HTTP Inbound Connections

[former_member204161]

Hi SAP Experts ,

We are implementing Security recommendations by converting all SAP URLS to HTTPS. We have many connections that are direct (not via integration platform) and do not have a complete picture of all applications calling SAP ECC (via message server)

Two queries related to this :

1. Can we activate any tracing to find what are the inbound HTTP calls to SAP ERP . I didn't find these log by default in ICM logs

2. We wants to convert all SICF services to HTTPS . By changing the root , we find that the child services do not get changed . Is there any way to mass change all services ?

Thanks for your help!

Regards,

Shaswat

[cris_hansen]

Hello Shaswat,

You can use the ICM trace (dev_icm) trace file to have more details:
- increase the trace level to 2;
- set icm/trace_secured_data = 1.

AFAIK, there is no mass-update tool for SICF. But you should consider HTTPURLLOC instead.

Regards,
Cris

[former_member204161]

Will increasing the trace level capture the source of the request ? I did not see that in SAP Help .

Regarding HTTPURLLOC yes it helps when a URL is to be generated by an ABAP program . Here my intent is to have the standard SAP services (as defined in SICF) require HTTPS by default . For example, all BSPs in the system to require secure HTTPS by changing the root node but that does not work . I was expecting a change in the root SICF node to be inherited but that doesnt seem to be the case

Regards,

Shaswat

[cris_hansen]

Hi Shaswat,

The dev_icm will show you from where the request is coming from. If you increase the trace level you can see the HTTP header, so you will know the service being called.

Changes in the root element will only be inherited if "use Global Settings" is used in every single ICF service, which is not the case. An example:

Regards,

Cris

[dasistdochscheisse]

Cant't that be done by redirecting the http-Port to https in the instance profile?

[former_member204161]

Hi Ulf ,

Thanks for your reply and good suggestion . It solves the problem only partially .

All the requests would get re-directed to HTTPS URL, but the SICF service itself continues to run in HTTP mode.

Will this work or be applicable if the target itself (the SICF service) does not require HTTPS ?

Regards,

Shaswat

[Isaias_SAP]

Hello shaswat.c ,

There would be no issues if an incoming connection is HTTPS and the SICF service is not requiring HTTPS.

The request would continue to be processed through HTTPS.

Regards,

Isaías

[Isaias_SAP]

Hello Shaswat,

Another option is to use the ICM log file.

It would be much easier to analyze then an ICM level 2 trace :-).

You could use a custom log format with "%j":

Regards,

Isaías