Importing public key certificate from external application

Hello!
I am trying to implement the following scenario:
1. External client application sends it's public key certificate to SAP WAS
2. SAP imports this certificate into its PSE
3. External client application sends digitally signed messages to SAP (with secKey HTTP call parameter)
4. SAP checks this signature and does whatever further action.
For simplicity reason, I emulated this "external app" by using the ArchiveLink interface of the very same SAP system. So, I have one system which is at the same time client and server, but the communication works via HTTP.
I started with step 1: The ArchiveLink (in my case "external app") uses the function SCMS_HTTP_PUT_CERT to send the public key certificate to the client via HTTP. It worked well - I received the message with HTTP service and it contained some binary content as expected (valid public key certificate - I suppose).
Unfortunately, I was unsuccessfull with step 2: How to import the received certificate into my PSE?
I debugged the STRUST transaction and saw that it uses the function SSFP_PUTCERTIFICATE to import public key certificate into SAP's own PSE. However, when I try to use it, I get error No temporary PSE available. I also tried to encode-base64 this message with the same result. What does this mean?
Does anyone has experience with this? Please share it.
Thanks in advance and kind regards,
Igor

The key point was understanding the cleverly named parameter PROFILE in the function SSFC_PUT_CERTIFICATE. You'd never guess: it's a path to a PSE where you want to put the certificate, in my case: C:\usr\sap\NSP\DVEBMGS00\sec\SAPSYS.pse. There's one more step: updating database with the file system PSE.
So, the test sequence that works is:
1. SSFP_GETSAPCERTIFICATE
2. SSFC_PUT_CERTIFICATE
3. SSFPSE_STORE
Regards,
Igor
P.S. Am I the only one playing with these things? I keep getting 0 replies to my questions.

Similar Messages

Logout from an "https client authentication (public key certificate)"

Hi ,
I am using an https client authentication (public key certificate) to login to my ADF faces website
How can I logout form the application? It seems the session.invalidate() is not working because my login information is still displayed after running the logout method (below)
Note that this logout method was working well with the Form-Based Authentication.
Thank you
Jamil
public String logout() {
ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContext();
HttpServletRequest request = (HttpServletRequest)ectx.getRequest();
HttpServletResponse response = (HttpServletResponse)ectx.getResponse();
HttpSession session = (HttpSession)ectx.getSession(false);
session.invalidate();
String temp = request.getContextPath() + "/adfAuthentication?logout=true&end_url=/faces/logout";
try {
ectx.redirect(temp);
FacesContext.getCurrentInstance().responseComplete();
} catch (Exception ex) {
System.out.println("Exception in logout()");
return null;
}

Can you try with the null chk.. as this piece of code is working fine for us
public void logout(ActionEvent evt) {> FacesContext fc = FacesContext.getCurrentInstance();
> HttpSession session =
> (HttpSession)fc.getExternalContext().getSession(false);
> HttpServletRequest request =
> (HttpServletRequest)fc.getExternalContext().getRequest();
> HttpServletResponse response =
> (HttpServletResponse)fc.getExternalContext().getResponse();
> try {
> if (session != null) {
> session.invalidate();
> }
> fc.getExternalContext().redirect(request.getContextPath() +
> "/faces/index");
> } catch (Exception exp) {
> try {
> fc.getExternalContext().redirect("/faces/Error");
> } catch (Exception ex) {
}> }
> }

ArchiveLink security: sending public key certificate by SCMS_HTTP_PUT_CERT

Hello!
I have a question which I asked on ESA and Security forums and didn't get answer.
I am trying to do a test program to check ArchiveLink security features. Namely, I am calling the function SCMS_HTTP_PUT_CERT which is supposed to send a public key certificate via HTTP. However, when I catch this call and want to import the certificate by using the function SSFC_PUT_CERTIFICATE, I get error message SSF kernel error: invalid parameter.
Does anyone have experience with this?
For more detailed description of my attempt, please see ArchiveLink security: sending public key certificate.
Thanks and regards,
Igor

Hi
SCMS_HTTP_PUT_CERT is used to send sap public key to Content server application. The content server application makes use of this key to verify the incoming request ie the Content Server uses the public key to check URIs and signatures.
SAP uses the Public/Private key security concept while communicating with Content server. Basically when SAP communicates with Content server it will be sending GET, PUT, POST requests. The URL from SAP will have field called secKey which contains the security key. secKey ensures that a URL cannot be changed after it has been generated by the SAP system. The private key is used by SAP to generate the secKey.
The content server application will use the public key provided via SCMS_HTTP_PUT_CERT to check the URL and will be able to detect if the URL has been tampered.
Refer SAP Content Server HTTP 4.5 Interface documentation section Security for more details.
http://help.sap.com/saphelp_nw04/helpdata/en/9b/e8c186eaf811d195580000e82deb58/frameset.htm
Hope this helps
Cheers,
Samanjay
Message was edited by:
Samanjay Shenoy

Problem signing certificates from external token (smart card)

I can not sign PDF documents with an external token (smart card) through a card reader of a Cherry keyboard.
The card drivers perfectly detect the card and certificates in it, however when trying to sign a certificate in Adobe and select the location of the certificate click in the option "A device attached to this computer" ... I get an error indicating that no device is connected to the computer appears.
I have tried several different card readers, it seems a problem of drives because the middleware card recognizes all tested certificates readers, however it seems that Adobe is not able to find the card reader. It has happened with several teams. In one team made a clone and deploy it to another machine with the same hardware environment, the firm run properly in the pdf that clone, however on the original computer is not working.
You have any idea what could be the problem? Thank you very much in advance.

If the digital ID's corresponding public-key certificate is not getting added to either the Windows Certificate Store, or Mac Keychain Access when you plug the card into the card reader, then you need to load the PKCS#11 module via the Acrobat UI. The module will be a DLL on Windows or a bundle file on the Mac. The problem is there is no one file name to look for, you would need to consult the hardware's documentation to find the name of the file. Once you know the name you can add the P11 module from the Security Settings dialog and then Acrobat will then see the digital ID(s) loaded on the smart card.
Steve

Renewing public key certificate used for Seeburger AS2

My general question is when a public key certificate, used for Seeburger AS2 payload decryption and digital signatures, needs to be renewed, how carefully do the certificate renewal steps need to be coordinated for a seamless transition? More specifically...
1. Once we import the CSR response from the CA, will the public key currently used by our partner become invalid, or will it continue to work until its expiration date?
2. Will our partner be able to validate our signature after the new CSR has been imported, but prior to them applying the new public key certificate in their system?
3. Or can we renew the certificate, import the CSR request, provide our partner with the renewed certificate, and let them apply the certificate at their own volition, provided they do it prior to the original certificate expiration?

Hi Kurt
In my experience, the renewal/replacement of AS2 certificates for encryption/decryption & signing/authentication requires coordinated effort on both sides.
This is because AS2 uses asymmetrical encryption, so both parties need to use the same pair of certificates at the same time, i.e. you encrypt on your private key, and partner decrypt on the public key matching your private key. If the keys used do not belong to the same pair, then decryption will not work.
I'm not sure what AS2 software your partner uses and if it has the feature of automatic rollover of certificate, but PI/Seeburger does not. The approach in PI/Seeburger can either be one of the following:-
i) import new cert replacing original cert of the same name
ii) import new cert into new name, manually update sender/receiver agreements
Due to the manual nature of the tasks, normally it requires coordinated effort during a cutover window.
Rgds
Eng Swee

URL based portlet from external application

Hello,
I'm trying to integrate a forms 6i patch 10 application into SSO.
First, I created an external application, passing it the correct parameters.
Everything went ok, and I can successfully call it by entering
"Administer Enternal Application" link on Oracle Portal.
Now I want to make a portlet from this external application. For that I'm
using PDK URL Services. So I reused the urlexternalauth provider which is
included in the latest PDK. The provider.xml is included below. I successfully
registered the provider, by following the wizard "Register Portlet Provider" on
Oracle Portal. But when I call the portlet, the html startup file for the form
is base.htm. When I call the external application through the "Administer Enternal Application" link,
I get the right html startup file, which is basejini.htm.
So I need basejini.htm called from the portlet, and not base.htm.
Thanks,
Andri.
provider.xml
<?xml version="1.0" encoding="UTF-8"?>
<?providerDefinition version="3.1"?>
<provider class="oracle.portal.provider.v2.http.URLProviderDefinition">
 <providerInstanceClass>oracle.portal.provider.v2.http.URLProviderInstance</providerInstanceClass>
 <session>true</session>
 <authentication class="oracle.portal.provider.v2.security.Authentication">
 <authType>ExternalApp</authType>
 <userFieldName>username</userFieldName>
 <userPwdName>password</userPwdName>
 <errorPageMessages>Error Message!</errorPageMessages>
 </authentication>
 <proxyInfo class="oracle.portal.provider.v2.ProxyInformation">
 <httpProxyHost>proxy.br.odebrecht.com</httpProxyHost>
 <httpProxyPort>8080</httpProxyPort>
 </proxyInfo>
<portlet class="oracle.portal.provider.v2.http.URLPortletDefinition">
<id>1</id>
<name>iCorporate</name>
<title>iCorporate</title>
<description>iCorporate - aplicacao Forms6i</description>
<timeout>100</timeout>
<timeoutMessage>iCorporate time out</timeoutMessage>
<acceptContentType>text/html</acceptContentType>
<showEdit>false</showEdit>
<showEditToPublic>false</showEditToPublic>
<showEditDefault>false</showEditDefault>
<showPreview>false</showPreview>
<showDetails>false</showDetails>
<hasHelp>false</hasHelp>
<hasAbout>false</hasAbout>
<passAllUrlParams>true</passAllUrlParams>
<inputParameter class="oracle.portal.provider.v2.URLPortletParameter">
<name>config</name>
<displayName>config</displayName>
<value>icorp</value>
<isMandatory>true</isMandatory>
</inputParameter>
<inputParameter class="oracle.portal.provider.v2.URLPortletParameter">
<name>database</name>
<displayName>database</displayName>
<value>server1</value>
<isMandatory>true</isMandatory>
</inputParameter>
<renderer class="oracle.portal.provider.v2.render.RenderManager">
<showPage class="oracle.portal.provider.v2.render.http.URLRenderer">
<contentType>text/html</contentType>
<pageUrl>http://server1.rjo.br.odebrecht.com:7780/servlet/f60servlet</pageUrl>
</showPage>
</renderer>
<securityManager class="oracle.portal.provider.v2.security.URLSecurityManager">
<authorizType>public</authorizType>
</securityManager>
</portlet>
</provider>

Andrea,
Could you tell me if FORMS 6i authentication process is based on cookies? The reason being, URL based portlets SSO feature is primarily driven by External Application's cookies, which act as authentication tokens. Once a valid user information is submitted to the External Application, cookies (if any) are received and stored so that they can be re-used in further connections. A typical flow of events can be summarized as follows :
At provider level :
1. Connect to External Application.
2. Submit user information to url specified by External Application's login URL.
3. Fetch cookies
4. Store them for future use.
At portlet level :
1. Read cookies fetched through provider, pertaining to this portlet.
2. Open connection to url specified by <pageUrl> tag in provider.xml
3. Read content and display in the portlet.
From the provider.xml, I can see that we are trying to show content given by http://venezuela.rjo.br.odebrecht.com:7780/servlet/f60servlet servlet, which has two parameters called {config and database}. This makes the resulting URL as http://venezuela.rjo.br.odebrecht.com:7780/servlet/f60servlet?config=icorp&database=venezula. I guess when this URL is accessed directly, FORMS servlet will redirect the user to base.htm file. Important point to note here is that when URL based portlet makes connection to the above URL, user information is not directly sent along with the request. Instead, cookies fetched from External Application, if any, are sent. But when the same application is viewed through portal's External Application, user information is directly submitted to the login URL. So, before deciding on something, it is important to know how different is the loginURL specified through portal's External Application details, from <pageUrl> of URL based portlets?
-aMJAD.

How to read xml reports from external application

Hi All,
I want to generate reports from SIEBEL Database and access those reports from external application(like BlackBerry application). I have gone through by some blogs and found that we can access the generated reports from an external application using the URL.
When I use this URL on browser it gives me the xml file of the report. But I am unable to read this file from the Blackberry application.
Thanks in advance

Hi Angha,
I want to invoke other portal application from my application.
Portal URL's also get changed from one system to Other. Prototype Portal->Development Portal -> Quality Portal->Production Portal>
All the above Portal URL will be different.
I want trigger another application dynamically.
Thx & Rgds
AW

How to pass values to dashboard prompts from external applications

Any idea is well appreciated.
How can I pass values of dashboard prompts from external applications to the dashboard prompts so that the dashboard is prefiltered based on values sent by external applications.
Thanks in Advance!
Kris

Kris,
i am able to change the session variable and able to call the dashboard from external app, but i identified prompt value not changing. but Finally i am able to found a workaround for you.
Use the following URL and it explained here
http://localhost:9704/analytics/saw.dll?Dashboard&nquser=Administrator&nqpassword=Administrator&PortalPath=/shared/abcd/_portal/dash1&Options=rmf&DSN=madan
PortalPath is your dashboard location. /shared/abcd is folder where i saved dashboards. dash1 is my dashboard name.
internally this dashboard includes many reports that uses the session variable. after doing above this i am able to update the session variable to the value i have given in URL, DSN=value.
You may observer here that calls the dashboard and passes the value but its not updating the prompt value. so workaround for this is edit your prompt,
change the Default to - SQL Results and place the sql
SELECT CASE WHEN 1=0 THEN Markets.Region ELSE VALUEOF(NQ_SESSION.DSN) END saw_0 FROM Paint
again here Market.Region is column from presentation layer and Paint is subject area. After doing this step, your prompt always shows value in the session varible as default.
Now include reports and dashboard prompt in the dashboard and run this url from external applicaitons.
http://localhost:9704/analytics/saw.dll?Dashboard&nquser=Administrator&nqpassword=Administrator&PortalPath=/shared/abcd/_portal/dash1&Options=rmf&DSN=madan
it worked for me and blog this soon. if it works for you mark the question as answered and mark my replies as correct.
thanks
- Madan

How to stop vdbench from external applications? What are the impacts?

I am using vdbench to test following scenario:
1) Start vdbench - do read/write (I use poweshell start-process to start vdbench which returns me the process object )
2) Poll for particualr system event(my test condtion). When the event happens stop read/write ASAP(To stop the process I use powershell Stop-process and pass process object as the argument. This actually stops IO as seen task manger)
3) Continue testing
I want to understand
1) Are the steps followed correct?
2) What is the correct method to stop vdbench from external application?
Regards
Jugari

An other thought, that maybe is of interest to you, coming in the next version of Vdbench.
A conversation with one of my internal users:
It does not make sense to look at current Vdbench output trying to figure out what is happening when.
This locks us in to tricks and guessing and prevents me from make changes to the output.
Monday I will create a new file in Vdbench: status.html
This file will only be there for any kind of wrappers to see what is going on.
I'll make sure that the file contents are flushed to the file system as soon as a line of text has been written.
* Vdbench status
* The objective of this file is to contain easily parseable information about the current state of Vdbench.
* This then can serve as an 'official' interface for any software monitoring Vdbench.
* Each line of output will be immediately flushed to the file system, making its content accessible by any monitoring program.
* The values below are all tab-delimited.
03/25/2015-13:42:44-MDT Starting slaves
03/25/2015-13:42:44-MDT Slaves connected
03/25/2015-13:42:44-MDT Query host configuration started
03/25/2015-13:42:44-MDT Query host configuration completed
03/25/2015-13:42:46-MDT Starting rd=rd1 For loops: None
03/25/2015-13:42:48-MDT Warmup done rd=rd1 For loops: None
03/25/2015-13:42:51-MDT Workload done rd=rd1 For loops: None
03/25/2015-13:42:51-MDT Slaves done rd=rd1 For loops: None
03/25/2015-13:42:51-MDT Shutting down slaves
03/25/2015-13:42:51-MDT Vdbench complete
Henk.

Make Firefox open URLs passed from external applications in new tabs

I upgraded Firefox (Mac) from 3.6.13 to 3.6.14 yesterday.
Since then Firefox does not respond to URLs passed from external applications, as it has always done.
The external apps pass the URL, FireFox is brought to the front, but no Tab (or new window) is opened.
Nothing else has changed. Firefox is selected as my default browser (in Safari Prefs) and there is only one copy of FireFox on my laptop,

Hi David
Go to Safari Preferences>General. At the bottom you'll see an option for opening in a tab. Makes sure Tabs are enabled in your Tab panel.

Get HTML (Dynamic Converter) converted content from external application

As per requirement, External (Other java application) application suppose to get dynamic converted (HTML version) content from UCM.
I am trying to execute GET_DYNAMIC_CONVERSION service using RIDC and web service client call.
I dont see HTML content is coming as the result of GET_DYNAMIC_CONVERSION service.
Would you please guide me in getting HTML converted document from external application.
Please let me know, if you need additional details.
Thank you in advance
Edited by: 958795 on Sep 12, 2012 3:29 PM

Hi Srinath,
I have tried your response. Still i am getting hda data only, not HTML content.
GET_DYNAMIC_URL service with fileUrl attribute is returning HTML content from UCM GUI (browser) but not from RIDC.
Code i tried is:
DataBinder dataBinder = idcClient.createBinder();
          dataBinder.putLocal("IdcService", "GET_DYNAMIC_CONVERSION");
          //dataBinder.putLocal("dID","1832");
          dataBinder.putLocal("dDocName","ECMPS5_002024");
          dataBinder.putLocal("IsJava","0");
          dataBinder.putLocal("RevisionSelectionMethod","LatestReleased");
          dataBinder.putLocal("DCViewFormat","WebViewable");
          // execute the request
          ServiceResponse response = idcClient.sendRequest (userPasswordContext, dataBinder);
InputStream istream=response.getResponseStream();
InputStreamReader isr = new InputStreamReader(istream);
BufferedReader br = new BufferedReader(isr);
String line = null;
while ( (line = br.readLine()) != null)
System.out.println(line);
}

How to renewal SSO public key certificate ??

hiiiiii
How to renewal SSO public key certificate....

Hello,
You should replace the existing certificate before it expires as per the link provided below.
http://help.sap.com/saphelp_nw04s/helpdata/en/5c/b7d53ae8ab9248e10000000a114084/frameset.htm
http://help.sap.com/saphelp_nw04s/helpdata/en/59/6b653a0c52425fe10000000a114084/frameset.htm
Thanks,
Siva Kumar

ITunes 11 won't import .mov video files from external hard drive but will from internal.

Hi Everyone
I'm having a problem with iTunes 11.0.1. I can't import .mov video files stored on an external hard drive. I can however import .m4v files from the same external drive. Using either the add to library option or dragging files from the finder.
I can add .mov files from the internal though. Strange I know.
The reason behind this posting is that I'm using iFlicks to convert my TV and movies from my external drive for Apple TV and add all relevent meta data, keeping the files on the external drive and having iTunes link to them.
I would like to be able to simply create a general iTune compatiable file using iFlicks which only takes a minute or two per file to convert. I'm currently converting them to .m4v just for the sack of being able to import them into iTunes from an external drive takes 45 minutes per file.
Has anybody else had this problem? Any ideas on a fix to allow me to import .mov files from an external drive into iTunes without copying it to the iTune library file.
Many Thanks
Dave

This might be worth a shot - basically seeing if Vista permissions could be the culprit.
Give yourself FULL control and ownership of the exHD, let's call it M:
How to Take Ownership and Grant Permissions in Windows Vista
Take control of the top level folder and ALL subfolders.
Try creating a new blank ITL file on M: by pressing *and holding* the shift key while itunes starts. See if you can add everything again.

DMS BAPI RFC Open DMS document from external application

Hello,
I want open a document stored in DMS through RFC BAPI, from an external application (for example .NET)
EasyDNS run OK: I have included the bapi Z_EASYDMS_ECL_OPEN_DOCUMENT (code from a SAP note) in the system and I can open ECL/EAI & local documents (pdf, word, ...)
If I run Z_EASYDMS_ECL_OPEN_DOCUMENT from SE37 run OK: I can see every document, document is downloaded to local system and then open.
But when I call bapi Z_EASYDMS_ECL_OPEN_DOCUMENT from my external application through RFC I don't receive any result: document is not download to local system.
I have debugged the bapi (with SM50) and I have see that the calling entry in bapi, run and then ... crash.
I have detected the fail in OLE_FLUSH_CALL: system has a dump.
Summary:
- EasyDMS run Ok
- SE37 Z_EASYDMS_ECL_OPEN_DOCUMENT run ok
- Z_EASYDMS_ECL_OPEN_DOCUMENT dump at OLE_FLUSH_CALL
Any idea?
thanks in advance,

Hello,
it is possible to extract DMS's file to application server directory:
FUNCTION Z_DMS_VIEW.
""Interfase local
*" IMPORTING
*"     VALUE(DOC_NUMBER) LIKE BAPI_DOC_DRAW2-DOCUMENTNUMBER OPTIONAL
*"     VALUE(DOC_PART) LIKE BAPI_DOC_DRAW2-DOCUMENTPART OPTIONAL
*"     VALUE(DOC_TYPE) LIKE BAPI_DOC_DRAW2-DOCUMENTTYPE OPTIONAL
*"     VALUE(DOC_VERS) LIKE BAPI_DOC_DRAW2-DOCUMENTVERSION OPTIONAL
*"     VALUE(ORIGINAL_PATH) LIKE BAPI_DOC_AUX-FILENAME OPTIONAL
*" EXPORTING
*"     VALUE(P_RETURN) LIKE BAPIRET2 STRUCTURE BAPIRET2
*" TABLES
*"      DOC_FILES STRUCTURE BAPI_DOC_FILES2 OPTIONAL
CLEAR:   doc_files.
REFRESH: doc_files.
DATA: i_doc_files like bapi_doc_files2.
DATA: i type i.
i = 2.
while i = 2.
   i = 2.
endwhile.
CALL FUNCTION 'BAPI_DOCUMENT_CHECKOUTVIEW2'
    EXPORTING
      DOCUMENTTYPE    = DOC_TYPE
      DOCUMENTNUMBER = DOC_NUMBER
      DOCUMENTPART    = DOC_PART
      DOCUMENTVERSION = DOC_VERS
      DOCUMENTFILE    = i_doc_files
      GETSTRUCTURE    = '0'
      GETCOMPONENTS   = 'X'
      ORIGINALPATH    = ORIGINAL_PATH
      HOSTNAME        = ' '
      GETHEADER       = 'X'
      PF_HTTP_DEST    = 'SAPHTTPA'
      PF_FTP_DEST     = 'SAPFTPA'
    IMPORTING
      RETURN          = P_RETURN
    TABLES
      DOCUMENTFILES   = DOC_FILES.
ENDFUNCTION.
ORIGINAL_PATH must be a directory of application server.
By background is not possible (I don't know how can we do that) download thsi file to PC.
Then with the file in application server we can :
- to map application server directory in a drive unit of Pc
- to transfer with a ftp client from Pc
- rfcexec
But always the bapi can not download the file: it must be a process in Pc who transfer the file.

Need info on Standard Web services to pull Order data in CRM from external applications

Hi Gurus,
I have a requirement to pull Order data in CRM from external non-sap application using Web services. Are there any standard SAP provided web services to pull order data based on some input? If yes, can you provide me any kind of documentation related to this?
Appreciate your help on this.
Thanks
Lakshman

Hi Lakshman,
I have checked further.
Please review below link of the SAP Help documentation :
http://help.sap.com/saphelp_nw70/helpdata/en/47/3a989cbcef2f35e10000000a1553f6/content.htm?frameset=/en/46/97218e79f115eae10000000a114a6b/frameset.htm&current_toc=/en/d1/802cfc454211d189710000e8322d00/plain.htm&node_id=439&show_children=false
and also the link :
–http://esworkplace.sap.com/socoview(bD1lbiZjPTAwMSZkPW1pbg==)/render.asp?packageid=DE0426DD9B0249F19515001A64D3F462&id=347DD31EB5AB4BC592BD8B29C0981A1B
Hoping that this will be helpful.
Best regards - Christophe

Importing public key certificate from external application

Similar Messages

Maybe you are looking for