Message Level Security and Performance

Hi All,
Does the implementation of Message Level security features Like SSL and Encryption degrade the performance of the server in Processing the messages ?
regards,
Rahul

Encryption related performance issue is purely related to size of messages.
In my opinion, SSL wouldnt affect the performance for large messages. SSL will take its usual time for checking for security.
And the volume and size could anytime affect the performance
Regards,
Prateek

Similar Messages

WebServices and message level security

Hello,
I am investigating about the use of XI web services using message level security (encrypted xml), is it possible to achieve this between an SAP provider and a third party consumer, without using a PCK or developing a specific adapter? (most solutions I see always point to this).
If anyone could shed some light into this matter i would be thankful.
Regards,
Leandro Fonseca

Hello,
I am investigating about the use of XI web services using message level security (encrypted xml), is it possible to achieve this between an SAP provider and a third party consumer, without using a PCK or developing a specific adapter? (most solutions I see always point to this).
If anyone could shed some light into this matter i would be thankful.
Regards,
Leandro Fonseca

Invoking a message-level secured webservice WS Security

I am not having any luck invoking a webservice that has been secured via message-level security. For simplicity, I have been using WS-Security Policies provided by WebLogic and applying them on my webservice via annotations. I have been testing with Wssp1.2-Wss1.0-X509-TripleDesRsa.xml. I am using soapUI to invoke the webservice. When I send a singed soap request, I get a response indicating that it wasn't able to validate the signature. I made sure that both soapUI and WebLogic server is using the same identity store. I have also made sure that the certificate in the identity store is also in the trust store for WebLogic. There could also be a problem with the structure of the soap request. I send a soap request that includes a signature of the timestamp, the initiator token (x509 in binary form), and the body.
Anyone have luck with WebLogic webservice security and soapUI?

Applying 'format XML' after signing it changes the message and makes the signature invalid, different content == different signature.
You should also ask yourself why you'd like to transport blank characters (zero information) over the wire just to make it more readable for yourself? Just compare the size of the unformatted and formatted message to see the waste of bandwidth.
--olaf

Message Level security : PI 7.1

Hello All,
We are currently evaluating the message level security options in PI in order to communicate with native ABAP systems like CRM , HR, BW etc. Does it need us to set up a PCK (Decentralized adapter engine) in order to use it ?
http://help.sap.com/saphelp_nwpi71/helpdata/en/a8/882a40ce93185de10000000a1550b0/content.htm
The scenarios are
SOAP - XI - Proxy
SOAP - XI - WS Adapter
Thanks.
Kiran

Thanks Marcus & Caio !! The settings listed in the link
http://help.sap.com/saphelp_nwpi71/helpdata/EN/ea/c91141e109ef6fe10000000a1550b0/frameset.htm
Do they have to be done on our ECC box and how do I do it for both Consumer and Provide Proxy ?
Is ther a link to the blog available for the same with comm channel documents.
Thanks.
Kiran

Message Level Security with SOAP Adapter

Hi,
I need to use Message Level Security with my SOAP Adapter. Please let me know if anyone has done the same in the past?
What are the steps I would need to do? How can I use WSS based security in the SOAP Adapter?

Hi,
Message-level security is recommended and sometimes a prerequisite for inter-enterprise communication.
It improves communication-level security by adding security features that are particularly important for inter-enterprise
Message-level encryption is required if message content needs to be confidential not only on the communication lines but also in intermediate message stores.
Refer
How to use Client Authentication with SOAP Adapter
XML Encryption Using Web Services Security in SAP NetWeaver XI
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/f0650f56-7587-2910-7c99-e1b6ffbe4d50
http://help.sap.com/saphelp_nw04/helpdata/en/a8/882a40ce93185de10000000a1550b0/frameset.htm
Thanks
swarup

Message Level Security

Hi All,
In the PI to PI scenario i used certificates for sigining and encryption. For this i followed message level security document.
In PI1 message is signed and encrypted, but the sign is not validated and message is not decrypted in PI2 server. Output from PI2 server is coming in encrypted form. How to solve this issue.
PI1 SP is 11 and PI2 SP is 06.
Kindly suggest some solution.
Regards
Prakash

Hi,
Message-Level Security
Message-level security allows you to digitally sign or encrypt documents exchanged between systems or business partners. It improves communication-level security by adding security features that are particularly important for inter-enterprise communication. Message-level security is recommended and sometimes a prerequisite for inter-enterprise communication.
●      A digital signature authenticates the business partner signing the message and ensures data integrity of the business document carried by a message.
Signatures are used in two scenarios:
○       Non-repudiation of origin
The sender signs a message so that the receiver can prove that the sender actually sent the message.
○       Non-repudiation of receipt
The receiver signs a receipt message back to the sender so that the original sender can prove that the receiver actually received the original message.
●      Message-level encryption is required if message content needs to be confidential not only on the communication lines but also in intermediate message stores.
SAP NetWeaver usage type Process Integration (PI) offers message-level security for the XI protocol itself, for the RosettaNet protocol, for the CIDX protocol, and for the SOAP and Mail adapters. The table below summarizes the message-level security features of these protocols and adapters.
Message-Level Security Features
XI Protocol (XI 3.0)
Messaging components
Integration Server and PCK
SOAP
Adapter Engine and PCK
Mail
Adapter Engine
RNIF 2.0
Adapter Engine
RNIF1.1/CIDX
Adapter Engine
IIly
Signature
X
X
X
X
X
Non-repudiation of origin
X
X
(Web service security)
X
X
Non-repudiation of receipt
X
X
X
Encryption
X
X
X
X
Technology
Web service security (XML signature)
Signed parts are the SAP main header, the SAP manifest, and the payloads (SOAP attachments).
Encrypted parts are the payloads (SOAP attachments).
S/MIME or
Web service security (XML signature)
The SOAP body is signed.
S/MIME
S/MIME
PKCS#7
XI 3.0 is the XI protocol valid for both SAP NetWeaver ´04 and SAP NetWeaver 7.0.
Message-level security is not guaranteed across the entire communication path of a message, but only for the intended B2B connections, which can be the following communication paths, as described under Service Users for Message Exchange.
●      XI protocol
○       (s4) Integration Server to Integration Server, PCK to Integration Server
○       (r4) Integration Server to Integration Server, Integration Server to PCK
●      SOAP protocol
○       (s3) SOAP sender to Adapter Engine or PCK
○       (r3) Adapter Engine or PCK to SOAP receiver
●      Mail protocols
○       (s3) Mail server to Adapter Engine or PCK (IMAP4/POP3)
○       (r3) Adapter Engine or PCK to mail server (IMAP4/SMTP)
●      RNIF and CIDX protocol
○       (s3) RNIF or CIDX sender to Adapter Engine
○       (r3) Adapter Engine to RNIF or CIDX receiver
You define whether and how message-level security is to be applied to messages in the Integration Directory by using sender agreements on the inbound (sender) side in scenarios (s3) and (s4) and by using receiver agreements on the outbound (receiver) side in scenarios (r3) and (r4). For more information about configuring message-level security, see Security Configuration at Message Level.
Message-level security relies on public and private x.509 certificates maintained in the J2EE keystore, where each certificate is identified by its alias name and the keystore view where it is stored. Certificates are used in the following situations:
●      When signing a message, the sender signs it with its private key and attaches its certificate containing the public key to the message.
The receiver then verifies the digital signature of the message with the senderu2019s certificate attached to the message. There are two alternative trust models to verify the authenticity of the senderu2019s public certificate:
○       In the direct trust model, the signeru2019s public key certificate is compared with the locally maintained, expected public key certificate of the partner. Therefore, the direct trust model requires offline exchange of public key certificates, which can be self-signed or issued by a CA.
○       In the hierarchical trust model, the signeru2019s public key certificate is validated by a locally maintained public certificate of the CA that issued the signeru2019s public certificate. In addition, the subject name and the issuer of the signeru2019s certificate is compared with the expected partneru2019s identity configured in a receiver agreement on the receiver side.
Generally, the hierarchical trust model enables chains of certificates attached to the message. The XI 3.0 message format, however, does not support such chains; the certificate used for signing has to be signed by a root CA.
In the hierarchical trust model, the sender and the receiver only need to agree upon the CA and the subject name that the sender has used in its certificate.
The following trust models are supported:
○       The RNIF and CIDX adapters support both a direct and a single-level hierarchical trust models.
○       The XI protocol and the SOAP adapter (with Web service security) only support a single-level hierarchical trust model.
○       The Mail adapter and the SOAP adapter (with S/MIME) support a multi-level hierarchical trust model.
●      When encrypting a message, the sender encrypts with the public key of the receiver (also verifying the correctness of the receiveru2019s certificate by using the public key of the certificateu2019s root CA).
The receiver decrypts with its private key certificate.
For more information about the certificate store, see Certificate Store.
Whenever a message is signed, the receiver archives the signed messages for non-repudiation purposes. See Archiving Secured Messages.
reg,
suresh

Message Level Security in FTPS

Hi ,
Did File Adapter with FTPS will provide the Message Level Security ?
And What is the Exact Difference Between FTPS for Control Connection and FTPS for Control and Data Connection .
What is the Significance of Use X.509 Certificate for Client Authentication check box. If we check it what will happen r if we dont what will happen ?
Thanks.
Anitha.

>
Anitha SAP wrote:
> Hi Rajesh,
>
> I have to use only FTPS. Because my client is suggesting that only. Isn't possible using FTPS ?
> And Tell me The Difference Between FTPS for Control Connection and FTPS and Control and Data Connection .
> Neccesity of Public key certificate from FTP Sever?
>
> Thanks.
> Anitha.
PI supports FTPS. you can use the File adapter for the same.
The basic difference when we talk about FTPS for Control Connection* and FTPS and Control and Data Connection is that in case of FTPS and Control and Data Connection, you data is also encrypted. Else the connection is secure but the data level encryption will not be active
FTPS works with Certificates and hence the need for the same

What is MacKeeper - 911 for your Mac, Instant Mac cleanup, High-level security, Mac performance boost, Univ? I keep getting a pop up on my iMac?

What is MacKeeper - 911 for your Mac, Instant Mac cleanup, High-level security, Mac performance boost, Univ? I keep getting a pop up on my iMac?

Do not install MacKeeper (and how to uninstall it if you have):
https://discussions.apple.com/docs/DOC-6221
(Please note that references to the original developers, Zeobit, also now refer to Kromtech Alliance Corp, who acquired MacKeeper and PCKeeper from ZeoBit LLC in early 2013.)
This recent court case is illuminating:
http://www.courthousenews.com/2014/01/21/64695.htm

Message Level Security in XI 7.0

Hi,
Have someone worked on Message level Security in XI 7.0 for transferring a file from one system to an external third party system?
If so can u provide me with links or documents?
Thanks
Manjula

Hi,
Please Find the Required Details in the Links
http://help.sap.com/saphelp_nw04/helpdata/en/f7/c2953fc405330ee10000000a114084/content.htm
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/d024ca8e-e76e-2910-c183-8ea4ba681c51
Reward Points if Helpful
Regards
Khanna

SOAP receiver - Message level security - Encryption

Hello,
I want to use message level security when using HTTPS. Client provided us the encryption certificate which we have uploaded in the keystore, also done the necessary settings in PI 7.1 but we are getting the below mentioned error.
Message processing failed. Cause: com.sap.engine.interfaces.messaging.api.exception.MessagingException: com.sap.aii.security.lib.exception.SecurityException: SecurityException in method: apply( Message, CPALookupObject ). Message: SecurityException in method: apply( Message, CPALookupObject ). WSSEThread-Exception: SecurityException in method: run(). Message: Connection timed out: connect. To-String: java.net.ConnectException: Connection timed out: connect; To-String: com.sap.aii.security.lib.exception.SecurityException: SecurityException in method: run(). Message: Connection timed out: connect. To-String: java.net.ConnectException: Connection timed out: connect. To-String: com.sap.aii.security.lib.exception.SecurityException: SecurityException in method: apply( Message, CPALookupObject ). WSSEThread-Exception: SecurityException in method: run(). Message: Connection timed out: connect. To-String: java.net.ConnectException: Connection timed out: connect; To-String: com.sap.aii.security.lib.exception.SecurityException: SecurityException in method: run(). Message: Connection timed out: connect. To-String: java.net.ConnectException: Connection timed out: connect
Thanks & Regards,
Rahul Nawale

I agree
Try executing a Full CPA Cache refresh.

After AVG PC Tune up, software update message for security and stability update is available FireFox 3.6.18. Should I Update?

My Dell laptop (Operating on Windows XP) was hit with multiple viruses - I could not open Mozilla Firefox or any other applications for that matter. After much time and many attempts, I was finally able to install and run an AVG Scan and then an AVG PC Tune up. 4,559 problems found and repaired. After the repairs, I received the following message:
"Software Update - A security and stability update for Firefox is available: Firefox 3.6.18 - It is strongly recommended that you apply this update for Firefox as soon as possible. - an underlined link reading, "View more information about this update" and then 2 choices - "Ask Later" or "Update Firefox." Since part of the problem was with Firefox and some error messages pointed to that, I'm hesitant to click on any of the three options above. Can you help me to get past this error message, please. I am sending this from my home computer. Thank you. Diane

Sometimes the updater gets in a funny state - Go to http://www.mozilla.org/en-US/firefox/new/ and download the full installer. Close Firefox and run the installer

Message level security: difference digital signature and certificate

Hi everybody,
could anybody please explain the difference between digital signature and certificate?
Thans
Regards Mario

Mario,
A digital signature is an electronic signature that can be used to authenticate the identity of the sender of a message or the signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. Digital signatures are easily transportable, cannot be imitated by someone else, and can be automatically time-stamped. The ability to ensure that the original signed message arrived means that the sender cannot easily repudiate it later.
A digital signature can be used with any kind of message, whether it is encrypted or not, simply so that the receiver can be sure of the sender's identity and that the message arrived intact. A digital certificate contains the digital signature of the certificate-issuing authority so that anyone can verify that the certificate is real.
where as
A digital certificate is an electronic "credit card" that establishes your credentials when doing business or other transactions on the Web. It is issued by a certification authority (CA). It contains your name, a serial number, expiration dates, a copy of the certificate holder's public key (used for encrypting messages and digital signatures), and the digital signature of the certificate-issuing authority so that a recipient can verify that the certificate is real. Some digital certificates conform to a standard, X.509. Digital certificates can be kept in registries so that authenticating users can look up other users' public keys.
hope it helps u.
--Archana

Tab level security and customization privileges

Hi,
I've created a page that includes a tabbed region. I have given access to different tabs to different groups - when I do my demo, I'd like to show that we can secure data via tabs. This all works beautifully when my groups only have 'View Only' privileges. If I give the group 'Customization (Add Only)' privileges, when users of that group log into the page, they see ALL of the tabs, not just the ones their group has access to.
I am not sure this is the intended behavior, but please let me know if it is.
Thanks.

Nevermind...the trick is not the give the privilege at the Group level, but at the Page level. Works as expected. Thanks and sorry.
-melissa
<BLOCKQUOTE>quote:<HR>Originally posted by Melissa Blakeney ([email protected]):
Hi,
I've created a page that includes a tabbed region. I have given access to different tabs to different groups - when I do my demo, I'd like to show that we can secure data via tabs. This all works beautifully when my groups only have 'View Only' privileges. If I give the group 'Customization (Add Only)' privileges, when users of that group log into the page, they see ALL of the tabs, not just the ones their group has access to.
I am not sure this is the intended behavior, but please let me know if it is.
Thanks.<HR></BLOCKQUOTE>
null

Row-level security and Oracle9iAS

Hi!
Does anybody know how to use RLS in J2EE application with Oracle9iAS? Can you please help me with patterns, documentation and examples? Can not find anything on it.
I am using Oracle9iAS 9.0.3 and Oracle8i
Thanks a lot in advance!

Is this a requirement or an issue?
There are several options available you can use the inbuilt OBIEE security to append filters onto the tables.
I think the more elegant solution would be to attempt to use the database to apply the security (if you're using Oracle) - views and application contexts would be my preferred method.

Item Level Security and url not working

Hi,
I have a SharePoint 2010 web application for internal users with windows authentication that contains a infopath forms library with content approval enabled. This web application is extended as extranet for external sites and it's using forms authentication
and all the users are in a group that has read permissions. What we are doing is to create infopath files in the internal site and give permissions to certain groups so external users can access these infopath files from the external site.
Everything works fine we create a infopath form and its status is draft so users in the external site cannot see the files at that moment until the file is approved. If we remove the permissions from a group the user has not access to the item (file) in
the external site which is ok, the user can't see the file BUT if the user tries to access the file through the URL directly the user has access.
In conclusion the user has access to the item when its group is assigned to the permissions in the item and the user can see the file in the library.
If the group is removed from the item the user can't see the file in the library but the user can still access the file using the URL pointing to the infopath xml file directly.
It is worth to mention that we tested the same in a none content approval form library and users have not access using the URL.
I hope i explained myself correctly, any help would be much appreciated.

Does the library have versions enabled? Also are these logins occuring within word/excel etc?
If there's multiple login prompts which occur even if entering valid credentials what does hitting escape (after the first prompt) achieve, does the document open anyway?
There's a situation where Office will prompt for credentials if you open a document when you've only got read access but there's a version history (to which you don't have access). This is to allow you to enter more highly privelidged credentials if you
want to.

Message Level Security and Performance

Similar Messages

Maybe you are looking for