sap event stream processor: security guide

PUBLIC

SAP Event Stream Processor 5.1 SP09Document Version: 1.0 - 2014-11-26

SAP Event Stream Processor: Security Guide

Table of Contents1 Configuring Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31.1 Sandboxing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31.2 Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41.3 User Authorization Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

1.3.1 SYS_STREAMING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91.3.2 Enabling User Authorization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101.3.3 Granting Permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101.3.4 Revoking Permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121.3.5 Reviewing User Authorizations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141.3.6 Creating a Role. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151.3.7 Removing a Role. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

1.4 Secure Sockets Layer (SSL) Connections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181.5 Configuring SSL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19

1.5.1 Enabling SSL at the Project Level. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201.5.2 Disabling SSL at the Project Level. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211.5.3 Enabling SSL at the Node Level. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211.5.4 Disabling SSL at the Node Level. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

1.6 Generating an SSL Key in the Java KeyStore. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221.7 Generating PEM Format Private Keys. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241.8 Generating a TrustStore for a Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261.9 Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

1.9.1 Encrypting Passwords for Cluster Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301.9.2 Encrypting Passwords for Database Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311.9.3 Encrypting Passwords for Projects and Adapters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321.9.4 Encrypting Passwords for the Event Stream Processor Web Services Provider and ESP Studio. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331.9.5 Encrypting SSL Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341.9.6 Encrypting Passwords for Java External Adapters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

2P U B L I C© 2014 SAP SE or an SAP affiliate company. All rights reserved.

SAP Event Stream Processor: Security GuideTable of Contents

1 Configuring SecuritySet up server authentication, user authorization, and SSL connections, and encrypt passwords in configuration files.

Security in SAP® Event Stream Processor is managed centrally by the cluster manager. All projects running in a remote cluster are subject to the security rules defined for that cluster. For information on security for projects running in the local cluster, see the SAP Event Stream Processor: Studio Users Guide.

1.1 Sandboxing

Sandboxing is a security feature that allows you to restrict access to data files for projects in a cluster. Running projects in a sandboxed environment limits the directory which adapters and log stores use for reading and writing. Thus, files cannot be overwritten.

Within your operating system, a sandbox operates as a separate environment which does not disrupt other programs within your network. A sandbox limits the level of access its applications have, ensuring that adapters and ESP projects do not share data within the same workspace, which prevents overwriting important data files. You can configure adapters to read and write files within a sandboxed environment. The following Event Stream Processor adapters support sandboxing:

● File/Hadoop CSV Input and Output Adapter● File/Hadoop JSON Input and Output Adapter● File/Hadoop Event XML Input and Output Adapter● File/Hadoop XML Input and Output Adapter● File Fix Input and Output Adapter

Adapters that do not support sandboxing will point files to the specified base directory regardless of the sandbox-enabled setting. See the SAP Event Stream Processor: Adapters Guide for additional information on adapters. When sandboxing is enabled, log store paths, both relative and absolute, point to the sandbox base directory specified. See Creating a Log Store in the SAP Event Stream Processor: Studio Users Guide, and Creating a Log Store in the SAP Event Stream Processor: Developer Guide for additional information.

Sandboxing is enabled or disabled by the system administrator through SAP ESP Cockpit. See Configuring Sandboxing for an Adapter in the SAP Event Stream Processor: Cockpit Guide for additional information.If sandboxing is disabled, Event Stream Processor behavior is unchanged.

Related Information

Authentication [page 4]SAP Event Stream Processor is designed to integrate with your existing authentication framework whether you are using Kerberos, RSA, LDAP, SAP BI, SAP HANA, or your operating system’s native credential management system.

User Authorization Policies [page 6]

SAP Event Stream Processor: Security GuideConfiguring Security

P U B L I C© 2014 SAP SE or an SAP affiliate company. All rights reserved. 3

The operations that a user may perform when accessing SAP Event Stream Processor using a client interface such as SAP Event Stream Processor Studio, command line utilities, an SDK, or an adapter, are determined by the permissions that have been granted to that user.

Secure Sockets Layer (SSL) Connections [page 18]SAP Event Stream Processor supports SSL connections over the network to ensure the privacy of communication between client applications and the SAP Event Stream Processor server.

Configuring SSL [page 19]Enable or disable Secure Sockets Layer (SSL) at the node or project level using the SAP ESP Cockpit.

Generating an SSL Key in the Java KeyStore [page 22]Java keystores provide a convenient mechanism for storing and deploying X.509 certificates and private and public keys. Use keystores with Secure Sockets Layer (SSL) to have the SAP Event Stream Processor server store and read the key, to encrypt passwords for external servers and applications (like databases) to avoid storing passwords as clear text in configuration file. Also use keystores for RSA authentication because it stores user certificates.

Generating PEM Format Private Keys [page 24]Convert the Java keytool to generate private keys in privacy enhanced mail (PEM) format.

Generating a TrustStore for a Client [page 26]As part of enabling server certificate verification in SSL communication, create a TrustStore for your client which contains a root certificate of the SSL key which is signed by the certificate authority.

Encryption [page 27]SAP Event Stream Processor provides two utilities for encryption, streamingclusteradmin and streamingencrypt. These utilities support password encryption for internal adapter, service, cluster, and project configuration. SAP Event Stream Processor also provides the encrypt.sh and encrypt.bat scripts for encrypting passwords in external adapter configuration files.

1.2 Authentication

SAP Event Stream Processor is designed to integrate with your existing authentication framework whether you are using Kerberos, RSA, LDAP, SAP BI, SAP HANA, or your operating system’s native credential management system.

NoteLinux provides finger print authentication, which ESP does not support. If this is enabled in the host and ESP is using native operating system authentication, ESP may shut down unexpectedly while authenticating users.

When performing a typical installation, you are prompted to enter and confirm a password for the default cluster created by the installer. The password you enter is also used as the password for the system-created user SYS_STREAMING, which you use to log in to ESP Cockpit to assign roles and privileges for your users. When performing a custom installation, the type of server authentication you use is selected at install time. Options for server authentication include:

● Kerberos – ticket-based authentication● RSA – requires a key alias, a keystore containing a private key, and the password of the keystore● SAP HANA – requires host and port information for the SAP HANA indexserver.



● Username/password, implemented using one of the following:

○ LDAP credentials○ SAP BI credentials○ Native operating system credentials (native OS)○ Preconfigured username/password

If you need to change the authentication type after installation, use the SAP ESP Cockpit to add a new authenticator. See Add an Authentication Type in the SAP Event Stream Processor: Cockpit Guide for additional information.

When you connect to a cluster on the ESP server, your credentials are verified with the active security provider. If authentication succeeds, the server considers the user a valid client, and login is completed. You receive a session ID and, in subsequent communication, the client uses the session ID to verify itself.

NoteDo not confuse server authentication–enforced when users connect to remote clusters–with authentication on the local cluster–enforced when using the Run Project option within SAP Event Stream Processor Studio. Server authentication is enforced across your network and is designed for use in a production environment. Local cluster authentication is enforced only on a user's local machine and, like the local cluster itself, is intended for a test environment. Authentication on the local cluster is limited to username/password authentication and is based on the fixed username studio. Users can enter any password for this username to maintain a secure connection with the local cluster for the duration of the SAP Event Stream Processor Studio session. The password is maintained in memory and is not written to a disk. When the Studio session is terminated, the password is discarded from memory. When connecting to the local cluster in a subsequent SAP Event Stream Processor Studio session, users are once again required to provide a password for the fixed username studio. This password does not have to be the same password set during the previous SAP Event Stream Processor Studio session.

Authentication on the local cluster is provided automatically; there is no additional configuration required. For details on the local cluster password, see the Studio Users Guide.

Related Information

Sandboxing [page 3]Sandboxing is a security feature that allows you to restrict access to data files for projects in a cluster. Running projects in a sandboxed environment limits the directory which adapters and log stores use for reading and writing. Thus, files cannot be overwritten.

User Authorization Policies [page 6]The operations that a user may perform when accessing SAP Event Stream Processor using a client interface such as SAP Event Stream Processor Studio, command line utilities, an SDK, or an adapter, are determined by the permissions that have been granted to that user.









1.3 User Authorization Policies

The operations that a user may perform when accessing SAP Event Stream Processor using a client interface such as SAP Event Stream Processor Studio, command line utilities, an SDK, or an adapter, are determined by the permissions that have been granted to that user.

A permission consists of a privilege and privilege type, and a resource and resource type. The privilege specifies the action being permitted and the privilege type specifies the ESP elements for which that action is permitted. The resource type specifies the ESP elements on which the action is permitted, and the resource specifies a specific instance of the resource type.

NoteThe user authorization policy framework completely replaces the previous access control features of ESP. There is no migration tool for converting from the previous access control system to the new user authorization policy framework. If you implemented access control in a previous release of ESP review your policy.xml file before starting to manually implement your new user authorization policy.

The privilege portion of the permission can be any of the privileges in the table below.

Privilege Description

all Grants all privileges to a user, either for all resources or for a specific resource.

admin Grants the user administrative privileges on the specified system elements, which can be any of config, policy, rsa, and cockpit



Privilege Description

add Allows users to add resources of the specified privilege type (can be restricted by resource type and instance). For example, adding an application.

remove Allows users to remove resources of the specified privilege type (can be restricted by resource type and instance). For example, removing a workspace.

start Allows users to start resources of the specified privilege type (can be restricted by resource type and instance). For example, starting an application.

stop Allows users to stop resources of the specified privilege type (can be restricted by resource type and instance). For example, stopping an application.

control Gives users control over resources of the specified privilege type (can be restricted by resource type and instance). For example, providing runtime control over a project.

execute Allows users to execute a specific service, or all services.

read Allows users read access to resources of the specified privilege type (can be restricted by resource type and instance). For example, reading a stream.

view Allows users to view resources of the specified privilege type (can be restricted by resource type and instance). For example, viewing a project.

write Allows users to write to, or modify, elements of the specified privilege type (can be restricted by resource type and instance). For example, a stream.

Both the privilege type and the resource type can be any of the types in the table below.

Type Description

stream An element in a project for ESP that processes incoming events and produces output events.

adapter Connects ESP projects to external data sources and destinations, and handles any required data conversion.

project A set of event streams, data sources, and the continuous queries that process incoming data to produce the desired information.

application A project from the view of the host machine.

dataservice A connection to a database for reading or writing data.



Type Description

workspace One of the subdirectories within the working directory for Studio.

node A host machine, running ESP, belonging to a cluster.

cluster A group of one or more nodes that are managed as a unit.

service A stateless entity that is available to perform functions (such as discovery) for ESP.

system Specifies a privilege/resource type for administering the cluster.

all All of the items listed here.

The resource can be whatever name you have given to an instance of a resource type.

Permissions may be granted to users directly, or indirectly, through the creation of roles. A role is a set of permissions, which, once created, can be granted to either a user or another role. Usually, a role includes all of the permissions necessary to perform a particular task or function.

Permissions are administered using the streamingclusteradmin utility in either command line mode or interactive mode to execute the following commands:

● grant permission● revoke permission● get permissions● add role● grant role● remove role● get roles● get users

For information on using the streamingclusteradmin utility, including examples of granting privileges, see the SAP Event Stream Processor: Utilities Guide.

Related Information











1.3.1 SYS_STREAMING

During installation Event Stream Processor creates a special user, SYS_STREAMING, to bootstrap the implementation of your user authorization policy.

SYS_STREAMING

The predefined permissions for SYS_STREAMING are equivalent to the following grants:

grant permission view all to user SYS_STREAMINGgrant permission all system to user SYS_STREAMING

SYS_STREAMING is able to perform policy administration functions such as granting and revoking privileges.

The cluster password that you were prompted to create during the installation process is given to SYS_STREAMING when it is created.

Because this user is intended to set up user authorization policy, the standard ESP user authorization commands do not work on SYS_STREAMING. For example, get users, which lists all users granted authorization to use ESP, will not list SYS_STREAMING because it was created at installation time with a predefined set of permissions.

NoteDuring installation, the technical user for the ESP Cockpit is configured to use the SYS_STREAMING login and password.



1.3.2 Enabling User Authorization

Before you begin implementing your Event Stream Processor user authorization policy, you must start the cluster database and the cluster node.

Procedure

1. If this is your first session implementing your user authorization policy, go to the log directory underneath the directory where you installed ESP and verify that there are no errors in the init_cluster_db file.

2. Start the cluster database and the cluster node.

At the command prompt on a Linux or Solaris machine, enter the following commands to start the database and node1 of the cluster:

cd $STREAMING_HOME/cluster/config/esp1./start_db.sh./start_node.sh node1 &

To start a different node, substitute that node's name for node1.

On a Windows machine, go to the %STREAMING_HOME%\cluster\config\esp1 folder, doubleclick start_db.bat, and doubleclick start_node.bat.

3. User Authorization is enabled by default in ESP, but it can be disabled. If it has been disabled, you will get a Policy service is not enabled error message when you try to administer your user authorization policy using streamingclusteradmin. To enable user authorization, log in to the SAP ESP Cockpit, and select Security Enable Authorization Policy .

1.3.3 Granting Permissions

Control users' access to and control over Event Stream Processor by giving them only the permissions necessary to complete their assigned tasks.

Context

Permissions are granted using the grant perm command via the streamingclusteradmin utility. The syntax of the command is

grant perm <priv> [<privtype>] [on [any] <resourcetype>|<resourcetype> [<resource>]] to user|role <name>

The optional privtype, resourcetype, and resource arguments enable you to make the permissions granted to each user or role as broad or narrow as desired.



Procedure

1. Decide what tasks this user needs to perform using ESP.For example,

○ subscribe to a specific output stream to feed data into a dashboard○ administer the hardware on which ESP runs○ develop new projects○ maintain one or more existing projects○ run projects○ configure the system○ administer the authorization policy

2. For each task, identify what actions need to be performed, and on which resources.

There are three methods for granting permissions detailed in the following steps:3. Use streamingclusteradmin in interactive mode to set one permission at a time.

a. Start interactive mode. For example, a user named SYS_STREAMING with a cluster password Letmein! would enter the following to start streamingclusteradmin, in interactive mode, on the local machine:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=SYS_STREAMING --password=Letmein!

b. Execute the grant perm command for each of the permissions needed by the user.

The only required arguments are the priv (action you want to permit), whether you are granting it to a user or a role, and the name of that user or role. So, to grant permission to perform all actions, with no restrictions, to the user superuser, enter:

grant perm all to user superuser

c. The optional arguments <privtype>, <resourcetype>, and <resource> enable you to specify the type of element, the type of resource, or the specific resource for which the privilege is granted. For example, to grant the user developer1 permission to perform all actions, but only in workspace w1, enter:

grant perm all on workspace w1 to user developer1

d. To grant the role manager permission to read all streams in any workspace, enter:

grant perm read stream on any workspace to role manager

e. To grant the role subscriber1 permission to read only the stream s3, in project p7 in workspace w2, enter:

grant perm read stream on stream w1/p7/s3 to role subscriber1

f. Close the interactive session of streamingclusteradmin. Enter exit or quit.4. Use streamingclusteradmin in command line mode to run the grant perm command.

The ESP installer creates a user named SYS_STREAMING and assigns that user the cluster password entered during installation. For example, if you specified Letmein! as the cluster password during installation, to



grant a user named subscriber1 permission to read a single stream output2, in project p1, in workspace w1 using the command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=SYS_STREAMING --password=Letmein! --admin_policy --command "grant perm read stream on stream w1/p1/output2 to subscriber1"

5. Modify multiple user permissions in command line mode simultaneously using a single administration policy file.:a. Enter all desired commands granting permissions for users into a text file and save it to your machine.b. Using streamingclusteradmin --command_file to run all commands stored in that file, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysam --password=Letmein! --admin_policy --command_file=C:path/to/command/file

NoteYou can run separate command files to grant and revoke permissions and roles as needed. This may be useful in larger projects with tasks that vary over the course of time.

1.3.4 Revoking Permissions

Maintain security of Event Stream Processor by taking back permissions that are no longer required.

Context

Permissions are taken back from a role or a user using the revoke perm command via the streamingclusteradmin utility. The syntax of the command is

revoke perm <priv> [<privtype>] [on [any] <resourcetype>|<resourcetype> [<resource>]] to user|role <name>

As with the grant perm command, the optional privtype, resourcetype, and resource arguments enable you to precisely specify the scope of the permissions you revoke.

NoteHowever broadly or narrowly you specified a permission when you granted it, you must specify it exactly the same way when you revoke it. You cannot grant a broad permission, and then partially revoke it.



Procedure

1. See what permissions the user has been granted.For example, to see what permissions have been granted to user1 using the command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --command "get perm for user user1"

Or, to list the permissions granted to user1 in interactive mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!get perm for user user1exit

2. Use streamingclusteradmin to run the revoke perm command.

a. For example, to completely revoke the permission to read streams from user1 using the command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --command "revoke perm read stream from user1"

b. Or, to revoke the permission to read just the streams in workspace w1 and stream s3 in project p1, in workspace w2 from user1 using the interactive mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!revoke perm read stream on workspace w1 from user1revoke perm read stream on stream w2/p1/s3quit

c. Or, modify multiple user permissions simultaneously using a single administration policy file.Enter all desired streamingclusteradmin commands that revoke permissions for users into a stored text file. To run all commands stored in that file using command line, enter:


The file used in the --command_file option is parsed, and each line in the file is interpreted as a single command.

NoteYou can run separate command files to grant and revoke permissions and roles as needed. This may be useful in larger projects with tasks that vary over the course of time.



1.3.5 Reviewing User Authorizations

Identify the users and roles you've created, along with the permissions granted to them using the streamingclusteradmin utility's get command.

Context

The monitoring commands shown here are actually independent of each other, so you can run any or all of them in the order you prefer. And, if you choose to use the interactive mode, you can enter all of the commands in one session, rather than exiting and restarting the streamingclusteradmin utility.

Procedure

1. List all of the users who are authorized to perform tasks.For example, to list authorized users in command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --command "get users"

Or, to list authorized users in interactive mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!get usersexit

2. List all of the roles that have been created.For example, to list existing roles in command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --command "get roles"

Or, to list existing roles in interactive mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!get rolesexit

3. List all of the roles that have been assigned to each user.For example, to list existing roles assigned to user, user1, in command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --command "get roles for user user1"

Or, to list existing roles assigned to user1, user2, and user3 in interactive mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!



get roles for user user1get roles for user user2get roles for user user3exit

4. List the permissions that have been assigned to each role.For example, to list permissions granted to role1, in command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --admin_policy_cmd "get perm for role role1"

Or, to list permissions granted to role1, role2, and role3 in interactive mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!get perm for role role1get perm for role role2get perm for role role3exit

5. List the permissions that have been assigned to each user.For example, to list the permissions that have been granted to user1, in command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --command "get perm for user user1"

Or, to list the permissions granted to user1, user2, and user3 in interactive mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!get perm for user user1get perm for user user2get perm for user user3exit

1.3.6 Creating a Role

Define a set of privileges that enables a user to perform a particular task, which can then be granted to other users as needed.

Context

Roles are generally created to enable users to perform a particular task. As new tasks are identified, new roles can be created to enable users to perform them.



Procedure

1. Use streamingclusteradmin to run the add role command.

a. To add the role prod1 using the command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --command "add role prod1"

b. Or, to add the role using the interactive mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!add role prod1exit

2. Grant the permissions required to perform the task to the role.a. Using command line mode to grant permission to read streams in any workspace to the role prod1, enter

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --command "grant perm read stream on any workspace to prod1"

b. Or, using interactive mode to grant permission to read streams in the w1, w4, and w5 workspaces to the role prod1, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!grant perm read stream on workspace w1 prod1grant perm read stream on workspace w4 prod1grant perm read stream on workspace w5 prod1exit

c. Or, modify multiple user roles simultaneously using a single administration policy file.Enter all desired streamingclusteradmin commands that grant roles and permissions for users into a stored text file. To run all commands stored in that file using command line, enter:



NoteYou can run separate command files to add and remove roles and permissions as needed. This may be useful in larger projects with tasks that vary over the course of time.



1.3.7 Removing a Role

Get rid of a collection of privileges that is no longer required or not appropriate for the tasks that need to be done.

Context

Roles are generally created to enable users to perform a particular task. If a task no longer needs to be performed, the role enabling users to do it can be removed.

Procedure

1. Use streamingclusteradmin to run the remove role command.

a. To remove the role setup using the command line mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein! --admin_policy --command "remove role setup"

b. To remove the prod3 and prod7 roles using the interactive mode, enter:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://localhost:19011 --username=sysadm --password=Letmein!remove role prod3remove role prod7quit

c. Or, modify multiple user roles simultaneously using a single administration policy file.Enter all desired streamingclusteradmin commands that remove roles and permissions for users into a stored text file. To run all commands stored in that file using command line, enter:



NoteYou can run separate command files to add and remove permissions and roles as needed. This may be useful in larger projects with tasks that vary over the course of time



1.4 Secure Sockets Layer (SSL) Connections

SAP Event Stream Processor supports SSL connections over the network to ensure the privacy of communication between client applications and the SAP Event Stream Processor server.

If you install Event Stream Processor using a typical installation, SSL is enabled by default. If you install using a custom installation, you can choose whether to enable SSL. When SSL is enabled, gateway communication is encrypted, all incoming URLs must use HTTPS, and URIs must use ESPS.

A node in the cluster can support either HTTP or HTTPS, but not both simultaneously. When SSL is enabled for a cluster, all components in the cluster are also enabled for SSL.

To edit SSL configuration for new or existing nodes or clusters, use the SAP ESP Cockpit. For detailed instructions on how to enable or disable SSL using the SAP ESP Cockpit, see Configuring SSL [page 19].

NoteSAP Event Stream Processor supports only the TLSv1.2 protocol. TLSv1, TLSv1.1, SSLv2, and SSLv3 are not supported.

Related Information











1.5 Configuring SSL

Enable or disable Secure Sockets Layer (SSL) at the node or project level using the SAP ESP Cockpit.

Related Information











1.5.1 Enabling SSL at the Project Level

Enable SSL at the project level using SAP ESP Cockpit.

Prerequisites

Your user account has the required read and admin permissions in ESP.

Context

When you run a typical installation, SSL is enabled by default. When SSL is enabled at the project level, gateway communication is encrypted. Project-level SSL imposes no user requirements.

Procedure

1. Select the EXPLORE workset, then select Actions Configure Cluster .2. Expand the Applications folder and select either ha_project or project.3. Click Add Property.4. Specify ssl-key-file for the property name, and in the value column point to the directory that holds the

SSL files. For example, ${STREAMING_HOME}/cluster/keys/${STREAMING_CLUSTER_NAME}.5. Click Add Property.6. Specify ssl-key-file-encrypted, and set the value to true.

The SSL files generated during the installation of ESP are encrypted. If you set ssl-key-file-encrypted to true when the SSL files are not encrypted, the project fails to run.

7. Click Apply.



1.5.2 Disabling SSL at the Project Level

Disable SSL at the project level using SAP ESP Cockpit.

Prerequisites


Context

When you run a typical installation, SSL is enabled by default. When SSL is enabled at the project level, gateway communication is encrypted. Project-level SSL imposes no user requirements.

Procedure

1. Select the EXPLORE workset, then select Actions Configure Cluster .2. Expand the Applications folder and select either ha_project or project.3. Remove the ssl-key-file property or leave its value empty.4. Remove the ssl-key-file-encrypted property or set its value to false.5. Click Apply.

1.5.3 Enabling SSL at the Node Level

Enable SSL at the node level using SAP ESP Cockpit.

Prerequisites


Context

When you run a typical installation, SSL is enabled by default. When SSL is enabled at the node level, all incoming URLs must use HTTPS and URIs must use ESPS.



Procedure

1. Select the EXPLORE workset, then select Actions Configure Cluster .2. Expand the Nodes folder and select a node.3. Select the Connectivity tab.4. Click the check box for SSL.5. Click Apply.

1.5.4 Disabling SSL at the Node Level

Disable SSL at the node level using SAP ESP Cockpit.

Prerequisites


Context

When you run a typical installation, SSL is enabled by default. When SSL is disabled at the node level, all incoming URLs must use HTTP and URIs must use ESP.

Procedure

1. Select the EXPLORE workset, then select Actions Configure Cluster .2. Expand the Nodes folder and select a node.3. Select the Connectivity tab.4. Uncheck the check box for SSL.5. Click Apply.

1.6 Generating an SSL Key in the Java KeyStore

Java keystores provide a convenient mechanism for storing and deploying X.509 certificates and private and public keys. Use keystores with Secure Sockets Layer (SSL) to have the SAP Event Stream Processor server store and read the key, to encrypt passwords for external servers and applications (like databases) to avoid storing



passwords as clear text in configuration file. Also use keystores for RSA authentication because it stores user certificates.

Procedure

1. To generate an SSL key which includes the server domain name, run:

$JAVA_HOME/bin/keytool -genkey -validity 3650 -keypass <keypass name> -keystore $STREAMING_HOME/cluster/examples/cluster_example.jks -alias <alias name> -storepass <storepass name> -keyalg RSA -keysize 2048 -dname "CN=myhostname, OU=myunit, O=myorganizatio, L=mylocation, S=mystate, C=mycountry" -ext SAN=dns:localhost,ip:<ip address>

Note that the values provided in this example are for demonstrative purposes only.

○ where CN is the hostname of the ESP server to which you want to connect. For example, if the hostname of the SAP Event Stream Processor server to which you are connecting is myserver.sap.com, then CN would be myserver.sap.com. If you have a multinode cluster, use a wild card for the domain name in the CN value. For example, if the domain name was sap.com, then the value for CN should be *.sap.com.

○ where OU is your organizational unit.○ where O is the name of the organization.○ where L is the name of your city or locality.○ where S is the name of your state or province.○ where C is your two-letter country code.○ where SAN is any additional host that you want included in the certificate. You can specify either a fully

qualified domain name, a localhost, or an IP address.

An SSL key is created and placed in the KeyStore. If a KeyStore is not available, one is created.

Related Information











1.7 Generating PEM Format Private Keys

Convert the Java keytool to generate private keys in privacy enhanced mail (PEM) format.

Prerequisites

Ensure that you have JDK 1.6 installed on your machine.

Context

Several Event Stream Processor utilities require PEM-format private keys, including:

streamingprojectclientstreamingconvertstreaminguploadstreamingsubscribestreamingcncstreamingquery

The keystore tool is located in the $JAVA_HOME/bin directory.



Procedure

1. From the command line, run this script to export the Java keystore to a PKCS12 format keystore, which is used by OpenSSL:

keytool -importkeystore -srckeystore <filename>.jks -destkeystore <exportfilename>.p12 -deststoretype PKCS12

NoteThe file name and export file name required in this command are variable.

Press Return.2. Run this command to convert the PKCS12 format keystore to a PEM-format private key:

openssl pkcs12 -in <filename>.p12 -out <username>.private.pem -nodes

NoteThe file name and user name required in this command are variable.

Related Information











1.8 Generating a TrustStore for a Client

As part of enabling server certificate verification in SSL communication, create a TrustStore for your client which contains a root certificate of the SSL key which is signed by the certificate authority.

Context

In this example, the SSL key is self signed.

Extract the root certificate for your client from the SSL key and use it as the TrustStore for the client. Copy the TrustStore and PEM formatted certificate to the client side for the client to use when it connects to the Event Stream Processor server.

Procedure

1. (C/C++ and .NET SDK client) Extract the root certificate in PEM format (cert.pem) and use it as the C/C++ and .NET SDK TrustStore:

$JAVA_HOME/bin/keytool -exportcert -keystore $STREAMING_HOME/cluster/examples/cluster_example.jks -file cert.pem -alias <alias name> -storepass <storepass name> –rfc

2. (Java SDK) Extract the root certificate from the SSL key and place it in the Java TrustStore:

$STREAMING_HOME/lib/jre/bin/keytool -exportcert -keystore $STREAMING_HOME/cluster/examples/cluster_example.jks -file cert.cer -alias <alias name> -storepass <storepass name>$STREAMING_HOME/lib/jre/bin/keytool -importcert -trustcacerts -alias ca -file cert.cer -storepass <storepass name> -storetype jks -keystore truststore.jks

You can delete the cert.cer file once you import it into the TrustStore as there is no further need for it.



Related Information









1.9 Encryption

SAP Event Stream Processor provides two utilities for encryption, streamingclusteradmin and streamingencrypt. These utilities support password encryption for internal adapter, service, cluster, and project configuration. SAP Event Stream Processor also provides the encrypt.sh and encrypt.bat scripts for encrypting passwords in external adapter configuration files.



Utilities

The streamingclusteradmin utility encrypts passwords for project configuration, internal adapter configuration, and database service connections. Call it from a command line:

$STREAMING_HOME/bin/streamingclusteradmin --uri=esp[s]://<host>:<port> --username=<user-name> --password=<password>

The streamingencrypt utility encrypts passwords in cluster configuration, passwords for the web services provider, and cluster SSL files. Call it from a command line:

$STREAMING_HOME/bin/streamingencrypt [options...]

For more information on the utilities and their supported commands, see the SAP Event Stream Processor: Utilities Guide.

Scripts

SAP Event Stream Processor provides a pair of scripts useful for encrypting external adapter configuration values and testing decryption of the encrypted values.

The encrypt.sh/bat and decrypt.sh/bat are available at $STREAMING_HOME/adapters. These are independent utilities that can encrypt or decrypt using any independent keystore. Values you need to supply include keystore, alias, and the keystore password.

The script or utility you use for encryption depends on the element you're encrypting, as described in this table.

Encrypt... Located in... Using the utility or script...

SAP Event Stream Processor Studio keystore password

studio.xml streamingencrypt

Cluster configuration passwords ESP Cockpit settings streamingencrypt

Project configuration file (CCR) password

<project-name>.ccr streamingclusteradmin

Adapter CNXML file password <adapter>.cnxml streamingclusteradmin

Database service configuration password

SAP Event Stream Processor Studio properties view for a data service

streamingclusteradmin

SSL files (server.key and server.crt) ESP Cockpit settings (referenced only)

streamingencrypt

Java external adapter configuration file password

Custom external configuration file encrypt.sh or encrypt.bat

Adapter configuration files adapter.xml; adapter_config.xml

encrypt.sh or encrypt.bat



Encrypt... Located in... Using the utility or script...

Web services provider keystore password

wsp.xml streamingencrypt

Related Information











1.9.1 Encrypting Passwords for Cluster Configuration

Use the streamingencrypt executable to encrypt passwords for new nodes, or to re-encrypt existing values.

Context

During installation, ESP encrypts passwords for the cluster cache, keystore, and key elements. Manually encrypt cluster passwords only when you configure a new node or cluster (before you start it), or when you need to re-encrypt a password or property using a new key file.

The key password element is optional. While the keystore password locks the entire keystore, the key password only locks a specific key within the store. If the key password is not specified, ESP uses the same password for both elements.

Use SAP ESP Cockpit to update cluster configuration files. If you do not have ESP Cockpit installed, or if it cannot start due to errors in configuration, see Cannot Start ESP Cockpit Due to Configuration Errors in the SAP Event Stream Processor: Configuration and Administration Guide.

Procedure

1. Shut down the affected node or, in some cases, the entire cluster:

Before you... Shut down...

Encrypt a password in the cluster configuration that has not changed (password value is already in the file).

The node

Change and encrypt a password or key password in the cluster cache or keystore section.

All nodes in the cluster

NoteIf you choose to encrypt passwords in the Keystore element of a new node, first configure the Keystore. The Type, File, and Password elements in Keystore require values. A default value is provided for Type, but you must fill in File and Password values.

2. (Optional) If you are re-encrypting an encrypted password, create a new cluster key.a. From a command line, navigate to STREAMING_HOME/bin and launch the streamingencrypt

executable using the --create-key option:

streamingencrypt --create-key cluster.key

The command writes a new key to the file cluster.key.3. From a command line, navigate to STREAMING_HOME/bin and launch the streamingencrypt utility using

the --encrypt option, where <text> is the password you are encrypting:

streamingencrypt --encrypt cluster.key --text <text>



If you enter the --text value successfully, the streamingencrypt utility writes the encrypted text to the display.

4. Open ESP Cockpit. Select the EXPLORE workset, then select Actions Configure Cluster .

5. In the left pane, select Security Keystore .6. Copy the encrypted text from the utility, and replace the original value in the Key Store Password or Key

Password field with the encrypted text.7. Ensure that the Encrypted box is checked for each password that receives encrypted text.

This attribute ensures that the server recognizes the password as encrypted text and decrypts it at runtime. If the attribute is not set to true, the server does not recognize the password as encrypted text and tries to process the password without decrypting it, resulting in errors.

8. Click Apply to save changes.

1.9.2 Encrypting Passwords for Database Services

Encrypt passwords for database service connections using the streamingclusteradmin utility to avoid displaying sensitive data in plain text.

Prerequisites

Set up a database service connection.

Procedure

1. Open Studio.2. In the SAP ESP Authoring perspective, open the Data Services view and select a data service.3. In the Properties view, copy the password you want to encrypt.4. From a command line, navigate to STREAMING_HOME/bin and launch the streamingclusteradmin utility

using the --encrypt_text command. This command requires host and port information as well as credentials for the ESP server. For example, where <Pass1234> is the password you want to encrypt, the syntax is:

streamingclusteradmin --uri=esp[s]://<host>:<port> --username=<username> --password=<password> --encrypt_text --text=<Pass1234>

NoteIf you omit the password parameter when you call the streamingclusteradmin tool, Event Stream Processor prompts you for the password and hides it as you type, which improves security.

The streamingclusteradmin utility writes the encrypted password to the display.5. Copy the encrypted text and return to Studio.



6. In the Properties view, paste the encrypted text into the password field. Click anywhere outside of the view to save.

1.9.3 Encrypting Passwords for Projects and Adapters

Encrypt passwords within project configuration (CCR) files and adapter CNXML files using the streamingclusteradmin utility to avoid displaying sensitive data in plain text.

Prerequisites

Configure and start your cluster.

Context

Modify the adapter .cnxml only during project environment setup.

Procedure

1. Use a text editor to open the desired configuration file:

In the local (Studio) cluster: <user's-home-dir>/SybaseESP/5.1/workspace/<project-name>/<project-name>.ccr

STREAMING_HOME/lib/adapters/<adapter>.cnxml 2. Within the configuration file, copy the password text you want to encrypt.3. From a command line, navigate to STREAMING_HOME/bin and launch the streamingclusteradmin utility

using the --encrypt_text command. This command requires host and port information as well as credentials for the ESP server. For example, where <Pass1234> is the password you want to encrypt, the syntax is:

streamingclusteradmin --uri=esp[s]://<host>:<port> --username=<username> --password=<password> --encrypt_text --text=<Pass1234>

NoteIf you omit the password parameter when you call the streamingclusteradmin tool, Event Stream Processor prompts you for the password and hides it as you type, which improves security.

The streamingclusteradmin utility writes the encrypted password to the display.4. Copy and paste the encrypted text from the utility into the configuration file you opened in step 1 [page 32].

Replace the original password in the Password parameter with the encrypted text.



5. Change the encrypted="false" attribute for the Password parameter to encrypted="true".

The encrypted attribute ensures that the server recognizes the password as encrypted text and decrypts it at runtime. If the attribute is set to false, the server does not recognize the password as encrypted text and tries to process the password without decrypting it, resulting in errors.

6. Save and close the configuration file.

1.9.4 Encrypting Passwords for the Event Stream Processor Web Services Provider and ESP Studio

Use the streamingencrypt utility to encrypt the keystore password for the ESP Web Services Provider, or re-ecnrypt SAP Event Stream Processor Studio passwords.

Context

During installation, ESP encrypts the keystore passwords in wsp.xml and studio.xml. Encrypt the keystore password only when you need to re-encrypt a password using a new key file.

Procedure

1. Use a text editor to open the necessary configuration file:

STREAMING_HOME/wsp/wsp.xml

STREAMING_HOME/studio/clustercfg/studio.xml2. Copy the keystore password. If the keystore password is not in the configuration file, add the password

parameter to the keystore element and set it to "true".

In the following section of a sample Web Services Provider configuration file, the keystore password is "Pass1234".

<Security> <Keystore> <Type>JKS</Type> <File>keystore.jks</File> <Password prompt="true">Pass1234</Password> </Keystore> <Cipher> <File>STREAMING_HOME/wsp/wsp.key</File> </Cipher></Security>

3. Note the value in the Cipher element. This is the cluster key file required to encrypt passwords. If the Cipher element does not exist:



a. Create a cluster key. From a command line, navigate to STREAMING_HOME/bin and launch the streamingencrypt executable using the --create-key option:

streamingencrypt --create-key wsp.key

The command writes a new key to the file wsp.key. Enter studio.key to create a new studio key file.b. Add the Cipher element to the required configuration file using the format in step 2 [page 33].

4. From a command line, navigate to STREAMING_HOME/bin and launch the streamingencrypt utility using the --encrypt option, where <text> is the password you are encrypting:

streamingencrypt --encrypt <key-file> --text <text>

If you enter the --text value successfully, the streamingencrypt utility writes the encrypted text to the display.

5. Copy and paste the encrypted text from the utility into the configuration file. Replace the original password in the Password parameter for the Keystore element with the encrypted text.

6. Ensure that the encrypted attribute in the password parameter is set to encrypted="true".

This attribute ensures that the Web Services Provider, or SAP Event Stream Processor Studio, recognizes the password as encrypted text and decrypts it at runtime. If the attribute is not set to true, the Web Services Provider, or SAP Event Stream Processor Studio, does not recognize the password as encrypted text and tries to process the password without decrypting it, resulting in errors.

7. Save and close the configuration file.

1.9.5 Encrypting SSL Files

Use the streamingencrypt executable to encrypt secure sockets layer (SSL) files (server.key and server.crt) for new nodes, or to re-encrypt existing files.

Context

During installation, ESP encrypts SSL files. To indicate that they are encrypted, the files gain the .enc extension, becoming server.key.enc and server.crt.enc. Encrypt SSL files only when you configure a new node or cluster (before you start it), or when you need to re-encrypt SSL files using a new key file. By default, ESP looks for encrypted and unencrypted SSL files in STREAMING_HOME/cluster/keys/<cluster-name>.

The ESP installer provides only encrypted SSL files. To configure SSL files for a new cluster, either:

● Use OpenSSL or a similar toolkit to generate your own server.key and server.crt in privacy enhanced mail (PEM) format, or;

● Copy existing SSL files to the new cluster, then use a new cluster key file to re-encrypt the files.



Procedure

1. Shut down all nodes in the cluster.2. (Optional) If you are re-encrypting an encrypted SSL file, create a new cluster key.

a. From a command line, navigate to STREAMING_HOME/bin and launch the streamingencrypt executable using the --create-key option:

streamingencrypt --create-key cluster.key

The command writes a new key to the file cluster.key.3. From a command line, navigate to STREAMING_HOME/bin and launch the streamingencrypt executable.

Do one of the following to encrypt either the server.key file or the server.crt file:

a. To encrypt an SSL file for the first time, use the --encrypt option with the cluster key file:

streamingencrypt --encrypt <key-file> --file <server.key>

b. To re-encrypt an SSL file, create a new cluster.key file (see step 2). Then, use the --re-encrypt option with the cluster key file:

streamingencrypt --re-encrypt <old-key-file> <new-key-file> --file <server.key.enc>

Notestreamingencrypt works on a file with any name, allowing you to keep multiple copies of your SSL files. At runtime, however, ESP looks for SSL files with these names:

server.keyserver.crtserver.key.encserver.crt.enc

The setting of the ssl-key-file-encrypted property (see step 6) determines whether ESP looks for SSL files with or without the .enc extension.

The SSL files gain the .enc extension, marking them as encrypted.

4. Open ESP Cockpit. Select the EXPLORE tab, then select Actions Configure Cluster .5. In the left pane, select Applications, then choose the application type.6. Ensure that the ssl-key-file-encrypted property is set to true.

This attribute ensures that the server recognizes the file as encrypted and decrypts it at runtime. If the attribute is not set to true, the server does not recognize the file as encrypted and tries to process the file without decrypting it, resulting in errors.

7. Ensure that the ssl-key-file property points to the location of the encrypted SSL files:

STREAMING_HOME/cluster/keys/<cluster-name>8. Click Apply to save changes.



1.9.6 Encrypting Passwords for Java External Adapters

Use an independent keystore to encrypt passwords in external adapter configuration files, and to tell Event Stream Processor to decrypt encrypted values at runtime.

Prerequisites

Set the JAVA_HOME environment variable. SAP Event Stream Processor supports SAP JVM 7.1.011.

Context

Java external adapter configuration files contain an encryption algorithm that Event Stream Processor uses to authorize decryption.

Procedure

1. Use any text editor to open the desired external adapter configuration file.2. Call the encrypt.sh (UNIX) or the encrypt.bat (Windows) script:

$JAVA_HOME/bin/java -cp jar/adapterapi.jar:jar/commons-codec-1.3.jar com.sybase.esp.adapter.api.CryptUtils encrypt <password> <alias/user> RSA <keystorepath>/keystore.jks <keystorepassword>

a. Copy the password string from the external adapter configuration file and paste it in the position of the <password> variable in the script.

b. Replace the <alias/user> variable with the store key-alias (user name).c. Provide the name of the authentication method the external adapter is using. The default is RSA.d. Replace the <keystorepath> variable with the filepath to the keystore.jks file.e. Replace the <keystorepassword> variable with the keystore password.f. Run the script.

The action produces a string of encrypted text that contains your hidden password:

ilNkDIv7MK99CvRHkVmDunuAvErHEyNdGZ+VTe63PBMEbyZ2CfZf6iHhCtDXD6fR9jPYIT/3FcyHmX2VL5xEeDL29KJP4xPS6d9/TUIozJvJb9YhA8yyHUGv9iGUmtJdcN4vvQ1XJPSGHD84vIKSHQOfz8UlZKl07uJl54b47JXi+hIt1X3hZtGAaKuNt9BDo3KIgD4McehJFH2eT0vYmLHjWAL+JoO4V0/+e9ZlgF4hzjpVkYaO5zik7WyWbvVzLcv4sT4A77CGq4/uo+ZsJlGdBQ/qlSXDBUKBacHhmYBV1j5xZgxLPu2feEl1OGP/+27126/Lz0M/JVeShDOw==

NoteUse the decrypt.sh (UNIX) or decrypt.bat (Windows) script to validate encrypted text. To run the decrypt command against the encrypted text, call the decrypt script and provide the same credentials you provided for the encrypt script.



g. Copy and paste the encrypted text from the script to the text editor containing the configuration file. Replace the original password under the espPassword parameter with the encrypted text, then create and set the encrypted attribute for the parameter to true.

If set to true, this attribute ensures that Event Stream Processor recognizes the password as encrypted text and is able to decrypt the password at runtime. If the attribute is set to false, ESP does not recognize the password as encrypted text and tries to process the password without decrypting it, resulting in errors.

<espPassword encrypted="true">ilNkDIv7MK99CvRHkVmDunuAvErHEyNdGZ+VTe63PBMEbyZ2CfZf6iHhCtDXD6fR9jPYIT/3FcyHmX2VL5xEeDL29KJP4xPS6d9/TUIozJvJb9YhA8yyHUGv9iGUmtJdcN4vvQ1XJPSGHD84vIKSHQOfz8UlZKl07uJl54b47JXi+hIt1X3hZtGAaKuNt9BDo3KIgD4McehJFH2eT0vYmLHjWAL+JoO4V0/+e9ZlgF4hzjpVkYaO5zik7WyWbvVzLcv4sT4A77CGq4/uo+ZsJlGdBQ/qlSXDBUKBacHhmYBV1j5xZgxLPu2feEl1OGP/+27126/Lz0M/JVeShDOw==</espPassword>

3. The external adapter configuration file contains a <espConnection> section that includes the parameters needed to connect to streamingproject. Provide values for espHost and espPort, and in the case of a cluster, supply the cluster URI under espConnection.

 <esp> <espConnection> <espHost>localhost</espHost> <espPort>22000</espPort> </espConnection>

4. The <espSecurity> section contains parameters required to enable authentication for the external adapter, such as user name and password. Specify an authentication type for espAuthTypeSpecify the user name and password authentication for espAuthType.Authentication Type Required Value

Kerberos user_password

LDAP user_password

keystore, keystore password server_rsa

Native OS (user name/password) user_password

Example using the Kerberos authentication value:

<espAuthType>user_password</espAuthType>

5. Provide values for other required fields, based on the chosen authentication type.

Regardless of authentication type, if the password is encrypted, you must define values for espRSAKeyStore and espRSAKeyStorePassword.

 <espRSAKeyStore>/keystore/keystore.jks</espRSAKeyStore> <espRSAKeyStorePassword>Sybase123</espRSAKeyStorePassword> <espEncryptionAlgorithm>RSA</espEncryptionAlgorithm>

6. Modify the authentication type specified for espEncryptionAlgorithm as needed. The default value is RSA. Your other option is DSA.

7. Save the configuration file.

Important Disclaimers and Legal Information

Coding SamplesAny software coding and/or code lines / strings ("Code") included in this documentation are only examples and are not intended to be used in a productive system environment. The Code is only intended to better explain and visualize the syntax and phrasing rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be liable for errors or damages caused by the usage of the Code, unless damages were caused by SAP intentionally or by SAP's gross negligence.

AccessibilityThe information contained in the SAP documentation represents SAP's current view of accessibility criteria as of the date of publication; it is in no way intended to be a binding guideline on how to ensure accessibility of software products. SAP in particular disclaims any liability in relation to this document. This disclaimer, however, does not apply in cases of wilful misconduct or gross negligence of SAP. Furthermore, this document does not result in any direct or indirect contractual obligations of SAP.

Gender-Neutral LanguageAs far as possible, SAP documentation is gender neutral. Depending on the context, the reader is addressed directly with "you", or a gender-neutral noun (such as "sales person" or "working days") is used. If when referring to members of both sexes, however, the third-person singular cannot be avoided or a gender-neutral noun does not exist, SAP reserves the right to use the masculine form of the noun and pronoun. This is to ensure that the documentation remains comprehensible.

Internet HyperlinksThe SAP documentation may contain hyperlinks to the Internet. These hyperlinks are intended to serve as a hint about where to find related information. SAP does not warrant the availability and correctness of this related information or the ability of this information to serve a particular purpose. SAP shall not be liable for any damages caused by the use of related information unless damages have been caused by SAP's gross negligence or willful misconduct. All links are categorized for transparency (see: http://help.sap.com/disclaimer).


SAP Event Stream Processor: Security GuideImportant Disclaimers and Legal Information

http://help.sap.com/disclaimer/

SAP Event Stream Processor: Security GuideImportant Disclaimers and Legal Information


www.sap.com/contactsap

© 2014 SAP SE or an SAP affiliate company. All rights reserved.No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice.Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary.These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies.Please see http://www.sap.com/corporate-en/legal/copyright/index.epx for additional trademark information and notices.

http://www.sap.com/contactsap

http://www.sap.com/corporate-en/legal/copyright/index.epx

http://www.sap.com/corporate-en/legal/copyright/index.epx

sap event stream processor: security guide

Documents