specify a fully qualified file name for the SSL truststore. Tip: Because an SSL truststore must not be shared by several instances of Collector Server, it is good practice to create the truststore in the instance directory. For example, specify: v Linux UNIX /home/iccsapadmin/instance1/security/https/ truststore.jks v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\ instance1\security\https\truststore.jks Example: keytool -importcert -file /home/iccsapadmin/root.der -alias was1 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks Chapter 5. Configuring Collector Server 59

72 60 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

73 Chapter 6. Configuring your environment for basic tasks Archiving and viewing data and print lists and archiving, linking, and viewing documents are the tasks that you probably complete most frequently. For these basic tasks, you need a basic environment, which is the SAP GUI, IBM Content Navigator, one or more Collector Server instances, and one or more repositories. Before you begin: 1. Chapter 1, Preparing your environment, on page Chapter 2, Configuring FileNet P8 for use with Content Collector for SAP, on page Chapter 3, Configuring IBM Content Navigator, on page Fix Pack 1 Chapter 4, Configuring a daemon, on page Chapter 5, Configuring Collector Server, on page 41. It is assumed that you completed a basic instance configuration. In Configuration Feature, you completed all mandatory fields, and you configured the appropriate communication with SAP and IBM Content Navigator. In addition, you defined the logical archives for your repository. Most of the basic tasks require additional settings in the instance configuration and additional configuration of SAP or of your repository. The following topics show which parts of the basic environment are used by a task and which parts require additional configuration. 6.1 Configuring for archiving data Content Collector for SAP supports various data archiving solutions. For example, it supports the archiving of data on different media, such as hard disks, tapes, or WORMs. In addition, it supports automatic moving of data from one medium to another. To archive data, you need the basic environment. Figure 25 on page 62 shows which parts of the Content Collector for SAP environment must be configured so that you can archive data. Copyright IBM Corp. 2010,

74 Figure 25. Configuration of your Content Collector for SAP environment for archiving data In your basic instance configuration, you configured the following parts: v An HTTP connection or an RFC connection between the Collector Server instance and SAP v The logical archives where the data is to be stored Thus, your instance configuration is complete. To archive data, you must also configure SAP. The configuration tasks are explained by using the sample archive object FI_BANKS, which refers to bank master data. Bank master data is usually not archived. Therefore, you can use the sample archive object in an SAP production system. Procedure: , Setting up the sample archiving object FI_BANKS , Configuring the SAP ArchiveLink path, on page , Checking your data archiving configuration, on page , Creating test data for the sample archiving object, on page , Running an archiving session to test your archiving setup, on page Setting up the sample archiving object FI_BANKS Configure SAP for the use of the sample archiving object FI_BANKS. Procedure: 1. In the SAP GUI, enter the transaction code SARA to open the Archive Administration: Initial Screen window. 62 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

75 2. In the Object Name field, specify: FI_BANKS Figure 26 shows the Archive Administration: Initial Screen containing the sample archiving object name. Figure 26. Archive Administration: Initial Screen window containing the name of the sample archiving object FI_BANKS 3. Click Customizing to open the Data Archiving Customizing window. 4. Under Archiving Object-Specific Customizing, double-click Technical Settings. Figure 27 shows which item to double-click in the Data Archiving Customizing window. Figure 27. Data Archiving Customizing window showing which item to double-click 5. In the Change View "Customizing View for Archiving": Details window, specify the following settings unless they are already specified: a. Under Delete Jobs, select Start Automatically. b. Under Place File in Storage System: 1) In the Content Repository field, specify where the data is to be archived. Specify the logical archive ID. Where to find the information in Configuration Feature: Basic Configuration > Logical Archives > Overview > Logical Archive ID Chapter 6. Configuring your environment for basic tasks 63

76 For example, type: A1 2) Select the Start Automatically check box. This setting ensures that, when the archiving session is run, a request is automatically sent to Content Collector for SAP to archive the file that was generated with SAP. 3) Under Sequence, select Store Before Deleting. Figure 28 shows what the Change View "Customizing View for Archiving": Details window might look like after you completed step 5a on page 63 and step 5b on page 63. Figure 28. Change View "Customizing View for Archiving": Details window containing your settings 6. Click the Save icon to save your settings. 7. In the Prompt for Workbench request window, select a request in the Request field. If a request does not exist yet, click the Create icon to create a request. 8. Click the Continue icon to return to the Change View "Customizing View for Archiving": Details window. What to do next: 6.1.2, Configuring the SAP ArchiveLink path Configuring the SAP ArchiveLink path Complete these steps to configure the SAP ArchiveLink path. Before you begin: 6.1.1, Setting up the sample archiving object FI_BANKS, on page Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

77 Procedure: 1. In the SAP GUI, enter the transaction code FILE to open the Change View "Logical File Path Definition": Overview window. If a window opens with the message Caution: The table is cross-client., press Enter. 2. In the table, select ARCHIVE_GLOBAL_PATH by clicking in the first cell of the row that contains this entry. 3. Double-click Assignment of Physical Paths to Logical Path in the Dialog Structure pane on the left. Figure 29 shows which items you must select in the Change View "Logical File Path Definition": Overview window. Figure 29. Change View "Logical File Path Definition": Overview window reflecting your selections in Step 2 and Step 3 The Change View "Assignment of Physical Paths to Logical Path": Overview window opens. 4. In the Syntax grp column of the table, double-click the entry for your operating system. For example, double-click UNIX. Figure 30 on page 66 shows what your selection might look like. Chapter 6. Configuring your environment for basic tasks 65

78 Figure 30. Change View "Assignment of Physical Paths to Logical Path": Overview window containing your sample selection UNIX 5. As Physical path, specify the full path to the exchange directory where your SAP applications must store the files that are to be archived by Content Collector for SAP. Use the path that you specified in the Basic Path field when you created the content repository in SAP (transaction code OAC0). For example, type: /home/sap/transfer/base/ Figure 31 shows what your specification might look like. Figure 31. Change View "Assignment of Physical Paths to Logical Path": Overview window containing the sample physical path 6. In the Dialog Structure pane on the left, double-click Logical File Name Definition, Cross-Client. 66 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

79 7. In the Change View "Logical File Name Definition, Cross-Client": Overview window, double-click ARCHIVE_DATA_FILE_WITH_ARCHIVE_LINK. Figure 32 shows which item you must double-click. Figure 32. Change View "Logical File Name Definition, Cross-Client": Overview window showing which item to double-click 8. Check whether the Logical path field shows ARCHIVE_GLOBAL_PATH. Correct the path, if necessary. Figure 33 shows which field you must check. Figure 33. Change View "Logical File Name Definition, Cross-Client": Details window showing which field to check 9. Click the Save icon to save your settings. Then click the Back icon. 10. In the Change View "Logical File Name Definition, Cross-Client": Overview window, double-click the ARCHIVE_DATA_FILE table entry. See Figure 32, which also lists the ARCHIVE_DATA_FILE table entry. Chapter 6. Configuring your environment for basic tasks 67

80 11. Check whether the Logical path field shows ARCHIVE_GLOBAL_PATH. Correct the path, if necessary. Figure 34 shows which field you must check. Figure 34. Change View "Logical File Name Definition, Cross-Client": Details window showing which field to check 12. Click the Save icon to save your settings. What to do next: 6.1.3, Checking your data archiving configuration Checking your data archiving configuration Check the configuration for your sample archiving object FI_BANKS. Before you begin: 6.1.2, Configuring the SAP ArchiveLink path, on page 64 Procedure: 1. In the SAP GUI, enter the transaction code SARA to open the Archive Administration: Initial Screen window. 2. In the Object Name field, specify: FI_BANKS Figure 26 on page 63 shows the Archive Administration: Initial Screen containing the sample archiving object name. 3. Click Customizing to open the Data Archiving Customizing window. 4. Under Archiving Object-Specific Customizing, double-click Technical Settings. Figure 27 on page 63 shows which item to click in the Data Archiving Customizing window. 5. In the Change View "Customizing View for Archiving": Details window, check the following settings: a. Make sure that the Logical File Name field contains either of the following values: v ARCHIVE_DATA_FILE v ARCHIVE_DATA_FILE_WITH_ARCHIVE_LINK b. Under Settings for Delete Program, check whether the Test Mode Variant contains a test variant, for example: SAP&TEST 68 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

81 c. Check whether the Production Mode Variant field contains a production variant, for example: SAP&PROD d. Under Delete Jobs, check whether Start Automatically is selected. e. Under Place File in Storage System, check whether the correct archive is specified in the Content Repository field. For example, check if A1 is specified. f. Check whether the Start Automatically check box is selected. This setting ensures that, when the archiving session is run, a request is automatically sent to Content Collector for SAP to archive the file that was generated with SAP. g. Under Sequence, check whether Store Before Deleting is selected. Figure 35 shows what the Change View "Customizing View for Archiving": Details window might look like with the information that you checked in step 5a on page 68 through step 5g. Figure 35. Change View "Customizing View for Archiving": Details window containing the necessary settings 6. Click the Save icon to save your settings. 7. In the Prompt for Workbench request window, select a request in the Request field. If a request does not exist yet, click the Create icon to create a request. Chapter 6. Configuring your environment for basic tasks 69

82 8. Click the Continue icon to return to the Change View "Customizing View for Archiving": Details window. Your settings are saved. What to do next: 6.1.4, Creating test data for the sample archiving object Creating test data for the sample archiving object Complete these steps to create test data for the sample archiving object FI_BANKS. Before you begin: 6.1.3, Checking your data archiving configuration, on page 68 Procedure: 1. In the SAP GUI, enter the transaction code FI01 to open the Create Bank: Initial Screen window. 2. In the Bank Country field, type: AD 3. In the Bank Key field, type: Figure 36 shows what the Create Bank: Initial Screen window might look like after you completed step 2 and step 3. Figure 36. Create Bank: Initial Screen window containing your specifications 4. Press Enter. 5. In the Create Bank: Detail Screen window, type Archiving test in the Bank name field. Figure 37 on page 71 shows the Create Bank: Detail Screen window containing the bank name. 70 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

83 Figure 37. Create Bank: Detail Screen window containing the bank name 6. Click the Save icon to save your settings. What to do next: 6.1.5, Running an archiving session to test your archiving setup Running an archiving session to test your archiving setup Test your setup by archiving the test data for archiving object FI_BANKS. Before you begin: 6.1.4, Creating test data for the sample archiving object, on page 70 Procedure: 1. In the SAP GUI, enter the transaction code SARA to open the Archive Administration: Initial Screen window. 2. In the Object Name field, specify: FI_BANKS 3. Optional: If necessary, click Customizing to check and correct your configuration settings. 4. Click Write. 5. In the Archive Administration: Create Archive Files window, specify a variant in the Variant field For example, type: test_variant Figure 38 on page 72 shows the Archive Administration: Create Archive Files window containing the sample variant test_variant. Chapter 6. Configuring your environment for basic tasks 71

84 Figure 38. Archive Administration: Create Archive Files window containing the sample variant test_variant 6. Click Maintain. 7. In the Variants: Change Screen Assignment window, select For All Selection Screens and then click the icon. 8. Click Maintain again. 9. In the Maintain Variant window, specify the following information: a. Under Bank Master Data, type AD in the Bank Country field. b. Under Restrictions, clear the Only With Deletion Indicator check box. c. In the Min.No.of Days in the System field, type: 0 d. Under Processing Options, click Production Mode. e. From the Detail Log list, select Complete. f. From the Log Output list, select List. g. In the Archiving Session Note field, type a description. For example, type: Content Collector for SAP Test Figure 39 on page 73 shows what the Maintain Variant window might look like after you completed step Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

85 Figure 39. Maintain Variant window containing the necessary settings 10. Click the Save icon to save your settings. 11. Click the Back icon. 12. To specify when the archiving session is to run, take these steps: a. In the Archive Administration: Create Archive Files window, click Start Date. b. In the Start Time window, click Immediate. c. Click the Save icon at the bottom of the window. Figure 40 on page 74 shows which button to click in the Start Time window. Chapter 6. Configuring your environment for basic tasks 73

86 Figure 40. Start Time window showing which button to click 13. To specify the output device, take these steps: a. In the Archive Administration: Create Archive Files window, click Spool Params. b. In the Background Print Parameters window, specify a suitable printer in the Output Device field. For example, type: LP01 c. Click the Continue icon. Figure 41 shows the Background Print Parameters window containing the sample printer. Figure 41. Background Print Parameters window containing the sample printer LP01 74 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

87 14. In the Archive Administration: Create Archive Files window, click the Execute icon to run the archiving session. 15. Click the Job Overview icon. In the Job Overview window, you see the different jobs that are started for this archiving session, where no stands for the number that is assigned to the job. ARV_FI_BANKS_SUBno ARV_FI_BANKS_WRIno ARV_FI_BANKS_DELno ARV_FI_BANKS_STOno submit write delete store After the STO job finishes and if the Start Automatically check box is selected in the Change View "Customizing View for Archiving": Details window under Place File in Storage System, a request is automatically sent to Content Collector for SAP to archive the file that was generated with SAP. See Figure 35 on page Configuring for archiving data and protecting archived data and documents by using BC-ILM 3.0 With BC-ILM 3.0, you can archive data in Tivoli Storage Manager and protect the archived data. In addition, you can protect documents that are archived in FileNet P8. Before you begin: Plan for configuring your environment for the use of BC-ILM. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH SAP Application Server must be installed as a J2EE Engine, or as an ABAP Engine and a J2EE Engine. In addition, you need Tivoli Storage Manager and FileNet P8 Version 5.2, or later, as repositories. Figure 42 on page 76 gives an overview of how the life-cycle management of SAP data is integrated with Content Collector for SAP. Chapter 6. Configuring your environment for basic tasks 75

88 Applications XML Archiving Program local archive.. administration XML Archiving.. Program XML Archive API XML DAS Connector local archive administration XML Archive API XML DAS Connector SAP NetWeaver Application Server Java SAP NetWeaver Application Server ABAP http(s) http(s) Archiving system XML Data Administration XML Data Archiving Service (robust) file system Content Collector for SAP Figure 42. Overview of a life-cycle management environment Figure 43 on page 77 shows which parts of the Content Collector for SAP environment must be configured so that you can use BC-ILM Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

89 Figure 43. Configuration of your Content Collector for SAP environment for using BC-ILM 3.0 In your basic instance configuration, you configured the following parts: v An HTTP connection between the Collector Server instance and SAP. v The logical FileNet P8 archives where the documents are stored. v The logical Tivoli Storage Manager archive for BC-ILM. As BC-ILM version, you specified BC-ILM 3.0. In a server configuration profile, you find the following specifications that relate to BC-ILM 3.0: Section in server configuration profile Keyword UI field that supplies the value Global section WEBDAV_AUTH User for ILM-enabled data archiving ARCHIVE STORAGETYPE The selection of BC-ILM 3.0 results in the value TSM_WEBDAV_ILM3. Where to find the UI field in Configuration Feature Logical Archives > Tivoli Storage Manager for BC-ILM Logical Archives > Logical Tivoli Storage Manager Archive for BC-ILM > General To use BC-ILM 3.0, you must also configure XML Data Archiving Service (XML DAS) and your SAP system. Complete these tasks: , Creating a user for ILM-enabled data archiving, on page , Creating a root collection in the empty logical archive, on page 79 Chapter 6. Configuring your environment for basic tasks 77

90 , Creating a destination in XML Data Archiving Service (XML DAS), on page , Creating an archive store in XML Data Archiving Service (XML DAS), on page , Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS), on page , Creating the home paths for the archiving objects in the logical archive, on page , Assigning the home paths to the archive store, on page Creating a user for ILM-enabled data archiving Create a user who is allowed to archive data by using XML Data Archiving Service (XML DAS). The procedure for creating this user depends on whether the user data is stored in the SAP J2EE database or in the SAP ECC database. You must have the permission to create such a user Creating a user for ILM-enabled data archiving if the user data is stored in the SAP J2EE database Complete these steps if you installed SAP Application Server as a J2EE Engine. Create the sample user XMLDAS. 1. Start the J2EE Engine Visual Administrator. 2. In the navigation pane on the left, click the Cluster tab. 3. Select your server and then select Services > Security Provider. 4. In the content pane, click the Switch to the edit mode icon. 5. Create the user: a. In the content pane, click the User Management tab. b. Click Create User. c. In the Create New User window, type the name of the user. Specify the same name as for the following field in Configuration Feature: Basic Configuration > Logical Archives > Tivoli Storage Manager for BC-ILM > User for ILM-enabled data archiving For example, type: XMLDAS d. Type a password for the user. Repeat the password in the Confirm password field. Then, click OK. 6. Change a property for the user: a. On the Users page of the User Management page, type XMLDAS in the Name field. Then, click Search. b. Click the user in the search result box. The pane in the middle of the User Management page shows the properties for the selected user. c. Under Authentication, select the No password change required check box. 7. Add the user to the necessary security concept: a. Click the Policy Configurations tab. b. Under Components, click sap.com/ tc~techsrv~xml_das*dataarchivingservice. The list might not be sorted alphabetically. c. Click the Security Roles tab. d. Under Security Roles, click XMLDASSecurityRole. 78 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

91 e. Under Mappings, next to Users, click Add to add the user to the selected security role. What to do next: 6.2.2, Creating a root collection in the empty logical archive Creating a user for ILM-enabled data archiving if the user data is stored in the SAP ECC database Complete these steps if you installed SAP Application Server as an ABAP Engine and a J2EE Engine , Creating a user with CPIC access, on page 4. Note the following specifications: v Specify the same name as for the following field in Configuration Feature: Basic Configuration > Logical Archives > Tivoli Storage Manager for BC-ILM > User for ILM-enabled data archiving For example, specify: XMLDAS v On the Logon data page of the Maintain User window, select System from the User Type list. 2. Start the J2EE Engine Visual Administrator. 3. In the navigation pane on the left, click the Cluster tab. 4. Select your server and then select Services > Security Provider. 5. In the content pane, click the Switch to the edit mode icon. 6. Add the user to the necessary security concept: a. Click the Policy Configurations tab. b. Under Components, click sap.com/ tc~techsrv~xml_das*dataarchivingservice. The list might not be sorted alphabetically. c. Click the Security Roles tab. d. Under Security Roles, click XMLDASSecurityRole. e. Under Mappings, next to Users, click Add to add the user to the selected security role. What to do next: 6.2.2, Creating a root collection in the empty logical archive Creating a root collection in the empty logical archive Content Collector for SAP supplies a command-line tool for creating a root collection. Before you begin: 6.2.1, Creating a user for ILM-enabled data archiving, on page 78 Procedure: 1. Log on to the operating system with your Content Collector for SAP user ID. 2. On a command line, change to the bin directory of your Collector Server installation. 3. Enter the following command: manage_root_collection port archive_id root_collection_path create port Specify the Collector Server port. Where to find the information in Configuration Feature: Basic Configuration > Communication > Ports > Collector Server port Chapter 6. Configuring your environment for basic tasks 79

92 archive_id Specify the logical archive ID of the logical Tivoli Storage Manager archive for BC-ILM. In this logical archive, you create the root collection. Where to find the information in Configuration Feature: Logical Archives > Overview > Logical Archive ID root_collection_path Specify a path in the following format: /node_1/node_2/.../node_n/ Each node_i is the name of a logical node in the storage hierarchy. If you use a single path, the root node, which is denoted by the slash (/), is sufficient. If you need several paths, make sure that they do not overlap. Example: manage_root_collection 5500 A3 /rootcoll1/ create 4. To remove an existing empty root collection, run the following command: manage_root_collection port archive_id root_collection_path remove The entire path is removed. What to do next: 6.2.3, Creating a destination in XML Data Archiving Service (XML DAS) Creating a destination in XML Data Archiving Service (XML DAS) In the destination, you specify where the data must be archived. Create the sample destination WEBDAV_DEST. Before you begin: 6.2.2, Creating a root collection in the empty logical archive, on page 79 Procedure: 1. Start the J2EE Engine Visual Administrator. 2. In the navigation pane on the left, click the Cluster tab. 3. Select Services > Destinations. 4. In the Destinations pane on the Runtime page, select HTTP. 5. Click New to create a destination. 6. In the window that opens, type a name for the destination, and then click OK. For example, type: WEBDAV_DEST 7. Under Connection Settings, intheurl field, type the fully qualified path to the root collection that you previously created. Use the following format for the path: server port Specify the fully qualified host name or the IP address of the system where Collector Server is installed. Specify the TCP/IP port through which the web dispatcher gets its requests. 80 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

93 Where to find the information in Configuration Feature: Basic Configuration > Communication > HTTP or HTTPS communication with SAP > Web port root_collection_path Specify the path to the root collection. Example: 8. Under Logon Data, select BASIC from the Authentication list. 9. Under Basic Authentication, type the name of the user who is allowed for ILM-enabled data archiving. For example, type: XMLDAS 10. Click Save. 11. If necessary, restart the Destinations service so that the new destination can be used. What to do next: 6.2.4, Creating an archive store in XML Data Archiving Service (XML DAS) Creating an archive store in XML Data Archiving Service (XML DAS) Complete these steps to create an archive store. Create the sample archive store WEBDAV_STORE. Before you begin: 6.2.3, Creating a destination in XML Data Archiving Service (XML DAS), on page 80 Procedure: 1. Open XML DAS Administration by using the following web address: J2EE Engine host:http port/dataarchivingservice/das An example web address would be: 2. Log on to XML DAS Administration with the name of the user who is allowed for ILM-enabled data archiving, for example, XMLDAS. 3. Click Archive Store Management. 4. Click Define. 5. Specify the following information: a. In the Archive Store column, type a name for the store. For example, type: WEBDAV_STORE b. Optional: In the Description column, type a description. c. From the list in the Store Type column, select WebDAV System. d. From the list in the Destination column, select the destination that you previously created. For example, select WEBDAV_DEST. e. In the Proxy Port column, type the HTTP port of your proxy server, if necessary. Chapter 6. Configuring your environment for basic tasks 81

94 6. Click OK to create the archive store. What to do next: 6.2.5, Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS) Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS) Create an HTTP connection. Create the sample connection XML_SRV_CONN1. Before you begin: 6.2.4, Creating an archive store in XML Data Archiving Service (XML DAS), on page 81 Procedure: 1. In the SAP GUI, enter the transaction code SM59 to open the Configuration of RFC Connections window. 2. In the RFC Connections column, click HTTP Connections to External Server and then click the Create icon. 3. In the RFC Destination field of the RFC Destination window, type a name for the RFC destination. For example, type: XML_SRV_CONN1 4. Under Description, type a description in one or more of the Description fields. For example, type: XML Data Archiving Service 5. Click the Technical Settings tab. 6. Under Target System Settings, inthetarget Host field, type the host name or the IP address of the SAP J2EE Engine. For example, type: sapj2ee 7. In the Path Prefix field, type the relative path to the XML DAS installation. For example, type: /DataArchivingService/DAS 8. Click the Logon & Security tab. When the message HTTP connections may not be secure is displayed, press Enter. 9. Under Logon Procedure, click Basic Authentication. 10. When the message Do you want to change the HTTP logon procedure is displayed, click Yes. 11. Click the Special Options tab. 12. Under Status of HTTP Version, select HTTP Click the Save icon to save your settings. 14. Click Connection Test to verify that the connection can be established. What to do next: 6.2.6, Creating the home paths for the archiving objects in the logical archive, on page Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

95 6.2.6 Creating the home paths for the archiving objects in the logical archive For each archiving object, create a home path in the empty root collection of the logical archive. Create a home path for sample archiving object BC_SBOOK_X. Before you begin: 6.2.5, Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS), on page 82 Procedure: 1. In the SAP GUI, enter the transaction code SARA to open the Archive Administration: Initial Screen window. 2. In the Object Name field, specify the name of the archiving object, for example, BC_SBOOK_X. 3. Click Customizing to open the Data Archiving Customizing window. 4. Under Basis Customizing, double-click Customizing of Home Paths. Figure 44 shows which item to double-click in the Data Archiving Customizing window. Figure 44. Data Archiving Customizing window 5. In the Change View "Customizing View for Archiving": Details window, check whether the Home Path field contains the following entry: /<SYSID>/<CLIENT>/<OBJECT>/ At run time, the individual parameters are replaced as follows: SYSID Is replaced with the system ID of your SAP system. CLIENT Is replaced with for the name of the SAP client. OBJECT Is replaced with for the name of the archiving object. Figure 45 on page 84 shows what the setting must look like. Chapter 6. Configuring your environment for basic tasks 83

96 Figure 45. Change View "Customizing of Home Paths": Details window containing the required setting 6. Click the Back icon twice to return to the Data Archiving Customizing window. 7. Under Basis Customizing, double-click Synchronization of Home Paths. 8. In the Synchronization of Home Paths for XML-Based Archiving window, click Production Mode and then click the Execute icon. If, for example, you are working with SAP client 800 of SAP ID (SID) EC6 and the root collection path is /rootcoll1/, your logical archive then contains the following folder structure: /rootcoll1/ec6/ /rootcoll1/ec6/800/ /rootcoll1/ec6/800/bc_sbook_x What to do next: 6.2.7, Assigning the home paths to the archive store Assigning the home paths to the archive store You must assign the home paths to the archive store that you created in XML Data Archiving Service (XML DAS). Assign the home path for sample archiving object SB_BOOK_X, which is /rootcoll1/ec6/800/bc_sbook_x, to the sample archive store WEBDAV_STORE. Before you begin: 6.2.6, Creating the home paths for the archiving objects in the logical archive, on page Open XML DAS Administration by using the following web address: J2EE Engine host:http port/dataarchivingservice/das An example web address would be: 2. Log on to XML DAS Administration with the name of the user who is allowed for ILM-enabled data archiving, for example, XMLDAS. 3. Click Archive Hierarchy & Store Assignment. 4. Under Archive Paths, you see the contents of the root collection. Expand the folder that shows the system ID of your SAP system until you see the archiving objects. To see the sample archiving object SB_BOOK_X, you would expand ec6 > Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

97 5. Click an archiving object. For example, click SB_BOOK_X. 6. Under Archive Path Properties, fromthearchive Store list, select the archive store to which you want to assign the home path. For example, select WEBDAV_STORE. 7. Click Assign. 8. Repeat step 5 through step 7 for each home path that you want to assign. 6.3 Configuring for archiving incoming documents You can archive documents by creating work items in an SAP workflow, by processing their bar codes, or by using simultaneous archiving. Use work items if you want to include the linking process in more complex routing processes. Also, use work items if your scanning application creates a description file and you want to transfer document information from the description file to the SAP workflow. For information about how to configure SAP for simultaneous archiving, see the SAP documentation Configuring for archiving incoming documents by processing their bar codes To archive incoming documents and link them to SAP by processing the bar codes of the documents, you must complete additional configuration steps on SAP Application Server. Figure 46 on page 86 shows which parts of the Content Collector for SAP environment must be configured so that you can archive documents by processing their bar codes. Chapter 6. Configuring your environment for basic tasks 85

98 Figure 46. Configuration of your Content Collector for SAP environment for archiving incoming documents by processing their bar codes In your basic instance configuration, you configured the following parts: v An HTTPS connection between the Collector Server instance and IBM Content Navigator v The logical archives where the incoming documents are to be stored Collector Server sends the bar code directly to SAP. Take these steps to complete the configuration of your environment for archiving documents by processing their bar codes. For more details about the SAP configuration, refer to the SAP documentation. 1. Assign the various types of bar codes that the documents use, to the individual SAP business objects. Use the transaction code OAC5 for this step. 2. Check the settings for the specified bar-code types. Use the transaction code OAD4 for this step. 3. Enable SAP for archiving documents by processing their bar codes , Enabling the Collector Server instance to archive incoming documents, on page , Making the document classes available for property mapping, on page Configuring for archiving incoming documents by creating work items in an SAP workflow When documents are archived, they are also linked to SAP. Only those documents are linked that can be associated with a specific SAP workflow. 86 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

99 Figure 47 shows which parts of the Content Collector for SAP environment must be configured so that you can archive documents by creating work items in the SAP workflow. Figure 47. Configuration of your Content Collector for SAP environment for archiving incoming documents by creating work items in an SAP workflow In your basic instance configuration, you configured the following parts: v An HTTPS connection between the Collector Server instance and IBM Content Navigator v At least one Java RFC dispatcher for the communication between the Collector Server instance and SAP v The logical archives where the incoming documents are to be stored Take these steps to complete the configuration of your environment for archiving incoming documents by creating work items in an SAP workflow: Procedure: , Associating documents with a specific SAP workflow , Enabling the Collector Server instance to archive incoming documents, on page , Making the document classes available for property mapping, on page Associating documents with a specific SAP workflow When you archive or link incoming documents by creating work items in an SAP workflow, only those documents can be linked to SAP that can be associated with the appropriate SAP workflows. Chapter 6. Configuring your environment for basic tasks 87

100 You associate a document with an SAP workflow and thus with an SAP business object by using the document type. The document type groups documents of the same type. Create at least one document type for each logical archive. If a logical archive contains, or is to contain, documents that must be associated with different SAP workflows, create a document type for each SAP workflow. Procedure: 1. In the SAP GUI, enter the transaction code OAD5 to open the ArchiveLink: Document Type Customizing Wizard. Figure 48 shows what the Start page of the ArchiveLink: Document Type Customizing Wizard might look like. Figure 48. Start page of the ArchiveLink: Document Type Customizing Wizard 2. Click Continue. 3. On the Document type page, specify the following information: a. In the Doc.type field, type a name for the group of documents that are to be linked to the same SAP business object. For example, type: FIIINVOICE b. In the Name field, specify a description. For example, type: Incoming invoice w/o verification Figure 49 on page 89 shows what the Document type page of the ArchiveLink: Document Type Customizing Wizard might look like with the sample entries. 88 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

101 Figure 49. Document type page of the ArchiveLink: Document Type Customizing Wizard containing the sample document type and the sample description c. Click Continue. 4. On the Document type template page, proceed as follows: v If you want to use an existing document type as a template, specify this document type in the Doc.type field. Then, click Continue. v If you do not want to use a template, click Continue. For this example, do not specify a template. Figure 50 on page 90 shows what the Document type template page of the ArchiveLink: Document Type Customizing Wizard might look like. Chapter 6. Configuring your environment for basic tasks 89

102 Figure 50. Document type template page of the ArchiveLink: Document Type Customizing Wizard containing no template 5. On the Workflow document type page, select the Workflow document type check box so that the document type can be used by an SAP workflow. Then, click Continue. Figure 51 shows what the Workflow document type page of the ArchiveLink: Document Type Customizing Wizard might look like. Figure 51. Workflow document type page of the ArchiveLink: Document Type Customizing Wizard with selected item 90 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

103 6. On the Document class page, specify the document class, which is the technical format of a document type, in the Doc. class field, and then click Continue. For documents of document type FIIINVOICE, type, for example: FAX 7. On the Object, method and tasks page, associate the document type with an SAP business object type and assign a method and a workflow task to the document type. Then, click Continue. You can use the standard tasks or the workflow templates. The default values for documents of document type FIIINVOICE are as follows: Property Object type Method Task (for entry) Task (for assignment) Value BKPF CREATE TS TS For more details, see the SAP documentation. Figure 52 shows what the Object, method and tasks page of the ArchiveLink: Document Type Customizing Wizard might look like with the default values for documents. Figure 52. Object, method and tasks page of the ArchiveLink: Document Type Customizing Wizard containing the default settings for documents of document type FIIINVOICE 8. On the Workflow parameter page, you have the following options: v If you specified an existing document type as a template, leave the offered transaction code as it is and click Continue. v If you did not specify a template, specify a transaction code. For example, specify FB10 for a financial booking. Then, click Continue. Chapter 6. Configuring your environment for basic tasks 91

104 Figure 53 shows what the Workflow parameter page of the ArchiveLink: Document Type Customizing Wizard might look like with the sample transaction code. Figure 53. Workflow parameter page of the ArchiveLink: Document Type Customizing Wizard containing the sample transaction code FB10 9. On the Storage system and link table page, specify the following information: a. In the Cont.Rep.ID field, specify the ID of the logical archive that contains, or is to contain, the documents. Where to find the information in Configuration Feature: Logical Archives > Overview > Logical Archive ID For example, type: A2 b. In the Link field, specify an SAP ArchiveLink link table. For example, select TOA01. Figure 54 on page 93 shows what the Storage system and link table page of the ArchiveLink: Document Type Customizing Wizard might look like with the sample values. 92 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

105 Figure 54. Storage system and link table page of the ArchiveLink: Document Type Customizing Wizard containing the sample content repository A1 and the sample link table TOA01 c. Click Continue. 10. On the Selection from available presettings page, you have the following options: v If you want to add the document type to one or more existing presettings, click the button in front of available presettings, and click Continue. v If you want to create a presetting only, click Continue. For this example, do not select a presetting. Figure 55 on page 94 shows what the Selection from available presettings page of the ArchiveLink: Document Type Customizing Wizard might look like. Chapter 6. Configuring your environment for basic tasks 93

106 Figure 55. Selection from available presettings page of the ArchiveLink: Document Type Customizing Wizard without the selection of a presetting 11. On the Create new presettings page, you have the following options: v If you want to create a presetting, specify a 4-digit ID and a name for the presetting. Then, click Continue. v If you do not want to create a presetting, click Continue. To create a sample presetting, type A101 in the first line of the ID column and type Financial booking for A1 in the first line of the Name column. Figure 56 on page 95 shows what the Create new presettings page of the ArchiveLink: Document Type Customizing Wizard might look like with a sample presetting. 94 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

107 Figure 56. Create new presettings page of the ArchiveLink: Document Type Customizing Wizard containing a sample presetting 12. In the Details of presettings page, take these steps: a. Go to the existing presetting that you selected or go to the new presetting by clicking the Next default setting icon. b. In the Obj. Type column, type US for User. c. In the ID column, type the name of the user who owns the Inbox where the work item is to be placed. For example, type: DEMO_US d. Select one or more of the available check boxes. For example, select: v Storing for subsequent entry v Store and enter v Assign then store Figure 57 on page 96 shows the Details of presettings page of the ArchiveLink: Document Type Customizing Wizard containing the necessary settings. Chapter 6. Configuring your environment for basic tasks 95

108 Figure 57. Details of presettings page of the ArchiveLink: Document Type Customizing Wizard containing the necessary settings e. Click Continue. 13. Click Complete. 14. In the Prompt for Workbench request window, select a request in the Request field. If a request does not exist yet, click the Create icon to create a request. 15. Click the Continue icon Enabling the Collector Server instance to archive incoming documents You must change the instance configuration. In Configuration Feature, take these steps: 1. Open the instance configuration that you want to change. 2. Go to Basic Configuration > Paths. 3. Complete the Archiving base path field. In a server configuration profile, you find the following specification that relates to the archiving of incoming documents: Section in server UI field that supplies the configuration profile Keyword value Global section ARCHIVING_PATH Archiving base path 96 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

109 6.3.4 Making the document classes available for property mapping More than one document class can be defined for an object store. If your scanning application creates a description file, the values in this file can be stored with the documents. For this purpose, the custom properties of the document classes must be mapped to the values in the description file. Specify the documents classes whose custom properties are to be available for mapping. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical FileNet P8 Archive id. 3. Complete the Property Mapping section. 4. Repeat steps 2 and 3 for each logical FileNet P8 archive where documents are to be stored. In a server configuration profile, you find the following specifications that relate to making the document classes available for property mapping: Section in server configuration profile UI field that supplies the value Keyword ARCHIVE REPINFOCLASSES Document classes RETURN_ALL_ATTR All custom properties can be mapped 6.4 Configuring for archiving outgoing documents To archive outgoing documents, you need the basic environment. Figure 58 on page 98 shows which parts of the Content Collector for SAP environment must be configured so that you can archive outgoing documents. Chapter 6. Configuring your environment for basic tasks 97

110 Figure 58. Configuration of your Content Collector for SAP environment for archiving outgoing documents In your basic instance configuration, you configured the following parts: v An HTTP connection or an RFC connection between the Collector Server instance and SAP. v The logical archives where outgoing documents are to be stored In Configuration Feature, take these steps: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical FileNet P8 Archive id. 3. Complete the Documents section. Fix Pack 1 This section has been renamed to Archiving of Outgoing Documents. 4. Repeat steps 2 and 3 for each logical FileNet P8 archive where outgoing documents are to be stored. In a server configuration profile, you find the following specifications that relate to the archiving of outgoing FileNet P8 documents: Section in server configuration profile Keyword UI field that supplies the value ARCHIVE DEFAULT_P8DOCCLASS Default document class DEFAULT_FOLDER Default folder DOCTYPE MIME type P8DOCCLASS Document class CUSTOM_FOLDER Folder 98 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

111 6.5 Configuring for linking archived documents to SAP Your repository might contain documents that are not linked to SAP. You can link such documents by processing their bar codes or by creating work items in an SAP workflow. Use work items if you want to include the linking process in more complex routing processes. Also, use work items if you want to transfer additional document information to the SAP workflow. Figure 59 shows which parts of the Content Collector for SAP environment must be configured so that you can link the archived documents by creating work items in the SAP workflow. Figure 59. Configuration of your Content Collector for SAP environment for linking archived documents by creating work items to the SAP workflow Figure 60 on page 100 shows which parts of the Content Collector for SAP environment must be configured so that you can link the archived documents by processing their bar codes. Chapter 6. Configuring your environment for basic tasks 99

112 Figure 60. Configuration of your Content Collector for SAP environment for linking archived documents by processing their bar codes In your basic instance configuration, you configured the following parts: v An HTTPS connection between the Collector Server instance and IBM Content Navigator v At least one Java RFC dispatcher for the communication between the Collector Server instance and SAP if you want to link the archived document by creating work items in an SAP workflow v The logical FileNet P8 archives that contain the documents that are to be linked Take these steps to complete the configuration of your environment for linking FileNet P8archived documents: Procedure: , Enabling the Collector Server instance to link archived documents , Creating P8 queues and workflows, on page , Associating documents with a specific SAP workflow, on page Enabling the Collector Server instance to link archived documents You must change the instance configuration. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical FileNet P8 Archive id. 3. Complete the Linking of Documents in a P8 Queue section. 100 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

113 Fix Pack 1 This section has been renamed to Document Linking. 4. If you plan to link your documents by creating work items in an SAP workflow, you can add the values of custom properties to the SAP workflow. In this case, you must complete the Property Mapping section where you specify the document classes that are to supply the property values. Only the custom properties of the specified document classes can then be mapped to the SAP workflow attributes, a task that you complete in Administration Feature. 5. Repeat step 2 on page 100 through step 4 for each logical archive that contains documents that are to be linked. In a server configuration profile, you find the following specifications that relate to the linking of archived documents: Section in server configuration profile Keyword UI field that supplies the value Where to find the UI field in Configuration Feature DESTINATION R3NAME SAP system ID SAP System > General > General ARCHIVE PE_USERID User Logical Archives > Logical FileNet P8 PE_CONNECTPOINT Connection point to Archive id > Linking workflow system of Documents in a PE_QUEUENAME Queue name P8 Queue Fix Pack 1 Logical Archives > Logical FileNet P8 Archive id > Document Linking REPINFOCLASSES Document classes Logical Archives > Logical FileNet P8 RETURN_ALL_ATTR All custom Archive id > properties can be Property Mapping mapped What to do next: 6.5.2, Creating P8 queues and workflows Creating P8 queues and workflows The documents that are to be linked must be available as work items in a P8 queue. You must create the P8 queues, and you must create the workflows that make these documents available in the P8 queues. Before you begin: v 6.5.1, Enabling the Collector Server instance to link archived documents, on page 100. v Documents with bar codes must have the property named Barcode, which is of data type string with a maximum length of 40 characters. To enable the Collector Server instance to perform certain tasks, such as processing the bar codes of the documents, the workflow and the P8 queues must meet the following requirements: Chapter 6. Configuring your environment for basic tasks 101

114 v Because a queue can contain documents from several workflows, the name of the workflow must have the following format: <sap_system>_<archive_id>_<p8_queue_name> <sap_system> Specify the ID of the SAP system that the instance is to log on to. Where to find the information in Configuration Feature: SAP System > General > General > SAP system ID <archive_id> Specify the ID of the logical FileNet P8 archive that contains the documents that are to be linked. Where to find the information in Configuration Feature: Logical Archives > Overview > Logical Archive ID <p8_queue_name> Specify the name of the P8 queue that is to receive the documents that are to be linked. Where to find the information in Configuration Feature: Logical Archives > Logical IBM Content Manager Archive id > Linking of Documents in a P8 Queue > Queue name Fix Pack 1 The Linking of Documents in a P8 Queue section has been renamed to Document Linking. v v v Important: Ensure that the workflow name has a maximum length of 31 characters. Example for a workflow name: EC5_Y5_BarcodeQueue The workflow must have the following properties: A field of data type string, named DWRemark. This field is used to store error messages that might occur during bar-code processing. Documents are only linked if this field is empty. The length of the field must be specified in bytes. The field must be long enough to hold 100 English ASCII characters. If you use a multibyte character set, characters do not equal bytes. Check the code page of your database to determine the number of bytes per character and to calculate the minimum length of the DWRemark field in bytes. An attachment of a data type other than array, named DocumentNumber. This attachment contains the document ID of the document that is to be linked. Create an index on the P8 queue. The name of the index must be DWIndex. The index must contain these fields in this sequence: 1. F_Class 2. F_LOCKED 3. DWRemark 4. F_EnqueueTime Create the index by using Process Configuration Console. For more information, see the IBM FileNet P8 product documentation ( knowledgecenter/ssnw2f/welcome). Expose the fields F_CLASS and DWRemark in the P8 queue. These fields are used in an internal search. Expose the fields by using Process Configuration Console. 102 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

115 Note: The names Barcode and DWRemark are case-sensitive and must not be changed. If these names exist in your environment, you must create a property-name mapping file, in which you map these names to the names of your choice. For example, if you want to use bar_code instead of Barcode and remarks instead of DWRemark, specify the following entries in the property-name mapping file: INTERNAL_BARCODE bar_code INTERNAL_DWREMARK remarks For more information about how to create property-name mapping file, see 7.1, Mapping the reserved names of properties, on page 129. Content Collector for SAP provides a sample workflow definition that is designed for processing bar codes. This workflow definition is available in the file WorkflowGeneration.pep, which you find in the following path: v Linux UNIX InstallHome/samples v Windows InstallHome\samples Integrate this sample into your Workplace or Workplace XT and change it according to your needs. For more information about how to create P8 queues and workflows, see the FileNet P8 Platform documentation ( SSNW2F/welcome). The following procedure shows how to integrate the sample workflow definition into your Workplace XT: 1. Start Workplace XT by using the following web address: 2. Log on to Workplace XT as an administrator. 3. Click Tools > Advanced Tools > Process Designer. 4. Accept any security certificates for signed applets that are displayed to you. 5. In the Process Designer window, click File > Open, gotoinstallhome and then select the file WorkflowGeneration.pep. The sample workflow definition is imported, the name of the workflow is displayed on the tab, and an icon is added to the Workflow area. 6. Click the new icon to view and change the workflow properties, which are shown on the right. What to do next: If you want to link the documents by creating work items in an SAP workflow: Associating documents with a specific SAP workflow Associating documents with a specific SAP workflow When you archive or link incoming documents by creating work items in an SAP workflow, only those documents can be linked to SAP that can be associated with the appropriate SAP workflows. You associate a document with an SAP workflow and thus with an SAP business object by using the document type. The document type groups documents of the same type. Create at least one document type for each logical archive. If a logical archive contains, or is to contain, documents that must be associated with different SAP workflows, create a document type for each SAP workflow. Chapter 6. Configuring your environment for basic tasks 103

116 Procedure: 1. In the SAP GUI, enter the transaction code OAD5 to open the ArchiveLink: Document Type Customizing Wizard. Figure 61 shows what the Start page of the ArchiveLink: Document Type Customizing Wizard might look like. Figure 61. Start page of the ArchiveLink: Document Type Customizing Wizard 2. Click Continue. 3. On the Document type page, specify the following information: a. In the Doc.type field, type a name for the group of documents that are to be linked to the same SAP business object. For example, type: FIIINVOICE b. In the Name field, specify a description. For example, type: Incoming invoice w/o verification Figure 62 on page 105 shows what the Document type page of the ArchiveLink: Document Type Customizing Wizard might look like with the sample entries. 104 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

117 Figure 62. Document type page of the ArchiveLink: Document Type Customizing Wizard containing the sample document type and the sample description c. Click Continue. 4. On the Document type template page, proceed as follows: v If you want to use an existing document type as a template, specify this document type in the Doc.type field. Then, click Continue. v If you do not want to use a template, click Continue. For this example, do not specify a template. Figure 63 on page 106 shows what the Document type template page of the ArchiveLink: Document Type Customizing Wizard might look like. Chapter 6. Configuring your environment for basic tasks 105

118 Figure 63. Document type template page of the ArchiveLink: Document Type Customizing Wizard containing no template 5. On the Workflow document type page, select the Workflow document type check box so that the document type can be used by an SAP workflow. Then, click Continue. Figure 64 shows what the Workflow document type page of the ArchiveLink: Document Type Customizing Wizard might look like. Figure 64. Workflow document type page of the ArchiveLink: Document Type Customizing Wizard with selected item 106 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

119 6. On the Document class page, specify the document class, which is the technical format of a document type, in the Doc. class field, and then click Continue. For documents of document type FIIINVOICE, type, for example: FAX 7. On the Object, method and tasks page, associate the document type with an SAP business object type and assign a method and a workflow task to the document type. Then, click Continue. You can use the standard tasks or the workflow templates. The default values for documents of document type FIIINVOICE are as follows: Property Object type Method Task (for entry) Task (for assignment) Value BKPF CREATE TS TS For more details, see the SAP documentation. Figure 65 shows what the Object, method and tasks page of the ArchiveLink: Document Type Customizing Wizard might look like with the default values for documents. Figure 65. Object, method and tasks page of the ArchiveLink: Document Type Customizing Wizard containing the default settings for documents of document type FIIINVOICE 8. On the Workflow parameter page, you have the following options: v If you specified an existing document type as a template, leave the offered transaction code as it is and click Continue. v If you did not specify a template, specify a transaction code. For example, specify FB10 for a financial booking. Then, click Continue. Chapter 6. Configuring your environment for basic tasks 107

120 Figure 66 shows what the Workflow parameter page of the ArchiveLink: Document Type Customizing Wizard might look like with the sample transaction code. Figure 66. Workflow parameter page of the ArchiveLink: Document Type Customizing Wizard containing the sample transaction code FB10 9. On the Storage system and link table page, specify the following information: a. In the Cont.Rep.ID field, specify the ID of the logical archive that contains, or is to contain, the documents. Where to find the information in Configuration Feature: Logical Archives > Overview > Logical Archive ID For example, type: A2 b. In the Link field, specify an SAP ArchiveLink link table. For example, select TOA01. Figure 67 on page 109 shows what the Storage system and link table page of the ArchiveLink: Document Type Customizing Wizard might look like with the sample values. 108 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

121 Figure 67. Storage system and link table page of the ArchiveLink: Document Type Customizing Wizard containing the sample content repository A1 and the sample link table TOA01 c. Click Continue. 10. On the Selection from available presettings page, you have the following options: v If you want to add the document type to one or more existing presettings, click the button in front of available presettings, and click Continue. v If you want to create a presetting only, click Continue. For this example, do not select a presetting. Figure 68 on page 110 shows what the Selection from available presettings page of the ArchiveLink: Document Type Customizing Wizard might look like. Chapter 6. Configuring your environment for basic tasks 109

122 Figure 68. Selection from available presettings page of the ArchiveLink: Document Type Customizing Wizard without the selection of a presetting 11. On the Create new presettings page, you have the following options: v If you want to create a presetting, specify a 4-digit ID and a name for the presetting. Then, click Continue. v If you do not want to create a presetting, click Continue. To create a sample presetting, type A101 in the first line of the ID column and type Financial booking for A1 in the first line of the Name column. Figure 69 on page 111 shows what the Create new presettings page of the ArchiveLink: Document Type Customizing Wizard might look like with a sample presetting. 110 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

123 Figure 69. Create new presettings page of the ArchiveLink: Document Type Customizing Wizard containing a sample presetting 12. In the Details of presettings page, take these steps: a. Go to the existing presetting that you selected or go to the new presetting by clicking the Next default setting icon. b. In the Obj. Type column, type US for User. c. In the ID column, type the name of the user who owns the Inbox where the work item is to be placed. For example, type: DEMO_US d. Select one or more of the available check boxes. For example, select: v Storing for subsequent entry v Store and enter v Assign then store Figure 70 on page 112 shows the Details of presettings page of the ArchiveLink: Document Type Customizing Wizard containing the necessary settings. Chapter 6. Configuring your environment for basic tasks 111

124 Figure 70. Details of presettings page of the ArchiveLink: Document Type Customizing Wizard containing the necessary settings e. Click Continue. 13. Click Complete. 14. In the Prompt for Workbench request window, select a request in the Request field. If a request does not exist yet, click the Create icon to create a request. 15. Click the Continue icon. 6.6 Configuring for archiving and viewing print lists To archive and view print lists, you need the basic environment. Figure 71 on page 113 shows which parts of the Content Collector for SAP environment must be configured so that you can archive and view print lists. 112 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

125 Figure 71. Configuration of your Content Collector for SAP environment for archiving and viewing print lists In your basic instance configuration, you configured the following parts: v An HTTP connection or an RFC connection between the Collector Server instance and SAP v The logical archives where the print lists are to be stored Perform these tasks to complete the configuration of your environment for archiving and viewing print lists: Procedure: , Defining an archive device , Associating print lists with an SAP business object of type DRAW, on page , Creating an SAP ArchiveLink batch job, on page , Enabling extended ALF viewing, on page , Enabling print-list viewing, on page Defining an archive device Define an archive device where the print lists can be archived. Procedure: 1. In the SAP GUI, enter the transaction code SPAD to open the Spool Administration: Initial Screen window. 2. Click Display next to Output devices. 3. In the Spool Administration: List of Output Devices window, double-click ARCH. Chapter 6. Configuring your environment for basic tasks 113

126 4. In the Spool Administration: Output Device (Display) window, click the Change icon. 5. On the DeviceAttributes page of the Spool Administration: Output Device (Change) window, select ARCHLINK: SAP ArchiveLink Archiver from the Device Type list. 6. From the Device Class list, select Archiving program. Figure 72 shows what the DeviceAttributes page of the Spool Administration: Output Device (Change) window might look like after you completed step 5 and step 6. Figure 72. DeviceAttributes page of the Spool Administration: Output Device (Change) window containing the necessary settings 7. Click the Access Method tab. 8. From the Host Spool Access Method list, select I: Archiving Device. Figure 73 on page 115 shows the DeviceAttributes page of the Spool Administration: Output Device (Change) window containing your selection. 114 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

127 Figure 73. DeviceAttributes page of the Spool Administration: Output Device (Change) window containing your selection 9. Click the Save icon to save your settings. What to do next: 6.6.2, Associating print lists with an SAP business object of type DRAW Associating print lists with an SAP business object of type DRAW When you archive print lists, they must be linked to an SAP business object of type DRAW. To associate a print list with an SAP business object, you must create a document type. Before you begin: 6.6.1, Defining an archive device, on page 113 Create at least one document type for each logical archive. For screen captures, refer to Associating documents with a specific SAP workflow. Procedure: 1. In the SAP GUI, enter the transaction code OAD5 to open the ArchiveLink: Document Type Customizing Wizard. 2. Click Continue. 3. On the Document type page, specify a name of your choice and a description for the document type. 4. On the Document type template page, proceed as follows: v If you want to use an existing document type as a template, specify this document type in the Doc.type field. Then, click Continue. v If you do not want to use a template, click Continue. For this example, do not specify a template. 5. On the Document class page, specify ALF in the Doc. class field and then click Continue. SAP uses the document class to select a suitable viewer application for the print lists. 6. On the Object, method and tasks page, specify DRAW in the Obj. type field. Then, click Continue. Chapter 6. Configuring your environment for basic tasks 115

128 7. On the Storage system and link table page, specify the following information: a. In the Cont.Rep.ID field, specify the ID of the logical archive that contains, or is to contain, the documents or the print lists. Where to find the information in Configuration Feature: Logical Archives > Overview > Logical Archive ID For example, type: A2 b. In the Link field, specify a link table. For example, select TOA01. c. Click Continue. 8. Click Complete. 9. In the Prompt for Workbench request window, select a request in the Request field. If a request does not exist yet, click the Create icon to create a request. 10. Click the Continue icon. What to do next: 6.6.3, Creating an SAP ArchiveLink batch job Creating an SAP ArchiveLink batch job Create an SAP ArchiveLink batch job to archive spooled print lists automatically. Before you begin: 6.6.2, Associating print lists with an SAP business object of type DRAW, on page 115 Procedure: 1. In the SAP GUI, enter the transaction code SM36 to open the Define Background Job window. 2. In the Job name field, type a name of your choice. For example, type: ARCHIVELINK 3. In the Job class field, leave C as value. Figure 74 on page 117 shows what the Define Background Job window might look like after you completed step 2 and step Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

129 Figure 74. Define Background Job window containing your specifications 4. Click the Start condition icon. 5. In the Start Time window, click Date/Time. 6. In the fields that become available, specify a schedule, and then click the Save icon at the bottom of the window. Figure 75 on page 118 shows the Start Time window containing a sample schedule specification. Chapter 6. Configuring your environment for basic tasks 117

130 Figure 75. Start Time window containing a sample schedule You are returned to the Define Background Job window, which shows the specified schedule under Job start. 7. Click the Step icon. 8. In the Create Step 1 window, click ABAP program. 9. Under ABAP program, inthename field, type the name of the ABAP program. For example, type: ILQBATCH Figure 76 on page 119 shows the Create Step 1 window containing a sample ABAP program name. 118 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

131 Figure 76. Create Step 1 window containing the sample ABAP program name ILQBATCH 10. Click the Save icon at the bottom of the window. The Step List Overview window opens. It contains the ABAP program that you specified. What to do next: 6.6.4, Enabling extended ALF viewing Enabling extended ALF viewing Complete these steps to enable extended ALF viewing. Before you begin: 6.6.3, Creating an SAP ArchiveLink batch job, on page 116 Procedure: 1. In the SAP GUI, enter the transaction code RZ10 to open the Edit Profiles window. 2. In the Profile field, specify the name of an existing profile. For example, select DEFAULT. 3. Under Edit Profile, click Extended maintenance and then click the Change icon. Figure 77 on page 120 shows what the Edit Profiles window might look like after you completed step 2 and step 3. Chapter 6. Configuring your environment for basic tasks 119

132 Figure 77. Edit Profiles window containing your specifications 4. In the Maintain Profile window, click the Create icon. 5. In the Parameter name field, type: rspo/archive_format 6. In the Parameter val. field, type: 2 Figure 78 shows what the Edit Profiles window might look like after you completed step 5 and step 6. Figure 78. Maintain Profile window containing your specifications 7. Click the Exit icon. 8. When the message The parameter was changed. Do you want to save the changes? is displayed, click Yes. 9. In the Edit Profiles window, click the Save icon. 10. When prompted, click Yes to activate the profile. What to do next: 6.6.5, Enabling print-list viewing, on page Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

133 6.6.5 Enabling print-list viewing To enable the viewing of print lists, you must adapt SAP ArchiveLink protocol. Adapt the sample protocol HTTP1. Before you begin: 6.6.4, Enabling extended ALF viewing, on page 119 Procedure: 1. In the SAP GUI, enter the transaction code OAA3 to open the ArchiveLink: Communications Interface Administration window. 2. Double-click the SAP ArchiveLink protocol. For example, double-click HTTP1. 3. In the ArchiveLink Protocols: Overview of Protocol window, double-click Display Stored Document. Figure 79 shows which item to double-click in the ArchiveLink Protocols: Overview of Protocol window. Figure 79. ArchiveLink Protocols: Overview of Protocol window showing which item to double-click 4. Under Document classes, click the radio button next to ALF and click the Change icon. Figure 80 on page 122 shows which radio button and which icon to click in the ArchiveLink Protocols: Overview of Protocol window. Chapter 6. Configuring your environment for basic tasks 121

134 Figure 80. ArchiveLink Protocols: Overview of Protocol window showing which radio button and which icon to click 5. In the Communication Type field of the small window that opens, specify R/3 and then click the Continue icon. Figure 81 shows what the ArchiveLink Protocols: Overview of Protocol window might look like after you specify the communication type. Figure 81. ArchiveLink Protocols: Overview of Protocol window showing the necessary communication type 6. Click the Continue icon to confirm your specifications and to close the window. 7. Click the Save icon to save your settings. 6.7 Configuring for viewing archived documents with the SAP GUI To view archived documents with the SAP GUI, you need only the basic environment. Figure 82 on page 123 shows which parts of the Content Collector for SAP environment must be configured so that you can view archived documents with the SAP GUI. 122 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

135 Figure 82. Configuration of your Content Collector for SAP environment for viewing archived documents with the SAP GUI In your basic instance configuration, you configured the following parts: v An HTTP connection between Collector Server and SAP. For print lists, an HTTP connection or a Remote Function Call (RFC) connection. v The logical archives where the documents that are to be viewed are stored. For information about how to set up the document viewer in SAP, see the SAP help document Customizing for the Document Viewer. 6.8 Configuring for viewing archived objects with IBM Content Navigator You can view archived documents, folders, stored searches, and search templates. To view the archived objects with IBM Content Navigator, you must change the instance configuration. If the default viewer map of IBM Content Navigator, which associates each MIME type with a specific viewer, does not fit your needs, you must also define a custom viewer map. Before you begin: Plan for secure viewing. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Chapter 6. Configuring your environment for basic tasks 123

136 Figure 83 shows which parts of the Content Collector for SAP environment must be configured so that you can view FileNet P8 objects with IBM Content Navigator. Figure 83. Configuration of your Content Collector for SAP environment for viewing objects with IBM Content Navigator In your basic instance configuration, you configured the logical FileNet P8 archives that contain the objects that are to be viewed. To complete the configuration of your environment for viewing archived objects with IBM Content Navigator, you must change the instance configuration. For an overview of the document viewers that are supported by IBM Content Navigator and for information about how to configure the document viewers, see the IBM Content Navigator product documentation ( support/knowledgecenter/sseuex/welcome). Procedure: 1. In Configuration Feature, take these steps: a. Open the instance configuration that you want to change. b. Go to Logical Archives > Logical FileNet P8 Archive id. c. Complete the Viewing with IBM Content Navigator section. d. Repeat steps 1b and 1c for each logical archive that contains objects that are to be viewed with IBM Content Navigator. Important: If you want to use a common user for viewing, ensure that the URL of IBM Content Navigator contains the fully qualified host name. In addition, the cookie domain must be equal to, or a subset of, this URL. 124 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

137 e. If you specified HTTPS as protocol in the URL of IBM Content Navigator, enable SSL support for the IBM Content Navigator server. Use your web application server administration tools for this task. f. If you specified HTTPS and a common user, complete this task: , Configuring the client authentication, on page 58. The certificate that you create on the web application server that hosts IBM Content Navigator must be issued for the host name that you specified in the URL of IBM Content Navigator. 2. If the default viewer map does not fit your needs, define a custom viewer map in IBM Content Navigator. For details, see Configuring viewers used to display documents in the web client ( knowledgecenter/sseuex_2.0.3/com.ibm.installingeuc.doc/eucco011.htm). In a server configuration profile, you find the following specifications that relate to the viewing of objects with IBM Content Navigator: Section in server configuration profile Keyword UI field that supplies the value ARCHIVE ICN_URL URL ICN_DESKTOP Desktop ID ICN_REPOSITORY_ID Repository ID ICN_INCLUDED_MIMETYPES Displayed MIME types ICN_EXCLUDED_MIMETYPES Excluded MIME types ICN_USERID User ICN_SESSION_DOMAIN Cookie domain 6.9 Configuring for transferring index information To improve the searchability of the archived documents, you can store additional document information with the documents by transferring the index information from the SAP business objects to the archived documents. The documents that the index information can be transferred to, must already be linked to SAP business objects. In addition, the link must be stored in an SAP ArchiveLink link table. Before you begin: 1. Deploy the index-transfer enablement package. For more information, see the corresponding topic in the Deploying part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH You completed one of the following tasks: v 6.3, Configuring for archiving incoming documents, on page 85 v 6.4, Configuring for archiving outgoing documents, on page 97 v 6.5, Configuring for linking archived documents to SAP, on page 99 Figure 84 on page 126 shows which parts of the Content Collector for SAP environment must be configured so that you can transfer index information. Chapter 6. Configuring your environment for basic tasks 125

138 Figure 84. Configuration of your Content Collector for SAP environment for transferring index information In your basic instance configuration, you configured the following parts: v The repository to which the index information is to be transferred v A Collector Server instance v An HTTP connection between the Collector Server instance and IBM Content Navigator. The Collector Server instance communicates with SAP directly. Because more than one document class can be defined for an object store, you must specify the document classes that are to receive the index information. Only the custom properties of the specified document classes can then be mapped to the SAP attributes that supply the index information. You map the properties to the SAP attributes later in Administration Feature. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical FileNet P8 Archive id. 3. Complete the Property Mapping section. 4. Repeat steps 2 and 3 for each logical archive that is to receive index information. In a server configuration profile, you find the following specifications that relate to the index transfer: 126 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

139 Section in server configuration profile UI field that supplies the value Keyword ARCHIVE REPINFOCLASSES Document classes RETURN_ALL_ATTR All custom properties can be mapped Chapter 6. Configuring your environment for basic tasks 127

140 128 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

141 Chapter 7. Configuring your environment for more or advanced tasks To use specific functions, to automate the start of Collector Server, or to increase the performance, you must further configure your environment. Before you begin: 1. Chapter 1, Preparing your environment, on page Chapter 2, Configuring FileNet P8 for use with Content Collector for SAP, on page Chapter 3, Configuring IBM Content Navigator, on page Fix Pack 1 Chapter 4, Configuring a daemon, on page Chapter 5, Configuring Collector Server, on page 41. It is assumed that you completed a basic instance configuration. In Configuration Feature, you completed all mandatory fields, and you configured the appropriate communication with SAP and IBM Content Navigator. In addition, you defined the logical archives for your repository. 7.1 Mapping the reserved names of properties FileNet P8 properties that must be created for use by Content Collector for SAP, have reserved names. If you cannot use a reserved name, for example, because it exists in your environment, you must map the name of your choice to the reserved name. For this purpose, you must create a mapping file. You can use a different mapping file for each logical archive. Identical logical archives, however, must use the same mapping file. Two logical archives are considered identical if specific fields in the instance configuration have the same values. Collector Server checks the following field: Logical Archives > Logical FileNet P8 Archive > General > Object store Procedure: 1. Open a text editor. 2. Map the names as follows: v On the left side of a mapping, specify the name that Content Collector for SAP requires, in uppercase characters and preceded by the prefix INTERNAL_. v On the right side, specify the name of the attribute, database field, or property that you want to assign. For example: INTERNAL_BARCODE barcode1 3. Save the mapping file with the extension txt, for example, mapping.txt. 4. In Configuration Feature, take these steps in Extended settings view: a. Go to Logical Archives > Logical FileNet P8 Archive id > Properties and type the fully qualified path to the mapping file in the Property-name mapping file field. Copyright IBM Corp. 2010,

142 For example, type C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\ instance1\mapping.txt Repeat this step for each logical archive that is to use the mapping file. In a server configuration profile, you find the following specification that relates to the mapping of reserved names: Section in server UI field that supplies the configuration profile Keyword value ARCHIVE section ATTRMAPPING_FILE Property-name mapping file 7.2 Setting timeouts for the RFC or Java RFC dispatcher and the agents You can ensure that, after a specific period of inactivity, the RFC dispatcher, the Java RFC dispatcher, or the agent closes the network connection to the SAP Gateway or to the repository. By setting timeouts, the connections between the involved components remain intact until the timeout is reached. Timeouts have the following advantages: v If you have several SAP systems and the connection to one SAP system fails, the RFC dispatcher or the Java RFC dispatcher automatically establishes a working connection to another SAP system. You do not need to restart your Collector Server instance. You can specify a timeout for the RFC dispatcher or the Java RFC dispatcher and a different timeout for each agent. If you do not set timeouts, Collector Server uses the following default settings: Component Value in seconds TSM agent 0 CM agent (1 day) P8 agent (1 day) OD agent (1 day) RFC dispatcher or Java RFC dispatcher (1 day) Setting the timeout for the RFC or Java RFC dispatcher To specify a timeout for the RFC dispatcher or the Java RFC dispatcher, you must change the instance configuration. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to SAP System > General. 3. In the Timeout field, specify a value. In a server configuration profile, you find the following specification that relates to the timeout of the dispatchers: 130 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

143 Section in server configuration profile Keyword DESTINATION TIMEOUT Timeout UI field that supplies the value Setting the timeout period for the agents To specify a timeout period for an agent, you must change the instance configuration. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical FileNet P8 Archive id > Miscellaneous > General. 3. In the Timeout field, specify a value. 4. Repeat steps 2 and 3 for each logical archive that you want to specify a timeout for. In a server configuration profile, you find the following specification that relates to the timeout of the dispatchers: Section in server configuration profile Keyword ARCHIVE TIMEOUT Timeout UI field that supplies the value 7.3 Assigning fixed ports to the client dispatchers When the API of Content Collector for SAP is to communicate with a Collector Server instance, you can start several client dispatchers to run parallel connections. In the instance configuration, you can specify the Collector Server port. However, the ports for the client dispatchers are assigned dynamically. A dynamic assignment can pose a problem, for example, if the API is behind a firewall. To solve this problem, you can assign fixed port numbers to the client dispatchers. The client dispatchers are then assigned a fixed range of consecutive port numbers that immediately follows the port numbers that are used by a Collector Server instance. You must ensure, however, that this fixed range of port numbers is not used by any other process. Assume, for example, that you specified 5500 as Collector Server port number in the instance configuration, that you started three client dispatchers, and that you want to assign fixed ports to the client dispatchers. In this example, Collector Server would use the ports 5500 and 5501 and the client dispatchers would be assigned the ports 5502, 5503, and You must ensure that the port numbers are not used by any other process. To use fixed ports, you must change the instance configuration. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Basic Configuration > Communication > Ports and select the Use fixed port numbers check box. In a server configuration profile, you find the following specification that relates to fixed ports: Chapter 7. Configuring your environment for more or advanced tasks 131

144 Section in server configuration profile Keyword UI field that supplies the value Global section CLIENT_ALL_PORTS_FIXED The selection of the Use fixed port numbers check box results in the value YES. 7.4 Configuring for preprocessing outgoing documents Content Collector for SAP provides a preprocessor user exit. By using this user exit, you can change outgoing documents with a preprocessor before the documents are archived. To include preprocessors in the archiving process, you must change the instance configuration The preprocessor user exit The preprocessor user exit supports one preprocessor per MIME type. The preprocessor user exit checks the MIME type of a document that is sent by SAP and that was created by using create or mcreate operations. If a document consists of more than one component, the preprocessor user exit checks the MIME type of only the first component. After the user exit reads all components of a document, it calls the preprocessor that you defined for this MIME type in the instance configuration. The preprocessor can run as an executable file or as a Java class. The preprocessor user exit of Content Collector for SAP currently supports the following types of preprocessing: v Changing the format of a document, for example, from TIFF to PDF. v Merging a document that consists of several single-page components into a document with a multi-page component. In this way, you can merge, for example, single-page documents in TIFF format into one multi-page TIFF document. The preprocessor user exit does not support the following tasks: v Linking files to a processed document v Changing or deleting the document ID or the component ID v Processing a document with several preprocessors Requirements for running a preprocessor You can run the preprocessor as an executable file or as a Java class. To run the preprocessor as an executable file, the command to start the preprocessor must look as follows: preprocessor_command> <input_file> <result_file To run the preprocessor as a Java class, you must provide a Java class that implements the following interface: public interface ACPreprocessor { public ResultSection execute(string archivefilename); } 132 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

145 The input for the preprocessor is created by Content Collector for SAP. You are responsible for creating the preprocessor that produces a result that Content Collector for SAP can evaluate The input for the preprocessor Content Collector for SAP creates the following input for your preprocessor: an input file and an extended input file. The name of the input file is the temporary file name of the outgoing document. If the document consists of more than one component, the name of the input file is the temporary file name of the first component. The extended input file contains the temporary files of all components of the document, including the name of the input file. The temporary file names ensure that the individual components are uniquely identified during preprocessing even if several SAP requests are processed in parallel. The extended input file can contain the following sections: [Data] Contains the temporary file names of all components that are not annotations or descriptions. If you want to transform several single-page documents into one multi-page document, this section contains the temporary file names of all pages. [Note] Contains the temporary file name of an annotation. [Desc] Contains the temporary file name of a description. This section is specified only for documents of MIME type application/x-alf. If a specific component type does not exist, the corresponding section is omitted. For example, if there is no annotation, the extended input file does not contain the [Note] section. Notes: v Except for the file name extension, the file name of the input file is identical to the file name of the extended input file. The extended input file has always the extension.input. v The name of the input file is included as the first file name in the [Data] section of the extended input file. v The extended input file lists the file names in the order in which the components are to be preprocessed. v The name of the input file is passed to the preprocessor. The name of the extended input file is not passed to the preprocessor. Preprocessors that can handle an extended input file must check for its existence The result from the preprocessor Depending on whether you run your preprocessor as an executable file or as a Java class, the preprocessor produces a result file or a result object. This result file or result object must have specific characteristics and a specific format. The result file or result object must meet the following requirements: v The result file or result object contains one file name only, that is, the name of the output file. This means that the preprocessor returns only one component and deletes any additional components. In this way, a document with several components is merged into a document with one component. Chapter 7. Configuring your environment for more or advanced tasks 133

146 v v The result file or result object and the input file can contain different MIME types. In this way, you can change a TIFF document to a PDF document. The MIME type must be specified in the result file or result object if it differs from the MIME type in the input file. The result file or result object can contain additional indexes. The index fields and their values must be added to the attribute list in the result file or result object. Content Collector for SAP does not check the document after it is changed by the preprocessor. Ensure that the document can be accessed and used by SAP The format of the result file: If the preprocessor runs as an executable file, a result file is produced. The format of the result file is similar to the format of a server configuration profile. The order of the individual sections and the order of the parameters within each section is arbitrary. The result file must contain a GLOBAL section. It can also contain an INDEX section. The following example shows the various sections and the parameters that you can specify: [GLOBAL] File=output_file_name DocType=new_mimetype [INDEX] index_field1=index_value1 index_field2=index_value2 Explanation of the parameters: Parameter Description Mandatory or optional File DocType [INDEX] section The name of the output file that contains the document and that is created by the preprocessor. You can specify one file name only. The MIME type of the document after it is changed by the preprocessor. The list of attributes that are returned by the preprocessor in the format index_field=index_value Mandatory Mandatory if different from the input file Optional Notes: v The file name that you specify for the File parameter can be enclosed in quotation marks. The web dispatcher removes the quotation marks. v Blanks are not allowed before or after the equal (=) sign. v Content Collector for SAP evaluates all parameters in the result file The format of the result object: If the preprocessor runs as a Java class, a result object is produced. The format of the result object must meet specific requirements. The result object that is to be returned by the preprocessor must look as follows: 134 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

147 public class ResultSection { private GlobalEntries globalentries; private Map indexvalues; } The GlobalEntries class must contain the following parameters: public class GlobalEntries { private List filenames; private String documentclass; private String documenttype; private String[] links; } Content Collector for SAP evaluates the following parameters. Any additional parameters are ignored. Parameter Description Mandatory or optional filenames The name of the output file that contains the Mandatory document and that is created by the preprocessor. documenttype You can specify one file name only. The MIME type of the document after it is changed by the preprocessor. Mandatory if different from the input file The preprocessor You are responsible for creating a preprocessor that can handle the input that Content Collector for SAP creates, that produces the result that can be used by Content Collector for SAP, and that changes the documents as supported by the preprocessor user exit of Content Collector for SAP. In addition to the input and result requirements, keep in mind the following information when you create a preprocessor: v The preprocessor must remove any temporary files that it creates. v The preprocessor does not have to remove the input after preprocessing is completed. The input file and all files that are listed in the extended input file are deleted by Content Collector for SAP. Important: The existence of the result file or result object is the only indicator that the preprocessor ran successfully. Therefore, ensure that the creation of the result file or result object is the last preprocessing step Including the preprocessors in the archiving process To include one or more preprocessors, you must change the instance configuration. You can specify one preprocessor per MIME type. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical FileNet P8 Archive id. 3. Complete the Preprocessors section. 4. Repeat steps 2 and 3 for each logical archive that is to use one or more preprocessors. In a server configuration profile, you find several of the following specifications that relate to the preprocessing of outgoing documents: Chapter 7. Configuring your environment for more or advanced tasks 135

148 Section in server configuration profile Keyword ARCHIVE PREPROC_MIMETYPE MIME type PREPROC_EXEC File PREPROC_CLASS Class name PREPROC_CLASSPATH Class path UI field that supplies the value 7.5 Linking documents to SAP by using the Cold program With the Cold program, you can link documents that cannot be processed by SAP ArchiveLink. The Cold program uses the bar code of a document to create the link. The Cold program is supplied with Content Collector for SAP. You can change it according to your needs. Before you begin:deploy the Cold program. For more information, see Deploying the Cold program Linking documents that are not archived yet by using the Cold program The documents must have a bar code and must be accessible by Content Collector for SAP or by a scanning application that can scan and archive documents. The SAP business object to which the documents are to be linked, must exist. Before you begin: v 6.3.1, Configuring for archiving incoming documents by processing their bar codes, on page 85. v The documents must include information that the Cold program can use to create the link. This information can be either in the file name or in a description file. The Cold program provides a user exit that you can use to implement a method for identifying SAP business objects. If no SAP business object is found to which the document can be linked, the document is imported as a print list. Procedure: 1. Archive the documents by processing their bar codes. Use Operation Feature of Content Collector for SAP or use a scanning application that can also archive documents. 2. In the SAP GUI, enter the transaction code ZCSI to open the IBM Content Collector for SAP Applications - Document Import window. 3. In the ARCHIV field, specify the ID of the logical archive that contains the documents that are to be linked. 4. In the SAPOBJ field, specify the SAP business object to which the documents are to be linked. The default value is DRAW to import the documents as print lists into the document management system (DMS) of SAP. 5. In the AR_OBJ field, specify the kind of document on which the SAP business object depends. The default value is DRW. 6. In the DOCTYPE field, type the document type. The default document type is alf for print lists. 136 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

149 7. In the OBJECTID field, type an ID that is used as starting point for the automatic generation of print-list IDs. The ID must have the following format: cn. c stands for one alphabetic character, and n stands for a 7-digit integer. The Cold program checks the existence of the same ID in the TOADL table and automatically increments numerically. A maximum of documents for each leading alphabetic character can be imported. The default starting ID is C In the INFO field, type the value that is to be displayed in DMS and thus serves as an index. The default value is IMP. 9. In the PRINTER field, type the ID of the printer. The ID is displayed in DMS and thus serves as an index. You can assign a value each time the Cold program runs. This parameter applies only to print lists. The default value is LP In the FORMULAR field, type the form. The form is displayed in DMS and thus serves as an index. You can assign a value each time the Cold program runs. This parameter applies only to print lists. The default value is CS_INDEX. 11. Select the DVS check box if you want to make print lists accessible through DMS. For this example, select the check box. 12. Click the Execute icon. The Cold program is started. It reads the entries in the SAP table of open external bar codes and links the document to the corresponding SAP business object or places it in the document management system of SAP (SAP DMS). The bar code of the document is interpreted as a SAP business object ID or a print-list description. If the bar code cannot be interpreted as an SAP business object ID, you can use the user exit to implement a method for identifying SAP objects. On request, the user exit generates a hyperlink for the document in the import protocol. Figure 85 on page 138 shows what the IBM Content Collector for SAP Applications - Document Import window might look like after you completed step 3 on page 136 through step 11. Chapter 7. Configuring your environment for more or advanced tasks 137

150 Figure 85. IBM Content Collector for SAP Applications - Document Import window showing the sample settings and the default settings Linking archived documents by using the Cold program The Cold program links archived documents by generating an entry, for each document, in the SAP table of open external bar codes and then creating a link for each document in the SAP print-list tables. In this way, the documents become accessible from the SAP GUI. Procedure: 1. Create an input file that contains all archived documents. For each document, this input file must contain the document ID, the archiving date, and the SAP business object ID, separated by commas, for example: d, ,document abc, ,document2 1999zzzzzzzzzz, ,document3 The input file must be in UTF-8 format. You can also use an input file that is created by the scanning application that stored the documents. Make sure, however, that the input file contains the required entries, separated by commas. 2. Create an entry for each document that is listed in the input file in the SAP table of open external bar codes: a. In the SAP GUI, enter the transaction code ZCSL to open the IBM Content Collector for SAP Applications - List Importer window. b. In the ARCHIVID field, type the ID of the logical archive that contains the documents that are to be linked. The default value is A1. c. In the DOCTYPE field, specify the document type. For incoming documents, the default value is fax. d. In the TIMEFROM and TIMETO fields, specify the period during which the documents must be archived in order to be linked. The default start date is The default end date is Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

151 e. Select the TESTRUN check box to open the SAP report but to suppress the processing of the input file. If the check box is selected, no entries are generated in the table of open external bar codes. For this example, select the check box. f. In the FNIMPORT field, type the physical location and the case-sensitive name of the input file. On Linux and UNIX systems, the default path is /usr/sap/put/transfer/base/import.txt. g. In the POS1 field, type the position of the ID of the archived document in the input file. The type is character and the maximum length is 40. The default value is 1. h. In the POS2 field, type the position of the archiving date in the input file. The type is character and the format is yyyymmdd. The default value is 2. i. In the POS3 field, type the position of the object ID in the input file. The type is character and the maximum length is 50. The default value is 3. j. Select the IGNORE check box if the first line in the input file is to be ignored. For this example, do not select the check box. k. Select the DELFLAG check box if the input file is to be deleted after it is processed. For this example, do not select the check box. l. In the FNERROR field, the fully qualified path to the error file. On Linux and UNIX systems, the default path is /usr/sap/put/transfer/base/ error.txt m. Select the APP check box if the existing error file is to be kept and further errors are to be appended to this file. For this example, do not select the check box. n. Click the Execute icon. Figure 86 on page 140 shows what the IBM Content Collector for SAP Applications - Document Import window might look like after you completed step 2b on page 138 through step 2m. Chapter 7. Configuring your environment for more or advanced tasks 139

152 Figure 86. IBM Content Collector for SAP Applications - List Import window showing the sample settings and the default settings The Cold program reads the input file and, for each line in the file, generates an entry in the SAP table of open external bar codes. All documents within the specified date range are processed. Faulty entries are written to the error file that you specified in step 2l on page , Linking documents that are not archived yet by using the Cold program, on page 136. Create a link for each document in the SAP print-list tables by completing step 2 on page 136 through step 12 on page 137. The documents are now accessible from the SAP GUI. 7.6 Integrating IBM Datacap and Content Collector for SAP Datacap can store scanned documents, including captured data, directly in IBM repositories. The archived documents cannot, however, be accessed from the SAP GUI. By integrating Datacap and Content Collector for SAP, the scanned documents are archived with Content Collector for SAP like incoming documents so that they can be retrieved from the SAP GUI. Before you begin: v Install Datacap Version or later. v Install Microsoft.Net Version 2, or later, on the system where Rulerunner of Datacap runs. v Install the add-ons package on the system where Rulerunner of Datacap runs. For more information, see the corresponding topic in the Installing part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

153 To make the archived documents accessible from SAP, incoming documents are archived by creating work items in an SAP workflow or by processing their bar codes. The functions that are necessary to complete these tasks are provided by the API of Content Collector for SAP (dynamic-link library csclient.dll). For the integration with Datacap, Content Collector for SAP supplies a set of custom actions that use the functions of the API. The custom actions are defined in the dynamic-link library ICCSAPAccess.dll. For Datacap V8, Content Collector for SAP also supplies the ICCSAPAccess.rrx file so that the custom actions can be used in the related rule sets. For Datacap V9, the ICCSAPAccess.rrx file is not needed because the functionality that is supplied by this file is integrated in the ICCSAPAccess.dll library. Figure 87 shows which parts of the Content Collector for SAP environment must be configured so that you can integrate Datacap. Figure 87. Configuration of your Content Collector for SAP environment for integrating Datacap In your basic instance configuration, you configured the following parts: v At least one Java RFC dispatcher for the communication between the Collector Server instance and SAP if you want to archive the documents by creating work items in an SAP workflow v The logical archive the scanned documents are stored Take these steps to complete the configuration of your environment for integrating Datacap: Procedure: , Deploying the archiving capability on Datacap, on page , Setting up a secure connection to Collector Server and adapting the client configuration profile, on page 144 Chapter 7. Configuring your environment for more or advanced tasks 141

154 , Setting the custom actions, on page Deploying the archiving capability on Datacap You must deploy the custom actions and the API. The custom actions, which are contained in the compressed file DatacapTMIntegration.zip, are available in the following directory: v Linux UNIX InstallHome/datacap v Windows InstallHome\datacap The API (csclient.dll library) is available in the following directory: v Linux UNIX InstallHome/api v Windows InstallHome\api Deploying the archiving capability on Datacap Version 8 Complete the following steps for Datacap V8. Library gsk8iccs.dll icclib082.dll Procedure: 1. Log on as application administrator to the system where Datacap runs. 2. If you use Datacap V8.1, you must ensure that the IBM Global Secure ToolKit (GSKit) libraries of Content Collector for SAP are used by Datacap. a. Make a backup copy of the gsk8iccs.dll library, which is in the following directory: v On a Windows 64-bit operating system: C:\Windows\SysWOW64 v On a Windows 32-bit operating system: C:\Windows\System32 b. Copy the following libraries as shown in this table: Copy the library from the following directory: The GSKit directory of the add-ons package of Content Collector for SAP, for example: C:\InstallHome\api\gskit The icclib directory of your GSKit installation, for example: C:\InstallHome\api\gskit\C\ icc\icclib libeay32ibm082.dll The osslib directory of your GSKit installation, for example: C:\InstallHome\api\gskit\C\ icc\osslib Copy the library to the following directory: On Windows 64-bit On Windows 32-bit C:\Windows\SysWOW64 C:\Windows\SysWOW64\icc\ icclib C:\Windows\SysWOW64\icc\ osslib C:\Windows\System32 C:\Windows\System32\icc\ icclib C:\Windows\System32\icc\ osslib c. Run Datacap Application Manager to encrypt the Datacap databases again. 3. Extract the DatacapTMIntegration.zip file to a temporary directory. You get the following folders and files: Datacap80 Datacap81 Datacap90 copyright.txt ICCSAPAccess.rrx 142 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

155 The folders contain the ICCSAPAccess.dll library for the corresponding Datacap version. 4. Move the extracted files to the following directories: v Move the ICCSAPAccess.dll library for Datacap V8.0.1 or V8.1 to the C:\Datacap\dcshared\NET directory. v Move the ICCSAPAccess.rrx file to the C:\Datacap\RRS directory. 5. Register the dynamic-link library ICCSAPAccess.dll by using the Assembly Registration tool (Regasm.exe): at a command prompt, enter the following command: regasm ICCSAPAccess.dll /codebase On most systems, the Assembly Registration tool is in the following directory: C:\Windows\Microsoft.NET\Framework\v Move the csclient.dll library to the C:\Datacap\dcshared directory. What to do next: 7.6.2, Setting up a secure connection to Collector Server and adapting the client configuration profile, on page 144 Library gsk8iccs.dll icclib082.dll Deploying the archiving capability on Datacap Version 9 Complete the following steps for Datacap V9. Procedure: 1. Log on as application administrator to the system where Datacap runs. 2. Ensure that the IBM Global Secure ToolKit (GSKit) libraries of Content Collector for SAP are used by Datacap. a. Make a backup copy of the gsk8iccs.dll library, which is in the following directory: v On a Windows 64-bit operating system: C:\Windows\SysWOW64 v On a Windows 32-bit operating system: C:\Windows\System32 b. Copy the following libraries as shown in this table: Copy the library from the following directory: The GSKit directory of the add-ons package of Content Collector for SAP, for example: C:\InstallHome\api\gskit The icclib directory of your GSKit installation, for example: C:\InstallHome\api\gskit\C\ icc\icclib libeay32ibm082.dll The osslib directory of your GSKit installation, for example: C:\InstallHome\api\gskit\C\ icc\osslib Copy the library to the following directory: On Windows 64-bit On Windows 32-bit C:\Windows\SysWOW64 C:\Windows\SysWOW64\icc\ icclib C:\Windows\SysWOW64\icc\ osslib C:\Windows\System32 C:\Windows\System32\icc\ icclib C:\Windows\System32\icc\ osslib c. Run Datacap Application Manager to encrypt the Datacap databases again. 3. Extract the DatacapTMIntegration.zip file to a temporary directory. You get the following folders and files: Chapter 7. Configuring your environment for more or advanced tasks 143

156 Datacap80 Datacap81 Datacap90 copyright.txt ICCSAPAccess.rrx The folders contain the ICCSAPAccess.dll library for the corresponding Datacap version. You need only the contents of the Datacap90 folder. 4. If the custom actions of Datacap V8 are already deployed, unregister the ICCSAPAccess.dll library by using the Assembly Registration tool (Regasm.exe): at a command prompt, enter the following command: regasm ICCSAPAccess.dll /u On most systems, the Assembly Registration tool is in the following directory: C:\Windows\Microsoft.NET\Framework\v Move the ICCSAPAccess.dll library from the Datacap90 folder to the C:\Datacap\RRS directory. Important: Do not register the library. 6. Move the csclient.dll library to the C:\Datacap\dcshared directory. What to do next: 7.6.2, Setting up a secure connection to Collector Server and adapting the client configuration profile Setting up a secure connection to Collector Server and adapting the client configuration profile You must set up a secure connection between the API and the Collector Server instance. In addition, you must configure the client configuration profile for the secure connection and, optionally, for use by Datacap. Before you begin: 7.6.1, Deploying the archiving capability on Datacap, on page 142 For the API to establish a connection between Datacap and Collector Server, you must supply the host name and the port number of Collector Server. In addition, you can specify whether a trace file is to be created for the API. You can supply the entire information in the client configuration profile and initialize the API with the settings in the client configuration profile. Alternatively, you can pass the required information as parameters during the initialization of the API. Procedure: 1.. If there are several users on the system where Datacap runs, decide which of these users are allowed to use the API. Also, decide whether several users are to share one certificate. 2.. Copy the folders with the client keystores to the system where Datacap runs. If you want to run Rulerunner as a service, move the client configuration profile csclient.ini to the following directory: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\IBM\iccsap Each user who is allowed to use the API must have access to a client keystore. 3. You can initialize the API with or without the use of the client configuration profile: v If you do not want to use the settings in the client configuration profile, ensure that the profile contains at least the following section: [ARCHPRO_CONNECTIONPARAMETER] keystore=path 144 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

157 v path stands for the fully qualified file name of the client keystore. If you want to use the settings in the client configuration profile, the ARCHPRO_CONNECTIONPARAMETER section must contain further settings: a. Set the following mandatory parameters: Server=server_name Port=port keystore=path server_name The host name or the IP address of the computer where Collector Server runs. port The port number that is specified for the ARCHPRO_PORT keyword in the server configuration profile. path The fully qualified file name of the client keystore that contains the certificate for the user. Example: Server=myICCSAPServer Port=7654 keystore=c:\users\cuser1\appdata\roaming\ibm\iccsap\security\client_1\client_1.kdb b. If a trace file is to be created for the API, set the following parameters: DLLTraceFile=trace_file DLLTraceLevel=1 DLLTraceMax=max_trace_size Interactive=0 trace_file stands for the fully qualified path to the trace file. max_trace_size stands for the maximum size of the trace file, in KB. The default value is The Interactive parameter is set to 0 to suppress pop-up windows that are displayed in the case of an error and that require your interaction. Example: DLLTracefile=c:\temp\dlltrace.trc DLLTraceLevel=1 DLLTraceMax=1024 Interactive=0 What to do next: 7.6.3, Setting the custom actions Setting the custom actions The deployed custom actions are under the namespace ICCSAPAccess in Datacap Studio. Decide which custom actions you need and set their parameters. All custom actions can handle smart parameters. Before you begin: 7.6.2, Setting up a secure connection to Collector Server and adapting the client configuration profile, on page 144 Procedure: 1. Decide how you want to archive your documents: by creating a work item in an SAP workflow or by sending their bar codes to SAP. 2. Decide which custom actions you need in your Taskmaster Client application. Table 9 on page 146 gives an overview of the custom actions and the required sequence. Chapter 7. Configuring your environment for more or advanced tasks 145

158 Table 9. Sequence of custom actions Custom action ICCSetDLLTraceFile ICCSetDLLTraceLevel ICCAccessInit or ICCAccessInit2 ICCArchiveID ICCDocType ICCFilePath ICCArchiveFileName ICCFileExtension ICCAddArchiveProperty or ICCAddSAPProperty ICCArchiveCreateWI or ICCArchiveSendBarcode ICCAccessExit DeleteFile Remarks Used only by the ICCAccessInit2 action. Both actions are required if you want to create a trace for the csclient.dll library. Depends on whether you want to use the client configuration profile. Use the ICCAccessInit action if the profile is to be used. Required only if the file name does not include the extension. Required only if you want to store index information in the logical archive or in SAP. Depends on whether you want to archive your documents by creating work items in an SAP workflow or by sending their bar codes to SAP. After the documents are archived, delete them from the path that is set in the ICCFilePath custom action. Important: The DeleteFile action is not part of the ICCSAPAccess.dll library. It is not described in this information. 3. Add the necessary custom actions to the Export rule set in the sequence shown. In addition, specify the values for the parameters that are required by the custom actions. The documents that Datacap scans and captures are now archived according to your specifications in the custom actions. All custom actions create log entries in the Rulerunner log ICCAccessExit Shuts down the Windows socket and closes any open trace file for the API. Parameters None. Return value True. Preferred level in document hierarchy Batch. 146 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

159 Example ICCAccessExit() Remarks Attach this action to the Close element of the batch to end the connection to the API ICCAccessInit Initializes the API by using the settings that are defined in the client configuration profile csclient.ini. In addition, it sends a message to the Collector Server instance. Thus, it can be used to test the connection to the Collector Server instance. It sets the parameters in the API and provides the version numbers, the host information, and the port number. Parameters None. All parameters that are necessary to initialize the API are retrieved from the client configuration profile. Return value Either of the following values: v True if the API was initialized successfully. v False if the API could not be found or loaded. Preferred level in the document hierarchy Batch. Example ICCAccessInit() Remarks A return code other than 0 is logged. If the return code is 0, the versions of Collector Server and of the API are written to the log ICCAccessInit2 Initializes the API without the use of the client configuration profile csclient.ini. The parameters that are passed with the initialization are used until the ICCAccessExit action is executed. Parameters Parameter name Type Length Required or optional Host String 255 characters Required Port String 255 characters Required Chapter 7. Configuring your environment for more or advanced tasks 147

160 Return value Either of the following values: v True if the API was initialized successfully and a session with the Collector Server instance could be established. v False if the API could not be found or loaded or if a session with the Collector Server instance could not be established. Preferred level in the document hierarchy Batch or document. Example ICCAccessInit2("myHost","5500") Remarks A return code other than 0 is logged. If the return code is 0, the versions of Collector Server and the csclient.dll library is written to the log ICCAddArchiveProperty Adds a custom property as a name and value pair to a list. When the ICCArchiveSendBarcode action or ICCArchiveCreateWI action is executed, the value is stored in the corresponding property in the logical archive. The name of the property must match the name of the property in the logical archive. This action must be called for each value that is to be stored in the logical archive. It is required only if you want to transfer additional document information to the logical archive. Parameters Parameter name Type Length Required or optional PropertyName String 255 characters Required PropertyValue String 255 characters Required Return value Either of the following values: v True if the property name and the property value are valid. v False if either of the parameters is missing or exceeds the maximum length of 255 characters. Preferred level in the document hierarchy Document. Example ICCAddArchiveProperty("Amount","@D.Amount") 148 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

161 ICCAddSAPProperty Adds a custom property as a name and value pair to a list. When the ICCArchiveSendBarcode action or ICCArchiveCreateWI action is executed, the property and its value are submitted to SAP. This action must be called for each value that is to be submitted to SAP. It is required only if you want to transfer additional document information to SAP. Parameters Parameter name Type Length Required or optional PropertyName String 255 characters Required PropertyValue String 255 characters Required Return value Either of the following values: v True if the property name and the property value are valid. v False if either of the parameters is missing or exceeds the maximum length of 255 characters. Preferred level in the document hierarchy Document. Example ICCAddSAPProperty("Client","800") ICCArchiveCreateWI Archives a document and creates a work item in an SAP workflow. The work item is created after archiving is complete. If an error occurs, the document is deleted automatically from the repository. If you also use the ICCAddSAPProperty action or the ICCAddArchiveProperty action, a property name and value pair is transferred each time you execute the ICCArchiveCreateWI action. Parameters Parameter name Type Length Required or optional ArObject String 10 characters Required. Corresponds to the SAP document type, for example, FIIINVOICE. Barcode String 40 characters Optional. Can be or NULL. Chapter 7. Configuring your environment for more or advanced tasks 149

162 Return value Either of the following values: v True if the action was completed successfully. v False if the parameter ArObject is missing or if the action was not completed successfully. Preferred level in the document hierarchy Document. Example ICCArchiveCreateWI("@D.mySAPDocType","") ICCArchiveFileName Defines the file name of the document that is to be archived. This action is required. Parameters Parameter name Type Length Required or optional Filename String 255 characters Required The total length of the fully qualified file name, including any extension, must not exceed 255 characters. The file name must not be NULL or an empty string. Return value Either of the following values: v True if the file name is valid. v False if the file name is missing or if the fully qualified file name exceeds the maximum length of 255 characters. Preferred level in the document hierarchy Document. Example ICCArchiveFileName("myFile_+@ID") Remarks If you include an extension in the file name, you need not execute the ICCFileExtension action ICCArchiveID Specifies the ID of the logical archive where the document is to be stored. This action is required. 150 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

163 Parameters Parameter name Type Length Required or optional ArchiveID String 10 characters Required The file name must not be NULL or an empty string. Return value Either of the following values: v True if the logical archive ID is valid. v False if the logical archive ID is empty or exceeds the maximum length of 10 characters. Preferred level in the document hierarchy Batch. Example ICCArchiveID("A1") ICCArchiveSendBarcode Archives a document and sends the bar code to SAP. The bar code is sent to SAP after the document is archived. If an error occurs, the document is deleted automatically from the repository. If you also use the ICCAddSAPProperty action or the ICCAddArchiveProperty action, a property name and value pair is transferred each time you execute the ICCArchiveSendBarcode action. Parameters Parameter name Type Length Required or optional Barcode String 40 characters Required Return value Either of the following values: v True if the action was completed successfully. v False if the bar code is missing or if the action was not completed successfully. Preferred level in the document hierarchy Document. Example ICCArchiveSendBarcode("@D.myBarcode") ICCDocType Specifies the type of the document that is to be archived. The document type corresponds to the SAP document class. This action is required. Chapter 7. Configuring your environment for more or advanced tasks 151

164 Parameters Parameter name Type Length Required or optional Doctype String 10 characters Required Return value Either of the following values: v True if the document type is valid. v False if the document type is missing or exceeds the maximum length of 10 characters. Preferred level in the document hierarchy Batch. Example ICCDocType("FAX") ICCFileExtension Defines the file extension of the document that is to be archived. Use this action only if the file extension is not set by the ICCArchiveFileName action. Parameters Parameter name Type Length Required or optional Extension String 255 characters Required The total length of the fully qualified file name, including the extension, must not exceed 255 characters. The file name must not be NULL or an empty string. Return value True. Preferred level in the document hierarchy Document. Example ICCFileExtension ("tif") ICCFilePath Specifies the path to the documents that are to be archived. The path is used to create the fully qualified file name of a document. This action is required. Parameters Parameter name Type Length Required or optional Path String 10 characters Required 152 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

165 The total length of the fully qualified file name, including the extension, must not exceed 255 characters. The file name must not be NULL or an empty string. Return value True. Preferred level in the document hierarchy Batch. Example ICCFilePath("c:\myApplication\myExportDir") ICCSetDLLTraceFile Specifies the fully qualified file name of the trace file for the API. This action is used by the ICCAccessInit2 action. It is required if tracing is enabled with the ICCSetDLLTraceLevel action. Parameters Parameter name Type Length Required or optional Tracefile String 255 characters Required if tracing is enabled where: Return value Either of the following values: v True if the trace file could be set. v False if the trace file could not be set. Preferred level in the document hierarchy Batch. Example ICCSetDLLTraceFile("c:\myTrace\CSClientDLL.trc") ICCSetDLLTraceLevel Enables or disables tracing for the API. This action is used by the ICCAccessInit2 action. Parameters Parameter name Type Values Required or optional Tracelevel Integer 0 1 Optional where: 0 indicates that tracing is disabled, which is the default. 1 indicates that tracing is enabled. Chapter 7. Configuring your environment for more or advanced tasks 153

166 Return value True. Preferred level in the document hierarchy Batch. Example ICCSetDLLTraceLevel("1") 7.7 Configuring for linking documents and folders directly to an SAP business object Fix Pack 1 If you have xft document connector and Fix Pack 1 of Content Collector for SAP installed, you can link selected archived documents and folders directly to an existing SAP business object. Before you begin: 3.3, Configuring IBM Content Navigator for linking FileNet P8 objects manually to SAP, on page 32 xft document connector provides an interface in the form of an ABAP function group. You must deploy this function group as a web service in SAP. In addition, you must generate the URL for the web service. Procedure: , Deploying the web service for the xft document connector , Configuring the web service in the SOA Manager of SAP, on page Deploying the web service for the xft document connector Fix Pack 1 You use the SAP GUI to deploy the web service. Procedure: 1. In the SAP GUI, enter the transaction code SE80 to open the Object Navigator window. 2. From the list in the middle of the window, select Function Group. 3. In the field that follows, type: /XFT/DCC_BAPI Figure 88 on page 155 shows what your entry looks like. 154 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

167 Figure 88. Object Navigator window containing the name of the function group 4. In the Object Name column of the table, right-click /XFT/DCC_BAPI and then click Create > Other Objects > Enterprise Service. The Create Webservice for Function Pool window opens. 5. On the Service page, specify the following information: a. In the Service Definition field, type a name for the web service. It is good practice to use the name of the function group as web service name. For example, type: ZXFT_DCC_BAPI b. In addition, type a short description for the web service. For example, type xft document connector web service in the Description field. c. Click Z. Figure 89 on page 156 shows what the Service page of the Create Webservice for Function Pool window might look like. Chapter 7. Configuring your environment for more or advanced tasks 155

168 Figure 89. Service page of the Create Webservice for Function Pool window containing the sample web service name and a sample description for the web service 6. On the Endpoint Function Group page, select the Map Names check box. Then, click Continue. Figure 90 on page 157 shows the Choose Endpoint page with your specification. 156 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

169 Figure 90. Endpoint Function Group page of the Create Webservice for Function Pool window containing the name of the function group and the selected item 7. On the Function Group page, click Continue. 8. On the Configure Service page, specify the following information: a. From the SOAP Appl list, select a security profile. For example, select urn:sap-com:soap_runtime_application:rfc:710. b. From the Profile list, select No Authentication and No Transport Guarantee as security level for the profile. Note: The connection between xft document connector and the web service is protected by a user ID and a password. An HTTPS connection is not supported. c. Click Continue. Figure 91 on page 158 shows what the Configure Service page might look like. Chapter 7. Configuring your environment for more or advanced tasks 157

170 Figure 91. Configure Service page of the Create Webservice for Function Pool window containing the sample security profile and the security level 9. On the Transport page, specify the following information: a. In the Package field, type the name of an existing package. For example, type: /mycomp/mypackage b. Click Continue. Figure 92 on page 159 shows the Transport page with your specification. 158 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

171 Figure 92. Transport page of the Create Webservice for Function Pool window containing the selected item 10. On the Complete page, click Complete. The web service ZXFT_DCC_BAPI is deployed. What to do next: 7.7.2, Configuring the web service in the SOA Manager of SAP Configuring the web service in the SOA Manager of SAP Fix Pack 1 Check whether the web service is active and specify your SAP logon credentials. Before you begin: 7.7.1, Deploying the web service for the xft document connector, on page 154 Procedure: 1. In the SAP GUI, enter the transaction code SE84 to open the Object Navigator window. 2. Expand Enterprise Services and then double-click Service Definitions. The Repository Info System: Find Service Definition window opens. 3. In the Service Definition field under Standard Selections, type: ZXFT_DCC_BAPI Figure 93 on page 160 shows what the Repository Info System: Find Service Definition window might look like. Chapter 7. Configuring your environment for more or advanced tasks 159

172 Figure 93. Repository Info System: Find Service Definition containing your specification 4. Click the Execute icon. Then, double-click ZXFT_DCC_BAPI. The Display Service Definition window shows the details for your web service. Check whether your web service has the state Active. Figure 94 shows what the Display Service Definition window might look like. Figure 94. Display Service Definition window containing the details about your web service 5. Enter the transaction code SOAMANAGER and then log on to SAP NetWeaver to open the SOA Management window. 6. On the Service Administration page of the SOA Management window, click the Web Service Configuration link. 7. In the Web Service Configuration window, complete these steps: 160 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

173 a. Search for the web service that you created. For example, type ZXFT_DCC* in the Search Pattern field and then click Go. The web service that you created is added to the Search Results table. b. Click the entry and then click Apply Selection. Figure 95 shows what the Web Service Configuration window might look like. Figure 95. Web Service Configuration window containing your specifications 8. On the Overview page of the Details of Service Definition window, select the appropriate binding. If the binding does not exist, create it. Figure 96 shows the Overview page with the selected binding. Figure 96. Overview page of the Details of Service Definition window containing a sample selection 9. On the Configurations page of the Details of Service Definition window, click the web service and then click Create. Figure 97 on page 162 shows which items to click on the Configurations page. Chapter 7. Configuring your environment for more or advanced tasks 161

174 Figure 97. Configurations page of the Details of Service Definition window showing which items to click 10. In the SOA Management window that opens, complete the required information. Then, click Apply Settings. Figure 98 shows what the SOA Management window might look like. Figure 98. SOA Management window containing sample information 11. On the Configurations page of the Configuration of Web Service window, click Edit. 12. On the Provider Security page of the Configuration of Web Service window, specify the following information: a. Under Transport Guarantee Type, click None. An HTTPS connection is not supported. b. Under Authentication Settings, select the No Authentication check box. c. Click Save. Figure 99 on page 163 shows the Provider Security page of the Configuration of Web Service window with your specifications. 162 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

175 Figure 99. Provider Security page of the Configuration of Web Service window containing your specifications 13. Return to the Details of Service Definition window. On the Overview page, click the Open WSDL document for selected binding or service link. Figure 100 shows which link to click on the Overview page of the Details of Service Definition window. Figure 100. Overview page of the Details of Service Definition window showing which item to click After you log on, the Web Services Description Language (WSDL) document opens. Figure 101 on page 164 shows the example contents of the WSDL document: Chapter 7. Configuring your environment for more or advanced tasks 163

176 Figure 101. Example contents of the WSDL document At the end of the document, you find the URL and the port of your web service. You must specify this information in the instance configuration. 7.8 Integrating Content Collector for SAP into the SAP Solution Manager You can integrate Content Collector for SAP into the SAP Solution Manager by registering Content Collector for SAP with the SAP System Landscape Directory (SLD). Procedure: 1. Change to the directory of your Collector Server installation. The default installation directory is as follows: v Linux UNIX InstallHome/server v Windows InstallHome\server 2. Open the file slddata.xml in a text editor. This file is in the installation directory. 3. Replace all occurrences of the word HOSTNAME with the fully qualified name of the host where Collector Server is installed. 4. Copy the modified file slddata.xml to a directory on the system where the SAP Solution Manager is installed. 5. Run the sldreg tool to upload the information that is contained in the modified slddata.xml file to the SLD. For a description of the sldreg tool, open the SAP Help Portal and search for Configuring sldreg and transferring data to SLD. 164 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

177 Chapter 8. Running a Collector Server instance You must start the Collector Server instance before you can create any task profiles for it in Administration Feature or before you can run any of the Content Collector for SAP tasks. Before you begin: 1. Plan for running Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Chapter 5, Configuring Collector Server, on page Optional: Chapter 6, Configuring your environment for basic tasks, on page Optional: Chapter 7, Configuring your environment for more or advanced tasks, on page Starting a Collector Server instance You start a Collector Server instance from the command line. Starting with Fix Pack 1, start an instance directly from IBM Content Navigator Starting a Collector Server instance from IBM Content Navigator Fix Pack 1 To start a Collector Server instance from IBM Content Navigator, you must change the instance configuration. Before you begin: v Chapter 4, Configuring a daemon, on page 35. Ensure that the daemon is running. v Ensure that the paths that you specified in the instance configuration do not contain any environment variables or shell expansions. Replace paths that contain environment variables or shell expansions with fully qualified paths. In Configuration Feature, take these steps: 1. Open the instance configuration that you want to change. 2. Go to Basic Configuration and complete the Instance Control section. 3. Click Save. Then, click Start. You are prompted for the passwords of the SSL keystore, the SSL truststore, and all users that are specified in the instance configuration. You are prompted even if you already specified that information on a command line. All passwords are stored in the password file. The Collector Server instance uses them the next time that it is started. In addition, the master key is generated if it does not exist yet. The paths that you specified in the instance configuration are created if they do not exist. Copyright IBM Corp. 2010,

178 The server configuration profile is stored on the system where Collector Server is installed. If, in the instance configuration, you specified the file name of the server configuration profile without a path, the server configuration profile is stored in the instance path. If you specified a fully qualified file name, the server configuration profile is stored in the path that you specified as part of the fully qualified file name. What to do next: , Configuring the server authentication on the web application server, on page Starting a Collector Server instance from a command line To start a Collector Server instance from a command line, you must first make the instance configuration available on the system where Collector Server is installed. Then, you must use the archpro command. Before you begin: Ensure that all paths that you specified in the instance configuration exist. Content Collector for SAP does not create any paths. Procedure: , Making an instance configuration available for use by Collector Server , Starting a Collector Server instance with the archpro command, on page Making an instance configuration available for use by Collector Server To run a Collector Server instance, the instance configuration must be available as a server configuration profile on the system where Collector Server is installed. You can use Configuration Feature to export the instance configuration to a server configuration profile. Then, you can move the server configuration profile to the server where Collector Server is installed. Use this manual procedure at least for making the instance configuration available for the first time. Alternatively, you can download the instance configuration with the archcmd program. You run this program from a command line on the system where Collector Server is installed. If your instance configurations change frequently, you can automate the download Exporting the instance configuration from Configuration Feature: When you make an instance configuration available for the first time, export it from Configuration Feature. Procedure: 1. Open a web browser and then open the IBM Content Navigator desktop for the Collector Server administrator, by typing the following URL: protocol://hostname:portnumber/context_root/?desktop=desktop_id You must have access to this desktop. For example, type: 2. Log on as Collector Server administrator. 3. In the plug-in pane on the left, click the IBM Content Collector for SAP Applications Configuration Feature icon. 166 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

179 4. On the Manage Collector Server Instances page, open the instance configuration that you want to export. 5. Click Export. The instance configuration is converted to a server configuration profile. The Export Configuration to Server Configuration Profile window shows the file name and the contents of the server configuration profile. Below the contents, you find the command that you can use to download the instance configuration with the archcmd program. Make a note of this command if you want to use this program. 6. Click OK. Then, save the server configuration profile. 7. Move or copy the saved server configuration profile to the system where Collector Server is installed. You can store the profile in a directory of your choice. It does not have to be stored in the instance directory. What to do next: , Starting a Collector Server instance with the archpro command, on page Downloading the instance configuration with the archcmd command: Instead of exporting the instance configuration from Configuration Feature each time the instance configuration changes, you can download it from a command line on the system where Collector Server is installed. For this purpose, Content Collector for SAP supplies the archcmd program. This program is based on the Java utilities that are supplied with Content Collector for SAP as part of the IBM Java Runtime Environment (JRE). Before you begin: , Exporting the instance configuration from Configuration Feature, on page 166. Complete at least step 1 on page 166 through step 5. You would typically use the archcmd program if you must frequently change your instance configurations and you want to automate the synchronization of the server configuration profile on Collector Server with the instance configuration in the IBM Content Navigator database. Procedure: 1. Open a command line on the system where Collector Server is installed. If, in the instance configuration, you specified the file name of the server configuration profile without a path, open a command line in the directory that the server configuration profile is to be downloaded to. If you specified a fully qualified file name, the server configuration profile is downloaded to the path that you specified as part of the fully qualified file name. Alternatively, open the command line in a directory of your choice and, in step 2, add the filename parameter to the archcmd command. 2. Enter the command that you noted down in step 5. For more information about the archcmd command, see the topic archcmd in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Optional: Schedule the archcmd program to automate the download. A server configuration profile with the latest instance configuration is created on the system where you ran the command. Chapter 8. Running a Collector Server instance 167

180 What to do next: , Starting a Collector Server instance with the archpro command Starting a Collector Server instance with the archpro command When you start a Collector Server instance for the first time, you must enter specific information. Before you begin: v , Making an instance configuration available for use by Collector Server, on page 166. v Windows If you run several Content Collector for SAP versions on one Windows system, check the PATH environment variable on a command prompt. The archpro command, which is used to start a Collector Server instance, can be issued from any directory. In addition to the command, you must specify the fully qualified file name of the server configuration profile. You are prompted for all other information that the Collector Server instance needs to start. To reduce the number of prompts, you can specify the appropriate parameters for the command. The fully qualified file name of the server configuration profile can be omitted if both of the following conditions are met: v v You enter the command from the directory that contains the server configuration profile. The server configuration profile has the name archint.ini. The procedures in the following topics are based on these assumptions: v The server configuration profile is in the instance directory. v The server configuration profile has the name archint.ini. v You enter the archpro command from the instance directory. The following topics give an overview of the parameters that you most likely have to provide with the archpro command. For the full list of parameters, see the topic archpro in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Starting a Collector Server instance that uses FileNet P8, with the archpro command: Complete these steps to start a Collector Server instance with the archpro command when you use FileNet P8 as repository. Procedure: 1. Open a command line and change to the instance directory. 2. Generate the master key, which encrypts the password file and the SAP certificates. Enter the following command: archpro -f masterkey You must have read and write access for the fully qualified path to the master key file, which contains the master key. Ideally, you are the owner of this file and no other user has access to this file. Linux and UNIX systems check the permissions for this file. 168 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

181 Content Collector for SAP creates a master key and saves it under the fully qualified file name that you specified in the instance configuration. Where to find the file name: Basic Configuration > Security > General > Master key file MASTER_KEYFILE keyword 3. If the Collector Server instance must log on to an SAP system, enter the following command: v If the instance is to log on to a specific SAP client, enter the following command: archpro -f r3passwd sap_client sap_user v sap_user stands for the name of the CPIC user that the Collector Server instance uses to log on to SAP client sap_client. You are prompted for the password of the specified CPIC user. If the instance is to log on to all SAP clients that are linked as logical systems, enter the following command: archpro -f r3passwd You are prompted for the password of each CPIC user and each SAP client that are linked as logical systems to the Collector Server instance. Notes: v Type the password exactly as you specified it for the CPIC user. v You must enter this command each time you want to change the SAP password. 4. The Collector Server instance must access your repository. Enter the following command: archpro -f serverpasswd server repos_user password server Specify the object store, the Content Engine WSI endpoint, and the domain that you specified in the instance configuration, in the following format: [objectstore][endpoint][domain] If any of the values contain a blank, enclose the entire server ID in quotation marks, such as: "[objectstore][endpoint][domain]" Note: On Windows, you must use double quotation marks. On Linux and UNIX systems, you can use single quotation marks or double quotation marks. Where to find the information: Logical Archives > Logical FileNet P8 Archive id > General Keywords OBJECTSTORE, REMOTESERVERURL, and P8DOMAIN repos_user Specify the user that Collector Server uses to log on to FileNet P8. Where to find the user ID: Logical Archives > Logical FileNet P8 Archive id > General > User Chapter 8. Running a Collector Server instance 169

182 P8USER keyword password Specify the password of the user. 5. IBM Content Navigator must access the Collector Server instance. Enter the following commands: v archpro -f keystore_passwd You are prompted for the password of the SSL keystore. v archpro -f truststore_passwd You are prompted for the password of the SSL truststore. Note: The keystore and the truststore are also used for an HTTPS communication with an SAP system. You must specify the commands and the passwords only once. 6. If you configured your instance for linking documents that are in a P8 queue, enter the following command: archpro -f serverpasswd_pe server pe_user password The variables are optional. If you do not specify them, you are prompted for them. server Specify the object store, the Content Engine WSI endpoint, and the domain that you specified in the instance configuration, in the following format: [objectstore][endpoint][domain] If any of the values contain a blank, enclose the entire server ID in quotation marks, such as: "[objectstore][endpoint][domain]" Note: On Windows, you must use double quotation marks. On Linux and UNIX systems, you can use single quotation marks or double quotation marks. Where to find the information: Logical Archives > Logical FileNet P8 Archive id > General Keywords OBJECTSTORE, REMOTESERVERURL, and P8DOMAIN pe_user Specify the user ID that can read P8 queues. Where to find the user ID: Logical Archives > Logical FileNet P8 Archive id > Linking of Documents in a P8 Queue > User Fix Pack 1 The Linking of Documents in a P8 Queue section has been renamed to Document Linking. PE_USERID keyword password Specify the password of the user. 7. If you configured your instance for viewing archived objects, folders, search templates, and stored searches with IBM Content Navigator, enter the following command: 170 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

183 archpro -f serverpasswd_icn server ICN_user password The variables are optional. If you do not specify them, you are prompted for them. server Specify the object store, the Content Engine WSI endpoint, and the domain that you specified in the instance configuration, in the following format: [objectstore][endpoint][domain] If any of the values contain a blank, enclose the entire server ID in quotation marks, such as: "[objectstore][endpoint][domain]" Note: On Windows, you must use double quotation marks. On Linux and UNIX systems, you can use single quotation marks or double quotation marks. Where to find the information: Logical Archives > Logical FileNet P8 Archive id > General Keywords OBJECTSTORE, REMOTESERVERURL, and P8DOMAIN ICN_user Specify the user that can be used to display objects in IBM Content Navigator without prior authentication. Where to find the user: Logical Archives > Logical FileNet P8 Archive id > Viewing with IBM Content Navigator > User ICN_USERID keyword password Specify the password of the user. 8. Enter archpro to start the Collector Server instance. All passwords that you specified are stored in the password file. The Collector Server instance uses them the next time that it is started. What to do next: , Configuring the server authentication on the web application server, on page Stopping a Collector Server instance At any time, you can stop a Collector Server instance. Collector Server waits until all jobs are finished and then shuts down. Before you begin: 8.1, Starting a Collector Server instance, on page 165 You stop a Collector Server instance from the command line. Starting with Fix Pack 1, stop the instance directly from IBM Content Navigator. Complete these steps to stop a Collector Server instance: v Fix Pack 1 To stop it from IBM Content Navigator, take these steps in Configuration Feature: Chapter 8. Running a Collector Server instance 171

184 v 1. In the Manage Collector Server Instances page, select the Collector Server instance that you want to stop. 2. Click Stop. You can stop one instance at a time. To stop it from a command line, take these steps: 1. Open a command line and change to the instance directory. 2. Enter the following command: archstop -i profile profile stands for the fully qualified file name of the server configuration profile. If you enter the command from the directory that contains the server configuration profile and if the server configuration profile has the default name archint.ini, -i profile is optional. When the archpro program receives the archstop command, it first stops all child processes and then it stops itself. For more information about this command and the parameters that you can specify, see the topic archstop in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Restarting a Collector Server instance At any time, you can change the configuration of a Collector Server instance. If the affected instance is running, the changes take effect after the restart of the instance. Before you begin: 8.1, Starting a Collector Server instance, on page 165 To apply changes to a running Collector Server instance, complete these steps: 1. In Configuration Feature, change the instance configuration. Then, click Save. 2. Continue as follows: v Fix Pack 1 To restart the instance from IBM Content Navigator, you are asked whether you want to apply your changes to the running instance. Click Stop to Restart to stop the instance and then restart it with the changed configuration. If you added users, keystores, or truststores to the instance configuration, you are prompted for their passwords. If a password changed, you are prompted for the new password. v To restart the instance from a command line, take these steps: a. 8.2, Stopping a Collector Server instance, on page 171. b , Starting a Collector Server instance from a command line, on page Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

185 Chapter 9. Running a Collector Server instance as a Windows service On Windows, you can run a Collector Server instance as a service. As a service, an instance runs continuously even if all users are logged off. This is useful, for example, if you want to use monitoring tools. 9.1 Installing a Collector Server instance as a service and starting the service You use the archservice program to install a Collector Server instance as a service and to start the service. Starting with Fix Pack 1, you can use the daemon to complete those tasks Installing a Collector Server instance as a service and running the service from IBM Content Navigator Fix Pack 1 The daemon must have the permission to create a Windows service and to start and stop a service. Before you begin: Chapter 4, Configuring a daemon, on page 35 In Configuration Feature, take these steps: 1. To install a Collector Server instance as a service and to start the service, proceed as follows: a. Open the configuration of the instance that you want to run as a service. If the instance is running, stop it. b. Go to Basic Configuration and complete the Instance Control section. c. Save the instance configuration and then click Start. The Collector Server instance is installed as a service and the service is started. In addition, the archpro program is started, which in turn starts other related programs. The service checks every few seconds if the archpro program is still running. If the service detects that this program stopped, it waits for 1 minute and then tries to restart it. 2. To stop the service, select or open the Collector Server instance and then click Stop. The service is stopped, together with the archpro program and the programs that were started by the archpro program. 3. To restart the service, select or open the Collector Server instance and then click Start Installing a Collector Server instance as a service and running the service from a command line The user who installs the Collector Server instance as a Windows service needs the right to change the Windows registry and, thus, must be an administrator. Copyright IBM Corp. 2010,

186 Before you begin: If the Collector Server instance that is to be installed as a service is still running, stop it. Open a command prompt as an administrator, then take these steps: 1. To install a Collector Server instance as a service, enter the following command: archservice install -i profile -n suffix profile stands for the fully qualified file name of the server configuration profile. If you enter the command from the directory that contains the server configuration profile and if the server configuration profile has the default name archint.ini, -i profile is optional. suffix stands for the suffix that is appended to the default name iccsap.for example, if you specify -n instance1, the service is named iccsap_instance1. The service is installed, and the Windows Services window lists the service. 2. To start or restart the service, use either of the following ways: v At the command prompt that you open as an administrator on the system where Collector Server is installed, enter the following command: archservice start v Right-click the appropriate service in the Services window, and click the menu item to start the service. The service is started. In addition, the archpro program is started, which in turn starts other related programs. The service checks every few seconds if the archpro program is still running. If the service detects that this program stopped, it waits for 1 minute and then tries to restart it. 3. To stop the service, use either of the following ways: v At the command prompt that you open as an administrator on the system where Collector Server is installed, enter the following command: archservice stop v Select the appropriate service in the Services window and then click Action > All Tasks > Stop. The service is stopped, together with the archpro program and the programs that were started by the archpro program. For more information, see the topic archservice in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Running several instances of Collector Server as services You can run several Collector Server instances as services on one system, for example, to improve the performance. Before you begin: Windows The instances must belong to the same Content Collector for SAP version. Procedure: 1. Install and start the services as follows: v Fix Pack , Installing a Collector Server instance as a service and running the service from IBM Content Navigator, on page Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

187 9.2 Uninstalling a service v 9.1.2, Installing a Collector Server instance as a service and running the service from a command line, on page 173. When you install the Collector Server instance as a service, specify a unique name by using the -n parameter , Assigning fixed ports to the client dispatchers, on page 131. You use the archservice program to uninstall a service. Procedure: 1. If the service is still running, stop it. 2. Open a command prompt as an administrator. Then, enter the following command: archservice remove -i profile -n name Important: If you installed a Collector Server instance with the archservice command and you did not specify the -n parameter, specify the archservice remove command without the -n parameter. For more information, see the topic archservice in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Hints and tips If a problem occurs when you run a Collector Server instance as a service, the following hints and tips might help you solve the problem. v v v Install a Collector Server instance as a service only after the instance is started for the first time, and if you do not get any error messages or warnings. Check whether dynamic tracing is enabled. By using dynamic tracing, the start of the instance is traced. Tracing stops automatically after the instance is fully initialized. Where to find the information in Configuration Feature: Go to Basic Configuration > Logging and Tracing > Tracing and check whether Dynamic is selected for Tracing. You can restart tracing by using the archadmin program. Starting with Fix Pack 1, you can restart tracing also from IBM Content Navigator. Remember, however, that tracing affects the performance of Content Collector for SAP. Therefore, stop tracing again when you do not need it any more. For more information about the archadmin program and the parameters that you can specify, see the topic archadmin in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH For more information about controlling tracing from IBM Content Navigator, see the topic Viewing logs and traces and controlling tracing from IBM Content Navigator. Record all messages that are issued when the instance is run as a service. For this purpose, you must change the instance configuration. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Basic Configuration > Logging and Tracing > Tracing 3. In the Service trace file field, and specify a fully qualified file name. Chapter 9. Running a Collector Server instance as a Windows service 175

188 In a server configuration profile, you find the following specification that relates to this trace file: Section in server configuration profile UI field that supplies the value Keyword Global section SERVICE_TRACEFILE Service trace file v If the number of RFC dispatchers is greater than 0, the paths that are set as basic path and archive path are probably unavailable when you start the service. However, an instance starts only if all paths are available. Where to find the basic path and archive path in Configuration Feature: Basic Configuration > Communication > RFC Communication with SAP 176 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

189 Part 2. Security Get familiar with the security concept that is provided by Content Collector for SAP before you complete any of the security tasks. For more information, see the topic Security concept provided by Content Collector for SAP in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH The master key is created when you start a Collector Server instance for the first time. For a secure communication between a Collector Server instance and the API of Content Collector for SAP or between a Collector Server instance and SAP, you must complete more steps. Copyright IBM Corp. 2010,

190 178 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

191 Chapter 10. Changing the master key You create the master key when you start the Collector Server instance for the first time. You can create a new master key each time you start the instance. Before you begin: 8.1, Starting a Collector Server instance, on page 165 v Fix Pack 1 If you start a Collector Server instance from IBM Content Navigator, select the Generate master key check box in the Start Instance window. v If you use a command line to start a Collector Server instance, complete these steps: 1. Open a command line and change to the instance directory. 2. Enter the following command: archpro -i profile -f masterkey profile stands for the fully qualified file name of the server configuration profile. If you enter the command from the directory that contains the server configuration profile and if the server configuration profile has the default name archint.ini, -i profile is optional. The master key is stored in the master key file that you specified in the instance configuration. Where to find the path to the master key file: Basic Configuration > Security > General > Master key file MASTER_KEYFILE keyword 3. Enter archpro to start the Collector Server instance. Related information: archpro Copyright IBM Corp. 2010,

192 180 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

193 Chapter 11. Changing the passwords in the password file All passwords that a Collector Server instance needs are stored in the password file. You add the passwords to the password file when you start the Collector Server instance. If the password of a user or keystore changes, for example, because your company policy requires that passwords are changed at regular intervals, you must also change it in the password file. Before you begin: 8.1, Starting a Collector Server instance, on page 165 You can add passwords to, or change them in, the password file when you start the Collector Server instance. Use either of these procedures: v Fix Pack 1 If you start a Collector Server instance from IBM Content Navigator, specify the new or changed passwords in the Start Instance window. v If you use a command line to start a Collector Server instance, complete these steps: 1. Open a command line and change to the instance directory. 2. Enter the following command: archpro -i profile -f parameters profile stands for the fully qualified file name of the server configuration profile. If you enter the command from the directory that contains the server configuration profile and if the server configuration profile has the default name archint.ini, -i profile is optional. parameters stands for the parameter or parameters that you must specify to change a specific password in the password file. For example, to change the password the of CPIC user that Collector Server uses to log on to an SAP client, enter the following command: archpro -f r3passwd You are prompted for the new password. 3. Enter the appropriate command for each password that you want to change in the password file. For more information, see the topic archpro in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Enter archpro to start the Collector Server instance. Copyright IBM Corp. 2010,

194 182 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

195 Chapter 12. Setting up a secure communication with the API Set up a secure communication between the API of Content Collector for SAP and a Collector Server instance if you want to use one or more external applications, such as IBM Datacap. Before you begin: 1. Plan for a secure communication between the API and one Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Install the add-ons package on the system where the external application runs. For more information, see the corresponding topic in the Installing part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Content Collector for SAP supplies a script file that uses Global Secure ToolKit (GSKit) commands to create the necessary keystores and the certificates and to register the certificates as trusted certificates. The script file has the following fully qualified file name: v Linux UNIX InstallHome/server/bin/client_key_gen.sh v Windows InstallHome\server\bin\client_key_gen.bat The script file executes several GSKit commands. The most important tasks can be completed by running the script file once, namely: v Create the server keystore. v Create the specified number of client keystores. v Create a self-signed certificate in each created keystore. v v Export the self-signed certificate, including the public key, from the server keystore and import it into all created client keystores. Export the self-signed certificates, including the public keys, from all created client keystores and import them into the server keystore. The following tasks show how to set up a secure connection to the API. The commands and specifications are based on the assumption that you use the default names for the keystores. For the complete functional scope of this script file, see the topic client_key_gen in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Tip: The tasks reflect an environment where the API is installed on a system with only a few users. You might have a much more complex environment with many applications and many users, where users share certificates and new users must be added from time to time. It is good practice to document the keystore names, the locations of the keystores, and the number of client keystores that you already created. Also, document which certificate belongs to which user and which certificates are shared by which users. Procedure: , Setting up a secure connection on Collector Server, on page 184 Copyright IBM Corp. 2010,

196 , Setting up a secure connection on the system with the API, on page Optional: 12.3, Setting up a secure communication between the API and several Collector Server instances, on page Setting up a secure connection on Collector Server You must create the server keystore and the client keystores on the Collector Server instance that communicates with the API. In addition, you must enable Collector Server for connecting to the API. Procedure: , Creating the keystores , Enabling the Collector Server instance to communicate with the API, on page Creating the keystores Create the server keystore and the client keystores. Procedure: 1. Open a command line and change to the directory where the folders for the keystores are to be stored. Tip: It is good practice to create the folders in a subdirectory of the instance directory. For example, create it in the following path: v Linux UNIX /home/iccsapadmin/instance1/security/server_clients v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\instance1\ security\server_clients 2. Enter the following command: v Linux UNIX client_key_gen.sh -c -p password -n number_clients v Windows client_key_gen.bat -c -p password -n number_clients password stands for the password of the server keystore. number_clients stands for the number of client keystores that are to be created. Create as many client keystores as you need certificates: v If the system with the API is used by several users and if each user must have their own certificate, create as many client keystores as there are users. v If you want to organize the users in groups, where each group is to share one certificate, create one client keystore for each group. For example, to create the server keystore and two client keystores and to encrypt the server keystore with the password secure, enter the following command. client_key_gen.sh -c -p secure -n 2 In the directory where you entered the command, the following folders are created: server, client_1, and client_2. The name of the server keystore is server.kdb. The names of the client keystores are client_1.kdb and client_2.kdb. The server keystore contains the certificates clientcert_1.crl and clientcert_2.crl. The client keystores contain the certificate servercert.crl. The server keystore is encrypted with the password secure. 3. At any time, you can add more client keystores. Enter the following command: 184 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

197 v Linux UNIX client_key_gen.sh -p password -n number_clients -i n+1_clients v Windows client_key_gen.bat -p password -n number_clients -i n+1_clients password stands for the password of the server keystore. number_clients stands for the number of client keystores that must be added. n+1_clients stands for the start number for the client keystores that are to be added. For example, to add another client keystore to two existing client keystores, you would enter the following command on a Linux or UNIX system: client_key_gen.sh -p secure -n 1 -i 3 The additional folder client_3 is created. What to do next: , Enabling the Collector Server instance to communicate with the API Enabling the Collector Server instance to communicate with the API Enable the Collector Server instance to use the server keystore and to communicate with the API. Before you begin: , Creating the keystores, on page 184 Procedure: 1. Change the instance configuration. In Configuration Feature, take these steps in Extended settings view: a. Open the instance configuration that you want to change. b. Go to Basic Configuration > Communication. c. Complete the Communication with the API section , Restarting a Collector Server instance, on page 172. To restart the instance from a command line, you use the archpro command with the following parameters: archpro -i profile -f dll_keystore_passwd password In a server configuration profile, you find the following specifications that relate to the communication with the API: Section in server configuration profile UI field that supplies the value Keyword Global section ARCHWINS Client dispatchers DLL_KEYSTORE_FILE Server keystore What to do next: 12.2, Setting up a secure connection on the system with the API 12.2 Setting up a secure connection on the system with the API You must copy the client keystores that you created on the system where the Collector Server instance runs, to the system where the API is installed. In addition, you must configure the client configuration profile for each user of this system. Chapter 12. Setting up a secure communication with the API 185

198 Before you begin: 12.1, Setting up a secure connection on Collector Server, on page 184 The sample client configuration profile csclient_sample.ini is installed together with Content Collector for SAP. You find it in the following path: v Linux UNIX InstallHome/api v Windows InstallHome\api Procedure: 1. On the system where the API is installed, create the following path in the env_var_appdata directory of each user on the system who is allowed to use the API: IBM\iccsap\security 2. Copy the sample client configuration profile to each env_var_appdata\ibm\ iccsap path and rename the file to csclient.ini. 3. Copy the folders that contain the client keystores (client_x) and that you created on the system where the Collector Server instance runs, to the system with the API. Use one of the scenarios, depending on your setup. Tip: Because the client keystores and the certificates are not protected by a password, it is good practice to place them in a subdirectory of the UserHome directory of a user, preferably in the env_var_appdata\ibm\iccsap\security directory. In the following scenarios, it is assumed that you use the env_var_appdata\ibm\iccsap\security directory for the client keystores. v , Scenario 1: One user uses the API v v v , Scenario 2: Several users where each user has a certificate, on page , Scenario 3: One certificate for several users in a private directory, on page , Scenario 4: One certificate for several users in a public directory, on page 188 What to do next: If you decide to connect your API with several Collector Server instances, continue with 12.3, Setting up a secure communication between the API and several Collector Server instances, on page Scenario 1: One user uses the API The system with the API is used by one user, or only one user on this system is allowed to use the API. Assume, for example, that the user who needs a certificate is cuser1 and the client_1 folder contains the client keystore with the certificate. Procedure: 1. Copy the client_1 folder to a directory that is accessible by cuser1. For example: C:\Users\cuser1\AppData\Roaming\IBM\iccsap\security\client_1 2. Open the csclient.ini file that you copied to the env_var_appdata\ibm\iccsap directory of the user, in a text editor. 186 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

199 3. Set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. For example: keystore=c:\users\cuser1\appdata\roaming\ibm\iccsap\security\client_1\ client_1.kdb Scenario 2: Several users where each user has a certificate Several users on the system are allowed to use the API, and a certificate is required for each user. Assume, for example, that the system is used by cuser1 and cuser2. In addition, assume that the client_1 folder contains the client keystore with the certificate for cuser1 and that the client_2 folder contains the client keystore with the certificate for cuser2. Procedure: 1. Copy the client_1 folder to a directory that is accessible by cuser1. In addition, copy client_2 folder to a directory that is accessible by cuser2. Example path to the client_1 folder for example user cuser1: C:\Users\cuser1\AppData\Roaming\IBM\iccsap\security\client_1 Example path to the client_2 folder for example user cuser2: C:\Users\cuser2\AppData\Roaming\IBM\iccsap\security\client_2 2. Open the csclient.ini files that you copied to the env_var_appdata\ibm\ iccsap directories of the users, in a text editor. 3. Set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. Example keystore setting in csclient.ini for example user cuser1: keystore=c:\users\cuser1\appdata\roaming\ibm\iccsap\security\client_1\ client_1.kdb Example keystore setting in csclient.ini for example user cuser2: keystore=c:\users\cuser2\appdata\roaming\ibm\iccsap\security\client_2\ client_2.kdb Scenario 3: One certificate for several users in a private directory Several users or all users on the system are allowed to use the API, and these users are to share one certificate. For each user, the same certificate is to be stored in a directory that can be accessed by this user only. Assume, for example, that the client_1 folder contains the client keystore with the certificate for the users cuser1 and cuser2. Procedure: 1. Copy the client_1 folder twice. Place one copy in a directory that is accessible by user cuser1 only, and place the other copy in a directory that is accessible by user cuser2 only. Example path to the client_1 folder for example user cuser1: C:\Users\cuser1\AppData\Roaming\IBM\iccsap\security\client_1 Example path to the client_1 folder for example user cuser2: C:\Users\cuser2\AppData\Roaming\IBM\iccsap\security\client_1 2. For each user, open the csclient.ini file that you copied to the env_var_appdata\ibm\iccsap directory of this user, in a text editor. Chapter 12. Setting up a secure communication with the API 187

200 3. Set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. Example keystore setting in csclient.ini for example user cuser1: keystore=c:\users\cuser1\appdata\roaming\ibm\iccsap\security\client_1\ client_1.kdb Example keystore setting in csclient.ini for example user cuser2: keystore=c:\users\cuser2\appdata\roaming\ibm\iccsap\security\client_1\ client_1.kdb Scenario 4: One certificate for several users in a public directory Several users or all users on the system are allowed to use the API, and these users are to share one certificate. The folder that contains the client keystore with the appropriate certificate is to be placed in a directory that is accessible by all users who share the certificate. In this case, ensure that all users who share the certificate have read access for this directory and that read access is restricted to those users only. Assume, for example, that the client_1 folder contains the client keystore with the certificate for the users cuser1 and cuser2. Procedure: 1. Copy the client_1 folder to a directory that is accessible by both users. Both users must have read access for the client_1 folder. Example path to the client_1 folder: C:\Users\security\client_1 2. Open one of the csclient.ini files that you copied to the env_var_appdata\ IBM\iccsap directory of the client users, in a text editor. For example, open the file for cuser1. 3. Set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for both users. For example: keystore=c:\users\security\client_1\client_1.kdb 4. Copy the updated csclient.ini file to the env_var_appdata\ibm\iccsap directory of all other users who share the certificate. In this example, copy it to the appropriate directory of user cuser2. Overwrite the existing csclient.ini file Setting up a secure communication between the API and several Collector Server instances If you want to the API to communicate with several Collector Server instances, you must secure all connections. Before you begin: v.plan for a secure communication between the API and several Collector Server instances. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH v It is assumed that you already set up at least one secure client connection and you are thus familiar with the client_key_gen script file. See Chapter 12, Setting up a secure communication with the API, on page Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

201 To set up secure communication with several Collector Server instances, you use the script file client_key_gen again. In addition, you use the script file that is installed with the add-ons package and has the following fully qualified file name: InstallHome\api\register_server.bat For the complete functional scope of this script file, see the topic register_server in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH The following procedure shows how to set up secure connections between the API and two Collector Server instances. It is based on the following example situation: v v v The API is installed on a system with two users who are supposed to share a certificate. Therefore, you need only one client keystore. The users are called cuser1 and cuser2 in this example. The API is to communicate with two Collector Server instances, which are called myservera and myserverb in this example. Therefore, you need two server keystores, one on myservera and one on myserverb. The server keystores are to be encrypted with the passwords securea and secureb. For this example, it is also assumed that you decide to create the required client keystore on myservera and that you use the default names for the keystores. Tip: Keep a record of all names and labels that you assign, the location of the keystores, and the number of the client keystores that you already created on each Collector Server instance. Also, document which certificate belongs to which user and which certificates are shared by which users. Procedure: 1. On myservera, create a server keystore, a client keystore, and the certificates. Use the client_key_gen script file. a. Open a command line and change to the directory where the folder for the server keystore is to be stored. b. Enter either of the following commands, depending on your operating system: v Linux UNIX client_key_gen.sh -c -p securea -n 1 v Windows client_key_gen.bat -c -p securea -n 1 In the directory where you entered the command, the following folders are created: server and client_1. The name of the server keystore is server.kdb. The name of the client keystore is client_1.kdb. The server keystore contains the certificate clientcert_1.crl. The client keystores contain the certificate servercert.crl. The server keystore is encrypted with the password securea. 2. Copy the client_1 folder from myservera to the system where the API is installed. You can paste the folder to a directory of your choice. 3. On myserverb, create a server keystore and the certificate for myserverb. Use the client_key_gen script file. a. Open a command line and change to the directory where the folder for the server keystore is to be stored. b. Enter either of the following commands, depending on your operating system: v Linux UNIX client_key_gen.sh -c -p secureb Chapter 12. Setting up a secure communication with the API 189

202 v Windows client_key_gen.bat -c -p secureb In the directory where you entered the command, the following folder is created: server. The name of the server keystore is server.kdb. The server keystore contains the certificate servercert.crl. The server keystore is encrypted with the password secureb. 4. Copy the server certificate servercert.crl of myserverb to the system where the API is installed. You can paste the certificate to a directory of your choice. 5. Add the server certificate of myserverb to the client keystore. Use the register_server.bat script file from the add-ons package. a. Open a command line and change to any directory. When you run the script file, you can specify the relative path to the client keystore and to the server certificate. b. Enter the following command: register_server.bat -add -cdb relative_path\client_1.kdb -scert relative_path\servercert.crl -sl new_certificate_label relative_path stands for the path that is relative to the directory where you entered the command. new_certificate_label is the new label for the server certificate that is added. A new label is necessary because both server certificates have the same default name servercert.crl. Assume, for example, that you copied the client_1 folder and the servercert.crl to the C:\security directory and that you want to issue the command from the C: directory. Also, assume that the server certificate that is to be added should receive the label servercert_b. Your command would then look as follows: register_server.bat -add -cdb security\client_1\client_1.kdb -scert security\servercert.crl -sl servercert_b 6. Copy the client certificate clientcert_1.crl to myserverb. You can paste the certificate to a directory of your choice. 7. Add the client certificate to the server keystore for myserverb. Use the client_key_gen script file. a. Open a command line and change to any directory. When you run the script file, you can specify the relative path to the server keystore and to the client certificate. In addition, you can specify a different label for the client certificate. b. Enter either of the following commands, depending on your operating system: v Linux UNIX client_key_gen.sh -add -sdb relative_path/ server.kdb -p secureb -ccert relative_path/clientcert_1.crl -cl new_certificate_label v Windows client_key_gen.gen -add -sdb relative_path\server.kdb -p secureb -ccert relative_path\clientcert_1.crl -cl new_certificate_label 8. On the system where the API is installed, copy the client_1 folder, which contains the certificate that is to be shared by both users on the system, to either of the following locations: v v UserHome directory of each user, such as the env_var_appdata\ibm\iccsap\ security directory A directory that is accessible by both users. Ensure that both users have read access for this directory. 190 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

203 Important: In any case, strictly control the access to the client folder and to the directory where the client folder is stored. Content Collector for SAP does not protect the client keystore and its contents with a password. 9. Enable each Collector Server instance to use its server keystore by changing each instance configuration. In Configuration Feature, take these steps: a. Open the instance configuration that you want to change. b. Go to Basic Configuration > Communication. c. Complete the Communication with the API section , Restarting a Collector Server instance, on page 172. To restart the instances from a command line, you use the archpro command with the following parameters: archpro -i profile -f dll_keystore_passwd password In a server configuration profile, you find the following specifications that relate to the communication with the API: Section in server configuration profile UI field that supplies the value Keyword Global section ARCHWINS Client dispatchers DLL_KEYSTORE_FILE Server keystore 11. Update the client configuration profile for each user: open the csclient.ini file in a text editor and set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. Open the csclient.ini file in a text editor and set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. If you decided to place the client_1 folder into a directory that is accessible by both users, your specification might look as in the following example: keystore=c:\users\security\client_1\client_1.kdb Chapter 12. Setting up a secure communication with the API 191

204 192 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

205 Chapter 13. Setting up an HTTPS communication with SAP If an SAP communicates with a Collector Server instance by using HTTP, you might want to secure this connection with server authentication and client authentication. Client authentication can be configured only in addition to server authentication. Before you begin: Plan for an HTTPS connection between the Collector Server instance and SAP. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH After the configuration of the authentication methods, insecure HTTP connections are still possible. If you want to ensure that all data can be accessed only with an HTTPS connection, you must enforce the use of HTTPS. Procedure: , Configuring the server authentication 2. Optional: 13.2, Configuring the client authentication, on page Optional: 13.3, Securing the communication with an entire Collector Server instance or with specific logical archives only, on page Configuring the server authentication You must configure the server authentication on Collector Server and in SAP Configuring server authentication on Collector Server Create an SSL keystore and a certificate for the Collector Server instance, configure the Collector Server instance for server authentication, and export the certificate to SAP. If you already created a server certificate for the communication with IBM Content Navigator, you must use this certificate for the HTTPS communication with SAP. In this case, skip the following procedure and continue with , Configuring the server authentication in SAP, on page 198. Procedure: , Creating an SSL keystore and a certificate for the Collector Server instance 2. Optional: , Having the certificate signed by a certificate authority, on page , Enabling the Collector Server instance for the server authentication, on page , Exporting the server certificate, on page Creating an SSL keystore and a certificate for the Collector Server instance Use the Java Keytool or the IBM Key Management Utility (IKEYMAN) to create the SSL keystore, the private key, and the public key and to associate the public key with a certificate. Copyright IBM Corp. 2010,

206 The Java Keytool and IKEYMAN are both delivered with Content Collector for SAP as part of the IBM JRE and have the following fully qualified file names: v The Java Keytool: Linux UNIX InstallHome/java/jre/bin/keytool Windows InstallHome\java\jre\bin\keytool.exe v IKEYMAN: Linux UNIX InstallHome/java/jre/bin/ikeyman Windows InstallHome\java\jre\bin\ikeyman.exe To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: Procedure: 1. Open a command line on the system where the server instance runs. 2. Enter the following command on one line: keytool -genkeypair -keyalg key_algorithm -keysize keysize -sigalg signature_algorithm -alias name -validity number_of_days -keystore ssl_keystore_file key_algorithm Specify the algorithm that is to be used to generate the key pair. Specify RSA. keysize Specify the size of the keys that are to be generated. signature_algorithm Specify the algorithm that is to be used to sign the certificate. Specify SHA256withRSA or SHA512WithRSA. name Specify a name of your choice for the certificate chain and the private key that are created with this command. The name must be unique in the keystore. number_of_days Specify for how many days the certificate is to be valid. ssl_keystore_file Specify a fully qualified file name for the SSL keystore. Tip: Because an SSL keystore is required for each instance of Collector Server, it is good practice to create the SSL keystore in the instance directory. For example, specify: v Linux UNIX /home/iccsapadmin/instance1/security/https/ keystore.jks v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\ instance1\security\https\keystore.jks Example: 194 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

207 keytool -genkeypair -keyalg RSA -keysize sigalg SHA256withRSA -alias iccsap_instance1 -validity 365 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks Important: Ensure that your SAP system can handle the level of cryptography that you specify for the keys, such as the keysize parameter. To be on the safe side, install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files on your SAP system. 3. Enter a password when you are prompted by this message: Enter keystore password: For example, enter: icc4sap 4. Enter an answer for each prompt for your organization information. For example: What is your first and last name? [Unknown]: server_name What is the name of your organizational unit? [Unknown]: Myunit What is the name of your organization? [Unknown]: Myorg What is the name of your City or Locality? [Unknown]: Mycity What is the name of your State or Province? [Unknown]: Mystate What is the two-letter country-code for this unit? [Unknown]: US Is <CN=myserver.com, OU=Myunit, O=Myorg, L=Mycity, ST=Unknown, C=US> correct? [no]: yes Enter key password for server_name (Press Enter if you want to use the same password as for the keystore) For server_name, specify the fully qualified host name or the IP address of the system where Collector Server is installed. A self-signed server certificate is created. What to do next: , Having the certificate signed by a certificate authority Having the certificate signed by a certificate authority A certificate authority might have to sign the self-signed certificate. The signed certificate must have a key algorithm and a signature algorithm that are, by default, enabled in IBM JRE and that are supported by the installed SAP Cryptographic Library. Before you begin: , Creating an SSL keystore and a certificate for the Collector Server instance, on page 193 Complete these steps to have a certificate signed and to include the signed certificate: 1. Open a command line on the system where the server instance runs. Chapter 13. Setting up an HTTPS communication with SAP 195

208 2. Generate a Certificate Signing Request (CSR) by entering the following command on one line: keytool -certreq -file certreq_file -alias name -keystore ssl_keystore_file For name and ssl_keystore_file, specify the same values as in the keytool -genkeypair command. See step 2 on page 194. For certreq_file, specify the fully qualified file name of the CSR. Example: keytool -certreq -file /home/iccsapadmin/instance1/security/https/certreq.csr -alias iccsap_instance1 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks 3. Enter the keystore password when you are prompted for it. For example, enter icc4sap 4. Send the CSR (certreq.csr) to a certificate authority. The certificate authority must return a certificate reply. A certificate reply is a file that contains, as a minimum, the certificate that is signed by the certificate authority. The contents depends on your chain of trust. 5. Import the certificate reply into the keystore by entering the following command on one line: keytool -importcert -file CA_reply -alias name -keystore ssl_keystore_file -trustcacerts For name and ssl_keystore_file, specify the same values as in step 2. For CA_reply, specify the fully qualified path to the certificate reply. Assume, for example, that the file name of the certificate reply is CA_reply_iccsap.txt and that you stored it in the /home/iccsapadmin/instance1/security/https directory. Your command would then look as follows: keytool -importcert -file /home/iccsapadmin/instance1/security/https/ca_reply_iccsap.txt -alias iccsap_instance1 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks -trustcacerts 6. Enter a password when you are prompted by this message: Enter keystore password: For example, enter: icc4sap 7. Enter YES if you get the following response:... is not trusted. Install reply anyway? [no]: You get the following final response: Certificate reply was installed in keystore What to do next: , Enabling the Collector Server instance for the server authentication Enabling the Collector Server instance for the server authentication You must enable the Collector Server to use Secure Socket Layer (SSL) and the SSL keystore that you created. 196 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

209 Before you begin: , Having the certificate signed by a certificate authority, on page 195 Procedure: 1. Change the instance configuration. In Configuration Feature, take these steps in Extended settings view: a. Open the instance configuration that you want to change. b. Go to Basic Configuration > Communication > HTTP or HTTPS Communication with SAP. c. Select the Use an HTTPS connection checkbox, then complete the SSL web port field. d. Go to the HTTP and HTTPS Settings section and complete the SSL keystore field , Restarting a Collector Server instance, on page 172. To restart the instance from a command line, you use the archpro command with the following parameters: archpro -i profile -f keystore_passwd In a server configuration profile, you find the following specifications that relate to the server authentication: Section in server configuration profile UI field that supplies the value Keyword Global section SSL_WEBPORT SSL web port KEYSTORE_FILE SSL keystore What to do next: , Exporting the server certificate Exporting the server certificate Use Java Keytool or the IBM Key Management Utility (IKEYMAN) to export the certificate from the SSL keystore. Before you begin: , Enabling the Collector Server instance for the server authentication, on page 196 To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: Procedure: 1. Open a command line on the system where the server instance runs. 2. Enter the following command on one line: keytool -exportcert -file certificate_file -alias name -keystore ssl_keystore_file certificate_file Specify a fully qualified file name for the server certificate. If you omit the path, the certificate is stored in the current directory. name Specify the name that you assigned to the keystore entry when you created the SSL keystore and the server certificate. Chapter 13. Setting up an HTTPS communication with SAP 197

210 ssl_keystore_file Specify the fully qualified file name of the SSL keystore. Example: keytool -exportcert -file /home/iccsapadmin/instance1/security/https/iccsap_instance1.cer -alias iccsap_instance1 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks What to do next: , Configuring the server authentication in SAP Configuring the server authentication in SAP On each SAP system, you must add the server certificate to SSL client SSL Client (Standard) Personal Security Environment (PSE). In addition, you must enable the content repositories for HTTPS. Before you begin: v The SSL client SSL Client (Standard) Personal Security Environment (PSE) must exist. v , Configuring server authentication on Collector Server, on page 193. Procedure: , Importing the Collector Server certificate into SAP , Enabling SSL support for the content repositories, on page Importing the Collector Server certificate into SAP You must import the server certificate into the SSL client SSL Client (Standard) Personal Security Environment (PSE). Procedure: 1. In the SAP GUI, enter the transaction code STRUST to open the Trust Manager window. 2. In the navigation pane, double-click SSL client SSL Client (Standard). 3. Under Certificate, click the Import certificate icon. Figure 102 on page 199 shows which items you must click in the Trust Manager window in step 2 and step Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

211 Figure 102. Trust Manager window showing which items to click 4. In the File path field of the Import Certificate window, specify the fully qualified file name of the server certificate that you created, and press Enter. 5. In the Trust Manager window, click. See Figure Click the Save icon. What to do next: , Enabling SSL support for the content repositories Enabling SSL support for the content repositories Complete these steps to enable Secure Socket Layer (SSL) support for your content repositories. Before you begin: , Importing the Collector Server certificate into SAP, on page 198 Procedure: 1. In the SAP GUI, enter the transaction code OAC0 to open the Display Content Repositories: Overview window. 2. Double-click a content repository. For example, double-click LP. 3. In the Display Content Repositories: Detail window, click the Display/Change icon. Chapter 13. Setting up an HTTPS communication with SAP 199

212 4. In the SSL Port Number field, type the value of the SSL_WEBPORT keyword, which you specified when you enabled Collector Server for the server authentication. For example, type: In the field in the toolbar, type: %https Figure 103 shows what the Change Content Repositories: Detail window might look like after you completed step 4 and step 5. Figure 103. Change Content Repositories: Detail window containing the necessary entries 6. Press Enter. The following fields become available: v HTTPS on frontend v HTTPS on backend Figure 104 on page 201 shows the Change Content Repositories: Detail window containing these fields. 200 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

213 Figure 104. Change Content Repositories: Detail window containing the fields HTTPS on frontend and HTTP on backend 7. Select HTTPS required in both fields. Figure 105 shows what the Change Content Repositories: Detail window might look like with your selection. Figure 105. Change Content Repositories: Detail window showing your selection What to do next: 13.2, Configuring the client authentication, on page 202 Chapter 13. Setting up an HTTPS communication with SAP 201

214 13.2 Configuring the client authentication You must export the SAP certificate with the trust manager of SAP and import it into the SSL truststore of the Collector Server instance. In addition, you must enable the Collector Server instance for client authentication. Before you begin: 13.1, Configuring the server authentication, on page 193 Procedure: , Exporting the SAP certificate , Importing the SAP certificate into the SSL truststore, on page , Enabling the Collector Server instance for the client authentication, on page Exporting the SAP certificate You must export the certificate from the SSL client SSL Client (Standard) Personal Security Environment (PSE). Procedure: 1. In the SAP GUI, enter the transaction code STRUST to open the Trust Manager window. 2. In the navigation pane, double-click SSL client SSL Client (Standard). 3. Under Own Certificate, double-click the certificate in the Owner field. The certificate is displayed under Certificate. 4. Under Certificate, click the Export certificate icon. Figure 106 on page 203 shows which items you must click in the Trust Manager window in step 2 through step Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

215 Figure 106. Trust Manager window showing which items to click 5. In the File path field of the Export Certificate window, specify a fully qualified file name for the SAP certificate. 6. Click Base64 as file format. Then, press Enter. 7. In the SAP GUI Security window, click Allow. What to do next: , Importing the SAP certificate into the SSL truststore Related information Configuring the SAP Application Server for Using SSL SAP Application Server notes and Importing the SAP certificate into the SSL truststore You must import the SSL client SSL Client (Standard) certificate into the SSL truststore on Collector Server. You use Java Keytool or the IBM Key Management Utility (IKEYMAN) for this task. Before you begin: , Exporting the SAP certificate, on page 202 To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: Procedure: 1. Copy the exported SAP certificate to the system where Collector Server runs. 2. Open a command line on the system where the server instance runs. Chapter 13. Setting up an HTTPS communication with SAP 203

216 3. Enter the following command on one line: keytool -importcert -file certificate_file -alias name -keystore ssl_truststore_file certificate_file Specify the fully qualified file name of the SAP certificate. name Specify a name of your choice for the certificate. The name must be unique in the truststore that is to contain the certificate. truststore_name Specify a fully qualified file name for the SSL truststore. Tip: Because an SSL truststore must not be shared by several instances of Collector Server, it is good practice to create the truststore in the instance directory. For example, specify: v Linux UNIX /home/iccsapadmin/instance1/security/https/ truststore.jks v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\ instance1\security\https\truststore.jks Example: keytool -importcert -file /home/iccsapadmin/sapsystem1.cer -alias sapsystem1 -keystore /home/iccsapadmin/instance1/security/https/truststore.jks What to do next: , Enabling the Collector Server instance for the client authentication Enabling the Collector Server instance for the client authentication You must enable the Collector Server instance to use the SAP certificates. Before you begin: , Importing the SAP certificate into the SSL truststore, on page 203 Procedure: 1. Change the instance configuration. In Configuration Feature, take these steps in Extended settings view: a. Open the instance configuration that you want to change. b. Go to Basic Configuration > Communication > HTTP or HTTPS Communication with SAP. c. Select the Use client authentication checkbox. d. Go to the HTTP and HTTPS Settings section and complete the SSL truststore field , Restarting a Collector Server instance, on page 172. To restart the instance from a command line, you use the archpro command with the following parameters: archpro -i profile -f truststore_passwd 204 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

217 In a server configuration profile, you find the following specifications that relate to the client authentication: Section in server configuration profile Keyword UI field that supplies the value Global section SSL_CLIENTAUTH The selection of the Use client authentication check box results in the value YES. TRUSTSTORE_FILE SSL truststore What to do next: 13.3, Securing the communication with an entire Collector Server instance or with specific logical archives only 13.3 Securing the communication with an entire Collector Server instance or with specific logical archives only After the configuration of server authentication, client authentication, or both authentication methods, insecure HTTP requests are still processed. You can disable the processing of HTTP requests for specific logical archives only, or you can disable the processing of all HTTP requests. In either case, you must change the instance configuration. Before you begin: 13.2, Configuring the client authentication, on page 202 v To disable the processing of HTTP requests for specific logical archives only, complete these steps in Configuration Feature in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical repository Archive id > Document Protection. 3. Select the Accept only HTTPS requests from SAP check box. 4. Repeat steps 2 and 3 for each logical archive that is not to receive any HTTP requests , Restarting a Collector Server instance, on page 172. In a server configuration profile, you find the following specification that relates to the disabling of HTTP requests for specific logical archives only: Section in server configuration profile Keyword UI field that supplies the value ARCHIVE SSL The selection of the Accept only HTTPS requests from SAP check box results in the value YES. v To disable the processing of all HTTP requests, ensure in the Communication pane of Configuration Feature that the Use an HTTP connection check box is not selected. In a server configuration profile, you find the following specification that relates to the disabling of all HTTP requests: Chapter 13. Setting up an HTTPS communication with SAP 205

218 Section in server configuration profile Keyword UI field that supplies the value Global section WEBPORT If the Use an HTTP connection check box is not selected, the value is set to Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

219 Chapter 14. Configuring Content Collector for SAP for US government security standards Content Collector for SAP meets the security requirements that are defined by the US government. For more information, see the National Institute of Standards and Technology website. Content Collector for SAP now supports all of the following security standards: FIPS Federal Information Processing Standards (FIPS) that specify requirements on cryptographic modules. SP A standard that requires longer encryption keys and stronger algorithms. This standard allows for a transition configuration where a mixture of FIPS and SP settings can be used until you move to a strict enforcement of SP If you use a transition configuration, check the timeframe for the transition period. Suite B A cryptographic algorithm policy for national security applications that is required by the National Security Agency (NSA). This policy is similar to SP but allows for disabling specific cryptographic algorithms. Complete these steps to implement one of the security standards: 1. Enable Collector Server to use the security standard: a. Open the server configuration profile of each Collector Server instance in a text editor. b. Add the JAVA_OPTIONS keyword, which is a global keyword, and specify one of the following values, depending on the security standard that you want to enforce: Security standard FIPS SP Suite B Values com.ibm.jsse2.usefipsprovider=truefalse com.ibm.jsse2.sp =transitionstrictoff com.ibm.jsse2.suiteb=128192false For example, to enforce the use of SP , your specification would look as follows: JAVA_OPTIONS -Dcom.ibm.jsse2.sp =strict If you already use this keyword, add the value and separate the values with a blank. c. Save the server configuration profile, and restart Collector Server for the changes to take effect. 2. Change the java.security file, which is included in the Java runtime environment (JRE) that is delivered with Content Collector for SAP. The file is in the following directory: v Linux UNIX InstallHome/java/jre/lib/security Copyright IBM Corp. 2010,

220 v Windows InstallHome\java\jre\lib\security Change the file depending on the security standard: Security standard FIPS SP Suite B Follow the description in the following topics of the Java documentation: Enabling FIPS Mode in the IBMJSSE2 Provider SP A Compliance Suite B Profile for Transport Layer Security (TLS) - RFC Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

221 Part 3. Monitoring With Content Collector for SAP, you can monitor the connection between Collector Server and the repositories. If you have IUVU licenses for users who use Content Collector for SAP infrequently, you can also monitor document retrieval requests by using the IUVU tool. Copyright IBM Corp. 2010,

222 210 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

223 Chapter 15. Monitoring the connection between Collector Server and the repositories If a Collector Server instance communicates with SAP by using HTTP or HTTPS, you might want to ensure from time to time that HTTP or HTTPS requests can be successfully routed through your Content Collector for SAP environment. You use the archcheck Java API to monitor the connection. Alternatively, you can monitor the connection directly from IBM Content Navigator Monitoring the connection between Collector Server and the repositories from IBM Content Navigator IBM Content Navigator shows whether the logical archives that are specified in a Collector Server instance, can be accessed. In addition, it shows, for each logical archive, the messages that were logged when a request was routed through your Content Collector for SAP environment. Before you begin: 5.2.3, Configuring the communication with IBM Content Navigator, on page 55 To monitor the connection, complete these steps 1. In Operation Feature, click Connection Monitoring in the navigation pane on the left. 2. To view more connection details for a Collector Server instance and its logical archives, double-click the Collector Server instance. 3. Fix Pack 1 In the Status Details window, you can also view traces and logs. For more information, see the topic Logs and traces available from IBM Content Navigator in the Troubleshooting and support part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Monitoring the connection between Collector Server and the repositories by using the archcheck Java API Content Collector for SAP supplies the archcheck Java API, which allows for simulating an SAP system that sends an HTTP request or an HTTPS request to a repository. For the HTTPS request, server authentication or client authentication can be used. The request is routed through the Content Collector for SAP environment like an HTTP or HTTPS request from SAP. When the connection to the repository is checked, no write operation is performed that would change the state of the repository. Figure 107 on page 212 shows how the archcheck program is integrated in your Content Collector for SAP environment. Copyright IBM Corp. 2010,

224 Figure 107. archcheck in your Content Collector for SAP environment The classes for the archcheck Java API are defined in the archcheck.jar file. The API can be invoked in either of the following ways: v v From a command line. The archcheck.jar file contains the necessary executable class, which is called archcheck program in this information. From a Java application. Content Collector for SAP supplies the ArchcheckAPISample.java file, which contains an example of how to call the Java API. You can monitor each logical archive that is defined in the instance configuration, at intervals of your choice. In addition, the archcheck.jar file can run on any system that has access to the Collector Server instance. The archcheck.jar file is in the following directory: v Linux UNIX InstallHome/server/bin v Windows InstallHome\server\bin Important: The archcheck program requires Java Version 6 or later Calling the archcheck Java API from a command line by using the archcheck program The archcheck program is an executable class in the archcheck.jar file to call the archcheck Java API from command line. If you verify an HTTPS connection, you must configure the server authentication and, optionally, the client authentication first. Procedure: 212 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

225 1. If you want to verify an HTTP connection, skip this step and start with step 2. If you want to verify an HTTPS connection, you must configure the server authentication. Complete these steps: a , Exporting the server certificate, on page 197 b. Import the certificate into the truststore on the system where the archcheck program is to run. Use the procedure that is described in , Importing the SAP certificate into the SSL truststore, on page 203. c. If you want to verify an HTTPS connection with client authentication, complete the following extra steps: 1) Create a certificate for the system where the archcheck program is to run. 2) Export the certificate to a file. Use the procedure that is described in , Exporting the server certificate, on page ) Import the certificate into the SSL truststore on the system where Collector Server is to run. Use the procedure that is described in , Importing the SAP certificate into the SSL truststore, on page Copy the archcheck.jar file to the system where you want to run the archcheck program. 3. If you want to verify an HTTPS connection, you can store the passwords for the truststore and, optionally, for the keystore in a password file. Create this file in a directory of your choice and specify the passwords in the file as follows: truststorepassword=truststore_password keystorepassword=keystore_password truststore_password and keystore_password stands for the passwords for the truststore and for the keystore. All characters after the equal sign are considered part of the password, including any leading and trailing white spaces. If you do not create this file, you are prompted for the passwords. The passwords are not displayed while you enter them. 4. Open a command line on the system where the archcheck program runs. 5. Enter the appropriate command depending on whether you want to verify an HTTP connection or an HTTPS connection. For a detailed description of the commands, see the topic archcheck in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH A log file that records the progress of the request is automatically generated in the checklogs folder of the instance directory of Collector Server. The log file has the following default name: archive_id_yyyy_mm_dd_hh_mm_ss_ms.log A log file is created each time the archcheck program is run. A history of log files is useful, for example, if Collector Server cannot connect to an archive any more and you want to investigate when this problem occurred for the first time. If you prefer to record the progress of only the last request, add the following parameter to your command: -log file_name file_name stands for the name of the log file. You cannot change the path to the log file. The log file is overwritten each time the archcheck program is run. Chapter 15. Monitoring the connection between Collector Server and the repositories 213

226 If the archcheck program ran successfully, it returns exit code 0 and writes the following message to the console: The connection_type request for archive archive_id was processed successfully. connection_type stands for HTTP or HTTPS. If the archcheck program did not run successfully, it returns an exit code greater than 0 and writes a message to the console: v v v v v 1 The connection_type request for archive archive_id failed with response code number: (text). 2 The connection_type request for archive archive_id failed. The request was sent to Collector Server but Collector Server did not return a response. 3 The connection_type request for archive archive_id failed. A connection to Collector Server could not be established. 4 The command is not valid. 5 For this exit code, no message is shown. Instead, the version of, and the help information about, the archcheck command is displayed. What to do next: For more information, see the topic archpro in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Calling the archcheck Java API from a Java application Content Collector for SAP supplies the sample file ArchcheckApiSample.java, which shows how to invoke the archcheck Java API from a Java application. The sample file is in the following directory: v Linux UNIX InstallHome/samples v Windows InstallHome\samples The list of parameters that you can set by using the setter methods is the same as for the archcheck program. Procedure: 1. Copy the archcheck.jar file to the system where you want to run the archcheck Java API. 2. If you want to verify an HTTP connection, skip this step and start with step 3 on page 215. If you want to verify an HTTPS connection, you must configure the server authentication. Complete these steps: a , Exporting the server certificate, on page 197 b. Import the certificate into the truststore on the system where the archcheck Java API is to run. Use the procedure that is described in , Importing the SAP certificate into the SSL truststore, on page 203. c. If you want to verify an HTTPS connection with client authentication, complete the following additional steps: 1) Create a certificate for the system where the archcheck Java API is to run. 2) Export the certificate to a file. Use the procedure that is described in , Exporting the server certificate, on page Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

227 3) Import the certificate into the SSL truststore on the system where Collector Server runs. Use the procedure that is described in , Importing the SAP certificate into the SSL truststore, on page Use the ArchcheckApiSample.java file to implement the archcheck Java API call in your Java application. Then, execute your Java application. The archcheck Java API call returns a result object, which contains the status of the connection verification. For details about the status that can be returned, see , Calling the archcheck Java API from a command line by using the archcheck program, on page 212. What to do next: For more information, see the topic archpro in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Chapter 15. Monitoring the connection between Collector Server and the repositories 215

228 216 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

229 Chapter 16. Monitoring the compliance with the license agreements You must ensure that the users of Content Collector for SAP have an AUVU license or an IUVU license. In addition, you must ensure that your IUVU users comply with the IUVU license agreements. Before you begin: 1. Plan for the compliance with the license agreements. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Chapter 5, Configuring Collector Server, on page 41 Content Collector for SAP supplies the IUVU tool, which records all document retrieval requests of all users against your IBM repositories during a period of 12 months. If you cannot use this tool, determine the number of users who have access to the SAP authorization object S_WFAR_OBJ Monitoring document retrieval requests with the IUVU tool Recording starts when the first retrieval request is issued for an IBM repository from the SAP GUI. Each retrieval request is recorded in an SAP table regardless of whether the document is successfully retrieved or whether the request fails. It is recorded for all users, whether they are users with an IUVU license (IUVU) or users with a full license (AUVU users). Print lists that are retrieved with several GET requests are considered one document. All requests that are issued by one user within 15 minutes are counted as one request. At the end of a 12-month period, a new 12-month period is recorded, where counting starts at 1 again. Up to five periods are recorded. After the fifth period, the oldest record is deleted. Before you begin: Deploy the IUVU tool. For more information, see the corresponding topic in the Deploying part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Procedure: , Configuring the IUVU tool , Monitoring the document retrieval requests, on page Configuring the IUVU tool To use the IUVU tool, you must activate it Activating the IUVU tool To activate the IUVU tool, you must create two entries in the SAP user-exit table TOAEX. Procedure: Copyright IBM Corp. 2010,

230 1. In the SAP GUI, enter the transaction code SE11 to open the ABAP Dictionary: Initial Screen window. 2. In the Database table field, type TOAEX and then click Display. Figure 108 shows the ABAP Dictionary: Initial Screen window with the name of the database table. Figure 108. ABAP Dictionary: Initial Screen window containing the name of the database table 3. In the Dictionary: Display Table window, click the Contents icon. 4. In the Data Browser: Table TOAEX: Selection Screen window, click the Execute icon. 5. In the Data Browser: Table TOAEX Select Entries window, check whether the table contains two entries with the following EXIT_ID: OA_DISPLAYJAVA_01 and OA_OBJECTDISPLAY_01. v If these table entries exist, check whether the value in the EXIT_FUB column is /IBMECM/RECORDACCESS for both entries. If the value differs, decide whether you can change the value. You can use the IUVU tool only if you can set the value to /IBMECM/RECORDACCESS. To change the value of EXIT_FUB, complete these steps: a. Select the check box in front of the OA_DISPLAYJAVA_01 entry and then click the Change icon. b. In the Table TOAEX Change window, type /IBMECM/RECORDACCESS in the EXIT FUB field. c. Ensure that the ACTIVE field contains the value X. Otherwise, the IUVU tool is inactive. d. Repeat the steps 5a to 5c for OA_OBJECTDISPLAY_ Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

231 v If these table entries do not exist, complete these steps: a. Return to the Dictionary: Display Table window. b. Click Utilities > Table Contents > Create Entries. c. In the Table TOAEX Insert window, type OA_DISPLAYJAVA_01 in the EXIT ID field. d. In the ACTIVE field, type X to activate the IUVU tool. e. In the EXIT FUB field, type: /IBMECM/RECORDACCESS f. Click the Save icon. Figure 109 shows the Table TOAEX Insert window containing your specifications. Figure 109. Table TOAEX Insert window containing your specifications g. Repeat the steps 4a to 4f to create the entry with the EXIT_ID OA_OBJECTDISPLAY_01. The Data Browser: Table TOAEX Select Entries window shows your specifications. Figure 110 on page 220 shows the Data Browser: Table TOAEX Select Entries window containing the entries that are necessary to use the IUVU tool. Chapter 16. Monitoring the compliance with the license agreements 219

232 Figure 110. Data Browser: Table TOAEX Select Entries window containing the entries that are necessary to use the IUVU tool The IUVU tool is ready for use. This means that when the first document is retrieved from an IBM archive for viewing, the start time stamp of the 12-month period is set. In addition, entries are added to the SAP tables that were created during the installation of the tool. The start time stamp applies to all users for which a retrieval request against an IBM archive is recorded within the 12-month period, even if they issue their first request days or weeks later. What to do next: , Monitoring the document retrieval requests, on page Deactivating the IUVU tool To deactivate the IUVU tool, you must remove the OA_DISPLAYJAVA_01 and OA_OBJECTDISPLAY_01 entries from the TOAEX table or change their EXIT FUB value. Procedure: 1. In the SAP GUI, enter the transaction code SE11 to open the ABAP Dictionary: Initial Screen window. 2. In the Database table field, type TOAEX and then click Display. See Figure 108 on page In the Dictionary: Display Table window, click the Contents icon. 4. In the Data Browser: Table TOAEX: Selection Screen window, click the Execute icon. 5. Decide whether you want to remove the entries or change the EXIT FUB values: v To remove the entries, complete these steps: a. In the Data Browser: Table TOAEX Select Entries window, right-click the OA_DISPLAYJAVA_01 entry and then click Delete. b. In the Table TOAEX Delete window, click Delete Entry. The entry is deleted. You are not asked to confirm the deletion. c. Repeat these steps for the entry OA_OBJECTDISPLAY_01. v To change the EXIT FUB values, complete these steps: a. In the Data Browser: Table TOAEX Select Entries window, select the check box in front of the OA_DISPLAYJAVA_01 entry and then click the Change icon. 220 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

233 b. In the Table TOAEX Change window, specify another value in the EXIT FUB field. c. Press Enter to save your specification. d. Repeat these steps for the entry OA_OBJECTDISPLAY_ Monitoring the document retrieval requests Monitoring and thus recording starts when the first document retrieval request is issued against an IBM repository. A retrieval request is recorded for each user who retrieves, or tries to retrieve, a document for viewing. You can create an IUVU report that provides an overview of the monitoring results. Before you begin: , Activating the IUVU tool, on page The SAP tables containing the retrieval requests: Overview The retrieval requests are recorded in the SAP tables that were created during the installation of the IUVU tool. The following SAP tables are available: Name Data List (/IBMECM/NAMEDATA) Contains an entry for each SAP client from which document retrieval requests against IBM repositories were issued, and shows the start time stamp of the first 12-month period. The start time stamp is created when the first document retrieval request is issued against an IBM repository. The start time stamp is the same for all SAP clients even if users of one or more SAP clients retrieve their first document days or weeks later. Content Repository Data (/IBMECM/DEPOTSET) Lists all repositories against which a retrieval request is issued from the SAP GUI since the activation of the IUVU tool. In addition, it shows whether a repository is an IBM repository. User Data (/IBMECM/USERSET) Contains an entry for each SAP client and user that issued a retrieval request and shows the number of retrieval requests within a 12-month period. The table can contain up to five entries for an SAP client/user combination to cover up to five periods. When the sixth period starts, the oldest entry is deleted. Important: v Do not delete any of the tables. v Time stamps are shown in Coordinated Universal Time (UTC) format. To view a table, complete the following steps: 1. In the SAP GUI, enter the transaction code SE16 to open the Data Browser: Initial Screen window. 2. In the Table Name field, type the table name. For example, type: /IBMECM/USERSET 3. Click the Table Contents icon. 4. In the Data Browser: Table name: Selection Screen window, click the Execute icon. Chapter 16. Monitoring the compliance with the license agreements 221

234 Creating an IUVU report regularly You can set up an SAP batch job to create an IUVU report regularly. Procedure: 1. In the SAP GUI, enter the transaction code SM36 to open the Define Background Job window. 2. In the Define Background Job window, complete these steps: a. In the Job name field, type a name of your choice. For example, type: IUVU report b. In the Job class field, leave C as value. c. Click the Start condition icon. Figure 111 shows the Define Background Job window containing the specifications. Figure 111. Define Background Job window containing the sample job name and the job class 3. In the Start Time window, take these steps: a. Click Date/Time. b. In the Scheduled start field that becomes available, specify a schedule and then click Period values. 4. In the Period Values window, specify the interval at which the report is to be generated. For example, click monthly. Click the Save icon. 5. In the Start Time window, click the Save icon. You are returned to the Define Background Job window, which shows the specified schedule under Job start and Job frequency. 222 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

235 The Define Background Job window should look similar to Figure 112. Figure 112. Define Background Job window containing the sample job name, the job class, and the sample schedule 6. Click the Step icon. 7. In the Create Step 1 window, continue as follows: a. Under Program values, click ABAP program. b. Under ABAP program, inthename field, type the name of the ABAP program, namely: /IBMECM/REPORTUSAGE c. Click the Print specifications icon. Figure 113 on page 224 shows the Create Step 1 window containing your specifications. Chapter 16. Monitoring the compliance with the license agreements 223

236 Figure 113. Create Step 1 window containing the ABAP program name 8. In the Background Print Parameters window, under Number of pages, click Print all. Then click Properties. 9. In the Spool Request Attributes window, complete these steps: a. Under General Properties, ensure that Print out immediately is selected for Time of printing. b. Expand Spool request. c. Double-click Name. IntheName field that becomes available, type /IBMECM/IUVU and then press Enter. d. Double-click Title. IntheTitle field that becomes available, type IUVU report and then press Enter. Figure 114 on page 225 shows the Spool Request Attributes window after you entered Steps 9c and 9d. 224 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

237 Figure 114. Spool Request Attributes window containing the name and the title of the spool request e. Expand Output Options and double-click Storage Mode. Fromthe Storage Mode list that becomes available, select Archive only or Print and archive. More fields become available. f. In the Object Type field, type DRAW. g. In the Document Type field, type D01 or another document type for a print list. h. In the Information field, type UVU. You can use the value later to find the IUVU reporting print lists in the associated content repository. i. In the Text field, type IUVU report. Then click the Continue icon. Figure 115 on page 226 shows the Spool Request Attributes window after you entered Steps 9f through 9i. Chapter 16. Monitoring the compliance with the license agreements 225

238 Figure 115. Spool Request Attributes window containing the name and the title of the spool request j. Click the Continue icon. You are returned to the Background Print Parameters window. The Background Print Parameters window should look similar to Figure 116. Figure 116. Background Print Parameters window containing your specifications 10. In the Background Print Parameters window, click the Continue icon. 11. In the Create Step 1 window, click the Check input icon and then click the Save icon. The Step List Overview window shows the new step. 226 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

239 Figure 117 shows the Step List Overview window containing the defined step. Figure 117. Step List Overview window containing the defined step 12. Click the Back icon to return to the Define Background Job window. 13. Click the Save icon to release the job. The Define Background Job window should look similar to Figure 118. Figure 118. Define Background Job window with the messages that one step is defined and the job is released The IUVU reports are created every month, starting on the planned start date, and are placed in the SAP ArchiveLink storage queue. What to do next: To archive the reports automatically, create an SAP ArchiveLink batch job. For more information, see Creating an SAP ArchiveLink batch job. To view a report, complete these steps: Chapter 16. Monitoring the compliance with the license agreements 227

240 1. Enabling print-list viewing. 2..View archived print lists. For more information, see the corresponding topic in IBM Knowledge Center or in IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Creating an IUVU report at your request From time to time, you might want to get an overview of the retrieval requests that were recorded so far in the current 12-month period. You can view the retrieval requests in a report and print and archive the report. Procedure: 1. In the SAP GUI, use the transaction code /IBMECM/IUVU030 to open the IUVU Report window. Prefix the transaction code with /n or /o, for example, /n/ibmecm/iuvu030 The IUVU Report window shows the monitoring results as collected up to the date and time at which you requested the report. Figure 119 shows a report example. Figure 119. IUVU Report window containing a report example 2. To print, archive, or print and archive the report, take these steps: a. In the IUVU Report window, click the Print icon. b. In the Print ALV List window, click Properties. c. In the Spool Request Attributes window, make your specifications and then click the Continue icon. For more information about the specifications, see 9 on page 224. d. In the Print ALV List window, click the Continue icon. You are returned to the IUVU Report window, which displays a message regarding your spool request. 3. At any time, you can sort the individual columns of the IUVU report by clicking the column header. You can also change its layout. Restriction: Print or archive the report as it is displayed after you enter the /IBMECM/IUVU030 transaction code. 228 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

241 The IUVU report: Description: The IUVU report provides all the information that you need to assess whether your users comply with the IUVU license agreement. Figure 119 on page 228 shows a report example. The first row of an IUVU report contains the name of the SAP user who created the report and the creation date and time of the report. The Access Count column shows whether the IUVU tool is configured correctly. If it contains the number 2, the SAP user-exit table TOAEX contains the two required entries: OA_DISPLAYJAVA_01 and OA_OBJECTDISPLAY_01. The columns of all other rows contain the following monitoring information: Client The system number of the SAP client. User Name The name of the SAP user. Expiry Date / Expiry Time The date and time at which the current 12-month period expires. Start Date / Start Time The date and time at which the current 12-month period started. Access Count The number of times that the SAP user issued a document retrieval request since the start of the current 12-month period. Access Date / Access Time / Time Fraction The date and time of the last request. Note: Time stamps are shown in Coordinated Universal Time (UTC) format Determining the S_WFAR_OBJ users The users with access to the SAP authorization object S_WFAR_OBJ also have access to the documents that were archived and linked by using Content Collector for SAP. You can determine the total number of users with access to this object. Procedure: 1. In the SAP GUI, enter the transaction code SUIM to open the User Information System window. 2. Expand User Information System > User > Users by Complex Selection Criteria and then click the Transaction Code icon in front of Users by Complex Selection Criteria. Figure 120 on page 230 shows which item to select in the User Information System window. Chapter 16. Monitoring the compliance with the license agreements 229

242 Figure 120. User Information System window showing which item to select in the navigation tree 3. In the Users by Complex Selection Criteria window, under Selection by authorizations, specify S_WFAR_OBJ in the Authorization object field, and then click the Execute icon. Figure 121 on page 231 shows the Users by Complex Selection Criteria window containing your specification. 230 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring

243 Figure 121. Users by Complex Selection Criteria window containing your specification The No. of users selected field contains the number of users who have access to the S_WFAR_OBJ object, as shown in Figure 122 on page 232. Chapter 16. Monitoring the compliance with the license agreements 231

244 Figure 122. Users by Complex Selection Criteria window containing the number of users with access to the S_WFAR_OBJ object 232 Content Collector for SAP: Configuring for use with FileNet P8, securing and monitoring