Skip to content

Commit

Permalink
Update from SAP DITA CMS (squashed):
Browse files Browse the repository at this point in the history
commit a75d270fa7d8cb03db29811423c84d9c9f3d7905
Author: REDACTED
Date:   Mon Jun 10 06:28:31 2024 +0000

    Update from SAP DITA CMS 2024-06-10 06:28:31
    Project: dita-all/slu1713332208086
    Project map: 6d6c94be23b547a19d534f13dd6d51a7.ditamap
    Output: loiocc0ab4c7365e43bbbee9eae27deb32da
    Language: en-US
    Builddable map: 446771d4951c4a6988252269c21d94ba.ditamap

commit 19493440fe0c1462a09f2166919206921ebfdae1
Author: REDACTED
Date:   Mon Jun 10 06:19:11 2024 +0000

    Update from SAP DITA CMS 2024-06-10 06:19:10
    Project: dita-all/slu1713332208086
    Project map: 6d6c94be23b547a19d534f13dd6d51a7.ditamap
    Output: loiocc0ab4c7365e43bbbee9eae27deb32da
    Language: en-US
    Builddable map: 446771d4951c4a6988252269c21d94ba.ditamap

commit fdd08ff2da2e7fe8fb0dccfce792027c0f04d22f
Author: REDACTED
Date:   Mon Jun 10 03:41:13 2024 +0000

    Update from SAP DITA CMS 2024-06-10 03:41:13
    Project: dita-all/djr1548327031813
    Project map: 035865251b5d4135a8b461c55ee9a8e9.ditamap
    Output: loiocf0e5a9be9804817aa649f51a84b9f39
    Language: en-US
    Builddable map: 668ddc52b4c54429a3abb37be25b57df.ditamap

##################################################
[Remaining squash message was removed before commit...]
  • Loading branch information
ditaccms-bot committed Jun 10, 2024
1 parent 83f5d96 commit 8ade9c4
Show file tree
Hide file tree
Showing 406 changed files with 7,909 additions and 8,696 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,9 @@ You’ve created a subaccount in your assigned global account using the SAP BTP

3. In the *New Instance or Subscription* dialog box, select the *Plan* and choose *Create*. Wait for the subscription to complete successfully.

> ### Note:
> For different plans see the SAP Note [2903776](https://help.sap.com/docs/link-disclaimer?site=https://me.sap.com/notes/2903776).
Check the status of the submission in the subscriptions section on the *Instances and Subscriptions* page. If the subscription is successful, you notice the status of the *Integration Suite* shown as *Subscribed*.

4. You must have specific roles to access theIntegration Suite. To assign these roles navigate to *Security* \> *Users*.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,3 +13,5 @@ Integration Assessment provides you with a guided approach to assess your integr

[Integration Assessment Process](integration-assessment-process-5769fcd.md "Define, document, and govern your integration technology strategy.")

<?sap-ot O2O class="- topic/link " href="d352b138fddb4da094314eb922b4ba1a.xml" text="" desc="" xtrc="link:3" xtrf="file:/home/builder/src/dita-all/slu1713332208086/loiocc0ab4c7365e43bbbee9eae27deb32da_en-US/src/content/localization/en-us/310067e3e49342ddbe5a90c8f33a1910.xml" output-class="" outputTopicFile="file:/home/builder/tp.net.sf.dita-ot/2.3/plugins/com.elovirta.dita.markdown_1.3.0/xsl/dita2markdownImpl.xsl" ?>

Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
<!-- loio47847b519d0849a4b9f91f60690d55b1 -->

<link rel="stylesheet" type="text/css" href="../css/sap-icons.css"/>

# Integration Assessment APIs

The following are the list of APIs used in Integration Assessment. For more information, see the [API reference on the SAP Business Accelerator Hub](https://api.sap.com/package/SAPIntegrationAssessment/overview).
The following is the list of APIs used in Integration Assessment. For more information, see the [API Reference on SAP Business Accelerator Hub](https://hub.sap.com/package/SAPIntegrationAssessment/overview). You can also navigate to the API Reference from the Integration Assessment application. Select <span class="SAP-icons-V5"></span> User Actions from the top toolbar, then choose *API Reference*. Additionally, navigate to the Business Hub by selecting <span class="SAP-icons-V5"></span> Explore our Ecosystem, then choosing *SAP Business Accelerator Hub*.



Expand Down Expand Up @@ -64,7 +66,7 @@ Use Case Pattern
</td>
<td valign="top">

Integration use case patterns refine the integration styles identified for your organization's integration strategy.
Integration use-case patterns refine the integration styles identified for your organization's integration strategy.

</td>
</tr>
Expand All @@ -76,7 +78,7 @@ Integration Pattern
</td>
<td valign="top">

To derive integration guidelines for complex landscapes, Integration patterns combines integration domains and integration styles to derive integration guidelines.
To derive integration guidelines for complex landscapes, Integration patterns combine integration domains and integration styles to derive integration guidelines.

You can do an assessment of your integration architecture by adding the integration patterns that are relevant to your organization or that you might want to further evaluate.

Expand All @@ -90,7 +92,7 @@ Key Characteristic
</td>
<td valign="top">

Key Characteristic help enterprise architects and integration architects to map integration styles to relevant capabilities of integration technologies.
Key Characteristic helps enterprise architects and integration architects to map integration styles to relevant capabilities of integration technologies.

</td>
</tr>
Expand All @@ -102,7 +104,7 @@ Key Characteristic Group
</td>
<td valign="top">

Key characteristics group, groups key characteristics and offers an additional layer for structuring for the key characteristcs.
Key characteristics group groups key characteristics and offers an additional layer for structuring for the key characteristics.

</td>
</tr>
Expand Down Expand Up @@ -284,7 +286,7 @@ Integration Flow
</td>
<td valign="top">

An integration flow represents the overall integration of one or more application.
An integration flow represents the overall integration of one or more applications.

</td>
</tr>
Expand Down Expand Up @@ -331,5 +333,5 @@ This entity describes the decision for a certain technology instance for a speci

[Creating Service Instance and Service Key to enable API calling](creating-service-instance-and-service-key-to-enable-api-calling-749897f.md "")

[https://api.sap.com/api/EntitiesAPI/resource/Domain](https://api.sap.com/api/EntitiesAPI/resource/Domain)
[Integration Assessment API Reference on SAP Business Accelerator Hub](https://hub.sap.com/package/SAPIntegrationAssessment/overview)

Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,12 @@

Settings include the SAP Integration Solution Advisory Methodology \(ISA-M\) master data. This data acts as the initial setup for completing the integration assessment.

For more information, see: [SAP Integration Solution Advisory Methodology](sap-integration-solution-advisory-methodology-a2e17f3.md)
For more information, see:

- [SAP Integration Solution Advisory Methodology](sap-integration-solution-advisory-methodology-a2e17f3.md)

- <?sap-ot O2O class="- topic/xref " href="d352b138fddb4da094314eb922b4ba1a.xml" text="" desc="" xtrc="xref:2" xtrf="file:/home/builder/src/dita-all/slu1713332208086/loiocc0ab4c7365e43bbbee9eae27deb32da_en-US/src/content/localization/en-us/957de135ee4c4d5d9778355d76760572.xml" output-class="" outputTopicFile="file:/home/builder/tp.net.sf.dita-ot/2.3/plugins/com.elovirta.dita.markdown_1.3.0/xsl/dita2markdownImpl.xsl" ?>


Reviewing and adjusting the ISA-M settings is the task of the enterprise architect \(see [Personas for Integration Assessment](../60-Security/personas-for-integration-assessment-5df5af1.md)\).

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -193,10 +193,6 @@ For more information, check out:
</tr>
</table>

If you use an external certificate, the certificate needs to be signed by a certification authority that is supported by the load balancer.

See: [Load Balancer Root Certificates Supported by SAP](load-balancer-root-certificates-supported-by-sap-4509f60.md)

4. Configure the sender system.

1. Make sure that the sender keystore contains the root certificate of the load balancer server certificate.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,8 @@ To enable communication with such a variety of systems, Cloud Integration suppor
- Connections to an external message broker using the Advanced Message Queuing Protocol \(AMQP\)


For an overview of the communication protocols and the available adapters \(that are based on a certain protocol\), see [Connectivity (Adapters)](https://help.sap.com/viewer/368c481cd6954bdfa5d0435479fd4eaf/Cloud/en-US/55325f2a722c4f67bb7752b369b09ff8.html "You have the option to specify which technical protocols should be used to connect a sender or a receiver to the tenant.") :arrow_upper_right:.

> ### Note:
> The procedure to set up HTTP connections depends on whether you use Cloud Integration in the Cloud Foundry or in the Neo environment.
Expand All @@ -54,6 +56,8 @@ To enable communication with such a variety of systems, Cloud Integration suppor

[Configuring Inbound HTTP Connections](configuring-inbound-http-connections-f568400.md "")

[Configuring Inbound HTTP Connections, Neo Environment](https://help.sap.com/viewer/368c481cd6954bdfa5d0435479fd4eaf/Cloud/en-US/bd1dbc4ba360426ab2244a9ae441ded6.html "") :arrow_upper_right:

[Setting Up Inbound SFTP Connections](setting-up-inbound-sftp-connections-d8fb958.md "Using the SFTP sender adapter, you connect an SAP Integration Suite tenant with an SFTP server so that the tenant can read data from the SFTP server (in a process referred to as polling).")

[Setting Up Inbound Mail Connections](setting-up-inbound-mail-connections-6ad4956.md "Using the mail sender adapter, you connect the tenant with an e-mail server so that the tenant can read data from the e-mail server (in a process referred to as polling).")
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ You send the CSR to a certification authority, who will provide a signing respon
**Related Information**


<?sap-ot O2O class="- topic/link " href="5490ca7917b64ef3803d9f34c542db70.xml" text="" desc="" xtrc="link:1" xtrf="file:/home/builder/src/dita-all/lze1710737251935/loiocc0ab4c7365e43bbbee9eae27deb32da_en-US/src/content/localization/en-us/b199dbe8c59e49ac933f29337c853d6e.xml" output-class="" outputTopicFile="file:/home/builder/tp.net.sf.dita-ot/2.3/plugins/com.elovirta.dita.markdown_1.3.0/xsl/dita2markdownImpl.xsl" ?>
<?sap-ot O2O class="- topic/link " href="5490ca7917b64ef3803d9f34c542db70.xml" text="" desc="" xtrc="link:1" xtrf="file:/home/builder/src/dita-all/slu1713332208086/loiocc0ab4c7365e43bbbee9eae27deb32da_en-US/src/content/localization/en-us/b199dbe8c59e49ac933f29337c853d6e.xml" output-class="" outputTopicFile="file:/home/builder/tp.net.sf.dita-ot/2.3/plugins/com.elovirta.dita.markdown_1.3.0/xsl/dita2markdownImpl.xsl" ?>

[Updating a Key Pair with a Signing Response](../50-Development/updating-a-key-pair-with-a-signing-response-4242f01.md "Upload a signing response from a certification authority and use it to update the key pair in your keystore, keeping the alias of the keystore entry unchanged.")

Original file line number Diff line number Diff line change
Expand Up @@ -72,37 +72,10 @@ To implement message-level security for OpenPGP, you use PGP keys.

![](images/Keys_for_Message_Level_Security_PGP_Inbound_0c58adc.png)



## Configuring the Sender

1. Generate and configure the PGP keys and the storage locations \(PGP secret and public keyrings\) for the sender system.

2. Import the related public keys from the tenant into the public PGP keyring of the sender and finish the configuration of the sender system.




Provide the tenant administrator with the public key \(is used to verify messages sent to the tenant\).



## Configuring the Integration Flow Steps for Message-Level Security

Configure the security-related integration flow steps.

Configure the **Decryptor** \(PGP\) and **Verifyer** \(PGP\) step.

When signatures are expected, make sure that you specify the *Signer User ID of Key\(s\) from Public Keyring* for all expected senders.

Based on the signer user ID of key\(s\) parts, the public key \(for message verification\) is looked up in the PGP public keyring. The signer user ID of key\(s\) key parts specified in this step restrict the list of expected senders and, in this way, act as an authorization check.

**Related Information**


[How OpenPGP Works](how-openpgp-works-29bc188.md "You can use Open Pretty Good Privacy (Open PGP) to digitally sign and encrypt messages.")

[Creating OpenPGP Keys](creating-openpgp-keys-6c5846b.md "You use the tool gpg4win to create the required keys for the usage of OpenPGP.")

[Define PGP Decryptor](../50-Development/define-pgp-decryptor-d0dc511.md "")

Original file line number Diff line number Diff line change
Expand Up @@ -72,40 +72,6 @@ To implement message-level security for the standards PKCS\#7, WS-Security, and

![](images/Certificates_for_Message_Level_Security_Inbound_dbc7998.png)



## Configuring the Sender

Configure the sender keystore in the following way:

- Generate a key pair \(and get it signed by a CA\).

- Import the tenant public key into the sender keystore.




Provide the tenant administrator with the public key \(is used to verify messages sent to the tenant\).



## Configuring the Integration Flow Steps for Message-Level Security

Depending on the desired option, configure the security-related integration flow steps.

- Configure the **Verifyer** \(PKCS7 or XML Signature Verifyer\) step.

Specify the *Public Key Aliases* in order to select the relevant keys from the tenant keystore.

- Configure the **Decryptor** \(PKCS7\) step.

Make sure that you specify the *Public Key Aliases* for all expected senders \(only if you have specified *Enveloped or Signed and Enveloped Data* or *Signed and Enveloped Data* for *Signatures in PKCS7 Message*\).

These are the public key aliases corresponding to the private keys \(of the expected senders\) that are used to sign the payload. The public key aliases specified in this step restrict the list of expected senders and, in this way, act as an authorization check.


In general, an alias is a reference to an entry in a keystore. A keystore can contain multiple public keys. You can use a public key alias to refer to and select a specific public key from a keystore.

**Related Information**


Expand All @@ -117,5 +83,3 @@ In general, an alias is a reference to an entry in a keystore. A keystore can co

[Creating Keys for the Usage of PKCS\#7, XML Digital Signature and WS-Security](creating-keys-for-the-usage-of-pkcs-7-xml-digital-signature-and-ws-security-6f43916.md "To set up message level security scenarios based on PKCS#7, XML Digital Signature or WS-Security, the required keys are created in the same way as for transport level security HTTPS.")

[Define PKCS\#7/CMS Decryptor](../50-Development/define-pkcs-7-cms-decryptor-51d903b.md "")

66 changes: 0 additions & 66 deletions docs/ISuite/40-RemoteSystems/involved-roles-3968091.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,69 +4,3 @@

The security artifact renewal process requires that different persons perform a sequence of steps in a coordinated way on each side of the communication. The exact sequence depends on the kind of security material which is renewed and on the use case.

**Roles in the Security Artifact Renewal Process**


<table>
<tr>
<th valign="top">

Role

</th>
<th valign="top">

Tasks

</th>
</tr>
<tr>
<td valign="top">

Sender/receiver administrator \(at customer side\)

</td>
<td valign="top">

Updates the security artifacts owned by the sender/receiver back-end system \(for example, the keystore\).

</td>
</tr>
<tr>
<td valign="top">

Integration developer

</td>
<td valign="top">

Updates the integration flow in certain use cases.

</td>
</tr>
<tr>
<td valign="top">

Tenant administrator

</td>
<td valign="top">

Updates the security artifacts of the tenant \(relevant for outbound communication\).

</td>
</tr>
<tr>
<td valign="top">

Load balancer administrator

</td>
<td valign="top">

Updates the security artifacts of the load balancer \(relevant for inbound communication\).

</td>
</tr>
</table>

Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,9 @@ Strong encryption is supported for the following algorithms:

For these algorithms, the key lengths 192 and 256 are possible.

> ### Caution:
> Algorithms starting with SHA1, MD2, or MD5 are still supported for compatibility reasons, but they no longer meet today's security requirements. Therefore, we recommend using stronger algorithms where possible. Check with your security experts or authorities like NIST for more detailed security recommendations.


## Recommendations
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,18 +27,13 @@ Simply spoken, this authentication is established using the following sequent st

- Using a client certificate from the service key

If you use a client certificate, you can either use an own \(*external*\) client certificate or a client certificate generated by SAP \(see [Service Key Types](service-key-types-0fc1446.md)\).
If you use a client certificate, you can either use an own \("external"\) client certificate or a client certificate generated by SAP \(see [Service Key Types](service-key-types-0fc1446.md)\).

> ### Tip:
> For a step-by-step description of how to set up this use case, check out the following tutorial:
>
> [Set Up Inbound OAuth Client Credentials Grant Authentication for Senders Calling Integration Flows with SAP-Generated Certificate](https://developers-qa-blue.wcms-nonprod.c.eu-de-2.cloud.sap/tutorials/btp-integration-suite-oauth-integration-flow.html)
> ### Caution:
> If you use an *external* client certificate \(*Key Type* parameter set to *External Certificate* when creating the corresponding service key, see [Creating Service Instance and Service Key for Inbound Authentication](creating-service-instance-and-service-key-for-inbound-authentication-19af5e2.md)\), the certificate must be signed by a CA from the list specified in the following topic:
>
> See: [Trusted Authorities for X.509 Certificates](https://help.sap.com/docs/btp/sap-business-technology-platform/trusted-certificate-authorities-for-x-509-secrets?version=Cloud)

2. Token server issues access token.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -72,38 +72,10 @@ To implement message-level security for OpenPGP, you use PGP keys.

![](images/Keys_for_Message_Level_Security_PGP_Outbound_8e6a163.png)



## Configuring the Receiver

1. Generate the PGP keys and the storage locations \(PGP secret and public keyrings\) for the receiver system.

2. Import the related public keys from the tenant into the public PGP keyring of the receiver and finish the configuration of the receiver system.




Provide tenant administrator with the public key \( used to encrypt messages sent to the receiver\).



## Configuring the Integration Flow Steps for Message-Level Security

Depending on the desired option, configure the security-related integration flow steps.

Configure the **Encryptor** \(PGP\) step.

- Specify the *User ID of Key\(s\) from Public Keyring* in order to select the relevant public receiver keys from the PGP public keyring.

- If you want to sign the payload, specify the *Signer User ID of Key\(s\) from Secret Keyring* in order to select the relevant private key from the PGP secret keyring. The private key is used to sign the message.


**Related Information**


[How OpenPGP Works](how-openpgp-works-29bc188.md "You can use Open Pretty Good Privacy (Open PGP) to digitally sign and encrypt messages.")

[Creating OpenPGP Keys](creating-openpgp-keys-6c5846b.md "You use the tool gpg4win to create the required keys for the usage of OpenPGP.")

[Define PGP Encryptor](../50-Development/define-pgp-encryptor-7a07766.md "")

Original file line number Diff line number Diff line change
Expand Up @@ -74,21 +74,6 @@ To implement message-level security for standards PKCS\#7, WS-Security, and XML



## Configuring the Receiver

Configure the receiver keystore in the following way:

- Generate a key pair \(and get it signed by a CA\).

- Import the tenant public key into the receiver keystore.




Provide the tenant administrator with the public key \(is used to encrypt messages sent to the receiver\).



<a name="loio57b2b199a17a49f1844bba06076f4be1__section_sqk_d2t_5bb"/>

## Configuring the Integration Flow Steps for Message-Level Security
Expand Down Expand Up @@ -119,7 +104,3 @@ In general, an alias is a reference to an entry in a keystore. A keystore can co

[Creating Keys for the Usage of PKCS\#7, XML Digital Signature and WS-Security](creating-keys-for-the-usage-of-pkcs-7-xml-digital-signature-and-ws-security-6f43916.md "To set up message level security scenarios based on PKCS#7, XML Digital Signature or WS-Security, the required keys are created in the same way as for transport level security HTTPS.")

[Sign the Message Content with PKCS\#7/CMS Signer](../50-Development/sign-the-message-content-with-pkcs-7-cms-signer-cc09e03.md "")

[Encrypt and Sign the Message Content with PKCS\#7/CMS Encryptor](../50-Development/encrypt-and-sign-the-message-content-with-pkcs-7-cms-encryptor-21fd211.md "")

Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,3 @@ To exchange the password of a user without any downtime, the cloud infrastructur

Security artifact renewal has to be performed in the following sequence:

1. Cloud infrastructure provider: Informs the sender administrator that he wants to change the password of a certain user used for HTTPS communication with the tenant and that he has created an **intermediate user** \(`user1`\) and password.
2. Sender administrator: Exchanges the old user/password \(`user0`\) with the intermediate user/password \(`user1`\) in the HTTPS sender client \(back-end system\).
3. Sender administrator: Informs the cloud infrastructure provider that the sender client now uses the intermediate user \(`user1`\).
4. Cloud infrastructure provider: Informs the sender administrator that the password of the original user \(`user0`\) has been changed.
5. Sender administrator: Exchanges the user/password of the intermediate user \(`user1`\) with the original user \(`user0`\) \(and with the new password\).
6. Sender administrator: Informs the cloud infrastructure provider that user and password has been changed.

Loading

0 comments on commit 8ade9c4

Please sign in to comment.