<p>about your learning experience to help us improve.</p>

You've completed

cleanFiles/bookmap_SAP_Mobile_Start_en-US_learning-sap-com_lsc-prod.zip (MMCP-DROPZONE) - 2024-07-17T11:08:53.000Z

Setting Up SAP S/4HANA for Principal Propagation

<div id="content"><p tabindex="0">This section explains the following steps to be executed in SAP S/4HANA system:</p><ul style="list-style-type:disc"><li tabindex="0">Import system certificate</li><li tabindex="0">Define rule-based mapping</li><li tabindex="0">Define Reverse Proxy Parameter and additional parameters in RZ10</li><li tabindex="0">Restart the ICM</li></ul><p tabindex="0">Watch the following video to learn how to set up the backend for principal propagation:</p><div class="kalturaVideoLessonWrapper"><div id="1_41m3mjl5" data-testid="video" class="kalturaVideoLessonContainer" aria-label=""></div></div><p tabindex="0">The following parameters are mentioned in the video and are included here for your reference:</p><ul style="list-style-type:disc"><li tabindex="0"><p tabindex="0">Reverse Proxy Parameter:</p><p tabindex="0">Name: <code>icm/trusted_reverse_proxy</code></p><p tabindex="0">Example value: <code>SUBJECT="CN=thisismycchost.mycompany.com, L=WDF, O=SAP, C=DE", ISSUER="CN=thisismycchost.mycompany.com, L=WDF, O=SAP, C=DE" </code></p><div class="note"><div class="noteTitle"><span class="noteIcon"><img src="/icons/note.svg" title="Note" /></span><span class="noteTitleText">Note</span></div><div class="noteBody"><p tabindex="0">Make sure that you use straight double quotes and not curly quotes.</p><p tabindex="0">It's easiest to copy the value of the SUBJECT and ISSUER from the Cloud Connector system certificate that you uploaded to STRUST.</p></div></div></li><li tabindex="0">Additional parameters: <ul style="list-style-type:circle" class="second1"><li tabindex="0"><code>login/certificate_mapping_rulebased = 1</code></li><li tabindex="0"><code>icm/HTTPS/verify_client = 1</code></li></ul></li></ul><div class="parentsection"><div class="section"><div tabindex="0"><h3>Test the Setup</h3></div><p tabindex="0">To verify that the change to principal propagation is working correctly, log on to the site from a desktop browser and open one of the assigned apps. If it opens correctly and shows the expected data, you have done everything correctly. If you get any sort of error message or you do not see the data, please run through this and the previous exercise one more time and verify that all the configuration steps were done correctly.</p><div class="note"><div class="noteTitle"><span class="noteIcon"><img src="/icons/hint.svg" title="Hint" /></span><span class="noteTitleText">Hint</span></div><div class="noteBody"><p tabindex="0">See this <a href="https://wiki.scn.sap.com/wiki/display/ASJAVA/How+to+troubleshoot+Cloud+Connector+principal+propagation+over+HTTPS" target="_blank">wiki</a> site for troubleshooting.</p><p tabindex="0">Also, this <a href="https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/configuring-principal-propagation" target="_blank">help</a> page on setting up the Cloud Connector provides some general information.</p></div></div></div></div></div>

Set Up Backend for Principal Propagation

Setting up SAP Mobile Start with SAP S/4HANA on SAP Build Work Zone

Learn how to set up the back-end for principal propagation in this tutorial. Follow the step-by-step instructions to import system certificates, define rule-based mapping, configure reverse proxy parameters, and restart ICM.<br><br># This description was auto-generated #

Setting Up Backend for Principal Propagation

To set up the back-end for principal propagation, you need to carry out the following steps. 1. Import System Certificate  2. Define Rule-Based Mapping  3. Define Reverse Proxy Parameter and  4. ICM Restart  Import System Certificate. The system certificate that we created at the beginning of this tutorial must be imported into the backend system. Go to Transaction as Trust and change to Edit Mode. Then expand the SSL Server Standard. Note: If you have not previously created an SSL Standard Server, right-click on it and create a new one as a first step. Once created, scroll down and click the Import Certificate button. In the pop-up window, navigate to the location where the system certificate, system_certificate.der was saved and selected for uploading. Click Add to Certificate List to include it in the list of trusted certificates. It will show up in the certificate list. Save the changes and exit the transaction. Define rule-based mapping. Since you are logging on to SAP BTP using an email address, this needs to be mapped to the SU01 user in the backend system. We don't have to do this manually for each of the users. Instead, we just need to create a mapping rule to handle this. Go to the transaction CERTRULE, click Import Certificate and select the sample certificate you had created earlier, scc_sample_cert.der and import it. Change to change mode and click Rule to create a rule that maps the SAP BTP user, that is, the email address, with the user's SU01 user ID. In the certificate attribute field, choose the attribute mapping from the drop-down menu. In the Login as field, select Email and press enter. Once the new rule is saved, you should see a similar screen where the mapping status and user status are both green. Define reverse proxy parameter. In the default parameter profile, you need to add a new parameter, trusted reverse proxy. In transaction RZ10, select the Default Profile and click Change. Add a new parameter, ICM/trusted_reverse_proxy_zero by adjusting the last digit in case you already used that profile for another scenario. The value for the parameter must follow the format  SUBJECT="CN=” ISSUER=CN=" For example,  SUBJECT="CN =thisismycchost.mycompany.com, L=WDF, O=SAP, C=DE"  ISSUER="CN=thisismycchost.mycompany.com, L=WDF, O=SAP, C=DE" Note: Make sure that you use straight double quotes and not curly quotes. Hint: Copy the value of the subject and issuer from the Cloud Connector System Certificate in the transaction as trust to ensure that the format is correct. For CERTRULE to work, the parameter login/certificate_mapping _rulebased  needs to be set to one. This is the default value, but make sure to verify this. The parameter icm/ HTTPS/verify_client must also be set to one default, or the HTTPS port configuration in ICM, needs to have VCLIENT = 1. Save and activate the profile. ICM restart. The last step is to restart the ICM so that the changes can take effect. Call transaction SMICM.Administration → ICM → Exit Soft → Global. Click Yes to the pop-up. The restart usually only takes a minute or two. However, make sure that there are no users accessing the ICM since they will be disconnected. This was the last step.