10Steps2S4

[ACT]
Web Dispatcher / Web Assistant

Installed Base Conversion

February 2019
Version 2.2

1
1 Introduction................................................................................................................................................................3

2 SAP Web Dispatcher ................................................................................................................................................4

2.1 Configure ASCSxx Profile ........................................................................................................................................4

2.2 Check Web Dispatcher Admin Access..................................................................................................................10

2.3 Check Connection Web Dispatcher à SAP FIORI Launchpad ..........................................................................11

3 Get all required certificates ....................................................................................................................................12

3.1 Export the certificate from your S/4HANA system ...............................................................................................12

3.2 Getting the certificate from hana.ondemand.com ................................................................................................14

3.3 Import these certificates into the SAP Web Dispatcher .......................................................................................15

3.4 Testing the redirection & access ...........................................................................................................................16

4 Role and Catalog for the Web Assistant ...............................................................................................................18

4.1 Create a catalog in your system ............................................................................................................................18

4.2 Create role in the S/4HANA system ......................................................................................................................21

4.3 Testing the Webassistant .......................................................................................................................................23

5 Configuration rework ..............................................................................................................................................26

5.1 Adjust HTTPURLLOC.............................................................................................................................................26

5.2 Adjust RFC connections .........................................................................................................................................28

6 Expose your system to the Internet .......................................................................................................................30

6.1 Prerequisites ...........................................................................................................................................................30

6.2 Connection details: .................................................................................................................................................31

6.3 Mobile Client ...........................................................................................................................................................32

7 Appendix..................................................................................................................................................................33

7.1 Apache Virtual Host File .........................................................................................................................................33

1 Introduction
This document has the scope to explain you the steps required to complete all the activities planned for the
current work-package.

By executing the steps described in this document you will be able to understand the main procedures required
to add an SAP Web Dispatcher and perform all required configuration steps for using the Web Assistant.
2 SAP Web Dispatcher
In this section you will configure the “integrated” Web dispatcher.

2.1 Configure ASCSxx Profile

· Connect to your system using a Remote Desktop Connection from the Terminal Server

· Logon with user <SID>adm

· Navigate to this shared folder:

/10steps2s4/5Steps2FIORI
· Copy the file redirect.txt to /usr/sap/<SID>/SYS/profile

· Navigate to /usr/sap/<SID>/SYS/profile
· Edit your ASCS profile:
· Copy all the content from the input file to the end your ASCS profile
· Adjust all yellow sections to reflect your own environment
· Save and quit

· Open a terminal window

Execute the following commands:

· Stop your Instance

o sapcontrol -nr 00 -function StopSystem
· Stop Service as sidadm
o sapcontrol -nr 00 -function StopService
o sapcontrol -nr 01 -function StopService
· Start Service as sidadm
o sapcontrol -nr 00 -function StartService Kxx
o sapcontrol -nr 01 -function StartService Kxx
· Start Instance again
o sapcontrol -nr 00 -function StartSystem

Hint:
Please be patient between the commands. You can check the status using:

· sapcontrol -nr 00 -function GetSystemInstanceList

Result:

Your system is restarted.

2.2 Check Web Dispatcher Admin Access
è https://linux-asxx.kmudemo.site:44301/sap/admin/public/default.html

è Login with user webadm and password jk366SAP

è Verify that user webadm has Admin rights granted

2.3 Check Connection Web Dispatcher à SAP FIORI Launchpad
Connect to the FIORI Launchpad:

https://linux-asxx.kmudemo.site:44301/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html

You should get an error connecting to the launchpad through the Web Dispatcher
3 Get all required certificates
3.1 Export the certificate from your S/4HANA system
Connect to the FIORI Launchpad (ICM):

https://linux-asxx.kmudemo.site:44300/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html
Use the Certificate Export Wizard to save to a local file:
3.2 Getting the certificate from hana.ondemand.com
Get the root certificate for https://cp.hana.ondemand.com so that SAP Web Dispatcher recognizes the SSL
certificates:
1. Open the URL https://cp.hana.ondemand.com in Google Chrome.

2. Click on the Lock and proceed as before

3. Open the Security tab.

4. Select View Certificate.

The Certificate dialog box is opened.

5. Select the Certificate Path tab.

6. Select the root certificate and select View Certificate.

7. Another Certificate dialog box is opened.

8. Select Details.

9. Select Copy to File...

The Certificate Export Wizard is opened.

1. Select Next.

2. Select Base-64 encoded X.509 (.CER).

3. Select Next.

4. Enter a location and file name to save the file (i.e. ondemand_cert)

5. Select Next.

6. Select Finish.

The certificate file is created.

3.3 Import these certificates into the SAP Web Dispatcher
Import the exported certificates into your SAP Web Dispatcher:

1. Open the certificate in a text editor.

2. Log on to SAP Web Dispatcher with the administration user.

For example:

-> https://linux-asxx.kmudemo.site:44302/sap/admin/public/default.html

3. Select SSL and Trust Configuration -> PSE Management.

4. Select SAPSSLC.pse in the Manage PSE dropdown box.

5. Select Import Certificate in the category Trusted Certificates.

An empty text field is opened.

6. Copy and paste the content of the certificate from the text editor.

7. Select Import.

The certificate is shown in Trusted Certificates section.

3.4 Testing the redirection & access
Check whether the redirection is working properly:

1. Test the SAP Fiori Launchpad via SAP Web Dispatcher

https://linux-asxx.kmudemo.site:44301/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html

Result:

Logon page via SAP Web Dispatcher

2. Test the redirection of the SAP content server

You can check whether the SAP content server is working properly through the proxy connection by

accessing:

https://sapwebdispatcher.dummycorp.com:44300/sap/dfa/help/odata.svc/?$format=json
 è https://linux-asxx.kmudemo.site:44301/sap/dfa/help/odata.svc/?$format=json

Displayed output:

{"d":{"EntitySets":["Transport","DeliverableForReplication","Tile","Project","Deli

verable","TransportHistory","TourIssue","ReplicationTourIssue","Hotspot","Product"

,"Context"]}}

3. Test the redirection of the Web Assistant server

You can check whether the Web Assistant server is working properly through the proxy connection by

accessing:

è https://linux-asxx.kmudemo.site:44301/resources/sap/dfa/help/sap/cfg/XrayBootstrapHelpConfig.json

Displayed output

"description":"This configuration registers the Xray bootstrap plug-in",

"modulePaths":{

"sap.dfa.help":"/resources/sap/dfa/help/~201509221536~"

},

"bootstrapPlugins":{

"BootstrapXrayPlugin":{

"module":"sap.dfa.help.utils.adapters.fiori.BootstrapXrayHelpPlugin"

}}}
4 Role and Catalog for the Web Assistant
4.1 Create a catalog in your system
Logon to your system:

https://linux-asxx.kmudemo.site:44301/sap/bc/ui5_ui5/sap/arsrvc_upb_admn/main.html?scope=CUST&sap-
client=100&sap-language=EN

Create a new catalog:

Add a target mapping:
4.2 Create role in the S/4HANA system
· Logon to your S/4HANA system
· Call transaction PFCG
· Create role Z_HELP_ROLE
Insert a Fiori Tile Catalog that points to the newly created catalog

Assign the role to your user

Save
4.3 Testing the Webassistant

https://linux-asxx.kmudemo.site:44301/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html

Logon to your system

Click on this new icon to turn the Web Assistant on:

You now have a working Web Assistant:
è Example with the app “List Incomplete Sales Documents”
5 Configuration rework
Every time you change the architecture of your SAP Fiori configuration (i.e. from ICM to SAP Web Dispatcher
etc.) you need to adapt your settings:

5.1 Adjust HTTPURLLOC

Tx: SE16
Replace with you own host and domain info:

è Your Web Dispatcher is running on port 44301 (adapt accordingly)

5.2 Adjust RFC connections
You have to adjust some RFC connections in order to reflect your own environment:

Tx: SM59

HTTP Connections:

è This depends on your configuration.

These destinations must also point to your SAP Web Dispatcher.
6 Expose your system to the Internet
6.1 Prerequisites
In order to provide a secure access from the "outside" of your company network, you would at least have a
Reverse Proxy installed in the DMZ (see below):
6.2 Connection details:
We have created a virtual host for every group.

https://<pxx>.kmudemo.ch/logon Example: https://p00.kmudemo.ch/logon

User and password are all known to you.

Hint:

Please think about your configuration adjustments, especially SAPGUi for HTML etc.

i.e. see chapter 5.

6.3 Mobile Client
Once you have your roles working, you can access it from a public web connection:

Install Mobile Client

Install the Mobile Client from the App Store on your mobile device:

è This client requires an officially signed certificate (is available as part of the 10Steps2S4 Reverse Proxy
setup)

Note: On some Android based frontends, you can get certificate errors.
7 Appendix
7.1 Apache Virtual Host File
<VirtualHost *:1443>

ServerName p00.kmudemo.ch

ErrorLog logs/p00.error.log

CustomLog logs/p00.custom.log common

LogLevel info

ProxyPreserveHost On

AllowEncodedSlashes On

ProxyErrorOverride On

DocumentRoot /var/www/errors/

ProxyPass /error-documents !

ErrorDocument 401 /error-documents/error.html

ErrorDocument 403 /error-documents/error.html

ErrorDocument 404 /error-documents/error.html

ErrorDocument 500 /error-documents/error.html

ErrorDocument 502 /error-documents/error.html

ErrorDocument 503 /error-documents/error.html

ErrorDocument 504 /error-documents/error.html

Alias /error-documents /var/www/errors

RewriteEngine On

SSLEngine On

SSLProtocol all

SSLCertificateFile sec/kmudemo_wc.cer

SSLCertificateKeyFile sec/kmudemo_wc.key

SSLProxyEngine On
10Steps2S4 – Fiori Extension

SSLProxyVerify none

SSLProxyCheckPeerCN off

SSLProxyCheckPeerName off

SSLProxyCheckPeerExpire off

SSLProxyProtocol all

RequestHeader set ClientProtocol HTTPS

ProxyPass /logon
https://10.0.2.80:44300/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html
nocanon

ProxyPassReverse /
https://10.0.2.80:44300/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html

ProxyPass /sap/ https://10.0.2.80:44300/sap/ nocanon

ProxyPassReverse /sap/ https://10.0.2.80:44300/sap/

ProxyPass / https://10.0.2.80:44300/ nocanon

ProxyPassReverse / https://10.0.2.80:44300/

</VirtualHost>

34
10Steps2S4 – Fiori Extension

© 2018 SAP SE or an SAP affiliate company. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP
affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered
trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. Please see http://www.sap.com/corporate-
en/legal/copyright/index.epx#trademark for additional trademark information and notices.

35