In SCC is Obligatory replace the default UI Certificate for Principal propagation?

[yerlan1]

Hello Community.

I enable the principal propagation through the following steps:

1. Configuration of the Cloud Connector

a. Update the principal type of the Access Control

b. Set up a trust with the identity provider

c. Export the system certificate so that you can import it in the backend system later on

d. Configure the CA certificate for the short-living certificate

e. Adapt the subject pattern for principal propagation

f. Generate a sample certificate in order to import it in the backend.

2. Configuration of the on-premise backend system

a. Import the system certificate of the Cloud Connector to establish trust

b. Configure the Internet Communication Manager (ICM) to ensure the communication to the outside world.

c. Set the view VUSREXTID.

3. Update of the destination in SAP Cloud Platform

a. Change the authentication type of the destination to “Principal Propagation”

My question is with point 3 of the configuration in the Cloud Conector is Obligatory replace the default UI Certificate for Principal propagation.

I use the UI certificate by default and I have a problem in validating the certificate in ECC.

[former_member213660 · Accepted solution]

Hi Yerlan

Take a look at this blog post: https://blogs.sap.com/2017/06/22/how-to-guide-principal-propagation-in-an-https-scenario/

You can use a self-signed certificate for the system certificate and re-use the same one as UI certificate if you want to.

For the principal propagation, the certificate used will be the CA certificate, and you need to make sure to enable the trust between the SCC and the backend system (as described in the blog post).

As your system does not have the CERTRULE transaction, you need to perform the manual mapping, so you can add the entries to the VUSREXTID using the EXTID_DN transaction.

Let me know your advances.

Augusto

[yerlan1 · Accepted solution]

Hi Augusto.

We made the adjustments according to the blog that you indicated to me and it worked perfectly.

Thank you very much.

[gregorw]

The UI Certificate doesn't have an influence in the Principal Propagation setup. But you sill should replace it with a valid certificate matching the FQDN of your Cloud Connector to avoid browser warnings.

What I'm missing in step 2 of your description are the profile parameters that need to be set to trust the system certificate. Instead of using VUSREXTID I would suggest to use Rule-based Mapping of Certificates.

[yerlan1]

Gregor Thanks for your answer. I understand your point, but how i reuse the UI certificate in System certificate if i dont have a validate certificate this is probably my problem, for this the question.

In the step the Rule-based Mapping of certificates, i can not use this because the backend version is not available.

Thanks

[pjcools]

If your version does not allow for Rule based mapping then there is no need to perform steps e and f of your Configuration of the Cloud Connector. This will have no impact at all and there is no need to generate the short-lived certificate and just make sure you are not loading this into STRUST as this is not required.

I've actually started signing the UI certificate first and then use this certificate as the System Certificate - which is then loaded into the backend systems. This has worked well for me in recent installations. You must make sure the ICM parameters are EXACTLY matching the System Certificate Issuer - even an additional space can cause the certificate not to be trusted. The ICM parameters I've summarised in this table. As gregorw stated rule based certificate mapping is ideal however I always make sure the External ID mapping (transaction EXTID_DN) is working successfully prior to performing this step and as you said you can only use rule based certificate mapping on later versions of SAP ERP.

The other important step is to make sure the CA certificate has the right attributes. It needs to have the KeyCertsign attribute included.

Lastly, just make sure you are carrying out a Synchronisation of the Principal Propagation settings in the Cloud Connector. You need to synchronise the AD you are using AND also synchronise other services (dispatcher) if you are using OData provisioning etc so check this as well.

Thanks

Phil Cooley