Is HTTPS/SSL mandatory for LRM 1.0 on HANA

[Former Member]

Dear Colleagues,

I'm installing LRM 1.0 on HANA ramp-up system in our non-production environment.  I do not want to implement HTTPS/SSL due to unnecessary complexity.  I'm having a problem accessing the LRM UI so I created a SAP customer message to report it.  The response from SAP is "it is currently not foreseen to install the LRM UI without using HTTPS/SSL".  I've asked them to confirm that HTTPS/SSL is mandatory.

I've avoided the need for SSL in the past on other systems that supposedly required it by changing the Logon Data to "Standard" for the related internet services. 

Has anyone implemented LRM 1.0 on HANA without HTTPS/SSL?  If so, how was it accomplished?

Feedback is appreciated as always.

Rex

[Former Member · Accepted solution]

Hi Rex, I am on the step in the LRM install guide where it states to configure SSL, just curious if you heard back from anyone if this is mandatory ?  Thx, Paul

[Former Member · Accepted solution]

Hi Paul,

Apparently, HTTPS/SSL is required for LRM 1.0.  Below is the explanation I received from SAP.

Rex

From SAP -

I spoke with some colleagues and this is the conclusion:

  1. For writing tasks SSL is technically needed. This includes

personalization and, more important, EXCEL-Download.

  2. Our security guideline states:

'Sending the HTTP protocol over a SSL secured connection is not only

standardized, but also required for SAP applications. '. This was

defined to ensure XSS invulnerability et al.

We discussed quite some time the possibilities to help you to get aroundthis need of SSL. But the result was that if we would enable non-SSL

access the security issues would be to dangerous to accept for a

standard application.

  I really understand your situation. But SSL is needed.