SAP Cryptographic Library

CSP SAP Connect supports the SAP Cryptographic Library. This document briefly describes the client-side and server-side setup and the usage of the SAP Cryptographic Library for SNC.

Server-Side Setup

Installing the SAP Cryptographic Library

1. Download the SAP Cryptographic Library (SAPCRYPTOLIB). To do so, you require access to SAP Service Marketplace.

   Note: Download two versions of the library - one for the SAP application server and one for the client. The installation path must not contain spaces.

2. Extract the SAP Cryptographic Library using SAPCAR.

3. Install the SAP Cryptographic Library and the SAPGENPSE configuration tool to the recommended location: D:\usr\sap\BW2\SYS\exe\run.

4. Copy the license ticket, the server PSE, and the credentials to the following location: D:\usr\sap\BW2\DVEBMGS00\sec\.

Creating a Personal Security Environment (PSE)

In the next step, you use the SAPGENPSE configuration tool to create a new PSE file.

1. Enter the following command in the command line:

   > sapgenpse gen_pse --p SAPBW2.pse --noreq CN=BW2,OU=PE,O=Cubeware,C=

2. Assign a password.

Creating the Credentials

In this step, you create the credentials for the server.

1. Define the value:

   >sapgenpse seclogin --p SAPBW2.pse --O CUBEWARE\xxx

2. The file cred_v2 will be updated to contain the credentials for SAPBW2.pse and for the user CUBEWARE\xxx.

Defining the Location for the License Ticket and the Credentials

In the next step, you specify the location for the license ticket and the credentials. To do so, you need to set the system environment variable SECUDIR to the appropriate directory.

The required registry key is: KEY_LOCAL_MACHINE\Software\SAP\BW2\environment\SECUDIR.

1. Define the value: D:\usr\sap\BW2\DVEBMGS00\sec.

2. Define the system environment variables:

   • SNC_LIB:D:\usr\sap\BW2\SYS\exe\run\sapcrypto.dll

   • SECUDIR:D:\usr\sap\BW2\DVEBMGS00\sec

Defining the Profile Parameters

Last, define the profile parameters. The profile is located in the profile directory: D:\usr\sap\BW2\SYS\profile\BW2_DVEBMGS00.

1. Enter the following parameters:

   snc/enable = 1

   snc/gssapi_lib = D:\usr\sap\BW2\SYS\exe\run\sapcrypto.dll

   sec/libsapsecu = D:\usr\sap\BW2\SYS\exe\run\sapcrypto.dll

   ssf/ssfapi_lib = D:\usr\sap\BW2\SYS\exe\run\sapcrypto.dll

2. Start the SAP application server.

Client-Side Setup

Installing the SAP Cryptographic Library

1. Download the SAP Cryptographic Library (SAPCRYPTOLIB). To do so, you require access to SAP Service Marketplace.

   Note: The installation path must not contain spaces.

2. Extract the SAP Cryptographic Library using SAPCAR and copy it into the directory C:\SNC.

Creating a Personal Security Environment (PSE)

In the next step, you use the SAPGENPSE configuration tool to create a PSE file.

1. Enter the following command in the command line:

   sapgenpse gen_pse -p RFCxxx.pse -noreq CN=Win8,OU=QS,O=Cubeware,C=DE

2. Assign a password.

3. Enter the distinguished name for the "RFCxxx" PSE file. It is: CN=Win8,OU=QS,O=Cubeware,C=DE.

4. The parameter in the SNC MyName field consists of "p:" and the distinguished dame of the client PSE:

   p:CN=Win8,OU=QS,O=Cubeware,C=DE

Creating the Credentials

In this step, you create the cred_v2 file with the credentials in the Client PSE, and set SECUDIR as environment variable.

1. Define the values:

   d:\snc

   >cd c:\snc

   >set secudir=c:\snc

   >sapgenpse seclogin --p RFCxxx.pse --O CUBEWARE\xxx

2. The file cred_v2 and the corresponding credentials have been created. You can check them using the commands >sapgenpse seclogin --l and >sapgenpse get_my_name --v.

Exporting the Client Certificate

Now export the client certificate of the PSE just created:

>sapgenpse export_own_cert --v --p RFCxxx.crt

Importing the Client Certificate into the Server PSE

In the final step, you import the client certificate into the server PSE.

Using the SAP Cryptographic Library for SNC

1. Start the CSP Importer.
2. Create a new relational database and select the driver SAP NetWeaver AS ABAP.
3. Check the Secure Network Communications box.
4. Enter the correct parameters for SNC Name and SNC MyName. "SNC Name" is the SNC name of the SAP application server. "SNC MyName" is the distinguished name which was specified for the client PSE plus the prefix "P:".
5. Click Test Connection.