Certificate Expire Notifications Alert in SAP Cloud Integration - iFlow

[Sathish_Kumar_BP]

Dear Readers,

This blog gives you insights into creating an iFlow for Automate Notifications of Expiring Certificates in the SAP Cloud Integration (CI) system. As we all know, there is no built-in solution to notify or provide details on certificate monitoring in the CI system.

SAP is also offering a solution for monitoring various components (like JMS Queues, Certificates, Health check etc…) through SAP Cloud ALM.

However, I have developed a simple iFlow to retrieve expiring certificate details from the CI system and send a notification via email with an attachment. This way, you can take timely action to renew certificates by coordinating with customers or partners.

Follow the steps below to get email alerts for your expiring Keystore entries:

1. Timer Setup:
   Use the timer to initiate the flow. Schedule it based on your convenience (e.g., weekly, or monthly). The timer will trigger the flow according to the schedule you define.
2. Request-Reply:
   This is used to connect to the SAP CI system via OData and retrieve all Keystore details in XML format.
3. OData Connection Setup:
   Use the following tenant URL format to connect to your SAP CI system: https://<your-tenant-id>.cfapps.<region>.hana.ondemand.com/api/v1

   Since our Integration Suite is hosted on Cloud Foundry, it required to use OAuth2 Authentication. Make sure to select the appropriate resource path and set the query options as needed.

   

4. Content Modifier:
   Use the Content Modifier to set the content type to application/xml.

5. Message Mapping:
   The data retrieved from the Keystore contains certificate details. Based on this, create the source XSD. You can design the target XSD as per your requirements and import it into the mapping. Also I have created a Groovy script to calculate the time difference and filtering the data in graphical mapping to extracting only the certificates that are expiring within the next 90 days.
   

6. XML to CSV Converter:
   Since the certificate details need to be sent as an attachment via email, I have used the XML to CSV Converter to transform the data into a CSV format for easy readability and inclusion in the email attachment.

   

7. Mail adapter setup: Configure the Mail Adapter to send the notification email maintain the body and attachment as below:

   

8. Received Mail Notification with attachment.

   

   --------------------------------------------------------------------------------------------------------------------------------------

Additional Information:

If you face any issue during OData configuration for resource path - Please check below.

Follow the steps below:

• The system requires the "metadata" to set up the resource path.
• When attempting to fetch the metadata during configuration, the connection fails because the authentication mechanism only supports Basic Authentication in the dropdown.
• To resolve this issue:
1. Copy the Address/URL of the metadata.
2. Use Postman to retrieve the metadata.
3. Save the metadata in EDMX format.
4. Upload the EDMX file, select the relevant Entity and fields, and finish.

-----------------------------------------------------------------------------------------------------------------------------

Below is API reference URL we can play around.

https://api.sap.com/api/SecurityContent/resource/Keystore_Entry

I hope this provides valuable insights into Keystore certificate expire notification configure and OData connection setup.

Thank you for your time.

Regards,

Sathish Kumar BP