Configuring the SAP Cryptolibrary on the ABAP Application Server

Transcription

1 Configuration Guide Document Version: 1.0 Final Date: Configuring the SAP Cryptolibrary on the ABAP Application Server Sap Backend Systems on the SAP Pharma Network

2 Typographic Conventions Type Style Example Description Words or characters quoted from the screen. These include field names, screen titles, pushbuttons labels, menu names, menu paths, and menu options. Textual cross-references to other documents. Example EXAMPLE Example Example <Example> EXAM PLE Emphasized words or expressions. Technical names of system objects. These include report names, program names, transaction codes, table names, and key concepts of a programming language when they are surrounded by body text, for example, SELECT and INCLUDE. Output on the screen. This includes file and directory names and their paths, messages, names of variables and parameters, source text, and names of installation, upgrade and database tools. Exact user entry. These are words or characters that you enter in the system exactly as they appear in the documentation. Variable user entry. Angle brackets indicate that you replace these words and characters with appropriate entries to make entries in the system. Keys on the keyboard, for example, F2 or ENTER SAP SE or an SAP affiliate company. All rights reserved. 2

3 Document History Version Status Date Change 1.0 Final First release 2016 SAP SE or an SAP affiliate company. All rights reserved. 3

4 Table of Contents 1 About This Document Purpose and Scope Target Audience Glossary Important SAP Notes Solution Overview Manual Installation First-Time Installation and Configuration of SAPCRYPTOLIB on an SAP NetWeaver Important Disclaimers and Legal Information Coding Samples Accessibility Gender-Neutral Language Internet Hyperlinks SAP SE or an SAP affiliate company. All rights reserved. 4

5 1 About This Document 1.1 Purpose and Scope This guide explains how to manually install a SAPCRYPTOLIB up to SAP Release 720 in the context of onboarding a SAP backend system to the SAP Pharma Network. 1.2 Target Audience This document is for members of the technical implementation team involved in integration and onboarding to the SAP Pharma Network, including: Managers Implementation and integration teams System Administrators Information Security Officers Network Administrators BASIS Administrators Related Documentation Introduction to the SAP Pharma Network SAP Pharma Network Onboarding Guide SAP Pharma Network Configuration Guides for SAP Backend Systems The SAP Cryptographic Library Installation Package 1.3 Glossary Term Abbreviation Definition SAPSECULIB A dynamic link library located on each application server that provides functions for using digital signatures in SAP Systems. It does not support functions for using encryption SAP SE or an SAP affiliate company. All rights reserved. 5

6 1.4 Important SAP Notes Recommendation Make sure that you read the SAP Notes before you start implementing the software. The SAP Notes contain the latest information about the installation as well as corrections to the installation information. Also make sure that you have the up-to-date version of each SAP Note, which is available on SAP Service Marketplace at SAP Note Number Title Description Central Note for CommonCryptoLib 8 (replacing SAPCRYPTOLIB) Central note for CommonCryptoLib. The ABAP Kernel comes with new CommonCryptoLib (SAPCRYPTOLIB) Version (or higher) which replaces SAPCRYPTOLIB version SAP SE or an SAP affiliate company. All rights reserved. 6

7 2 Solution Overview There is an old and a new SAP cryptrolibrary which can be distinguished by their names. The old library name ends in the format: plxx, for example, 5.5.5pl38, whereas the new cryptrolibrary uses the name "CommonCryptoLib 8" (shortened to "CCL") and is in the format 8.<major>.<minor>", for example, Note For SAP NetWeaver 74X, the new CommonCryptoLib 8 cryptrolibrary is a fixed component of the delivery (kernel CD) and, as of November 2013, "CommonCryptoLib 8" is also part of new 72x kernel patches (in the download from SAP Service Marketplace, in the packages SAPEXE and dw_utils). Manual installation and configuration of the library must be carried out in existing systems or upgrades of such systems SAP SE or an SAP affiliate company. All rights reserved. 7

8 3 Manual Installation 1. Install SAPCRYPTOLIB and the corresponding sapgenpse command line tool in the directory $DIR_EXECUTABLE on all application servers. 2. If you are using an old cryptrolibrary version SAPCRYPTO (pl32 and below) you must install a separate license ticket file in the $DIR_INSTANCE/sec directory. Note As of Kernel Release 6.20, the license ticket is generated automatically by the AS ABAP kernel (disp+work) in $DIR_INSTANCE/sec when the system is started. As of SAPCRYPTOLIB pl32, the system no longer requires a license ticket file, and the SAPCRYPTO pl34+ download packages still contain a file ticket as there are several installation instructions that describe the installation of the file ticket. However, the content of the file ticket is completely irrelevant for new libraries. Independent of SAPCRYPTOLIB, the NetWeaver Administrator in SAP AS Java checks for the existence of a file ticket. If necessary, you must place the configuration file in $DIR_INSTANCE/sec to satisfy the check function in the NetWeaver Administrator. 3. If you are using the new cryptrolibrary version CommonCryptoLib 8, the distribution packages of the cryptolibrary contain no file named ticket. To ensure consistent system behavior, set the environment variable SECUDIR in the environment of the user <sid>adm (or SAPService<SID> or both) in the directory$dir_instance/sec on all application servers. Note To protect the PSEs (key files) with a password, on UNIX systems, set the environment variable USER to the name of the UNIX user where the SAP system is running. 3.1 First-Time Installation and Configuration of SAPCRYPTOLIB on an SAP NetWeaver This section refers to SAP NetWeaver 6xx, 70X, 71X, 72x, or 73x. Set the following profile parameters in the instance profile of all application servers and then restart the system. The first three parameters replace the SAPSECULIB contained in the delivery of earlier SAP NetWeaver releases with SAPCRYPTOLIB. Instance Profile ssf/name ssf/ssfapi_lib sec/libsapsecu ssl/ssl_lib Parameter SAPSECULIB <path and file name of SAPCRYPTOLIB> <path and file name of SAPCRYPTOLIB> <path and file name of SAPCRYPTOLIB> 2016 SAP SE or an SAP affiliate company. All rights reserved. 8

9 Note In SAP Netweaver Release 740+ and in Netweaver 72x Kernel-Patches created in 2014 or later, SAPCRYPTOLIB is automatically installed in $(DIR_EXECUTABLE) along with all other Kernel libraries and executables. Use the following parameter values on all application server platforms. Each SAP application server substitutes the necessary platform-specific parts, such as the path separator character, shared library prefix and shared library filename extension. Instance Profiler ssf/name ssf/ssfapi_lib sec/libsapsecu ssl/ssl_lib Parameter SAPSECULIB $(DIR_EXECUTABLE)$(DIR_SEP)$(FT_DLL_PREFIX)sapcrypto$(FT_DLL) $(DIR_EXECUTABLE)$(DIR_SEP)$(FT_DLL_PREFIX)sapcrypto$(FT_DLL) $(DIR_EXECUTABLE)$(DIR_SEP)$(FT_DLL_PREFIX)sapcrypto$(FT_DLL) Note SAP Netweaver 74x Kernels include CommonCryptoLib and suitable predefined values for the profile parameters above, so removing custom settings for the above parameters from default and instance profile(s) of a Netweaver 74x ABAP System work as well SAP SE or an SAP affiliate company. All rights reserved. 9

10 4 Important Disclaimers and Legal Information 4.1 Coding Samples Any software coding and/or code lines/strings ("Code") included in this documentation are only examples and are not intended to be used in a productive system environment. The Code is only intended to better explain and visualize the syntax and phrasing rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be liable for errors or damages caused by the usage of the Code, unless damages were caused by SAP intentionally or by SAP's gross negligence. 4.2 Accessibility The information contained in the SAP documentation represents SAP's current view of accessibility criteria as of the date of publication; it is in no way intended to be a binding guideline on how to ensure accessibility of software products. SAP in particular disclaims any liability in relation to this document. This disclaimer, however, does not apply in cases of wilful misconduct or gross negligence of SAP. Furthermore, this document does not result in any direct or indirect contractual obligations of SAP. 4.3 Gender-Neutral Language As far as possible, SAP documentation is gender neutral. Depending on the context, the reader is addressed directly with "you", or a gender-neutral noun (such as "sales person" or "working days") is used. If when referring to members of both sexes, however, the third-person singular cannot be avoided or a gender-neutral noun does not exist, SAP reserves the right to use the masculine form of the noun and pronoun. This is to ensure that the documentation remains comprehensible. 4.4 Internet Hyperlinks The SAP documentation may contain hyperlinks to the Internet. These hyperlinks are intended to serve as a hint about where to find related information. SAP does not warrant the availability and correctness of this related information or the ability of this information to serve a particular purpose. SAP shall not be liable for any damages caused by the use of related information unless damages have been caused by SAP's gross negligence or willful misconduct. All links are categorized for transparency (see: SAP SE or an SAP affiliate company. All rights reserved. 10

11 2016 SAP SE or an SAP affiliate company. All rights reserved. 11

12 SAP SE or an SAP affiliate company. All rights reserved.