Enabling on premise Fiori SSO with OpenSSL certificates – Part 1

I had described how to enable single-sign-on based on OpenSSL for Windows on a Web AS ABAP sandbox system and this information is still valid. However, both the NWAS ABAP as well as the OpenSSL tools have evolved considerably since 2012 so that I will describe an updated approach for Fiori single-sign-on in this blog series. I will start with explaining how to setup a sucure SSL connection to the Fiori Launchpad based on OpenSSL certificates.

Again, this blog is intended for you to learn and understand the concepts. Neither key lengths nor other security considerations except for making this example work have been considered.

Configure ABAP to HANA SSL connection

The below instructions are based on sapcrypto. In SP7, there is an option to use commoncrypto. OpenSSL is also an option if sapcrypto is not installed.

• Install sapcrypto on both CI and HANA systems
• This is well documented, so I won't provide details here
• Copy libsapcrypto.so to .../lib directory
• cp libsapcrypto.so /usr/sap/<sid>/SYS/global/security/lib
• Create PSE files for both the CI and HANA systems
• See 1718944 - SAP HANA DB: Securing External SQL Communication (SAPCrypto)
• If a Certificate Authority (CA) is not available, SAP provides an option to create a test cert that is valid for 8 weeks: https://websmp110.sap-ag.de/tcs