Authenticate users using X.509 Authentication

Authenticate an end user using X.509 Server and manage communication between SMP and Gateway system using HTTPs ports.

Rule-based certificate mapping (transaction CERTRULE) enables mapping of users from parts of the subject or the subject alternative name of an X.509 certificate for a given issuer to the user ID or alias of a user master record. With a few rules, you can enable logon with X.509 certificates for all users. The tool also enables you to load an X.509 certificate and check if a rule applies to the certificate and if the certificate maps to a user. For individual users that do not map to the rules you create, you can create exceptions.

Ensure you have,

• Access to SAP Mobile Platform as an Administrator (SMP Admin Cockpit)
• Access to SAP Gateway System
• GW Basis roles
• List of Gateway documents that need to be checked
• Completed configuration as described in Authenticate users using HTTPs Authentication
• Authorization objects:
  • CC control center: System administration (S_RZL_ADM)
    • Activity 03 grants display authorizations.
    • Activity 01 grants change authorizations.
• User Master Maintenance: User Groups (S_USER_GRP)
  • Activity 03 grants display authorizations.
  • Activity 02 grants change authorizations.
  • Class: Enter the names of user groups for which the administrator can maintain explicit mappings.
• Enabled the login/certificate_ mapping_ rulebased profile parameter
  • Go to RZ11 or RZ10.
  • Maintain the profile parameter login/certificate_mapping_rulebased value to 1.
  • Save the settings and close.

  

• Alias for the SAP User Name (Required for Innovapptive, as Certificate does not have SAP User Name)

Note: Once enabled, rule-based mapping replaces manual mapping in the table USREXTID. If you use the table USREXTID for certificate mapping, use transaction CERTRULE_MIG to create a set of rules based on your current entries.