Name: Managing Security Options in SAP Commerce Cloud Portal
Uploaded: 2020-4-20
Duration: 371 s
Description: In this video you'll learn about various security options in the SAP Commerce Cloud Portal. If you're looking for further information on this topic, check out the SAP Help article- Security.

Share feedback

<p><u><strong>Planned maintenance of Practice Systems</strong></u></p>

Planned maintenance of Practice Systems

Why create an SAP account?

Enhance your learning experience

SAP Learning

Choose your subscription

Manage your subscription

Live Sessions

Hands-on Practice

Certification

My Learning

Ready to start learning?

<div><div><div><div><div><div>In this video you'll learn about various security options in the SAP Commerce Cloud Portal. <br><br>If you're looking for further information on this topic, check out the SAP Help article<a href="https://help.sap.com/viewer/0fa6bcf4736c46f78c248512391eb467/latest/en-US/65dc4624bddd48138133ae2138c6a816.html" rel="nofollow noopener noreferrer" target="_blank">- Security</a>.<br></div></div></div></div></div></div>

Managing Security Options in SAP Commerce Cloud Portal

Hello, my name is William. Before I build and deploy my solution, I'm gonna take a moment to familiarize myself with the various security configurations in the Cloud Portal and start configuring them to meet my needs. For all security configurations, once created, I won't be able to view or edit the contents. This is to ensure the files remain secure. If you create a configuration with a mistake, it's best to delete it and start again. To begin, I’ll click on the "Security" link in the side navigation. The first option is to configure your IP Filter sets. IP Filter sets are used to control which IPs can or cannot access your various endpoints. By default, for each of your environments, the endpoints are set to "Deny All" access. This means any request coming to my endpoint will be denied. According to our needs, we can configure a different set of IPs for each endpoint. In this example, I'm gonna create an IP filter set to prevent some IPs originating from North Korea from accessing my storefront. To create a new filter set, I’ll click the "Create" button. First, I need to create the list of IPs in the filter set. In this example, I have a text file to which I added only some of the known or suspected North Korean IPs. Another example would be to create an IP filter set of all your business IPs, which can be used to limit access to your back office services. Remember to not only include the public IPs but your VPN IPs as well. Back in the Cloud Portal, I’ll give the filter set a memorable name, and I’ll upload the text file I just created. Then I’ll add a comment and click the "Create" button. The next option is “SSL certificates”, which you get to by clicking the SSL Certificates link. Although SAP Commerce Cloud provides default SSL certificates for each of its endpoints, you may choose to use your own. If you already have SSL certificates, you should take a moment to add them now and update your endpoint to point to the new certificate. This way you're testing with your certificates right from the start. This screen shows me all the certificates currently available for my application and the details of where each one is being used. To upload a new certificate, I’ll first click "Create". I’ll now give the certificate a memorable name and put a short description. Next, I’ll paste the value of my certificate file, followed by the value of my private key. I'm now ready to save my certificate details by clicking the "Save" button. I'll repeat the same process for as many certificates as I have. If I'm going to be working with external services that require special certificates, such as SAP Cloud Platform Integration, I can take this opportunity to load the certificates. To do so, I’ll first click the "Trusted Certificates" link. This page will list all the trusted certificates loaded for my application. To upload a new one, I’ll click the "Create" button. I now give the trusted certificate a name, alias, and description, which I can use to identify it later. Next, I paste the value of my third-party certificate file. I am now ready to save my certificate details by clicking the "Save" button. Now, I want to configure the host aliases to establish a connection to my trusted external systems. First, I need to define a list of host aliases. For that, I’ll open a text file and add my host aliases on individual lines. Each line consists of the IP followed by a single blank space and the host alias name. To configure my host aliases in the Cloud Portal, I’ll click the "Host Aliases" button. I put a name and description I can use to identify it later and then drag the file I just created into the Host Aliases File box. I then click "Create" to upload my Host Alias set. Next is the option for creating a VPN. I won't be covering this example as there are a lot of different options for enabling and managing VPN connections. Please see the documentation for more. I now want to use the Cloud Portal to safely upload a security file. Examples of these include certificates, passwords, salts, and tokens. I can then attach these files to specific environments so that they transfer to the security folder of SAP Commerce when the application is deployed to that environment. To do this, I'll first click on the "Security Files" button. This page lists all the security files loaded for my application, including whether they are used on an endpoint. Currently, there are none. To upload a new one, I click the "Create" button. I give my security file a name and description, which I can use to identify it later when configuring my endpoint. I then drag the file I want uploaded into the security file box and click the "Create" button. The last security option to discuss is how to store sensitive properties. In most cases, I do not want to store sensitive properties like passwords, in my code repository. I can use static files for my sensitive data, but the better option is to define the properties as part of each environment's service configuration. One thing I do need to be aware of is that anyone with the Customer System Administration role in Cloud Portal will be able to see these property values. In this example, I'm going to store a property for the Backoffice service of my Commerce Cloud environment. First, I click on the "Environments" option in the left panel. I now select the environment. I scroll down to the "Services" section and select my Backoffice service. Next, I’ll click the "Properties" section. I'm gonna add a special password property and click “Save”. My property won't be activated until all services are restarted. Since this is just a testing environment, I'm going to click "Apply Configurations" and wait for the services to be restarted. The property will now be set for all endpoints associated to the Backoffice service. This is the end of this tutorial.