Skip to main content

Celonis Product Documentation

This documentation references a blog post on the SAP forums (indicated in orange): https://blogs.sap.com/2006/09/29/setup-data-encryption-between-rfc-client-and-web-as-abap-with-snc/

Additional to the settings in the blog article, it may be necessary to set snc/gssapi_lib in the profile.

Preparations in the SAP system

  1. To get started, we need to setup SNC on the SAP Server (Blog → Setup SNC on the ABAP Server)

  2. Save the certificate for your SAP Server's SNC PSE (Blog → Export Server Certificate)

Preparations on the extractor server

  1. To create our client PSE, from the extractor installation directory run the 'snc_create_pse.sh' script, providing your desired distinguished name and PSE password, e.g.:

    1. ./snc_create_pse.sh "CN=<YOUR_CHOSEN_CN>, OU=IT, O=CELONIS, C=DE" <your_chosen_password>

  2. Now add the certificate from step 2 above by running the 'snc_add_pse_cert.sh', providing the same PSE password provided when generating it e.g.:

    1. ./snc_add_pse_cert.sh ~/IDES.crt <your_chosen_password>

  3. As part of step 1 a client certificate is also generated named 'RFC.crt'. Import it into your SNC PSE on the SAP system (Blog → Import Client Certificate to Server PSE)

  4. Start the extractor using ./start_with_snc.sh (if started from outside of the extractor installation directory then please provide it as a parameter to the script)

  5. Use the distinguished name of the SAP Server's SNC PSE certificate as the SNC partner name in your Data Connection, e.g 'p:CN=IDES, OU=DEV, O=CELONIS, C=DE' (don't forget the p!)

Steps 2 - 3 can be repeated for each SAP Server you wish to connect to, afterwards just create separate Data Connections with the appropriate SNC partner names

Considerations when running as a Windows service

The provided 'install_with_snc.bat' will install a Windows service that bootstraps the extractor for SNC connections.

  1. Open the Administrative Tools > Services window on your Windows server

  2. Stop the service

  3. Open the Properties > Log On dialog

  4. Change the service user account to the user that ran 'snc_create_pse.bat'

  5. Start the service

  6. After allowing around 20-30 seconds for the service to start up, try the connection test