SAP BusinessObjects Server via HTTPS

Published on 11. October 2020

SAP Business Objects is a Java application. In contrast to the underlying web server, this is usually the focus when something needs to be configured.

In this article I show how to configure Apache Tomcat web server securely.

Configure HTTPS

The Tomcat web server is an open source web server that runs JAVA applications. This is installed by SAP as a standard web server. However, you can install Business Objects on other Java web servers if they are supported by SAP.

Which Tomcat version is available depends on the SAP Business Objects release. This can be found in note 2112338. There you can see that e.g. the following dependencies exist

SAP product	Tomcat version	SAP JVM	based onOracle JVM
BI 4.2 SP04	8.5.13	8.1.015	8u72

Dependencies of SAP BI on Java and Tomcat versions

This is important when it comes to the SSL configuration of the Tomcat server. The Tomcat server can basically rely on an OpenSSL or native Java Secure Socket Extension (JSSE) implementation for SSL configuration. However, OpenSSL is not installed with the SAP Business Objects installation.

Create Java keystore

With the following command we create a new keystore and set a distinguished name. At least the Common Name (CN) must be specified for this. With the extension SAN (Subject Alternative Name) we once again set the Full Qualified Hostname. This is important later with the signed certificate.

The keystore has been placed in a secure folder on which access rights are restricted.

D:\%JAVA_HOME%\bin\keytool -genkey -alias bopserver -keyalg RSA -keysize 2048 -keystore D:\secure\%COMPUTERNAME%_keystore.jks -dname "CN=hostname.example.org,OU=SAP-Basis, O=an-it, L=Halle, ST=NRW, C=DE" -ext SAN=dns:<hostname.example.org>

Create certificate request

To prevent the HTTPS connection from displaying errors in the browser, it is important to set the SAN extension and have this certificate signed by a Certificate Authority (CA). In companies, an internal Public Key Infrastructure (PKI) is usually set up to centrally manage such certificates. If the CA’s certificate is then stored in the users’ browsers, e.g. via AD group policy, there are no errors or warnings in the browser.

The certificate request was generated and the CSR file was sent to the PKI managers for signing.

D:\%JAVA_HOME%\bin\keytool -certreq -alias bopserver -file D:\secure\%COMPUTERNAME%.csr -keystore D:\secure\%COMPUTERNAME%_keystore.jks -ext SAN=dns:<hostname.example.org>

Import certificate

Once the certificate has been signed, it still needs to be imported into the keystore.

D:\%JAVA_HOME%\bin\keytool -import -alias bopserver -file D:\secure\<hostname>_chain_cert.p7b -keystore D:\secure\%COMPUTERNAME%_keystore.jks

After that, the Tomcat web server can be configured for HTTPS.

Configure Tomcat

The Tomcat server configuration is located at \tomcat\conf.

In this folder, the server.xml must be modified as follows. The connector port “8080” is used by default for HTTP. Here there is an attribute redirectPort. This is set from 8443 to 443. I would like to configure away the dedicated port specification here.

<Connector port="8080" protocol="HTTP/1.1" 
	connectionTimeout="20000" redirectPort="443" compression="on" 
	URIEncoding="UTF-8" compressionMinSize="2048" 
    noCompressionUserAgents="gozilla, traviata"
    compressableMimeType="text/html,text/xml,text/plain,text/css,text/javascript,text/json,application/javascript,application/json"
/>

<Connector port="443" protocol="HTTP/1.1" proxyName="<hostname>.example.org"
	SSLEnabled="true" maxThreads="150" 
	scheme="https" secure="true" clientAuth="false" 
	sslProtocol="TLS"  enableLookups="false" 
	disableUploadTimeout="true" acceptCount="100"  
	keystorePass="<SecurePassword>" 
	keystoreFile="D:\secure\%COMPUTERNAME%_keystore.jks" 
/>

In the lower section of the configuration, a new connector port must be configured. In addition to the port, the protocol specification is important here. With the generic specification “HTTP/1.1” the implementation is selected automatically. One can also specify a dedicated JSSE implementation:

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"        sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
...

The other attributes are then dependent on this implementation. After a restart, nothing stands in the way of HTTPS access.

Force HTTPS – HTTP redirect

However, HTTP access is still possible with the above configuration.

To force HTTPS, either disable the HTTP Connector port listed above (comment it out with ) or configure a redirect.

The redirect port is already specified in the HTTP Connector port. This must now be enforced. To do this, insert the following entries in the web.xml file in the Tomcat configuration folder and restart the Tomcat web server.

<security-constraint>
  <web-resource-collection>
  <web-resource-name>Protected Context</web-resource-name>
  <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <user-data-constraint>
  <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

Connecting SAP Lumira via HTTPS

So that the client tool Lumira can also communicate via HTTPS, the following note must also be observed.

In the axis2.xml under SAP BusinessObjects Installation>\SAP BusinessObjects Enterprise XI 4.0\warfiles\webapps\dswsbobje\WEB-INF\conf add the following entries.

<transportReceiver name="http" 
  class="org.apache.axis2.transport.http.AxisServletListener"> 
  <parameter name="port">8080</parameter>
</transportReceiver>

<transportReceiver name="https" 
  class="org.apache.axis2.transport.http.AxisServletListener">
  <parameter name="port">443</parameter>
</transportReceiver>

Afterwards the app has to be deployed. After that you can also connect to Lumira via HTTPS.