Encrypted (SNC) communication with print (server)

[Former Member]

Hello Folks

In the past we used SAPLPD with the Secude SNC library to secure the communication to a print server. Since SAPLPD is not supported anymore, i was trying to use its successor SAPSPRINT. There are obviously a few SNC related options, however i was unable to figure them out or find any official documentation for SAPSPRINT with SNC.

Is there anybody out there using encryption for printing, with or without SAPSPRINT? Anybody using IPP with SSL with SAP, or something like that?

Cheers Michael

[tim_alsop]

From what I understand, the use of SNC with SAPSPRINT instead of with SAPLPD is very similar. You can refer to instructions and information on this in SAP help library. For example there is a page at http://help.sap.com/saphelp_nw04/helpdata/en/90/78f08a030211d399b90000e83dd9fc/content.htm which you might find useful. If you have any specific questions, please let me know.

[Former Member]

Well the use (read use) is indeed very similar but the configuration is totally different

I have read the documentation several times now. SAPLPD had a saplpd.ini where you specified SNC information:

  [snc]

  enable=1

  gssapi_lib=C:\Program Files (x86)\SECUDE_SRV\bin\secude.dll

  identity/lpd=p:CN=<cn>

And i absolutely cannot find the corresponding part for SAPSPRINT. SAPSPRINT has its own configuration utility (but no snc library and identity option anywhere) and there are no ini files.

Cheers Michael

[tim_alsop]

Only if access method S is chosen in the device definition does the Security tab page appear, in which you can set the security functions for output  for this device.

Have you naelecred access method S ?

[Former Member]

Absolutely, yes. I can specify the snc identity of the SAPLPD/SAPSRINT service there, But i cannot set the identity in the SAPSPRINT config in the first place.

Cheers Michael

This is the relevant part of the SAPSPRINT logfile:

...

Th 07692: (04.06.2012 15:15:50) Ni2Listen: port 515 OK, socket 2

Th 07692: (04.06.2012 15:15:50) Network communication via SAP-NiLib

Th 07692: (04.06.2012 15:15:50) Initializing SAP Security Library.

Th 07692: (04.06.2012 15:15:50) No SAP Security Library installed.

Th 07692: (04.06.2012 15:15:50) Error: Cannot accept jobs without SAP Security.

...

[tim_alsop]

You need to use an SNC library which can act as a GSS-API acceptor, so that it can accept incoming connections from the server. If you are using an SNC library which support Kerberos, then the key table on the workstation would contain the keys for accepting the incoming connection. You may have to setup the SNC_LIB environment variable to point to the directory where this SNC library can be found.

[Former Member]

The SNC_LIB variable is set, i think one would need to set SNC_IDENTITY (or whatever it is called) as well, but as i said it does not seem to be documented anywhere.

We are focusing on other possibilities, one of the main disadvantages of the SNC solution is, that only the communication to the spool server is encrypted. The way to the printer is not.

Cheers Michael

[tim_alsop]

There is no SNC_IDENTITY param. The software on workstation just needs to know the SNC library to use. I am not aware of any way to encrypt the communications between SAP ABAP and the printer directly, but if you find a way, please can you add information here for others to benefit from ?

[Former Member]

I am not aware of any way to encrypt the communications between SAP ABAP and the printer directly, but if you find a way, please can you add information here for others to benefit from ?

If i ever will succeed i will post the howto information here, but so far i did not get anywhere...

[ales_prochazka]

Did anybody solve problem with " No SAP Security Library installed" error message ?

[Former Member]

I have same question as how to configure SNC on window server with SAPSprint installed.

Understand that SAPSprint has a SNC tab and can enter the SAP server certificate name there. But not sure how to setup secure library "gssapi_lib" on the window side. Anyone using sap crypto library for this?  any SAP official documentation?

thanks.