Hana Cloud Integration 1.0 October 2014 English

Hana Cloud Integration Setup & Configuration (C1E) Building Block Configuration Guide

SAP AG Dietmar-Hopp-Allee 16 69190 Walldorf Germany SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Copyright

© 2014 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. Please see http://global.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP SE or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP SE’s or its affiliated companies’ strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.

© SAP AG Page 2 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Icons

Icon Meaning Caution

Example

Note

Recommendation

Syntax

Typographic Conventions

Type Style Description Example text Words or characters that appear on the screen. These include field names, screen titles, pushbuttons as well as menu names, paths and options. Cross-references to other documentation. Example text Emphasized words or phrases in body text, titles of graphics and tables. EXAMPLE TEXT Names of elements in the system. These include report names, program names, transaction codes, table names, and individual key words of a programming language, when surrounded by body text, for example, SELECT and INCLUDE. Example text Screen output. This includes file and directory names and their paths, messages, source code, names of variables and parameters as well as names of installation, upgrade and database tools.

EXAMPLE TEXT Keys on the keyboard, for example, function keys (such as F2) or the ENTER key. Example text Exact user entry. These are words or characters that you enter in the system exactly as they appear in the documentation. Variable user entry. Pointed brackets indicate that you replace these words and characters with appropriate entries.

© SAP AG Page 3 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Content

1 Purpose...... 5 2 Preparation...... 5 2.1 Prerequisites...... 5 2.2 How to Use This Configuration Guide...... 5 2.3 Parameter Sheets...... 5 2.3.1 Files Provided by SAP...... 5 2.3.2 Parameters Provided by Customer...... 6 3 Configuration...... 6 3.1 Setting up Connectivity between SAP ERP and HCI...... 6 3.1.1 Setting up HCM SuccessFactors Scenarios in Eclipse...... 8 3.1.2 Certificates...... 9 3.1.3 Creation of Logical Ports in SOAManager...... 12 3.2 Setting up Connectivity between HCI and SuccessFactors System...... 14 3.2.1 Using Basic Authentication...... 14 3.2.2 Using Certificate Authentication...... 15 3.3 Adjusting Scenarios in Eclipse...... 16 3.3.1 Adjust Sender System in iFlow to include Backend Certificate:...... 16 3.3.2 Adjust Receiver SOAP Adapter for SOAP URL and to use Basic Authentication/Certificate Authentication...... 16

© SAP AG Page 4 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

HCI General Configuration within Eclipse

1 Purpose The purpose of this document is to describe the general configuration steps required to manually set up HCI general configuration in Eclipse for all or specific processes shipped with this Packaged Solution within a system landscape that has already been installed using the corresponding configuration guides for installation.

2 Preparation 2.1 Prerequisites Before you start installing this scenario, you must install the prerequisite building blocks. For more information, see the Building Block Prerequisites Matrix for this Packaged Solution. This document is in the content library, attached to the Step-by-Step Guide.

The Building Block SAP ERP HCM: Base Integration Settings (C1F)configuration guide serves as a prerequisite. 2.2 How to Use This Configuration Guide This configuration guide is designed to simplify the work to deploy and configure the entire or a specific scope of this Packaged Solution. The latest supports four scenarios: Basic Employee, Compensation, Recruiting and Workforce Analytics data. From a process integration view, you do not have to configure all available scenarios in this Packaged Solution scope. Which process you want to configure depends on your business requirements. For instance, you can choose to only configure the Compensation or Recruiting data scenario. But we recommend configuring at least the employee data scenario since it is the basis for the other scenarios. Regardless of the process(es) you want to configure in Integration Directory, you should make sure that the corresponding HCM customization described in C1F has been successfully performed and that the full BizX content (for all scenarios) is always deployed on to the tenant. 2.3 Parameter Sheets The following sheets are considered to help you through the configuration phase of this Packaged Solution. All information relevant to the configuration is listed here.

We recommend using the corresponding free text fields to note all relevant parameters. 2.3.1 Files Provided by SAP Standard HCM SuccessFactors BizX Content can be downloaded from the HCI Tenant using following URL:

© SAP AG Page 5 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

itspaces URL /itspaces Example: https://tmvb008avlb032avtvlb- avlb032.hana.ondemand.com/itspaces

© SAP AG Page 6 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

itspaces is only supported with IE9 or above. An Alternate browser ex: Mozilla Firefox can also be used to access itspaces. Procedure

Within the HCI itspaces WebUI it is possible to download or directly deploy the HCM / SuccessFactors BizX Integration content to the selected tenant. Both paths can be used to deploy the content on the HCI tenant. 1. Choose Catalog 2. Select ‘SuccessFactors BizX Talent Management integration with SAP ERP HCM (1305) ‘ 3. It is possible only to implement those processes which are required. In order to download these projects, click on ‘Actions’ icon against each Integration Project and select ‘Download’ 4. Save the Archive file in a local Directory. 5. If you want to directly deploy the integration content to the HCI tenant you can use the gear-wheel icon next to Download button, marked as ‘Click to deploy’.. 2.3.2 Parameters Provided by Customer

The customer must provide the following parameters. You can use the following template list to insert the necessary content.

© SAP AG Page 7 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

SuccessFactors Connection Details URL of SuccessFactors server SFSF Company ID of customer SFSF account name of customer

SAP ERP HCM Connection Data SID of HCM System Hostname of HCM System < SAP_ERP _port> HTTP Port of HCM System Client of HCM System

3 Configuration The configuration defined in this section covers:  Set connectivity between SAP ERP and HCI  Set up Project and create Configuration Objects in HCI  Set up Connectivity between HCI and SuccessFactors System 3.1 Setting up Connectivity between SAP ERP and HCI Use The purpose of this section is to describe how the connection between the application system (SAP ERP HCM) and the HCI Tenant can be set up. A successful setup of this connection allows the Add-On to send extracted data to the HCI Tenant, which will then replicate the data to SuccessFactors BizX.

The steps described in this section must be performed only when the connection setup between the SAP ERP and the HCI Tenant does not exist. If such a connection has already been set up, you can skip this section.

© SAP AG Page 8 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

SuccessFactors BizX HCI

SAP Customer OnDemand

HCM

To connect an application system (in this case SAP ERP) to the HCI Tenant, the following information must be available for the application system:

© SAP AG Page 9 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Field Data Comments

SID for example, EC6 3 coded system-ID from the HCM system which contains the source data

Client for example, 120 The client in the system-ID (SID) which contains the source data

© SAP AG Page 10 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

This set of information is unique for every system (productive, test, development). For HCI Tenant, the following information must be provided:

© SAP AG Page 11 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Field Data

Tenant ID for example, avlb032

Tenant Ops URL for example, https://tmvb008avlb032avtvlb- avlb032.hana.ondemand.com

Worker node URL for example, https://iflmapvb008avlb032avtvlb- avlb032.intaas.hana.ondemand.com

© SAP AG Page 12 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

3.1.1 Setting up HCM SuccessFactors Scenarios in Eclipse Use For the HCI content development and monitoring a new toolset has been implemented based on Eclipse. So before installing the HCI tooling itself you need to install Eclipse. Procedure 1. Download and install Eclipse Classic 4.2.2 IDE from the list available in Eclipse Juno Sr2 Packages page(JRE1.6) 2. In the Welcome page, open the Developer's Workbench. 3. From the main menu, choose Help > Install New Software... 4. In the Available Software page of the Install wizard, add the update site URL mentioned below:

© SAP AG Page 13 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

HCI Tools URL https://tools.hana.ondemand.com/juno

© SAP AG Page 14 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

5. Select the following three options:  Show only the latest version of available software  Groups items by category  Contact all update site during install to find required software. 6. Select the SAP HANA Cloud Integration Tools category. 7. Choose Next. 8. Check the features selected for installation and choose Next. 9. Accept the terms of licensing agreement and choose Finish. 10. Restart the Eclipse IDE. Once you have done this, you should be able to see following new Perspectives: 1. Integration Designer 2. Integration Operations Next Step would be to import the content downloaded from itspaces into Eclipse, as mentioned above: Procedure 1. Open Eclipse, switch to Integration Designer Perspective using Window  Open Perspective  Other  Integration Designer 2. Select File  Import 3. Select General  ‘Existing Projects into Workspace’ 4. Select Archive File, Choose Browse to locate the zip file for the scenario. Repeat this step for each Archive file. Once you have imported the Archive file, a Project as follows should appear in Eclipse Project Explorer

© SAP AG Page 15 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Project Node Content

Root Node for example, com.sap.SFIHCM01.hcm2bizx.SFSFAPIDictionaryDescribeSFObjectsExResult

Resources src.main.resources - parameters.prop - parameters.propdef

Mapping src.main.resources.mapping - Operation Mappings(.opmap) - Message Mappings(.jar) - XSLT Mapping

iFlow src.main.resources.scenarioflows.integrationflow

WSDL src.main.resources.wsdl

Build target.build

Manifest META-INF - MANIFEST.MF

Build.properties

© SAP AG Page 16 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

3.1.2 Certificates Use HCI services are secured by certificates. So in order to directly trigger HCI services via SOAP UI you will have to include your certificate into the build and deploy it to the operations server. For the backend connection a generic SAP certificate for the backend needs to be included into the build. 3.1.2.1 Obtaining Personal Certificate and Keystore Use For accessing the WSDL for your deployed services on the operations server and for directly triggering the services via SOAP UI you will need to export your certificate and include it in the build. SOAP UI needs a keystore file for authentication. SAP Passport CA can be used for selftest.via SOAPUI. Please find below the steps to generate SAP Passport CA:

Pre-requisite: In order to generate an SAP Passport CA, you must have a user in SMP. a. Generate SAP Passport CA from SMP (Service Market Place) Procedure The following procedure takes place in the background when you apply for your SAP Passport on the Applying for the SAP Passport page: 1. Your browser generates a key pair 2. Your browser sends the public key to the SAP Trust Center Service 3. The SAP Trust Center Service checks your application and password 4. The SAP Trust Center Service answers with a signed certificate, the SAP Passport 5. The SAP Passport is installed in your browser. You can find more information at:

© SAP AG Page 17 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Service Marketplace URL https://websmp203.sap- ag.de/~sapidp/002006825000000038452001E b. In order to use the SAP Passport CA, you need to export the key-pair from your browser. It may not be possible to export the key-pair from IE due to security- constraint. Please refer to the following blog for possible workaround to export the keys: SCN Blog http://scn.sap.com/community/about/blog/2011/05/03/sso- with-your-sap-passport-to-scnmarketplace-on-iphoneipad

c. From this generated key pair, typically you will use the private key to send the request from SOAPUI and public key certificate will be imported in the iFlow.

SoapUI could be downloaded from http://www.soapui.org | http://www.smartbear.com Procedure 1. In the SOAP client, go to File  Preferences 2. Go to HTTP Settings – uncheck the “Accept compressed responses from hosts” 3. In Proxy Settings enter the values of Host and Port. 4. In SSL settings, browse and select public-private key and enter the corresponding password. 3.1.2.2 Obtaining Backend Certificate Use HCI services should be triggered by the proxies in the ERP backend so there needs to be a certificate that authenticates this system. In order to export this certificate for including it into the build of the iflows, logon to the system and run transaction STRUST. Procedure 1. Run transaction STRUST 2. Choose SSL Client SSL Client (Standard) 3. Double choose the entry for Own Certificate. Once this is done, you should be able to see Certificate details in the Certificate section 4. Choose Export Certificate button at the bottom under Certificate Details There are two options to achieve the SSL connectivity. It depends on your choice to use either option 1 or option 2 3.1.2.2.1 Option 1: Using SSL Client Standard If the backend system identifies itself using an internal certificate, this is not accepted by the HCI factory landscape servers, because they are signed by a non-trusted CA. In that case you have to manually request a new certificate and setup the backend system accordingly. Procedure 1. Run transaction STRUST 2. Create a certificate request via menu Edit  Create Certificate Request

© SAP AG Page 18 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

3. Copy the text displayed in the dialog box, this will be needed when ordering the certificate 4. To order the Certificate, go to

© SAP AG Page 19 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

SAP Trust Center Service https://service.sap.com/TCS

© SAP AG Page 20 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

5. Choose SSL Server Certificates under Service Corner 6. Choose Order button to start the Order Process 7. Once Order process is completed, you can Import Certificate Response via: Edit  Import Certificate Response

You need to have required authorization(SSL Certificate Administrator) to order an SSL Server Certificate 3.1.2.2.2 Option 2: Use your own SSL Client PSE Use If you don’t want to use SSL Client Standard, you need to create a separate PSE for signing requests, and for this, you must first set up the trust manager. Procedure 1. Download SAPCRYPTOLIB from Service Marketplace:

© SAP AG Page 21 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

SAPCRYPTOLIB https://service.sap.com/swdc  Support Packages and Patches  A-Z download Index  S  SAPCRYPTOLIB link in Service Marketplace

© SAP AG Page 22 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

2. Generating a PSE and Self-Signed Certificate for the Application Server

© SAP AG Page 23 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Command Syntax

To generate a PSE for the application sapgenpse get_pse -p server containing a D:\usr\sap\ABC\DVEBMGS28\sec\ABC.pse self-signed -noreq -x abcpin "CN=ABC, OU=Test, O=MyCompany, C=DE" certificate. No certificate request is needed Where SID = ABC abcpin = The PIN that protects the PSE CN=ABC, OU=Test, O=MyCompany, C=DE is Server’s distinguished name 3. Next you can import Private key of your Passport CA Certificate/SSO_CA Certificate to this PSE using following command:

Command Syntax

To import Private key of your Passport sapgenpse import_p12 -p ABC.pse .p12 CA Certificate to the PSE

© SAP AG Page 24 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

4. Create a new entry for your SSL Client in table STRUSTSSL: a. Execute transaction SE16 b. Enter tablename as STRUSTSSL c. Choose ‘Create Entries’ d. Choose ‘New Entries’ e. Enter the name, for example HCISSL, of new SSL Client with Description 5. Import this PSE in STRUST: a. From the Menu, select PSE  Import b. Browse to select PSE created in step 2 c. Select PSE  Save As d. Select SSL Client and choose the new SSL Client created in step 4 from the dropdown list Once you have done this, Backend system would be able to access HCI using your SAP Passport CA/SSO_CA Certificate.

It is recommended not to use SAP PassportCA/SSO_CA Certificates for productive use. Instead Certificates signed by valid CAs need to be ordered at SAP Trust Center Service

3.1.2.2.3 Importing Server Certificate for Reverse Proxy The SAP ERP system must be able to connect to the Internet via https protocol as a prerequisite for communication from SAP ERP to the Cloud solution (as well as end-to-end from ERP to the Cloud solution). The Cloud solution tenant can only be reached by a reverse proxy used in the SAP cloud network. The server certificate of this reverse proxy is signed by the following certification authorities (CAs):  Cybertrust Sure Server Standard Validation CA  GTE Cyber Trust Global Root You must import the certificates of the above mentioned CAs into the SAP ERP system in transaction STRUST.

This step has to be performed in both the cases mentioned above, i.e. with SSL Client Standard or own SSL Client PSE Import the certificates into the folder SSL Client (Standard)/ Own SSL Client PSE Node for authentication with client certificate. You can obtain these certificates from Verizon certificate services at:

© SAP AG Page 25 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Verizon Certificate https://secure.omniroot.com/support/sureserver/rootcert.cfm Services

© SAP AG Page 26 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Procedure 1. Choose SSL Client(Standard) or your own SSL Client PSE Node 2. Choose ‘Import Certificate’ button on the bottom of the screen 3. Select each Certificate 4. Enter 5. Choose ‘Add to Certificate List’ 6. Once this is done, these Certificates should be visible under Certificate List. 3.1.3 Creation of Logical Ports in SOAManager Use To be able to test the integration via HCI instead of PI it should be possible to switch where a call triggered by a backend consumer proxy is routed to. This is possible via logical ports. They decide where a call triggered by a consumer proxy in the backend is finally processed Procedure 1. In Backend System, run transaction SOAMANAGER: 2. Select Web Service Configuration 3. Enter Search Criteria, as

© SAP AG Page 27 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Object Type: Consumer Operator: contains Expression: SFSF* Proxy

© SAP AG Page 28 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

4. For each Consumer Proxy, we need to create a Logical Port: a. Select Consumer Proxy b. Choose Create, select manual Configuration c. Enter Logical Port Name and Description d. Next e. Select X.509 SSL Client Certificate under Authentication Settings f. For X.509 SSL Client PSE, in case, you are using your own SSL Client, select your SSL Client, else, select DFAULT g. Next h. Enter values on screen “Transport Binding”

© SAP AG Page 29 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Field Value

URL Access 1. In Eclipse under Windows Preferences  SAP HANA Cloud path Integration  Operations Server enter the tenant URL, user and password. Save Settings. 2. under Node Explorer, Choose IFLMAP Node 3. Under Properties, go to Services tab 4. Copy the endpoint for respective service 5. Enter part of Endpoint starting with /cxf/.. would be URL Access path For example: /cxf/hcm2bizx/SFSFAPIDictionaryDescribeSFObjectsExResult

Computer Worker Node URL Name of Example: Access URL iflmapvb008avlb032avtvlb- avlb032.intaas.hana.ondemand.com

Port Number of 443 (for SSL) Access URL

URL Protocol HTTPS Information

Name of Proxy Proxy Details, example: proxy.wdf.sap.corp Host

Port Number of Proxy Port, example 8080 Proxy Host

Compress False Response

© SAP AG Page 30 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

i. Next j. Under Message ID (Synchronous), select ‘Suppress ID Transfer’ as Message ID Protocol k. Next l. Check ‘Suppress sending of IBC Identifier’ m. Next n. Under Transport Binding, check ‘Use non-default value for SOAP Action’ o. Under WS Addressing, check ‘Use non-default value for Inbound Message Action’ p. Choose Finish

For every Logical Port, Set to Default should be set to True These steps have to be repeated for each Webservice Proxy. 3.2 Setting up Connectivity between HCI and SuccessFactors System 3.2.1 Using Basic Authentication

In order to access Successfactors system using Basic Authentication, an artifact of Type Basic Authentication, needs to be deployed on HCI tenant:

Procedure

1. In Eclipse, double choose Tenant ID under Node Explorer 2. On right hand side, Message Monitoring and Deployed Artifacts tabs should be visible 3. Switch to Deployed Artifacts 4. Choose Deploy 5. Select ‘Basic Authentication’. Choose Next 6. Specify details under Deploy Credentials as follows:

© SAP AG Page 31 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Field Value

Type SuccessFactors

Name Free text, example sfsf_acexbc

It is recommended that the Name contains SuccessFactors Company ID to make it more informative

Description Free text

User SuccessFactors User, example, admin

Password Self- explanatory

Repeat password Self- explanatory

© SAP AG Page 32 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

7. Next 8. Server URL and Company ID

© SAP AG Page 33 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

Command Syntax

Server URL SuccessFactors System URL, example https://salesdemo4.successfactors.com:443/sfapi/v1/soap

Company ID SuccessFactors Company ID, example, acexbc

© SAP AG Page 34 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

9. Choose Finish. This Object of type CREDENTIALS, should now be available under Deployed Artifacts. 3.2.2 Using Certificate Authentication To set up Certificate Authentication, a keystore needs to be setup on HCI containing the certificates from the SFSF BizX system enabling a SSL handshake between both systems.

The setup of the keystore is divided into two separate tasks: 1. Keystore Creation: You first create a keystore file containing the client certificate. The client certificate is used by the client (HCI) to authenticate itself when calling the server (SFSF BizX). This certificate needs to be signed by a certification authority (CA). In addition to that, a server certificate is required that ensures that the client (HCI) can trust the server (SFSF BizX). This server certificate needs to be exported from SFSF BizX system and imported into HCI. 2. Keystore Deployment on HCI: The keystore needs to be deployed on the corresponding runtime nodes of HCI using the Operations View in the HCI Eclipse Environment. 3.2.2.1 Obtain SFSF BizX Server Certificates Procedure 1. Open SuccessFactors Server URL in Internet Browser

It is recommended not to use Internet Explorer, as it is not possible to export Certificate due to Security Constraints with Internet Explorer. An alternate Browser, example, Firefox can be used for this purpose. Steps mentioned here refer to Mozilla Firefox. 2. Choose Lock icon on Address Bar 3. Choose ‘More Information’ 4. Choose ‘View Certificate’ 5. Switch to Details tab 6. A Certificate chain of three certificates is available 7. Select each level and choose ‘Export’ to export all three Certificates belonging to the Certificate chain 3.2.2.2 Keystore Creation Use KeyStore Explorer is a free GUI replacement for the Java command-line utilities keytool, jarsigner and jadtool. KeyStore Explorer presents their functionality, and more, via an intuitive graphical user interface. Procedure 1. Download the KeyStore Explorer Software, Version 5.0.1, from here: Download link http://keystore-explorer.sourceforge.net/downloads.php

2. Launch KeyStoreExplorer Tool 3. Go to File  New

© SAP AG Page 35 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

4. Select JKS as New KeyStore type 5. Add the three SFSF certificates of SuccessFactors Certificate chain (as mentioned in section 3.2.2.1 Step 7) by using the “Import Trusted Certificates” function from the tool bar 6. Save KeyStore. Select File  Save 7. Set Password for KeyStore. 3.2.2.3 KeyStore Deployment on HCI

Keystores can only be deployed by HCI Administrator roles. Usually customers only get Integration Developer roles and need to send the necessary keystore to SAP Integration Consultants or raise a ticket to Cloud Managed Services who will deploy the keystore on the HCI tenant. Procedure 1. In Eclipse Integration Designer Perspective, double choose Tenant Node ID under Node Explorer to make Message Monitoring and Deployed Artifacts tabs visible. 2. Switch to Deployed Artifacts tab 3. Choose Deploy 4. Select Keystore 5. Choose Browse to select KeyStore File created as per the steps mentioned in section 3.2.2.2 6. Enter password for KeyStore file 7. Choose Finish 3.3 Adjusting Scenarios in Eclipse 3.3.1 Adjust Sender System in iFlow to include Backend Certificate: Procedure 1. Open iFlow under src.main.resources.scenarioflows.integrationflow node in respective Eclipse Project 2. Double Choose Sender system and switch to Properties tab 3. Select Certificate Authentication 4. Choose Browse and select SAP Passport CA/ Backend Certificate saved in your local Directory as explained in section 3.1.2.2 3.3.2 Adjust Receiver SOAP Adapter for SOAP URL and to use Basic Authentication/Certificate Authentication Procedure 1. Choose Receiver SOAP adapter in iFlow 2. Switch to Adapter Specific tab 3. Enter SOAP Address (SuccessFactors Server URL) 4. Check ‘Connect using Basic Authentication’

Do not check this option in case Certificate Authentication is used 5. Enter Credential Name as set in Section 3.2.1

© SAP AG Page 36 of 37 SAP Best Practices Hana Cloud Integration: Setup & Configuration: Configuration Guide

All other parameters, for example, parameters in SOAP Sender Channel, need not be changed, as these parameters have been externalized and will be retrieved from Properties file 3.3.3 Deploying the Scenarios on HCI Tenant Once all Scenarios have been adjusted, they need to be deployed on the tenant. In order to do this, first of all, we need to enable access to HCI tenant via Eclipse Procedure 1. Go to Windows -> Preferences ->SAP HANA Cloud Integration. 2. Enter Tenant Ops URL, ex: https://tmvb008avlb032avtvlb- avlb032.hana.ondemand.com 3. Enter your SCN/S-User and Password and click on ‘Test Connection’ to check the connectivity.

If you would like to change your SCN password, go to http://scn.sap.com/ and choose your profile by clicking on your avatar image, then choose “Change Password” within the “Actions”-Box on the right hand side. 4. Right click on respective Project, select ‘Deploy Integration Content’ Switch to Deployed Artifacts tab to check if deployment is successful, in this case, it should be available under Deployed Artifacts.

4 Troubleshooting 1. Handling Database update error resulting from long names of Integration Projects: Deploy failed for project(s) with error [NodeCommon][PERSISTENCE][ErrorInsertEntry]:Error occurred while inserting entities: [cf4b492f-de99-44d8-96da-bf3e0311b77e]. javax.persistence.RollbackException: Exception [EclipseLink-4002] (Eclipse Persistence Services - 2.4.1.v20121003-ad44345): org.eclipse.persistence.exceptions.DatabaseException Internal Exception: java.sql.BatchUpdateException: JZ0BE: BatchUpdateException: Error occurred while executing batch statement: Data exception - string data right truncated This error could appear because of long names of some Integration Projects. Procedure a. Open MANIFEST.MF File under META-INF folder in Integration Project b. Change the text in ID and Name field to make it bit short. c. Save changes. d. Deploy the scenario again on HCI Tenant. 2. Debugging Webservice calls: Procedure a. Login to HCM system b. Run transaction srt_util c. Right click on Users & Terminals & Request URI d. Add your user e. Under Configuration Tab set Payload Trace to active. f. Click ‘Save Configuration’ g. Run scenario h. Switch to Payload Trace tab and double click on entries to check error details.

© SAP AG Page 37 of 37