Note Number : 361123
Symptom
You want the SAP Content server to work properly.
Other terms
Signed URLs, AdminSecurity, SsfVerify failed
Reason and Prerequisites
The SAP Content Server was installed in accordance with the installation guide. For new installations, we recommend that you use the latest released version of the SAP Content Server, regardless of the SAP System release to which the SAP Content Server is connected.
Solution
This note provides additional information on different aspects of security when using the SAP Content Server.
Security against data loss
• The SAP server content stores the contents of the confidential document either in an SAP-DB instance or in the file system. To avoid data loss, the usual measures for databases and file systems are taken. These are only mentioned briefly here: Redundant hardware (mirror disks, raid systems and so on), regular backup (log files, backup). When you back-up the Content Server, note that you also have to save the ContentServer.ini configuration file as well as the Security directory in addition to backing up the database instance or the directories of the file system used for document content.
• Note 319332 describes backup strategies for a Content Server with database folders.
• SAP does not have a tool for backing up file system folders. In this case it is the responsibility of the customer to select and convert the backup strategy. Here you should note that, for a complete and consistent backup of a file system folder, it may be necessary to shut down the Content Server for the duration of the backup.
Security against unauthorized accesses on filed contents
• Before you access the content server, an authorization check usually occurs in the SAP system. However, the content server is usually accessed using a disclosed HTTP log. To make sure that only authorized accesses are possible, 'signed URLs' must be used. Signed URLs are URLs that were signed by the SAP system. You can recognize signed URLs because they are considerably longer than unsigned URLs and contain additional parameters. The signed URL, in particular, contains the additional parameters expiration (expiry time) and secKey (digital signature). A signed URL is only valid if the expiry time has not yet been exceeded and if it contains a valid signature. In order that the signature can be checked by the content server, the public key (certificate) of the SAP system must be stored on the content server and tagged for the corresponding repository. Transactions OAHT, OAC0 (as of 4.6C) and CSADMIN (as of 4.6C for SAP content server) are used to transfer the certificate. The certificate must be activated on the content server for the repository. Use CSADMIN to do this (for SAP Content server).
• In order that the digital signature of the SAP system can be used properly, EVERY SAP system must have its own unique certificate. To ensure this, a 'PSE' must be generated once in every SAP system after this SAP system is developed. Use transaction PSEMAINT to do this (note 354819).
• To protect the connection between the Content Server and its SAP-DB instance, the name and password of the database user can be changed and stored in encrypted format in the configuration of the content server. For details, see note 661852.
Access control for the administration
• The content server is partly administered from within the SAP system, and partly from outside it. When it is administered from outside, you must ensure that only authorized persons have (administrative) access to the server on which the content server is running. The (administrative) access to the database (note 212394) must be restricted accordingly.
• In order that administrative accesses from the SAP system are only possible for authorized persons, the parameter AdminSecurity must be set to 1 in the content server. You will find details on this in the installation documentation of the SAP Content Server.
Protection against server hardware outage
• The Windows version of the SAP Content Server can also be installed in an MSCS environment (Microsoft Cluster Server). For more detailed information, see "SAP Content Server 6.20 in an MSCS Environment", dated March 4, 2003, in the "News" section on the SAP Service Marketplace (http://service.sap.com/ha
• The duration of the non-availability of content servers, cache servers and alias servers can be reduced with the automated operator intervention described in note 484459.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.