{"type":"doc","content":[{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":66.66},"content":[{"type":"paragraph","content":[{"text":"Datavard Java connector is a component facilitating both authentication and communication with remote services using JDBC drivers. It runs as an independent OS process and can be configured and controlled through transaction ","type":"text"},{"text":"/DVD/JCO_MNG","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"layoutColumn","attrs":{"width":33.33},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"children","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"114af1f4-28c3-495d-9497-fe8d0b361f1c"},"schemaVersion":{"value":"2"},"title":"Children Display"}}}}]}]},{"type":"paragraph"},{"type":"mediaSingle","attrs":{"layout":"align-start","width":91.0},"content":[{"type":"media","attrs":{"width":941,"id":"647acc9b-9f6a-47a3-8b4d-3dad5fdfb6dc","collection":"contentId-2855045959","type":"file","height":315}}]},{"type":"paragraph","content":[{"text":"/DVD/JCO_MNG","type":"text","marks":[{"type":"code"}]},{"text":" allows you to link the Datavard Java connector with the SAP RFC destination which will be used as a communication channel between SAP and JCo and maintain the settings. After all required fields are filled and saved, you can click the Restart button to start the Java service. When the Java process is running, you can control it across the application servers and display logs.","type":"text"}]},{"type":"paragraph"},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"6d5b3856-ea1a-4950-84eb-b2d6ff7dc87b"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}}}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Setup","type":"text"}]},{"type":"paragraph","content":[{"text":"This component requires an initial setup to be fully functional.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Java runtime environment ","type":"text"}]},{"type":"paragraph","content":[{"text":"An up-to-date Java runtime must be available to the SAP's adm user. Datavard Java connector is tested and built using OpenJDK 11.","type":"text"},{"type":"hardBreak"},{"text":"The latest OpenJDK JRE can be downloaded from ","type":"text"},{"text":"https://jdk.java.net/15/","type":"text","marks":[{"type":"link","attrs":{"href":"https://jdk.java.net/15/"}}]},{"text":". ","type":"text"},{"type":"hardBreak"},{"text":"Not to interfere with possible Java installation already present on the SAP application server, the archive can be unpacked into a non-default directory, e.g. ","type":"text"},{"text":"/sapmnt//global/","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"},{"type":"hardBreak"},{"text":"In the case of AIX systems, OpenJDK is not available, but standard IBM Java should be usable. Download and installation link:","type":"text"},{"type":"hardBreak"},{"text":"https://www.ibm.com/support/pages/ibm-java-aix-howto-install-or-upgrade-ibm-java-specific-release-eg-service-refresh-or-fix-pack","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.ibm.com/support/pages/ibm-java-aix-howto-install-or-upgrade-ibm-java-specific-release-eg-service-refresh-or-fix-pack"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"SAP Java Connector library","type":"text"}]},{"type":"paragraph","content":[{"text":"SAP Java Connector 3.0 library ","type":"text"},{"text":"libsapjco3.so","type":"text","marks":[{"type":"strong"}]},{"text":", which can be downloaded from the SAP marketplace, needs to be uploaded to the SAP application server. It should be located in the directory referenced by the ","type":"text"},{"text":"LD_LIBRARY_PATH","type":"text","marks":[{"type":"code"}]},{"text":" environment variable of adm user.","type":"text"}]},{"type":"paragraph","content":[{"text":"It is recommended to append a shared Datavard directory ","type":"text"},{"text":"/sapmnt//global/security/dvd_conn","type":"text","marks":[{"type":"code"}]},{"text":" to ","type":"text"},{"text":"LD_LIBRARY_PATH","type":"text","marks":[{"type":"code"}]},{"text":" variable defined by SAP instance profile and place libsapjco3.so to this directory.","type":"text"},{"type":"hardBreak"},{"text":"Otherwise, it can be copied directly into the SAP kernel directory, which is by default included in ","type":"text"},{"text":"LD_LIBRARY_PATH","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"},{"type":"hardBreak"},{"text":"NOTE: If you copy the library into the SAP kernel directory, you must ensure the library will be preserved during each SAP kernel upgrade.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"initial","rowspan":1,"colwidth":[760.0]},"content":[{"type":"codeBlock","content":[{"text":"$ echo $LD_LIBRARY_PATH\n/usr/sap/DVQ/SYS/exe/run:/usr/sap/DVQ/SYS/exe/uc/linuxx86_64:/usr/sap/DVQ/hdbclient:/sapmnt/DVQ/global/security/dvd_conn\n \n/sapmnt/DVQ/global/security/dvd_conn/ # ls -l libsapjco3.so\n-rwxr-x--- 1 dvqadm sapsys 59 Apr 5 15:12 libsapjco3.so","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"SAP RFC role and user","type":"text"}]},{"type":"paragraph","content":[{"text":"Datavard Java connector uses a dedicated user in the SAP system for communication. This user should be created with the type 'Communications Data' and with authorizations limiting his privileges to basic RFC communication.","type":"text"}]},{"type":"paragraph","content":[{"text":"The required authorization object is S_RFC with these settings:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ACTVT = 16","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RFC_NAME = SYST, RFC1, SDIFRUNTIME","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RFC_TYPE = FUGR","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Example of custom SAP role in PFCG transaction (Display Authorization Data):","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":80.0},"content":[{"type":"media","attrs":{"width":898,"id":"3396f1e5-8dc5-4a70-8815-36dc42237503","collection":"contentId-2855045959","type":"file","height":182}}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Java RFC","type":"text"}]},{"type":"paragraph","content":[{"text":"Java RFC by name refers to the Datavard Java service which is used for authentication and communication with other services.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":65.0},"content":[{"type":"media","attrs":{"width":653,"id":"7a9845fc-4c9e-4100-8c59-382c5f6fff15","collection":"contentId-2855045959","type":"file","height":785}}]},{"type":"paragraph","content":[{"text":"Entries explained:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Connection Type","type":"text","marks":[{"type":"strong"}]},{"text":" – T for TCP/IP Connection","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Activation Type","type":"text","marks":[{"type":"strong"}]},{"text":" – select Registered Server Program","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Program ID","type":"text","marks":[{"type":"strong"}]},{"text":" – DATAVARD_JAVA_CONN","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"SAP gateway access","type":"text"}]},{"type":"paragraph","content":[{"text":"External communication with the SAP system goes through the SAP gateway. If SAP system parameter gw/acl_mode is enabled, there are two files (secinfo and reginfo) that limit the access.","type":"text"}]},{"type":"paragraph","content":[{"text":"In this case, a program needs to have granted access either by wildcard definition or explicitly defining the program registration name:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"DATAVARD_JAVA_CONN","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"More information on the SAP gateway ACL topic can be found on the SAP website ","type":"text"},{"text":"Gateway Security Files secinfo and reginfo","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://help.sap.com/saphelp_nw73/helpdata/en/e2/16d0427a2440fc8bfc25e786b8e11c/content.htm?no_cache=true"}}]},{"text":".","type":"text","marks":[{"type":"em"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"/DVD/JCO_MNG initial setup","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the latest JCo version by double-clicking the row on the left side of the screen","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Switch to Edit mode","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Fill default values” ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Adjust values you want to change","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Config","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":60.0},"content":[{"type":"media","attrs":{"width":581,"id":"2f022eef-1da3-4c46-8f95-59a4c81fbaa1","collection":"contentId-2855045959","type":"file","height":263}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Client - ","type":"text","marks":[{"type":"strong"}]},{"text":"the client of SAP technical user used to register on SAP gateway","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RFC User - ","type":"text","marks":[{"type":"strong"}]},{"text":"username of SAP technical user used to register on SAP gateway","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Password - ","type":"text","marks":[{"type":"strong"}]},{"text":"hashed password of SAP technical user used to register on SAP gateway. The hash can be created by typing the password in the field below and clicking the 'Hash' button","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Install directory - ","type":"text","marks":[{"type":"strong"}]},{"text":"directory on the application server where the application and log files will be generated - can be a physical path or a logical path enclosed in <>, default path can be used. After changing this value, you have to click the 'Generate paths' button, which will propagate new path structure to the rest of the configuration (as can be seen in the Advanced tab)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Java exe - ","type":"text","marks":[{"type":"strong"}]},{"text":"the path to Java executable on the SAP application server","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Java vendor - ","type":"text","marks":[{"type":"strong"}]},{"text":"Name of Java vendor, ORACLE or IBM (for SAP JVM, or OpenJDK, fill ORACLE)","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Dependencies","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":70.0},"content":[{"type":"media","attrs":{"width":609,"id":"5690c143-de17-494c-9342-d7902c3f3264","collection":"contentId-2855045959","type":"file","height":273}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"select a library that you want to use with JCO. The base library must always be selected. In case the connection to AWS or GCP is required, a library supporting such a platform needs to be selected.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In case the needed library is missing, please contact the Datavard representative for further instructions on how to load the library to the system.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Advanced","type":"text"},{"type":"hardBreak"},{"text":"In most scenarios, these settings don’t need to be changed.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"thatOS Command for starting java service - ","type":"text","marks":[{"type":"strong"}]},{"text":"name of an OS command for starting Java service (SM69)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OS Command for setting access permissions - ","type":"text","marks":[{"type":"strong"}]},{"text":"name of an OS command for setting execution rights (SM69)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Max RAM used - ","type":"text","marks":[{"type":"strong"}]},{"text":"maximum amount of RAM used by Java service (heap size)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Additional java starting arguments - ","type":"text","marks":[{"type":"strong"}]},{"text":"additional arguments used to start Java service","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Repository destination - ","type":"text","marks":[{"type":"strong"}]},{"text":"client destination from which repository should be obtained","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Work thread MIN - ","type":"text","marks":[{"type":"strong"}]},{"text":"number of threads Java service always runs with","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Work thread MAX - ","type":"text","marks":[{"type":"strong"}]},{"text":"maximum number of threads that can be used by Java service","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Connection count - ","type":"text","marks":[{"type":"strong"}]},{"text":"number of connections registered at SAP gateway","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Peak limit - ","type":"text","marks":[{"type":"strong"}]},{"text":"limit of JCo connections at peak","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log4j log level - ","type":"text","marks":[{"type":"strong"}]},{"text":"level of messages collected in logs","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log4j log deletion - ","type":"text","marks":[{"type":"strong"}]},{"text":"how long the logs should be archived","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"JAR path - ","type":"text","marks":[{"type":"strong"}]},{"text":"the path where the JAR file will be created","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Server config path - ","type":"text","marks":[{"type":"strong"}]},{"text":"the path where the server config will be created","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Destination config path - ","type":"text","marks":[{"type":"strong"}]},{"text":"the path where the destination config will be created","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log files path - ","type":"text","marks":[{"type":"strong"}]},{"text":"a directory where the log files will be saved","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log4j config path - ","type":"text","marks":[{"type":"strong"}]},{"text":"the path where the log4j config file will be created","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to the 'General' tab and assign an RFC to the Java connector","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":70.0},"content":[{"type":"media","attrs":{"width":669,"id":"b12f669b-49b1-4144-b888-1c94403d0fc5","collection":"contentId-2855045959","type":"file","height":253}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RFC Usage - ","type":"text","marks":[{"type":"strong"}]},{"text":"Defines an RFC that points to this Java application.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the settings","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start the Java service by clicking the 'Restart' button","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":70.0},"content":[{"type":"media","attrs":{"width":657,"id":"0ab55d7f-c3fc-4ba3-afc1-d488b4065d0d","collection":"contentId-2855045959","type":"file","height":249}}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The Java service is started with a system command. You can adjust the name of this command in the table Advanced tab. The default name of the command is ZDVD_START_JAVA. In the case the system command doesn't exist, it is created automatically. You can view the system commands through the transaction SM69. On Linux, another system command is required, which sets executable rights for the configuration files (chmod 755 ). Its name can be adjusted in the Advanced tab.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The following authorizations are required for the automatic start of the Java process:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"S_RFC_ADM (Administration for RFC Destination): ACTVT = 03, RFCTYPE = * , RFCDEST = , ICF_VALUE = * ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"S_DATASET (Authorization for file access): PROGRAM =/DVD/*, ACTVT = *, FILENAME = * ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"S_LOG_COM (Authorization to Execute Logical Operating System Commands): COMMAND = ZDVD*, OPSYSTEM = * , HOST = * ","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Management of JCO config versions (upload/download) also requires S_GUI (Authorization for GUI activities) with ACTVT = 61,60","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Central Java instance","type":"text"}]},{"type":"paragraph","content":[{"text":"It is possible to have a single Java connector running, instead of running one on every application server. To set such a scenario, follow these steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the Java connector is already running on several application servers, stop all instances.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":70.0},"content":[{"type":"media","attrs":{"width":674,"id":"89e4a423-3095-4c44-b7c9-dc32e735fbae","collection":"contentId-2855045959","type":"file","height":83}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the Java RFC destination and fill the Gateway options valid for the desired instance","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":55.0},"content":[{"type":"media","attrs":{"width":555,"id":"a042f35e-4e3e-42a7-befa-b5ad0e916dbd","collection":"contentId-2855045959","type":"file","height":784}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When you restart transaction ","type":"text"},{"text":"/DVD/JCO_MNG","type":"text","marks":[{"type":"code"}]},{"text":", only buttons belonging to the desired application server should be functional and all the other app. servers should be using this connection. Start the connector and all rows in the ","type":"text"},{"text":"Connection","type":"text","marks":[{"type":"code"}]},{"text":" column should be green.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":70.0},"content":[{"type":"media","attrs":{"width":659,"id":"1a8afa08-76f9-461b-b196-9e7d81fe0833","collection":"contentId-2855045959","type":"file","height":250}}]},{"type":"paragraph"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"SNC configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"If the SAP system is hardened by enabled Secured Network Communication (system parameter ","type":"text"},{"text":"snc/enable = 1","type":"text","marks":[{"type":"em"}]},{"text":"), there are additional configuration steps.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The first step is the creation of a Personal Security Environment (PSE) for Datavard JCo. This is to be done under ","type":"text"},{"text":"adm","type":"text","marks":[{"type":"strong"}]},{"text":" user. PSE should be stored together with other SAP PSE files, by default on path ","type":"text"},{"text":"/usr/sap///sec","type":"text","marks":[{"type":"strong"}]},{"text":", referenced by environment variable ","type":"text"},{"text":"$SECUDIR","type":"text","marks":[{"type":"strong"}]},{"text":". Commands to create the PSE, with an example of system ID NSZ with csh as nszadm’s shell:","type":"text"},{"type":"hardBreak"},{"text":"su - nszadm","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"setenv SECUDIR /usr/sap/NSZ/D00/sec","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"cd $SECUDIR","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"sapgenpse gen_pse -v -p DVDJCO.pse","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"type":"hardBreak"},{"text":"PSE can be optionally protected by a passphrase. The mandatory input parameter is the Distinguished name of the PSE owner, in our example, it’s ","type":"text"},{"text":"CN=JCO_RFC, OU=DVD, C=DE","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"nsz:nszadm 98> sapgenpse gen_pse -v -p DVDJCO.pse\nGot absolute PSE path \"/usr/sap/NSZ/D00/sec/DVDJCO.pse\".\nPlease enter PSE PIN/Passphrase:\nPlease reenter PSE PIN/Passphrase:\n!!! WARNING: For security reasons it is recommended to use a PIN/passphrase\n!!! WARNING: which is at least 8 characters long and contains characters in\n!!! WARNING: upper and lower case, numbers and non-alphanumeric symbols.\n\nget_pse: Distinguished name of PSE owner: CN=JCO_RFC, OU=DVD, C=DE\n Supplied distinguished name: \"CN=JCO_RFC, OU=DVD, C=DE\"\n Creating PSE with format v2 (default)\n succeeded.\n certificate creation... ok\n PSE update... ok\n PKRoot... ok\nGenerating certificate request... ok.\nCertificate Request:\n Signed Part:\n Subject: CN=JCO_RFC, OU=DVD, C=DE\n Key: rsaEncryption (2048 bits)\n Attributes: None\n Signature:\n Signature algorithm: sha256WithRsaEncryption (1.2.840.113549.1.1.11)\n Signature: \n\nPKCS#10 certificate request for \"/usr/sap/NSZ/D00/sec/DVDJCO.pse\":\n\n-----BEGIN CERTIFICATE REQUEST-----\nMIICcjCCAVoCAQAwLTELMAkGA1UEBhMCREUxDDAKBgNVBAsTA0RWRDEQMA4GA1UE\n################################################################\n################################################################\n################################################################\nPxmDNQSCYvLxURXcP+vQxDSOq5QYgQf4g4egjVXRcyQwOJNZRpHlP1olXc4Aa675\n-----END CERTIFICATE REQUEST-----\nnsz:nszadm 99>","type":"text"}]},{"type":"paragraph"}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The second step is to export the certificate with the public key from newly created PSE, using the command:","type":"text"},{"type":"hardBreak"},{"text":"sapgenpse export_own_cert -v -p DVDJCO.pse -o DVDJCO.crt","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"This produces a DVDJCO.crt file.","type":"text"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"nsz:nszadm 99> sapgenpse export_own_cert -v -p DVDJCO.pse -o DVDJCO.crt\n\n Opening PSE \"/usr/sap/NSZ/D00/sec/DVDJCO.pse\"...\n No SSO credentials found for this PSE.\n PSE (v2) open ok.\n Retrieving my certificate... ok.\n Writing to file (PEM-framed base64-encoded)... ok.\n\nnsz:nszadm 100>","type":"text"}]},{"type":"paragraph"}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Now import DVD JCo certificate file into SAP system’s Trust manager. ","type":"text"},{"type":"hardBreak"},{"text":"Run transaction ","type":"text"},{"text":"STRUST","type":"text","marks":[{"type":"strong"}]},{"text":" → switch to ","type":"text"},{"text":"Edit","type":"text","marks":[{"type":"strong"}]},{"text":" mode → double-click ","type":"text"},{"text":"SNC PSE node","type":"text","marks":[{"type":"strong"}]},{"text":" → in the lower part of the screen click on ","type":"text"},{"text":"Import certificate","type":"text","marks":[{"type":"strong"}]},{"text":" icon, locate the certificate file, confirm file selection → click ","type":"text"},{"text":"Add to Certificate List","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Save","type":"text","marks":[{"type":"strong"}]},{"text":" (Ctrl+S)","type":"text"},{"type":"hardBreak"},{"text":"NOTE: You may need to download the certificate file to your frontend to be able to select it.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":1250,"id":"5995ef7e-605a-4816-966c-010628674cf1","collection":"contentId-2855045959","type":"file","height":905}}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"We have imported the JCo certificate to SAP. To create two-way trust between SAP and JCo, now we need to import the SAP system’s certificate to JCo PSE.","type":"text"},{"type":"hardBreak"},{"text":"Export SAP’s own certificate, similarly as in step 3. run ","type":"text"},{"text":"STRUST","type":"text","marks":[{"type":"strong"}]},{"text":" select ","type":"text"},{"text":"SNC PSE node","type":"text","marks":[{"type":"strong"}]},{"text":", but double-click on ","type":"text"},{"text":"Own certificate","type":"text","marks":[{"type":"strong"}]},{"text":" and in the bottom of the screen click icon ","type":"text"},{"text":"Export certificate","type":"text","marks":[{"type":"strong"}]},{"text":". Choose ","type":"text"},{"text":"Base64","type":"text","marks":[{"type":"strong"}]},{"text":" format, path, and filename to save the .crt file. Upload the file to the application server, ideally to ","type":"text"},{"text":"$SECUDIR","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"},{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To import SAP certificate to JCo PSE, run command:","type":"text"},{"type":"hardBreak"},{"text":"sapgenpse maintain_pk -v -a SAP.crt -p DVDJCO.pse","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"nsz:nszadm 104> sapgenpse maintain_pk -v -a NSZ.crt -p DVDJCO.pse\n\n Opening PSE \"/usr/sap/NSZ/D00/sec/DVDJCO.pse\"...\n No SSO credentials found for this PSE.\n PSE (v2) open ok.\n retrieving PKList\n Adding new certificate from file \"NSZ.crt\"\n----------\nSubject : CN=NSZ, OU=DVD, C=DE\nIssuer : CN=NSZ, OU=DVD, C=DE\nSerialno : 0A:20:21:01:24:10:44:01\nKeyInfo : RSA, 2048-bit\nValidity - NotBefore: Sun Jan 24 11:44:01 2021 (210124104401Z)\n NotAfter: Fri Jan 1 01:00:01 2038 (380101000001Z)\nKeyUsage : none\nExtKeyUsage : none\nSubjectAltName : none\n----------------------------------------------------------------------------\n\n PKList updated (1 entries total, 1 newly added)\n\nnsz:nszadm 105>","type":"text"}]},{"type":"paragraph"}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To allow JCo running under adm user using the credentials stored in the PSE, SSO credentials need to be created in the ","type":"text"},{"text":"cred_v2","type":"text","marks":[{"type":"strong"}]},{"text":" file.","type":"text"},{"type":"hardBreak"},{"text":"It is advised to back up the cred_v2 file before proceeding.","type":"text"},{"type":"hardBreak"},{"text":"The file should already exist in ","type":"text"},{"text":"SECUDIR","type":"text","marks":[{"type":"strong"}]},{"text":" and will be updated using the command:","type":"text"},{"type":"hardBreak"},{"text":"sapgenpse seclogin -p DVDJCO.pse -O nszadm","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"nsz:nszadm 105> cp -p cred_v2 cred_v2.bkp\nnsz:nszadm 106> sapgenpse seclogin -p DVDJCO.pse -O nszadm\n\n running seclogin with USER=\"nszadm\"\n creating credentials for yourself (USER=\"nszadm\")...\n Added SSO-credentials for PSE \"/usr/sap/NSZ/D00/sec/DVDJCO.pse\"\n\nnsz:nszadm 107>","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Available SSO credentials can always be checked using the command:","type":"text"},{"type":"hardBreak"},{"text":"sapgenpse seclogin -l","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Now that the security environment is prepared, configure JCo SNC in transaction ","type":"text"},{"text":"/DVD/JCO_MNG","type":"text","marks":[{"type":"strong"}]},{"text":" as follows:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":918,"id":"048349f9-7167-49e0-ac04-806a7bc6f333","collection":"contentId-2855045959","type":"file","height":609}}]},{"type":"paragraph"},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SNC enabled","type":"text","marks":[{"type":"strong"}]},{"text":" - once activated, user and password fields will be greyed out and have no effect on JCo configuration","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SNC QoP Level","type":"text","marks":[{"type":"strong"}]},{"text":" - SNC Quality of Protection, needs to be the same level as set in system parameter ","type":"text"},{"text":"snc/data_protection/use","type":"text","marks":[{"type":"em"}]},{"text":" (default = 3)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"JCo SNC name","type":"text","marks":[{"type":"strong"}]},{"text":" - Distinguished name chosen during the creation of JCo PSE (step 1.)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SNC enabled GW port","type":"text","marks":[{"type":"strong"}]},{"text":" - SAP gateway port used for secure communication. Default port number is ","type":"text"},{"text":"48$$","type":"text","marks":[{"type":"strong"}]},{"text":", $$ being instance number","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SNC partner name ","type":"text","marks":[{"type":"strong"}]},{"text":"- Distinguished name of SAP system, pre-filled from SAP profile parameter ","type":"text"},{"text":"snc/identity/as","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"type":"hardBreak"},{"text":"Save the configuration when completed, but do not start the JCo yet.","type":"text"},{"type":"hardBreak"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"There are two more configuration pieces to complete before JCo can properly start-up and register on SAP gateway.","type":"text"},{"type":"hardBreak"},{"text":"In ","type":"text"},{"text":"SU01","type":"text","marks":[{"type":"strong"}]},{"text":", activate SNC for ","type":"text"},{"text":"RFC user","type":"text","marks":[{"type":"strong"}]},{"text":" dedicated for JCo communication, filling ","type":"text"},{"text":"SNC name","type":"text","marks":[{"type":"strong"}]},{"text":" dedicated to JCo.","type":"text"},{"type":"hardBreak"},{"text":"Despite the user no longer being configured in /DVD/JCO_MNG, it is used by matching the SNC name entered here and the Distinguished name configured in JCo PSE. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":643,"id":"a95132ac-292b-4f66-975a-c2667a5165bf","collection":"contentId-2855045959","type":"file","height":352}}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Secondly, via ","type":"text"},{"text":"SM59","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"activate SNC ","type":"text","marks":[{"type":"strong"}]},{"text":"in RFC destination dedicated to communication between SAP and JCo and fill JCo distinguished name again in ","type":"text"},{"text":"Logon & Security","type":"text","marks":[{"type":"strong"}]},{"text":" tab (SNC options button):","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":1251,"id":"d6278c81-7511-415e-b5bf-f88426c96d7d","collection":"contentId-2855045959","type":"file","height":740}}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Having all SNC prerequisites met, Datavard Java Connector can be started.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Sample JCo configuration files with SNC enabled","type":"text"}]},{"type":"codeBlock","content":[{"text":"nsz:/usr/sap/NSZ/D00/work/dvd_conn/jco217 # cat config.jcoServer\nversion=217\njco.server.gwhost=127.0.0.1\njco.server.gwserv=4800\njco.server.connection_count=10\njco.server.progid=DATAVARD_JAVA_CONN\njco.server.repository_destination=ABAP_AS_WITH_POOL\njco.server.worker_thread_min_count=5\njco.server.worker_thread_count=20\njco.server.snc_mode=1\njco.server.snc_qop=3\njco.server.snc_myname=p:CN=JCO_RFC, OU=DVD, C=DE\njco.server.snc_lib=/sapmnt/NSZ/exe/uc/linuxx86_64/libsapcrypto.so\n\nnsz:/usr/sap/NSZ/D00/work/dvd_conn/jco217 # cat config_as.jcoDestination\njco.client.client=001\njco.client.sysnr=00\njco.client.peak_limit=10\njco.client.ashost=127.0.0.1\njco.client.snc_mode=1\njco.client.snc_qop=3\njco.client.snc_myname=p:CN=JCO_RFC, OU=DVD, C=DE\njco.client.snc_partnername=p:CN=NSZ,OU=DVD,C=DE\njco.client.snc_lib=/sapmnt/NSZ/exe/uc/linuxx86_64/libsapcrypto.so","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Upgrading Java connector","type":"text"}]},{"type":"paragraph","content":[{"text":"This is a list of steps to do when you update your Datavard software and you would like to switch to a new version of Java connector. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open transaction ","type":"text"},{"text":"/DVD/JCO_MNG","type":"text","marks":[{"type":"code"}]}]},{"type":"mediaSingle","attrs":{"layout":"center","width":95.0},"content":[{"type":"media","attrs":{"width":1072,"id":"0fc2c3d5-7c34-4d8a-99c0-6adf8b44892d","collection":"contentId-2855045959","type":"file","height":300}}]},{"type":"paragraph"}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Double-click the current working connector and click ","type":"text"},{"text":"Copy config","type":"text","marks":[{"type":"code"}]}]},{"type":"mediaSingle","attrs":{"layout":"center","width":95.0},"content":[{"type":"media","attrs":{"width":1069,"id":"8c52d670-8787-445d-a4b2-5b568e72e266","collection":"contentId-2855045959","type":"file","height":262}}]},{"type":"paragraph"}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Double-click the latest connector, enter ","type":"text"},{"text":"Edit mode","type":"text","marks":[{"type":"code"}]},{"text":", then click ","type":"text"},{"text":"Paste config","type":"text","marks":[{"type":"code"}]},{"text":", then fill the ","type":"text"},{"text":"RFC Usage","type":"text","marks":[{"type":"code"}]},{"text":" field with the same RFC that was used with the old connector","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":95.0},"content":[{"type":"media","attrs":{"width":1064,"id":"f85214a0-3704-4320-9d61-73d0cfac61de","collection":"contentId-2855045959","type":"file","height":268}}]},{"type":"paragraph"}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Switch to the ","type":"text"},{"text":"Dependencies","type":"text","marks":[{"type":"code"}]},{"text":" tab and make sure you are using the latest libraries for your connector","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":95.0},"content":[{"type":"media","attrs":{"width":967,"id":"04f3fdd3-9094-43c5-a855-ad4ac881db04","collection":"contentId-2855045959","type":"file","height":229}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Switch back to the ","type":"text"},{"text":"General","type":"text","marks":[{"type":"code"}]},{"text":" tab and click ","type":"text"},{"text":"Restart","type":"text","marks":[{"type":"code"}]},{"text":" for every Application server","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":95.0},"content":[{"type":"media","attrs":{"width":1066,"id":"676e580d-9179-40f8-9f64-031613310e8a","collection":"contentId-2855045959","type":"file","height":294}}]},{"type":"paragraph"}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Restarting the connector can cause running Glue/Outboard jobs to fail. Either do the Restart the connector in quiet hours or make sure you re-run the failed jobs.","type":"text"}]}]}],"version":1}

Browser not supported