Solution Manager Security

Question

Hello,
I'm responsible to setup Solution Manager to provide Enterprise Support to the customer. I would like my customer to use Solution Manager by using Internet VPN connection. In the middle of preparation, I have some questions for Solution Manager Security. Because our company has very strict security policy, I need to make sure the questions below and make report to the manager.
1. To follow our companyu2019s security policy, I need to select the port. Could you please let me know which port# do we need to open?  I think port# 80 and 443 are required to use Internet connection. Are there any required port #?
2. What kind of Standard User Authentication does Solution Manager have? (Basic Authentication, Digest Authentication or other?)
3. I would like to restrict any unauthorized access. What kind of access control does Solution Manager have? (Like Service Market Place, is there any authentication before entering first screen?)
4. Is it possible to access both HTTP and HTTPS? If so, is it possible to restrict to HTTP connection? I think HTTPS is much safer.
I read the Security Guide downloaded from Service Market Place, but still have questions. I really need someoneu2019s help.
Thank you in advance.
Best Regards,
Natsumi

Answer 1

Hi Natsumi,
Your question addresses general topics of SAP NetWeaver Web Application Server.
Please find some answers below and I would recommend to check the standard documentation.
>
Natsumi Kimura wrote:
>1. To follow our companyu2019s security policy, I need to select the port. Could you please let me know which port# do we need to open? I think port# 80 and 443 are required to use Internet connection. Are there any required port #?
>
port #80 is the default port for http, port #443 is the default port for https.
You can define your own port numbers to provide access.
>
Natsumi Kimura wrote:
> 2. What kind of Standard User Authentication does Solution Manager have? (Basic Authentication, Digest Authentication or other?)
>
SAP Solution Manager 7.0 is based on SAP NetWeaver and is using the same authentications options.
>
Natsumi Kimura wrote:
> 3. I would like to restrict any unauthorized access. What kind of access control does Solution Manager have? (Like Service Market Place, is there any authentication before entering first screen?)
>
The first screen is the logon screen. Users needs to have logon data (user, password) to access the Work Center.
The URL for the Key User is accessible in the Internet (and may be further restricted to dedicated IP address by additional network infrastructure).
See section "4.4 Internet Communication Framework" in Security Guide.
See section "4.5 Secure Socket Layer (SSL) for HTTP Connections" in Security Guide.
>
Natsumi Kimura wrote:
> 4. Is it possible to access both HTTP and HTTPS? If so, is it possible to restrict to HTTP connection? I think HTTPS is much safer.
>
Yes, it's possible to offer HTTPS connection, only.
Helpful links:
[Application Help - Additional Information on Network Security|http://help.sap.com/saphelp_nw70ehp1/helpdata/en/0a/0a2e12ef6211d3a6510000e835363f/content.htm]
[Security Guide SAP Solution Manager 7.0 EHP 1 and SP 19 |http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000718044&_OBJECT=011000358700000310012009E]
[How-To install&configure the SAP Web Dispatcher|http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000722611&_SCENARIO=01100035870000000202&_OBJECT=011000358700000121752008E]
Best regards,
Ruediger