Configuring a RFC SSL

Hi there
Does anyone know if there is a step by step for setting up a SSL client and configuring the SSL for an RFC? I suppose it's on the basis side of things which Iu2019m not to keen on. I did some research on it and there is a Trust Manager it should be done with? But cannot find anything on what the Trust Manager is and how to get to itu2026
Thanx, Jan

Hi,
Below links will hep u for configuration.
SSL Configuration
http://help.sap.com/saphelp_nw04/helpdata/en/14/ef2940cbf2195de10000000a1550b0/frameset.htm
SSL config pdf
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/964f67ec-0701-0010-bd88-f995abf4e1fc
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/23894238-0701-0010-40b0-a0a6d5c4ad9f?prtmode=navigate
SSL Message level security
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/d024ca8e-e76e-2910-c183-8ea4ba681c51
Certificate Authority
http://www.tc.umn.edu/~brams006/selfsign.html

Similar Messages

How to configure sso with SSL step by step

Purpose
In this document, you can learn how to configure SSO with SSL. After user have certificate installed in browser, he can login without input username and password.
Overview
In this document we will demonstrate:
1. How to configure OHS support SSL
2. How to Register SSO with SSL
3. Configure SSO for certificates
Prerequisites
Before start this document, you should have:
1. Oracle AS 10g infrastructure installed (10.1.2)
2. OCA installed
Note:
1. “When you install Oracle infrastructure, please make sure you have select OCA.
2. How Certificate-Enabled Authentication Works:
a. The user tries to access a partner application.
b. The partner application redirects the user to the single sign-on server for authentication. As part of this redirection, the browser sends the user's certificate to the login URL of the server (2a). If it is able to verify the certificate, the server returns the user to the requested application.
c. The application delivers content. Users whose browsers are configured to prompt for a certificate-store password may only have to present this password once, depending upon how their browser is configured. If they log out and then attempt to access a partner application, the browser passes their certificate to the single sign-on server automatically. This means that they never really log out. To effectively log out, they must close the browser.
Enable SSL on the Single Sign-On Middle Tier
The following steps involve configuring the Oracle HTTP Server. Perform them on the single sign-on middle tier. In doing so, keep the following in mind:
l You must configure SSL on the computer where the single sign-on middle tier is running.
l You are configuring one-way SSL.
l You may enable SSL for simple network encryption; PKI authentication is not required. Note though that you must use a valid wallet and server certificate. The default wallet location is ORACLE_HOME/Apache/Apache/conf/ssl.wlt/default.
1. Back up the opmn.xml file, found at ORACLE_HOME/opmn/conf
2. In opmn.xml, change the value for the start-mode parameter to ssl-enabled. This parameter appears in boldface in the xml tag immediately following.
<ias-component id="HTTP_Server">
<process-type id="HTTP_Server" module-id="OHS">
<module-data>
<category id="start-parameters">
<data id="start-mode" value="ssl-enabled"/>
</category>
</module-data>
<process-set id="HTTP_Server" numprocs="1"/>
</process-type>
</ias-component>
3. Update the distributed cluster management database with the change: ORACLE_HOME/dcm/bin/dcmctl updateconfig -ct opmn
4. Reload the modified opmn configuration file:
ORACLE_HOME/opmn/bin/opmnctl reload
5. Keep a non-SSL port active. The External Applications portlet communicates with the single sign-on server over a non-SSL port. The HTTP port is enabled by default. If you have not disabled the port, this step requires no action.
6. Apply the rule mod_rewrite to SSL configuration. This step involves modifying the ssl.conf file on the middle-tier computer. The file is at ORACLE_HOME/Apache/Apache/conf. Back up the file before editing it.
Because the Oracle HTTP Server has to be available over both HTTP and HTTPS, the SSL host must be configured as a virtual host. Add the lines that follow to the SSL Virtual Hosts section of ssl.conf if they are not already there. These lines ensure that the single sign-on login module in OC4J_SECURITY is invoked when a user logs in to the SSL host.
<VirtualHost ssl_host:port>
RewriteEngine on
RewriteOptions inherit
</VirtualHost>
Save and close the file.
7. Update the distributed cluster management database with the changes:
ORACLE_HOME/dcm/bin/dcmctl updateconfig -ct ohs
8. Restart the Oracle HTTP Server:
ORACLE_HOME/opmn/bin/opmnctl stopproc process-type=HTTP_Server
ORACLE_HOME/opmn/bin/opmnctl startproc process-type=HTTP_Server
9. Verify that you have enabled the single sign-on middle tier for SSL by trying to access the OracleAS welcome page, using the format https://host:ssl_port.
Reconfigure the Identity Management Infrastructure Database
Change all references of http in single sign-on URLs to https within the identity management infrastructure database. When you change single sign-on URLs in the database, you must also change these URLs in the targets.xml file on the single sign-on middle tier. targets.xml is the configuration file for the various "targets" that Oracle Enterprise Manager monitors. One of these targets is OracleAS Single Sign-On.
1. Change Single Sign-On URLs
Run the ssocfg script, taking care to enter the command on the computer where the single sign-on middle tier is located. Use the following syntax:
UNIX:
$ORACLE_HOME/sso/bin/ssocfg.sh protocol host ssl_port
Windows:
%ORACLE_HOME%\sso\bin\ssocfg.bat protocol host ssl_port
In this case, protocol is https. (To change back to HTTP, use http.) The parameter host is the host name, or server name, of the Oracle HTTP listener for the single sign-on server.
Here is an example:
ssocfg.sh https login.acme.com 4443
2. Restart OC4J_SECURITY instance and verify the configuration
To determine the correct port number, examine the ssl.conf file. Port 4443 is the port number that the OracleAS installer assigns during installation.
If you run ssocfg successfully, the script returns a status 0. To confirm that you were successful, restart the OC4J_SECURITY instance:
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY
Then try logging in to the single sign-on server at its SSL address:
https://host:ssl_port/pls/orasso/
 3. Back up the file targets.xml:
cp ORACLE_HOME/sysman/emd/targets.xml ORACLE_HOME/sysman/emd/targets.xml.backup
4. Open the file and find the target type oracle_sso_server. Within this target type, locate and edit the three attributes that you passed to ssocfg:
· HTTPMachine—the server host name
· HTTPPort—the server port number
· HTTPProtocol—the server protocol
If, for example, you run ssocfg like this:
ORACLE_HOME/sso/bin/ssocfg.sh http sso.mydomain.com:4443
Update the three attributes this way:
<Property NAME="HTTPMachine" VALUE="sso.mydomain.com"/>
<Property NAME="HTTPPort" VALUE="4443"/>
<Property NAME="HTTPProtocol" VALUE="HTTPS"/>
5.Save and close the file.
6. Reload the OracleAS console:
 ORACLE_HOME/bin/emctl reload
7. Issue these two commands:
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY
Registering mod_osso
1. This command sequence that follows shows a mod_osso instance being reregistered with the single sign-on server.
$ORACLE_HOME/sso/bin/ssoreg.sh
 -oracle_home_path $ORACLE_HOME
 -config_mod_osso TRUE
 -mod_osso_url https://myhost.mydomain.com:4443
2. Restarting the Oracle HTTP Server
After running ssoreg, restart the Oracle HTTP Server:
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
Configuring the Single Sign-On System for Certificates
1. Configure policy.properties with the Default Authentication Plugin
Update the DefaultAuthLevel section of the policy.properties file with the correct authentication level for certificate sign-on. This file is at ORACLE_HOME/sso/conf. Set the default authentication level to this value:
DefaultAuthLevel = MediumHighSecurity
Then, in the Authentication plugins section, pair this authentication level with the default authentication plugin:
MediumHighSecurity_AuthPlugin = oracle.security.sso.server.auth.SSOX509CertAuth
2. Restart the Single Sign-On Middle Tier
After configuring the server, restart the middle tier:
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY
Bringing the SSO Users to OCA User Certificate Request URL
The OCA server reduces the administrative and maintenance cost of provisioning a user certificate. The OCA server achieves this by authenticating users by using OracleAS SSO server authentication. All users who have an Oracle AS SSO server account can directly get a certificate by using the OCA user interface. This reduces the time normoally requidred to provision a certificate by a certificate authority.
The URL for the SSO certificate Request is:
https://<Oracle_HTTP_host>:<oca_ssl_port>/oca/sso_oca_link
You can configure OCA to provide the user certificate request interface URL to SSO server for display whenever SSO is not using a sertificate to authenticate a user. After the OracleAS SSO server authenticates a user, it then display the OCA screen enabling that user to request a certificate.
To link the OCA server to OracleAS SSO server, use the following command:
ocactl linksso
opmnctl stoproc type=oc4j instancename=oca
opmnctl startproc type=oc4j instancename=oca
You also can use ocactl unlinksso to unlink the OCA to SSO.

I have read the SSO admin guide, and performed the steps for enabling SSL on the SSO, and followed the steps to configure mod_osso with virtual host on port 4443 as mentioned in the admin guide.
The case now is that when I call my form (which is developed by forms developer suite 10g and deployed on the forms server which is SSO enabled) , it calls the SSO module on port 7777 using http (the default behaviour).
on a URL that looks like this :
http://myhostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=.......
and gives the error :
( Forbidden
You don't have permisission to access /sso/auth on this server at port 7777)
when I manually change the URL to :
https://myhostname:4443/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=.......
the SSO works correctly.
The question is :
How can I change this default behaviour and make it call SSO on port 4443 using https instead ?
Any ideas ?
Thanks in advance

How to configure apache for ssl in windows platform

hi all,
can anyone help me expalin how to configure apache for ssl in windows platform.

George,
I would take the following 'first steps'
1)Install Apache20 on your Windows machine following the Apache online documentation
http://httpd.apache.org/docs-2.0/misc/tutorials.html
2)Make sure you can 'serve up' static HTML content from your Apache Server
3)Install Weblogic Server per our online documentation
http://edocs.bea.com/wls/docs61/install/index.html
4)Also, make sure you can 'serve up' both static and dynamic (e.g., JSP) content
directly from WLS server
5)Once you have both of the above 'sanity' checks attempt to configure a simple
proxy by ppath or mime type via our online documentation
http://edocs.bea.com/wls/docs61/adminguide/apache.html#103803
Chuck Nelson
DRE
BEA Technical Support

Sld configuration for rfc to soap scenario

Hi all,
The scenario which i am planning to do, describes how the Custom RFC client application in SAP R/3 System invokes a free Web service (that is hosted over the internet) using SAP XI. For our demo purpose, we have used a free web service available on the Internet.
In this scenario we will be using GetQuote method of Web service DelayedStockQuote. This method retrieves the Stock quote for the given Stock symbol. The method GetQuote has an input that takes in two parameters Stock Symbol and License Key and returns the following information.
StockSymbol,
LastTradeAmount,
LastTradeDateTime,
StockChange,
OpenAmount,
DayHigh,
DayLow,
StockVolume,
PrevCls,
ChangePercent,
FiftyTwoWeekRange,
EarnPerShare,
PE,
CompanyName.
Link to web service:
http://ws.cdyne.com/delayedstockquote/delayedstockquote.asmx?op=GetQuote
In this scenario, I planned to create two mappings, first between RFC Request to SOAP Request and second between SOAP Response to RFC Response .
Adapter in sender communication channel is RFC.(RFC Protocol)
Adapter in receiver communication channel is SOAP.(HTTP Protocol)
Result:
On testing this scenario, In the Sender R/3 system we have to Execute the Report program we have created earlier. When the program is executed with Stock symbol it should get the details of that stock symbol from the Web service.
My question here is what would be the sld configuration for webservice.whether it is a Java WAS or third party.If it is a third party or java WAS,what would be the system name and host name.
Any clarification from you all is welcome and will be highly appreciated.
With Regards
Karthik.

Hi,
I would suggest you is to use third party. It is a web service, and does not matter the technology behind it (if it is java, abap, .net, cobol, no difference! it will be described by a wsld).
System name and host name doesn't matter too, you will not use this information in runtime, and you will specify host name and so at integration directory. You can make your standard on it, for example, put the name as DelayedStockQuote and host as http://ws.cdyne.com.
regards.
roberti

Configuring receiver RFC adapter to use RFC destination

Hello,
   I have been doing some digging, but I can't find a solid answer on how to configuring a receiver RFC adapter to use an existing RFC destination to call a 4/6C R/3 backend system... Our scenario is to WS --> SOAP --> RFC which is up and running in production just fine on NW 7.0, SP12.
   I ask this question because we, as a company, do not like to maintain passwords in multiple systems. That is necessary when we use the receiver RFC adapter now since SNC is a distant pipe dream for us and we would like to use an existing RFC destination that is set up to call the backend system using a logon ticket.
   I checked the relevant links I could find below, but I can not resolve the answer from them. Has anyone set this up successfully? This link (RFC Destination type RFC Receiver Adapter?) mentions it briefly, but it does not go into any length on how to set it up.
Thanks!
John
http://help.sap.com/saphelp_srm40/helpdata/fr/33/c6e63b60c25767e10000000a11402f/content.htm
http://help.sap.com/saphelp_nw04/helpdata/en/33/c6e63b60c25767e10000000a11402f/content.htm
Re: Asynchronous RFC call

Hi John !!
I suggest you to create a new user, without dialog access in your ECC system to be used exclusively by the XI system to access ECC. And then, always use this user in all RFC receiver adapter communication channels.
Regards,
Matias.

Configure sender RFC

HI
EXPERTS
my Scenario is RFC TO FILE
1.when i am sending bapi from sap system to xi system i was getting error
was : jco server couldnot fine the function /GLB/RGT_STOCK_ENQUIRY
so wt my mistke
plz help me
thanks
upendra

Hi Upendra,
Thejco server couldnot fine the function /GLB/RGT_STOCK_ENQUIRY means, that the function wasn't found. The exception message contains the function name.The reason is clear: the ABAP server is unicode enabled and the jco server wasn't configured properly. To be able to dispatch the call from an unicode enabled ABAP server following configuration steps are necessary:
 mark the destination in sm59 as unicode destionation 
hope this will solve your problem. Revert back to me with the result.
Thanks,
Shiv.

Configuring XI for SSL ?

Hi Guys,
My scenario is SOAP-Proxy and i need to send the data to a remote system using SSL. I am using the XI adapter on the receiver side.
I have installed the sap crpto lib on the ABAP stack, I am confused whether i need to do it on ABAP or Java ?
any help would be appreciated
Thanks,
Raj

Hi Raj,
You need to install crypto lib for both ABAP and Java stack.
Reason for this is that all ABAP adapters (IDoc, HTTP etc.) all depends on the crypto lib installed on ABAP stack, and all JAVA adapters (SOAP, FILE/FTP etc.) all depends on the crypto lib installed on JAVA stack.
Configuring the SAP Web AS for Supporting SSL - ABAP
http://help.sap.com/saphelp_nw70/helpdata/en/65/6a563cef658a06e10000000a11405a/frameset.htm
Installing the SAP Cryptographic Library on the AS Java
http://help.sap.com/saphelp_nw70/helpdata/en/9b/29f63def83c452e10000000a114084/frameset.htm
SAP NetWeaver Process Integration Security Guide
http://help.sap.com/saphelp_nw70/helpdata/en/f7/c2953fc405330ee10000000a114084/frameset.htm
SAP NetWeaver Security Guide
http://help.sap.com/saphelp_nw70/helpdata/en/8c/2ec59131d7f84ea514a67d628925a9/frameset.htm
Best regards,
Jacob

How to configure the RFC destination of ERP-CRM connection when moving to Q

Hi Experts,
I set up a ERP sales order and quotation in CRM but under configuration
Customer Relationship Management -->Transactions -->Settings for Sales Transactions -->Define Profile for ERP Sales Transactions
you can only configure one which is i already did in development now we are moving to Quality then next to Prod.
Do you mean we will change this everytime we move to different environment thanks in advanced
Br,
Etrafanob

Hi Etrafanob,
Yes, in each system you will have to change the RFC destination for this as the destination set in your development system will normally be transported through to QA and production. To make the change you will need to contact your basis team and request the system client to be open for configuration changes in transaction SCC4.
I hope this helps.
Regards,
David.

CQ mail configuration using GMail ssl

Hi ,
I done all configurations in Apache console Day cq Mail service .
smtp.gmail.com
465
ssl= true
username
password
.fromaddress
1. Can you help me, how can i get those configurations in my class.
2. For that i followed
http://blogs.adobe.com/learningwem/2011/11/27/cq5-4-workflow-process-to-send-an-email-usin g-messagegateway/
But i am getting messageGatewayService is null in error log.
Regards
Ravindra

Hi Sharam, thank you for using our forum, my name is Johnnatan I am part of the Small business Support community. I apologize for the delay of this response; this information could help you, I will share with you a link from other forum explaining why SMTP doesn´t work with gmail . https://supportforums.cisco.com/thread/2101910
I hope you find this answer useful,
*Please mark the question as Answered or rate it so other users can benefit from it"
Greetings,
Johnnatan Rodriguez Miranda.
Cisco Network Support Engineer.

How to configure SCOT/RFC destination to send email to external addresses

Hi,
I have an ABAP program which sends out an email to email addresses such as [email protected], i configured SCOT and entered our company exchange server address in the SMTP node, and it works just fine. Problem is the program also needs to send emails to internet mail id's such as [email protected] or [email protected], and here it doesnt work, the email request shows up in SOST as failed saying that the address is unrecognized, we are able to send receive emails from internet id's as well using our email client (outlook), i just have no idea how to get the same to work from my ABAP program, i guess i am missing some BASIS configuration, can anybody help please?

Please see the following example. Make sure you are setting the recipient type correctly.
report zrich_0003 .
data: maildata type sodocchgi1.
data: mailtxt type table of solisti1 with header line.
data: mailrec type table of somlrec90 with header line.
start-of-selection.
clear: maildata, mailtxt, mailrec.
refresh: mailtxt, mailrec.
maildata-obj_name = 'TEST'.
maildata-obj_descr = 'Test'.
maildata-obj_langu = sy-langu.
mailtxt-line = 'This is a test'.
append mailtxt.
mailrec-receiver = '[email protected]'.
 mailrec-rec_type = 'U'.
append mailrec.
call function 'SO_NEW_DOCUMENT_SEND_API1'
 exporting
 document_data = maildata
 document_type = 'RAW'
 put_in_outbox = 'X'
 tables
 object_header = mailtxt
 object_content = mailtxt
 receivers = mailrec
 exceptions
 too_many_receivers = 1
 document_not_sent = 2
 document_type_not_exist = 3
 operation_no_authorization = 4
 parameter_error = 5
 x_error = 6
 enqueue_error = 7
 others = 8.
if sy-subrc <> 0.
* MESSAGE ID SY-MSGID TYPE SY-MSGTY NUMBER SY-MSGNO
* WITH SY-MSGV1 SY-MSGV2 SY-MSGV3 SY-MSGV4.
endif.
Regards,
Rich Heilman

BOE ssl configuration

Hello,
I'm working on migrating our BOE XI R2 to BOE 3.1 SP2 on a new server (windows).
Before we were using iis and ssl setting was easy. Now on tomcat I'm having problems.
I'm not creating a new certificate I want to use a special one created for our domain from a 3rd party cert authority.
I don't know much about certificates.
so I have domain.cer domain.der domain.key domain.pem domain.pfx password.txt trustedcer.crt (root ceritiificate) files in d:\ssl folder.
From CCM I check the "enable the ssl"
and I try to fill below
SSL certificates folder=d:\ssl
server ssl certificate file=domain.cer
SSL trusted certificates file=trustedcer.crt
SSL private key file=domain.key
SSL private key passphrase file=password.txt
in tomcat configuration I use the same pattern.
Do I have to convert cer files to der.
Why this combination is not working how can I set the ssl.
Thank you

If yoour users are using the browser and no thick clients then it is all about configuring Tomcat for SSL. You can find plenty information about this in Internet or here https://css.wdf.sap.corp/sap/support/notes/1299147.
Regards,
Stratos

Configuration RFC in Third-Party System?!

Hi,
I try to connect a R/3 4.6c to the XI Server. I guess I configured the SLD right, but now i have to configure the RFC connection.
My idea in SM59:
Connectiontype: 3
target host: /H/1xx.xx.xx.xx/H/1xx.1xx.1xx.xx/H/
(external IP, Internal IP)
--> actually i am not sure how to configure this
User: XIAPPLUSER
Well, for the pro's i guess something seems to be wrong, and that's why the connection is not working.
Need some little help!

Hi Carsten,
Take a look at this link for a complete walk through on RFC:-
http://help.sap.com/saphelp_nw04/helpdata/en/80/09680289c751429ab3b07ad2a61c10/frameset.htm
http://help.sap.com/saphelp_nw04/helpdata/en/80/09680289c751429ab3b07ad2a61c10/frameset.htm
Regards.
Praveen

How to configure RFC scenarios

Hi all,
I am creating an outbound RFC async interface and an inbound RFC async interface. I have read the SAP Help documentation on 'Configuring Sender RFC Adapter' and 'Configuring Receiver RFC Adapter'. What are the steps involved for each?
Outbound:
1. Create RFC connection in SM59 in R/3. The outbound connection must be type TCP/IP.
2. Configure the sender RFC adapter in XI. The Program IDs in the RFC connection and RFC adapter must match.
3. Activate the sender RFC adapter to register the Program ID in the Gateway.
Inbound:
1. Create RFC connection in SM59 in R/3. The inbound connection must be type R/3.
2. Configure the receiver RFC adapter in XI.
3. Done.
Am I missing any steps or are any steps not correct?
Does anything need to be configured in the SLD for the RFCs?
Are the RFC types TCP/IP and R/3 correct?
Thanks in advance!
Dan

Hi Daniel
You already got replies from experts
I can add some load to thread that can be helpful
Troubleshooting RFC
Troubleshooting - RFC and SOAP scenarios *** Updated on 20/04/2009 ***
Sender RFC
The specified item was not found.
RFC calls from Adapter modules...the Web Service Way!
RFC adapter reconnect issue
XI : RFCAdapter ReConnect Issue
Thanks
Gaurav

RFC Function Module Configuration

Hi Experts,
             I have created an RFC function module which pushes data from R/3 system to XI. I need to configure this RFC in SM59. I am having XI server details and R/3 server details. Anyone can help me how to configure this and what kind of connection i have to use. so that data is pushed to XI system. we are having a bunch of RFC's in our project. we need to create configuration for all the RFCs.
              and what is Program ID?
              Please give me the sequence of steps for configuration.my mail id is [email protected]
              Points will be awarded for all the answers.
Thanks & Regards,
Poorna.

hi poorna,
              step 1- first go to the transaction sm59 and here you can
                        create a destination for R/3 to R/3 server type 3.
              step 2- Now give the IP address for the another R/3 system (XI) here
                         and the system no will be 00 (default).
               step 3- press save. now go to the second tab logon/ security
                           here declared the clind no, language , user name and
                         password.
               step 4- press save and then check the test connection.
Do reward if usefull.
regards,
vijay

RFC Adapter Configuration

Hello,
I am using the Adapter Engine, but i don´t see an option to configure the RFC Adapter, but in the documentation say this. I can´t understand.
"You can also use the Adapter Engine configuration screen to configure the Java part of the RFC adapter. For more information, see the Configuration Guide - SAP Exchange Infrastructure 2.0."
Thanks a lot,
Enrique.

Thaks Prasad,
The thing is that i installed another adapter engine in my local pc conecting with the Integration server, and in this adapter engine i can´t see the rfc adapter. Also i can´t install the rfc adapter because there is not a install_rfc_Adapter installation script.
Do you know how to install the java part of the adapter engine, in a new Adapter engine installation?
Thanks a lot.
Enrique.

Configuring a RFC SSL

Similar Messages

Maybe you are looking for