Fetching Security Materials in SAP CPI and Sending it as a PGP Encrypted CSV file via Email

[Daggolu_PremSai]

Introduction:

Managing credentials effectively is crucial in any integration landscape. SAP CPI provides Security Material to store authentication details such as UserCredentials, OAuth2ClientCredentials and SecureParameters. Manually handling these credentials can be risky and inefficient. 

In this blog, we will see how to automate credentials retrieval, encrypt the data with PGP and securely send it via email, ensuring compliance and data protection. Additionally we will also see how to decrypt file and view the original data.

Why is this use case Important?

• Secure Credential Management - Automates fetching credentials from SAP CPI Security Material.
• Data Protection - Ensures credentials are encrypted with PGP before sharing and logging.
• Compliance & Security - Prevents exposure of sensitive information in plain text or CSV and avoids the risk of storing credentials on local drives.

Prerequisites:

• Some credentials should be maintained in SAP CPI Security Material. i.e UserCredentials, OAuth2ClientCredentials, SecureParameters.
• PGP Public key must be uploaded in Security Material for encryption. please refer Blog for generation PGP keys using Kelopatra Tool.
• Corresponding PGP Private key should be available externally for decryption.
• SMTP Configuration for sending email. please refer Blog for SMTP Gmail setup.
• CPI OAuth credentials should be configured to fetch the Security Material details from API.

Integration Flow Overview:

To automate secure credential retrieval and transfer, this iflow performs the following key actions:

1. Fetch credentials name from SAP CPI Security material using HTTP.

2. Fetch password, client secret, secure parameter from the Secure Storage and format it as XML payload using groovy script.

3. Convert XML to CSV for easy readability.

4. Encrypt the CSV data using PGP and Log encrypted payload if required.

5. Send the encrypted payload as attachment via mail.

Download Integration flow from the Git : link 

• Download the Security Material Export with PGP Encryption.zip from the Git.
• Upload it in CPI
• Go to configure and update below parameters.

Receiver CPI:

Authentication	Basic / OAuth2 Client Credentials
Credential Name	Name defined in the Security Material for CPI

Receiver Mail:

Credential Name	Name defined in the Security Material for Mail
From	From Mail ID
To	To Mail ID
CC	Optional

More All Parameters:

Log File as Attachment	set value as 'true', if you want to log the encrypted payload as attachment in the monitoring logs
PGP Public Key	User ID of public key configured in Monitor > PGP Keys section
Tenant URL	URL of CPI tenant by removing https:// <--->.com, refer below screenshot.

Click on save and Deploy the iFlow.

Result:

Go to Monitor Message Processing and check the Attachments (CredentialDetails) created.

PGP Encrypted data

Check you mail inbox:

Attached file contains encrypted data.

Decrypt the file data using Online tool.

(you use can any PGP tool to decrypt)

1. Encrypted text in the file
2. Generated PGP Secret key 
3. Passphrase used while creating PGP key
4. Decrypted CSV text - we can see header column

Conclusion:

This blog covered how to securely fetch credentials from CPI Security material, encrypt them using PGP and send them via email. This approach enhances security and ensures compliance.

Let me know your thoughts or if you have any questions drop a comment below!

Happy Integrating!