SAP Secure Network Communication (SNC) Encryption Configuration

Encrypt the SAP Portal traffic to SAP ABAP systems and SAPGUI encryption to ABAP systems as part of their Infosec policy. Encryption is implemented using the SAP Secure Network Communication (SNC). This document explains the step-by-step configuration of SNC Encryption on the existing SAP Gui to ABAP systems and SAP Portal traffic to ABAP systems. SNC can be implemented in HANA On-premise and HANA Cloud landscapes as well.

Landscape

In order to demonstrate this configuration, the below landscape is required:

SAP ABAP Systems: ECC, SRM, GRC, HR, PI and Solution Manager
SAP GUI 7.5 running on Windows
Active Directory service user account
SAP Netweaver Application Server ABAP with Common Crypto Library installed
Microsoft Windows Domain Controller

Tools

LIBSAPCRPYTO Library files
Microsoft Active Directory ADSI
Microsoft Kerberos

Conclusion:

SNC Encryption enhances the existing SAP Cloud and On-Premise environment with a high level of security and the communications between the SAP systems are highly secured.

Configuration Steps:

Pre-Requisites:

SAP GUI Installed on a computer running on Microsoft Windows
Microsoft Windows Domain Controller – Service SPN accounts and SPN configuration
SAP Netweaver Application Server ABAP with Common Crypto library installed

Check the SECUDIR environment variables defined for the sec directory.
Check the SNC library path.
Backup of the existing sec folder and profile directory.
Create the SPN accounts: service user in Microsoft Active Directory (e.g., KerberosABC).
Set the checkboxes as below:
- Go to ADSI edit and set the Service Principle Name for Service user as, e.g., SAP/Kerberos.
- Check the Service Principal Name is unique.
Create SNC pse file with the following command:

sapgenpse get_pse -p < path to the sec directory/xxxx.pse> -x "CN="

7. Create the credentials:

sapgenpse seclogin -p -o

8. Now log in to the ABAP system.
9. Go to Transaction: STRUSTSSO2:
- Create SNC SAP Cryptolib PSE file, right-click on SNC SAP Cryptolib:
  - Remove the default values of Org(opt) & comp/org and maintain the specified values and SAVE.
10. Select SNC SAP Crypto pse and double click the CN=XXXXXX@XXXX.com.
11. Press Export button and export to your machine.
 - Use the name .cert
 - Select “Base64” as .cert.
12. Save the crt into the sec directory of portal dev system.
13. Export certificate of Java SNC PSE:
 ```
sapgenpse export_own_cert -o -x
 ```
14. Import ABAP SNC certificate into Java SNC PSE:
 ```
sapgenpse maintain_pk -p /usr/sap/J00/sec/xxxx.pse -a /usr/sap//J/sec/xxxx.cer
 ```
15. To get the details of the certificate:
 ```
sapgenpse get_my_name -p
 ```
16. Import Java SNC certificate into ABAP SNC PSE.
17. Maintaining the System ACL on the AS ABAP:
 - Go to Transaction SM30 - type VSNCSYSACL and next screen select “E” and click new entries.
 - Add the system and SNC name, e.g., P:CN=xxxx@org.com:
18. Maintain SNC related parameters in the instance profile of Java system and ABAP system:
 - Java System parameter as below:
 - ABAP Systems (ECC) Parameters as defined below.
19. Now continue with the Portal configuration as below:

### Portal SNC with Backend System (ECC)

- System Object creation (using Connection String):
 - Maintain connection string as follows:
   ```
   Connection String: /H//S/3200 SNC_PARTNERNAME="p:CN=xxxxxxxxxx@xxxx.com" SNC_QOP=9
   ```
- Transaction Iview details:
 - As per note: 1881298, create 2 sample transaction iviews and maintain the specified property:
   ```
   Additional Parameters to start SAP GUI: SUPPORTBIT_ON=NEED_STDDYNPRO
   ```
 - Iview 1 Name: ECC SNC

### Testing iview from Portal:

- Ensure the padlock is “ON” & SAP backend (ECC) is connected from the portal using SNC.
- Update the SAPGUI xml properties with the SNC details of respective SAP systems:
 - All SAP systems are encrypted with the key lock as shown:
 - RFC connections are encrypted with SNC as specified.

**End of the configuration.**

**Courtesy:** Rajeshkumar Srinivasan