Digitally Signed Documents in SAP

Transcription

1 MINIPPS Community Marketplace App4SAP User Guide Digitally Signed Documents in SAP Contents What it does? 1 What Business process will it serve? 1 Installation requirements 1 Functional specification 2 How to use 12 How to install 20 Appendix 21 Generate a Self-Signed Certificate with OpenSSL on Linux Author: Lior Tabib User Guide

2 Digitally Signed document in SAP Digitally sign PDF documents from inside SAP ERP system. Visit product page What it does? This mini application allows the following: 1. Digitally sign PDF documents from SAP standard ABAP run time. 2. Can be used both from SAP dialog (GUI) programs and background job. 3. Supports various key: Personal Smart Cards, USB Tokens, PKCS #12 file. What Business process will it serve? To meet the local tax regulation and SOX (Sarbanes Oxley) regulation regarding invoice files sending or archiving, files needs to be Digitally Signed, with one or two signees. This mini application allows sending or receiving of a document to be Digital Signed on your SAP application server or your local PC with SAPGUI. Installation requirements 1. SAP ABAP based with SAP Basis release 6.20 and above or SAP Application 4.70 and above. 2. Windows client (for PK11 certificate) or Windows/UNIX/Linux server (for PK12 certificate). 3. Signature certificate key. There are two types of certificates (PK11 & PK12) for two different usage scenarios: 3.1. For digital signature certificate linked to a specific computer, install documents digital signature certificate file (PK12 file) on every signing SAP server system or PC computers. The key must be installed on your PC/Server (for Windows server - double click the key and follow windows instructions for "Importing the key to your windows operating system", for UNIX/Linux server user OpenSSL package for the certificate import). Note that the documents digital signature on your DEV and QA server systems can be generated by SAP the server itself, but the PRD system should include an internationally recognized certificate that is issued by international approved vendor For a personal digital signature certificate smart card/usb token (PK11), issue your personal key at an approved internationally recognized certificate issuer, install on the signee PC computer and plug into to the PC when signing files. 4. Download and install JSignPdf open source solution from on every signing machine (PC and Servers). 1 P a g e

3 4.1. Note1: Java runtime environment (JRE) in required before installing the JSignPdf make sure you set the JAVA_HOME path (use system run command "sysdm.cpl,3" environment variables and create/edit the JAVA_HOME variable) Note2: For PK11 scenario (smart card token with a personal certificate) you need to change the JSignPdf s configuration file as follow: I order that the JSignPdf would recognize your smart card token, you need to set the path to your card s *.dll file. For ComSign token or any other Athena card, you may find the *.dll file at following path: C:\Windows\System32\asepkcs.dll For Siemens Card, you may find the *.dll file at the following path: C:\WINDOWS\system32\siecap11.dll The JSignPdf configuration folder is located at JSignPdf installation folder, under conf folder. Typically you may find it at: C:\Program Files (x86)\jsignpdf\conf There you can find two files: conf.properties pkcs11.cfg Copy the pkcs11.cfg file to new file called minipps.cfg, delete the new file s content and write the following two lines in the file: name=minipps library=c:\\windows\\system32\\asepkcs.dll Note that the library should contain the path to your smart card token *.dll file. Also note that the path should contains \\ instead of \ Change the content of the conf.properties file to point to the new minipps.cfg file by replacing the string #pkcs11config.path=conf/pkcs11.cfg with #pkcs11config.path=conf/minipps.cfg Note that the # was removed and that the pkcs11config.path is now pointing to the conf/minipps.cfg Hint: If windows tells you that the access to the file is denied, copy the file to you c:\temp location, change it there and copy it back to the denied location (C:\Program Files (x86)\jsignpdf\conf ) Restart you PC. Functional specification 1. Although the Digital Signature for SAP solution can be incorporated into any business process that needs an actual PDF file signature, Digital Signature for SAP solution includes a best practice scenario. The best practice scenario is based on SAP DMS (Document Management System) module and includes two signees. The SAP DMS module is our best practice due to the fact that it can be attached to any SAP entity and it also holds an attached documents. See ABAP Code in old BAdI DOCUMENT_MAIN01 method BEFORE_SAVE. This 2 P a g e

4 enhancement sign the DMS attached documents (originals). Scenario info: 1.1. DMS document type = ZDD 1.2. Status map: Create CT (Internal code AL) Initial status where invoice original document is attached First release R1 (Internal code WX) Invoice approved by first approver First "Invoice approved and singed" PA (Internal code TG) The invoice has its first approve done and the invoice contains one signature Second release RE (Internal code 02) Invoice approved by second approver Second "Invoice approved and singed" CO (Internal code W6) The invoice has its second approve done and the invoice contains two signature. DMS is now complete and a MIRO/FB60 invoice verification can be performed Release process was cancelled RJ (Internal code {A) the DMS canceled and no MIRO/FB60 invoice verification should be created DMS created with status "Create" (CT) and original attached (PDF file before being signed 1 ) 1.4. The first signee user changes the status of the DMS to "Release 1" (R1) via transaction code CV02N : 1 The file can be signed by external source or without any external signature. The Digital Signature for SAP solution adds1 your corporate's own internal signature (or your personal signature) to the PDF file, regardless of prior signature (if exists) in the file. 3 P a g e

5 or via mass approval transaction ZMDS (included in the installation package): 1.5. At save, the document is digitally singed and the status changes to "Part. Approved" (PA) The second signee user changes the status of the DMS to "Release" (RE) via transaction code CV02N or via mass approval transaction ZMDS (included in the installation package) At save, the document is digitally singed again and the status changes to "Completed" (CO) Now, the PDF attached to the DMS (original) has two signatures. 4 P a g e

6 2. Main cockpit transaction ZDDS 3. To activate the Digital Signature for SAP solution, click : Click New Entries 5 P a g e

7 3.1. User Name Add specific users to the list and/or allow the solution to all users (user = *) Active Mark to active the Digital Signature for SAP solution for the user (or users if User Name = *) Path to JSignPDF Dir The path to the directory where the JSignPdf.jar file is located on your workstation. You can execute program ZDDS_FIND_JSIGNPDF_JAR_ON_PC to find the directory: 6 P a g e

8 Hint: if the JSignPdf not found, please install on your PC / Server the JSignPdf JSignPDF conf.proper The path to the conf.proper file (the JSignPdf local solution's configuration file). Hint: This file usually residents at a subdirectory Conf of the Path to JSignPDF Dir Signature picture pa The location the user's signature scanned *.png file. This picture would be displayed at the resulted signature area in the signed document, alongside with the signature text data Lower left corner X 2 Set the lower left corner position on X-axe of a visible signature. Number from 1 to Lower left corner Y Set the lower left corner position on Y-axe of a visible signature. Number from 1 to Upper right corner X Set the upper right corner position on X-axe of a visible signature area. Number from 1 to Upper right corner Y Set the upper right corner position on Y-axe of a visible signature area. Number from 1 to Visible Signature Ty Type of visual signature sign of the PDF layout Blank of A is the default (display the signee s details from the certificate). 2 Use application JSignPdf.exe that includes in the JSignPdf installed on your PC, to decide the X and Y position: Click the 7 P a g e and re-position the square area. Click Close at the end and see the coordinates.

9 B used the text from field Visible text on PDF (is left blank, there would be no visual text Visible text on PDF The text to display on the PDF layout visual sign area. This parameter takes effect only when Visible Signature Ty = B. If left blank, and Visible Signature Ty = B, there would be no visual text in the sign area on the PDF layout JSignPdf local attr The full path to the attributes file (file with name like: *.JSignPdf). Hint: The file contains the encrypted password and the name of the KeyStore. This field should be left blank for PK12 signature scenario Password Your certificate password. Leave blank for PK12 certificates. Hint: The password field is only valid for PK11 certificates because the PK12 certificates are already installed on the PC/Server with their password Signature type Personal USB token/ Smart Card (PK11 file) or a certificate file registered to the PC/Server (PK12 file) PK12 key alias If Signature type is a PK12 file and you are using signing on the PC workstation (not signing on the server), then fill the field with the alias name of your certificate Temporary Folder This field is not a mandatory field. If you set this field, then it overrides the SAP Gui temporary folder. This is the temporary folder where the singed file would be created at Syntax group For execution the signature on the server, choose the server operation system (only windows and linux/unix are supported at this this) Server Run Mode - For execution the signature on the server, choose the type of execution: =Use SM49->ZDDS_JSIGNPDF system command. The ZDDS_JSIGNPDF contains sh (for Unix or Linux) or cmd /C (for Windows) and the actual execution will send the full path to the run.bat or the run.sh temporary file that does the signature. Note that this is the default options (and also the recommended option) if you cannot tell what to choose, choose this option =Use batch file called from direct ABAP system command (CALL 'SYSTEM' ID 'COMMAND' FIELD lv_command) where command is 3 Use Windows DOC command line : java -jar <full path to the JSignPdf.jar file> -kst WINDOWS-MY -lk q to get the list of aliases or use the JSignPdf.exe local application, choose Keystore type WINDOWS-MY, Click "Load Keys" and see the list of "Key Alias": 8 P a g e

10 sh "full path the run.sh file" (for Linux and Unix) cmd /C "full path the run.bat file" (for Windows) Note the bat/sh file is a temporary file that does the signature =Use ABAP direct system command (CALL 'SYSTEM' ID 'COMMAND' FIELD lv_command) to call java -jar... command that does the signature Digt.Signt LicenseId The License Id you have got from MINIPPS when purchasing the "Digitally Signed document in SAP". 4. To explore the ABAP Class that executes the File Digital Signature solution click:. This Class can be incorporated into any ABAP flow to achieve File Digital Signature. 5. The find the path location where the JSignPdf.exe is located on your PC, click:. The JSignPDF.exe is mandatory for the File Digital Signature solution so it must be installed on every signing PC/Server. To use the program, just use a temporary location on your PC: location of your JSognPdf.exe file:, click, and you would see the. 6. The Best Practice solution includes massive approving of DMS documents. Click: to navigate into report the changes status for DMS documents. Changing status, in the Best Practice scenario, sign the attached (original) documents of every DMS. If you are using PK11 certificate, make sure that the USB Token in plug to your PC and that the File Digital Signature is active for your user. To use the program, just fill selection screen data, including source and destination status: 9 P a g e

11 , click, and you would the documents in the source status. Mark the invoices you would like to change status to (changing status of DMS causes the invoice in the DMS to be signed): to sign., and click 7. To test your solution (signature on the PC), click:. This program allows you to sign a document on the PC ("Sign document with JSignPdf") and also allows you to check your java installation ("Get Java Version"). 10 P a g e

12 . Note the for "Sign document with JSignPdf", signed document would opened by this program at the end of signing process. 8. To test your solution (signature on SAP server), click: This program allows you to sign a document on the server ("Sign document with JSignPdf") and also allows you to check your java installation ("Get Java Version"). 9. BAdI exit at DMS save, calls Class ZDDS_UTILITIES that connects to the integrated Digital Signature solution to sign the PDF document. 10. In our DMS Demo Scenario, signed PDF documents replacing the existing DMS documents. 11. The ZDDS_UTILITIES Class can be called from any ABAP program or system exits to meet any business requirement. 12. The ZDDS_UTILITIES Class can be used for Digital Signing of invoices sent to a customer. Just add the class at the print program, before ing the layout. 11 P a g e

13 How to use Community Marketplace ltd 1. Set the java path on the signing machine (PC and Servers) by: setting the JAVA_HOME path (use system run command "sysdm.cpl,3" environment variables and create/edit the JAVA_HOME variable). 2. Download and install JSignPdf open source solution from on every signing machine (PC and Servers). 3. Activate the solution with Active Docs.Digital Sign. at from main cockpit transaction ZDDS 4. At first use, set user signature parameters: 4.1. For signing with smart USB user owned key card (that is installed on your PC), use application JSignPdf.exe that includes in the JSignPdf installed on your PC. In the JSignPdf.exe, fill the fields as described: 12 P a g e

14 13 P a g e Click Close and then Sign It a test PDF document.

15 4.2. For signing using Keystore file (PK12 signature file installed on your PC), use application JSignPdf.exe that includes in the JSignPdf installed on the signing PC/Server. In the JSignPdf.exe, fill the fields as described: 14 P a g e

16 Click Close and then Sign It a test PDF document For signing using Keystore file (PK12 signature file installed on your server), use application JSignPdf.exe that includes in the JSignPdf installed on the signing PC/Server. In the JSignPdf.exe, fill the fields as described: 15 P a g e

17 Note the after choosing KeyStore type, KeyStore file and KeyStore password, you need to click the choose the only alias (usually there is only one alias). 16 P a g e

18 Click Close and then Sign It a test PDF document. 5. A non-mandatory step: For best practice use with SAP DMS, saved DMS with an originals (attachments) via CV02N or BAPI, would automatically signed the attached documents according to the DMS status change. Sample implementation: 5.1. You can customize your DMS with transaction code SPRO. 17 P a g e

19 Set the Initial status. Set first signature status. 18 P a g e

20 And the second (and last) signature. This step would release the DMS. 19 P a g e 5.2. And set BAdI exit that sign the originals when DMS status changes: In new SAP releases, Implement New BAdI (Enhancement Implementation) definition DOCUMENT_STATUS and create an implementation or change an existing In old SAP releases, Implement Old BAdI definition DOCUMENT_MAIN01, method BEFORE_SAVE (see file "DOCUMENT_MAIN01~BEFORE_SAVE.txt" in the installation.zip that was sent at purchase)

21 How to install Community Marketplace ltd 1. Download and install JSignPdf open source solution from on every signing machines (PC and Servers). 2. For SAP ERP system, there is a change request transports for this mini application (LDVK940409: ZDDS:Document Digital Signature with SAP). 3. For SAP CRM/Solution Manager system, there is a change request transports for this mini application (SLMK900070: ZDDS:Document Digital Signature with SAP). 4. Install Documents Digital Signature certificate (X.509 certificates) purchased from COMODO or any other vendor Or generate a self-signed certificate 4 with OpenSSL If Smart Card Token is used, please use the installation pack supply by your Token supplier If server PK12 (*.PFX file or *.PK12 file) certificate is used For windows Install the certificate using CertUtil command line server tool (use the importpfx command) on windows or Use MMS.exe tool to install the certificate for the service SAP user that runs your SAP: Run mms.exe (you can use the one that is used to run SAP service). Choose File->Add/Remove Snapins. Select Certificates. Click Add. Select Service Account. Select local computer. Select SAP Service (SAPXXX_##) (you may need to repeat this step for every SAP service). Finish the wizard and OK to close the add/remove dialog. On the applicable category right click and select add tasks to find the import. Import the PK12 certificate (it is recommended to add password to the file) For UNIX/Linux OpenSSL utility from command line as describe in this document's Appendix If workstation PK12 (*.PFX file or *.PK12 file) certificate is used, just right click the file and choose install. Also open your Internet Explorer and choose Internet Setting -> Content Tab Click Certificates. On the Personal tab choose Import to add the certificate is not already there (this put the certificate in the Windows-My StoreKey). 5. Implement the mini application transport (LDVK or the SLMK900070) to your system with your SAP BASIS team or use MINIPPS free mini application Uploading transport from local files. 6. For signing document by server, create new External Operating System Command at transaction code SM49 (on the signing server): 6.1. Name: ZDDS_JSIGNPDF 4 Self-Signed certificate can only be used for PK12 scenario. 20 P a g e

22 6.2. For windows Operating system command: CMD /C 6.3. For UNIX/Linux Operating system command: sh 6.4. Additional parameters allowed: Checked 7. In order to implement the best practice DEMO process, implement old BAdI definition DOCUMENT_MAIN01, method BEFORE_SAVE using transaction SE19 and add the code attached from file "DOCUMENT_MAIN01~BEFORE_SAVE.txt" in the installation.zip that was sent after purchase. If the DOCUMENT_MAIN01~BEFORE_SAVE already exists in your system, just add the code from file "DOCUMENT_MAIN01~BEFORE_SAVE.txt" in the installation.zip that was sent after purchase, at the beginning of the method. Note that the " IF draw-dokar EQ 'ZDD'." ABAP code line can be changes according to the DMS document type that you are using for the demo (in the best practice demo described in this document we have used ZDD). Appendix Generate a Self-Signed Certificate with OpenSSL on Linux To Digitally Sign PDF documents with MINIPPS "Document Digital Signature with SAP" from inside SAP ERP server requires a PK12 certificate file. If you have none from an external CA source (like COMODO or Symantec and so on ) you can generate your own PK12 file (a *pfx file or *.p12 file) with OpenSSL. 4. Make sure to have Linux OS or UNIX OS on SAP application server. 5. Make sure you have JAVA Run-Time Environment installed and configured on you server. You can open terminal on the server and make sure that command java -fullversion returns your java version (XXXX full version "1.X.X_XXX-XXX"). Note: Version should be 1.5 and above (1.6 and above support the full features). 6. Make sure that you have OpenSSL installed on your server. Use terminal on SAP server and type: openssl list-standard-commands if installed, you would get a list of OpenSSL standard commands. 7. To generate PKCS #12 file, open terminal on SAP server and use the OpenSSL full guide or IBM Guide or just follow those steps: 1. Type (change the path and file name of the pem file) : openssl req -newkey rsa:2048 -nodes -keyout / <full path where you want your certificate file to be located at> /key.pem -x509 -days out / <full path where you want your certificate file to be located at> /YOURCERTIFICATE.pem 2. Answer all required questions (note that the common name is your domain name). 3. At the end of the process, YOURCERTIFICATE.pem is created at the requested path. 4. Now, let us convert the YOURCERTIFICATE.pem file into YOURCERTIFICATE.pfx file the is suitable for file signatures with JSignPDF: openssl pkcs12 -inkey / <full path where you want your certificate file to be located at> /key.pem -in / <full path where you want your certificate file to be 21 P a g e

23 located at> /YOURCERTIFICATE.pem -export -out / <full path where you want your certificate file to be located at> /YOURCERTIFICATE.pfx Enter the certificate password (Case Sensative) as required (the password would be required for files signing). 5. The YOURCERTIFICATE.pfx is now ready. 22 P a g e