Secure Network Communication (SNC)

Secure Network Communication (SNC) is an SAP-specific layer in the SAP system architecture that provides Application-Level Security for communication between various SAP components and between SAP systems and external clients.¹ It sits on top of the network layer (TCP/IP) and provides enhanced security services that the standard network infrastructure might not offer.

SNC uses external security products (e.g., SAP NetWeaver Single Sign-On, Microsoft Kerberos, various PKI-based products) to implement its security features.² It's crucial for achieving Single Sign-On (SSO), data confidentiality, and data integrity for SAP communication.³

I. What is SNC? (Detailed Explanation)

SNC enhances the security of network communication in SAP by providing the following services:

Authentication:
- User Authentication: Verifies the identity of the communication partner (e.g., an SAP GUI user, another SAP system, a third-party application).⁴ This is often the basis for Single Sign-On (SSO), where a user authenticates once to their operating system/domain and then automatically gets authenticated to SAP without re-entering credentials.
- System Authentication: Verifies the identity of the SAP application server or the other communication partner (e.g., Gateway, Message Server).
Confidentiality (Encryption):
- Encrypts the data stream flowing between the communication partners. This prevents eavesdropping and ensures that sensitive data (passwords, business data) cannot be read by unauthorized parties if intercepted.⁵
Integrity (Message Integrity Protection):
- Ensures that the data exchanged between communication partners has not been altered or tampered with during transmission.⁶ It uses cryptographic checksums to detect any unauthorized modifications.
Quality of Protection (QoP) Levels:
- SNC allows you to define different levels of security, known as Quality of Protection (QoP) levels, for various communication paths.⁷ This enables a flexible security approach, balancing security requirements with performance overhead.
- 1 (Authentication Only): Only mutual authentication is performed. No encryption or integrity protection. Lowest overhead, lowest security.
- 2 (Integrity Protection): Authentication + Integrity. Data is protected against tampering, but not encrypted. Moderate overhead.
- 3 (Confidentiality Protection): Authentication + Integrity + Confidentiality (Encryption). Data is protected against tampering and is encrypted.⁸ Highest overhead, highest security.
- 8 (Maximum available): Uses the strongest protection available by the underlying security product.
- 9 (Default protection): Uses the default protection level configured in the system.

SNC is used for:

SAP GUI to Application Server: Securing user logons from SAP GUI.⁹
Application Server to Application Server: Securing RFC communication between SAP systems (e.g., ECC to BW, S/4HANA to GRC).
Application Server to Gateway/Message Server: Internal communication within an SAP system.
Application Server to Database Server: Securing database connections (though native DB encryption is also common).
Application Server to External Systems: Securing communication with third-party applications or non-SAP systems that support SNC.¹⁰

How SNC Works (High-Level):

SNC relies on an external security product (also known as a GSS-API V2 library).¹¹ SAP provides the framework, but the actual cryptographic operations are handled by this external library.

GSS-API V2 Library: This is a shared library (DLL on Windows, .so on Unix/Linux) provided by the security product vendor. SAP interfaces with this library using the Generic Security Services Application Programming Interface (GSS-API) standard.
Credentials: The security product typically uses cryptographic credentials (e.g., X.509 certificates, Kerberos tickets) to identify and authenticate the communication partners.¹²
Secure Channel Establishment: When an SNC-protected connection is initiated, the SAP communication partners (e.g., SAP GUI and Application Server) use the GSS-API library to perform a handshake, exchange security tokens, and establish a secure, encrypted communication channel.

II. Setting Up SNC (Detailed Steps)

Setting up SNC involves configuring both the SAP system(s) and the external security product. The steps below provide a generic outline; specific details will vary significantly based on the chosen security product (e.g., SAP NetWeaver SSO, Microsoft Kerberos integration, third-party PKI).

Prerequisites:

Choose an SNC Product: Select an external security product that provides a GSS-API V2 compliant library.
- SAP NetWeaver Single Sign-On (SAP NW SSO): Often recommended for SAP environments, supports various authentication methods (SAML, Kerberos, X.509 certs).
- Microsoft Kerberos: Common for Windows-centric environments, leveraging Active Directory.¹³
- Third-party PKI Solutions: (e.g., OpenSSL-based, Entrust, RSA) for certificate-based authentication.
Obtain SNC Library: Get the GSS-API V2 library (libsapcrypto.so, sapcrypto.dll, or similar) from your chosen product vendor.
Establish Trust (Certificates/SPNs): Depending on the product, you'll need to set up:
- PKI: Generate and distribute X.509 certificates (public/private key pairs) for each SAP application server and potentially each SAP GUI client.
- Kerberos: Create Service Principal Names (SPNs) in Active Directory for each SAP application server.¹⁴
Network Configuration: Ensure network ports are open and firewalls allow SNC traffic (typically the standard SAP ports, but secured).

Generic Setup Steps:

A. On Each SAP Application Server (ABAP):

Install SNC Library:
- Place the SNC GSS-API V2 library file (e.g., libsapcrypto.so for Unix/Linux, sapcrypto.dll for Windows) into a secure directory on the SAP application server, typically /usr/sap/<SID>/SYS/exe/run or a dedicated SNC directory.¹⁵ Ensure it has correct permissions.
Configure Environment Variables:
- Set the environment variable SNC_LIB to the full path of the SNC library file for the <sid>adm user (Unix/Linux) or <SID>adm service user (Windows).¹⁶ This ensures SAP processes can find the library.
- Example (Unix): export SNC_LIB=/usr/sap/security/sapcrypto.so
- Example (Windows): set SNC_LIB=C:\SAP\security\sapcrypto.dll
Configure Profile Parameters (RZ10/RZ11):
- Modify the instance profile of each application server to enable SNC and define its behavior.¹⁷ These parameters typically require an application server restart to take effect.
  - snc/enable = 1: Activates SNC for the application server.¹⁸
  - snc/gssapi_lib = <path_to_snc_library>: Specifies the full path to the SNC GSS-API library on the server.¹⁹ (Often redundant if SNC_LIB env var is set, but good practice to specify).
  - snc/identity/as = <SNC_Name_of_AS>: Defines the SNC name (Principal Name or Distinguished Name) of the application server.²⁰ This is how the server is identified securely.
    - Example (Kerberos): p:SAPService<SID>@<DOMAIN.COM>
    - Example (X.509): p:CN=<hostname>, OU=<org_unit>, O=<organization>, C=<country>
  - snc/accept_insecure_cpic = 1: Allows insecure RFC connections to the server (useful during migration, but should be 0 in productive environments once all secure).²¹
  - snc/accept_insecure_gui = 1: Allows insecure SAP GUI connections (should be 0 in production for GUI SSO).²²
  - snc/accept_insecure_rfc = 1: Allows insecure RFC connections (should be 0 in production for secure RFC).²³
  - snc/data_protection/min = <QoP>: Minimum Quality of Protection level for incoming connections (1, 2, 3).²⁴
  - snc/data_protection/max = <QoP>: Maximum Quality of Protection level for incoming connections.²⁵
  - snc/data_protection/use = <QoP>: Default Quality of Protection level for outgoing connections initiated by the application server.²⁶
  - snc/force_debug_output = 1: (Optional, for troubleshooting) Enables SNC debug logging to the developer trace (dev_w* files). Set to 0 after troubleshooting.
  - snc/extid_support = 1: Enables support for external IDs (e.g., for mapping Windows users to SAP users).
Create Server Credentials (PKI only):
- If using PKI (X.509 certificates), you'll need to create a Personal Security Environment (PSE) for the application server.²⁷
- Use transaction STRUST (or sapgenpse command-line tool) to create, import, and manage the server's PSE, including its private key and certificate.²⁸ The server's identity in snc/identity/as must match the DN in its certificate.
Restart Application Server: Apply the profile parameter changes by restarting the SAP application server instance(s).

B. On Each SAP GUI Client:

Install SNC Client Software:
- Install the client component of your chosen SNC product on each user's workstation (e.g., SAP NetWeaver SSO client, Kerberos client tools, or a certificate management tool).
Configure SAP Logon Pad:
- In SAP Logon Pad, open the connection properties for the desired SAP system.
- Go to the "Network" tab.
- Check "Activate Secure Network Communication."
- SNC Name of Partner: Enter the exact SNC name of the SAP application server (matching snc/identity/as parameter).
- SNC Library: Browse to the client-side SNC GSS-API library (sapcrypto.dll or similar) on the workstation.²⁹
- QoP: Set the desired Quality of Protection level (usually 3 for Confidentiality).
Map External IDs to SAP Users (SU01):
- In SU01 for each SAP user, go to the "SNC" tab.³⁰
- Enter the user's external SNC name (e.g., their Kerberos Principal Name or X.509 Distinguished Name).³¹
- This maps the external identity to the internal SAP user ID, enabling SSO.³²
- Example (Kerberos): p:<Windows_User_ID>@<DOMAIN.COM>
- Example (X.509): p:CN=<User_Name>, OU=<Org_Unit>, O=<Organization>, C=<Country>

C. For RFC Communication Between SAP Systems (SM59):

Configure Both Source and Target Systems: Ensure SNC is enabled on both the calling (source) and called (target) SAP application servers as per section A.
Configure RFC Destination (SM59):
- Open the RFC destination in SM59 (e.g., for A->B communication, configure SM59 on A pointing to B).
- Go to the "Logon & Security" tab.
- Under "SNC," check "SNC active."
- Partner SNC Name: Enter the snc/identity/as value of the target application server.
- My SNC Name: (Optional, but recommended) Enter the snc/identity/as value of the source application server.
- Protection Quality: Set the desired QoP.
- Map RFC User: If the RFC destination uses a specific user ID for logon, ensure that user ID is mapped to an SNC name in SU01 on the target system.

III. Common Issues, Troubleshooting, and Solutions

SNC setup can be complex, and issues often arise due to misconfigurations, incorrect paths, or trust problems.³³

1. Issue: SNC ERROR (GSS-API) or main: gss_acquire_cred errors in dev_w* logs.

* Symptom: SAP system startup fails, or developer traces (dev_w*, dev_ms, dev_disp) show errors related to GSS-API or gss_acquire_cred.

* Cause: The SAP kernel cannot find or load the SNC library, or the library itself is corrupt/incompatible.

* Troubleshoot:

* Verify the SNC_LIB environment variable for the <sid>adm user (or service user) is set correctly and points to the correct, existing file.34

* Check permissions on the SNC library file (must be readable by SAP processes).35

* Verify the library architecture (32-bit vs. 64-bit) matches the kernel.

* Check if the library is provided by the correct vendor for your chosen SNC product.

* Solution: Correct SNC_LIB path, check permissions, replace with correct library.36

2. Issue: SNC NAME MISMATCH or Peer identity verification failed errors.

* Symptom: Connection fails (SAP GUI, RFC), and errors indicate a mismatch in SNC names.

* Cause: The SNC name configured in the client (SAP Logon Pad or SM59) does not exactly match the snc/identity/as parameter on the server, or vice versa. This can be due to case sensitivity, extra spaces, or incorrect principal names. For PKI, the client's trusted root CA doesn't trust the server's certificate.

* Troubleshoot:

* Server: Verify snc/identity/as in RZ11.

* Client (GUI): Compare SNC name of Partner in SAP Logon Pad.

* RFC (SM59): Compare Partner SNC Name and My SNC Name.

* For PKI, check STRUST on both sides to ensure certificates are valid and the correct root CAs are in the "ACL" (Access Control List) of the communication partner.

* Solution: Correct the SNC names to be identical. Ensure proper certificate trust chains for PKI.

3. Issue: SNC_DISABLED errors.

* Symptom: Error message indicating SNC is disabled.

* Cause: snc/enable = 0 in the instance profile, or the application server was not restarted after setting it to 1.

* Troubleshoot: Check RZ11 for snc/enable.

* Solution: Set snc/enable = 1 in RZ10 and restart the application server.37

4. Issue: User cannot log in with SSO, gets a password prompt instead.

* Symptom: SAP GUI connection is configured for SNC, but the user is still prompted for username/password.

* Cause:

* User's external SNC name not correctly mapped in SU01 -> SNC tab.

* snc/accept_insecure_gui = 0 (or missing) and SNC communication not fully established.

* The client-side SNC library is missing or misconfigured.38

* The external security product (Kerberos ticket, certificate) is not correctly acquired or presented by the client.

* Troubleshoot:

* Verify SNC name in SU01 -> SNC tab for the user.

* Check snc/accept_insecure_gui parameter on the server (RZ11).39

* Check SAP Logon Pad SNC library path.

* Check DEV_GUI trace (if available) on the client side, and dev_w* on the server side for SNC errors related to the user's logon.

* For Kerberos: Check klist on Windows client to see if a Kerberos ticket is acquired. Check SPN registration.

* Solution: Correct SNC name mapping in SU01. Ensure client library is present. Verify Kerberos setup (SPNs, domain trust).

5. Issue: RFC connection fails with SNC error, but direct GUI connection works.

* Symptom: Testing an RFC connection in SM59 using "Connection Test" or "Authorization Test" fails, but the same user can log into the target system via GUI.

* Cause:

* SNC parameters in SM59 (Partner SNC Name, My SNC Name, QoP) are incorrect or mismatched.

* The RFC user's SNC name is not mapped in SU01 on the target system.

* snc/accept_insecure_rfc = 0 on the target system, and SNC is not fully established for RFC.

* Troubleshoot:

* Verify SM59 SNC settings against snc/identity/as of both source and target servers.

* Check SU01 SNC tab for the RFC user on the target system.40

* Check dev_rfc.trc and dev_w* logs on both source and target systems for detailed SNC errors.

* Solution: Correct SM59 SNC parameters. Map RFC user's SNC name in SU01 on the target system.

6. Issue: Performance Degradation after SNC Activation.

* Symptom: System becomes slower, higher CPU utilization, especially during high network traffic.

* Cause: Encryption/decryption (Confidentiality protection - QoP=3) introduces overhead.41 If not properly sized or if the server hardware is weak, this can impact performance.

* Troubleshoot:

* Monitor CPU and network utilization (OS level,ST06). * Reviewsnc/data_protection/minandsnc/data_protection/useparameters. * **Solution:** * **Optimize QoP:** Re-evaluate ifQoP=3(Confidentiality) is strictly necessary for all communication paths. For internal, trusted network segments,QoP=2` (Integrity Only) might be sufficient, reducing CPU overhead.

* Hardware Sizing: Ensure the application servers have sufficient CPU power to handle the encryption/decryption load.

* Network Optimization: Ensure network latency is low.

7. Issue: STRUST errors (for PKI/X.509 based SNC).

* Symptom: PSE is invalid, certificates expired, "Peer certificate cannot be trusted."

* Cause: PSE not generated/imported correctly, root CA not imported into the correct trust list, certificates expired.

* Troubleshoot:

* Check PSE status in STRUST for each application server.

* Verify certificate chain.

* Check expiry dates.

* Solution: Regenerate/re-import PSE, import correct root CAs, renew expired certificates.

SNC is a powerful security feature that significantly enhances the protection of your SAP landscape.⁴² While its initial setup and troubleshooting can be intricate, especially when integrating with external security products, the benefits of secure communication and SSO far outweigh the complexity. Thorough planning, meticulous configuration, and systematic troubleshooting using relevant SAP tools are key to a successful SNC implementation.⁴³

Rakshit Ranjan Singh

Search This Blog