sap innovation management 1

Master GuideDocument Version: 1.2.2 – 2016-02-12

CUSTOMER

SAP Innovation Management 1.0Installation, System Landscape, and System Configuration

SAP Innovation Management 1.0Getting Started

CUSTOMER© 2015 SAP SE or an SAP affiliate company. All rights reserved. 2

Typographic Conventions

Type Style Description

Example Words or characters quoted from the screen. These include field names, screen titles,pushbuttons labels, menu names, menu paths, and menu options.Textual cross-references to other documents.

Example Emphasized words or expressions.

EXAMPLE Technical names of system objects. These include report names, program names,transaction codes, table names, and key concepts of a programming language when theyare surrounded by body text, for example, SELECT and INCLUDE.

Example Output on the screen. This includes file and directory names and their paths, messages,names of variables and parameters, source text, and names of installation, upgrade anddatabase tools.

Example Exact user entry. These are words or characters that you enter in the system exactly asthey appear in the documentation.

<Example> Variable user entry. Angle brackets indicate that you replace these words and characterswith appropriate entries to make entries in the system.

EXAMPLE Keys on the keyboard, for example, F2 or ENTER .



Document History

Version Date Change

1.0 2014-07-25 Released for Customer

1.1 2014-12-04 Changes to complete document, chapter 8: Integration with SAP Portfolioand Project Management added

1.1.1 2015-05-21 Changes to chapter 3: Installation Guide

1.2 2015-06-26 Changes to complete document corresponding to SP02 development

1.2.1 2016-02-02 Changes regarding HANA SPS 10

1.2.2 2016-02-12 KM Review of Section 1.2.4

4CUSTOMER© 2015 SAP SE or an SAP affiliate company. All rights reserved.


Table of Contents

1 Getting Started ........................................................................................................................61.1 About this Document ............................................................................................................................. 61.2 Related Information ............................................................................................................................... 7

1.2.1 Planning Information ............................................................................................................. 71.2.2 Further Useful Links .............................................................................................................. 81.2.3 Related Master Guides .......................................................................................................... 81.2.4 Related Operations Information........................................................................................... 81.2.5 Deployment ............................................................................................................................ 9

1.3 Important SAP Notes............................................................................................................................. 9

2 SAP Innovation Management Overview................................................................................ 10

3 Installation Guide .................................................................................................................... 113.1 Special Considerations for Upgrades ................................................................................................. 11

3.1.1 Installation Steps that can be Omitted ............................................................................... 113.1.2 Application Configuration ................................................................................................... 123.1.3 Additional Hints ................................................................................................................... 12

3.2 System Configuration .......................................................................................................................... 123.2.1 Timeout Settings ................................................................................................................. 123.2.2 Mail Configuration ............................................................................................................... 13

3.3 Installation ............................................................................................................................................ 143.4 Technical User Setup........................................................................................................................... 143.5 Innovation System Manager Setup .................................................................................................... 15

3.5.1 Additional Considerations .................................................................................................. 163.6 Admin User Setup Checkpoint and Troubleshooting ....................................................................... 173.7 Acquiring Repository Access .............................................................................................................. 173.8 Application Security Setup ................................................................................................................. 183.9 Run After Import Scripts ..................................................................................................................... 183.10 Schedule Batch Jobs ........................................................................................................................... 193.11 User and Group Administration .......................................................................................................... 19

3.11.1 Overview ............................................................................................................................... 193.11.2 User Upload ......................................................................................................................... 213.11.3 Group Upload ....................................................................................................................... 23

3.12 Automatic Grouping ............................................................................................................................ 253.13 Setting Up DB Users ............................................................................................................................ 253.14 SAML Setup .......................................................................................................................................... 25

3.14.1 Maintaining the Trust Relation between the HANA System and the Identity Provider 263.14.2 Enable SAML Logon ............................................................................................................ 283.14.3 Troubleshooting SAML Logon Configuration ................................................................... 28

3.15 Innovation Manager Setup .................................................................................................................. 29Additional Information ...................................................................................................................................... 29

4 Landscape Setup ................................................................................................................... 304.1 SAP Web Dispatcher Setup ................................................................................................................ 31



4.2 Browser and Mobile Client Setup ....................................................................................................... 324.3 URL Whitelists ...................................................................................................................................... 32

5 Application Configuration .................................................................................................... 345.1 Overview ............................................................................................................................................... 345.2 General Steps ....................................................................................................................................... 35

5.2.1 Create a Configuration Package ........................................................................................ 355.2.2 Create Configuration Package for E-Mail Template Images ........................................... 365.2.3 Activate Configuration ........................................................................................................ 365.2.4 Configuration Repository Export ....................................................................................... 37

5.3 Individual Application Configuration Settings ................................................................................... 385.3.1 Common Application Settings ........................................................................................... 385.3.2 Allowed File Types ............................................................................................................... 385.3.3 Package Content at a Glance ............................................................................................. 39

5.4 Settings in Innovation Office ............................................................................................................... 39

6 Business Scenario of SAP Innovation Management ............................................................ 416.1 Run an Idea Campaign for Product Innovation ................................................................................. 41

7 Security Considerations ....................................................................................................... 427.1 Fundamental Security Guides ............................................................................................................ 42

8 Integration with SAP Portfolio and Project Management .................................................. 438.1 Integration from SAP Portfolio and Project Management to Innovation Management ................ 43

8.1.1 Configure Innovation Management to accept SSL connections..................................... 438.1.2 Import the Innovation Management Server Certificate into Portfolio and Project

Management ........................................................................................................................ 448.1.3 Configure Innovation Management Users ........................................................................ 448.1.4 Configure Single Sign-On with SAP Assertion Tickets..................................................... 44

8.2 Integration from SAP Innovation Management to the Portfolio and Project Management .......... 458.2.1 Enable Portfolio and Project Management for SSL .......................................................... 458.2.2 Import the Portfolio and Project Management Certificate into Innovation

Management ........................................................................................................................468.2.3 Configure Single Sign-On with SAP Assertion Tickets.....................................................468.2.4 Maintain the Portfolio and Project Management Destination in Innovation

Management ........................................................................................................................468.2.5 Settings on SAP Portfolio and Project Management ....................................................... 47

9 References ............................................................................................................................. 48

10 Release Availability Information .......................................................................................... 49



1 Getting Started

1.1 About this Document

Purpose

This Master Guide is the central starting point for the technical implementation of SAP Innovation Management.You can find cross-scenario implementation information as well as scenario-specific information in this guide.

NoteThe central starting point for the technical upgrade of your SAP application/solution is the Master Guide,which you can find on SAP Service Marketplace at http://service.sap.com/instguides.

Use the Master Guide to get an overview of SAP Innovation Management, and the required steps for installing theapplication, setting up the required system landscape, and configuring the system.The Master Guide consists of the following main sections:· Installation Guide· Landscape Setup· System Configuration

NoteYou can find the most current information about the technical implementation of SAP InnovationManagement and the latest installation and configuration guides on SAP Service Marketplace athttp://service.sap.com/instguides.We strongly recommend that you use the documents available here. The guides are regularly updated.

Constraints

· The business scenarios that are presented here serve as examples of how you can use SAP software in yourcompany. The business scenarios are only intended as models and do not necessarily run the way they aredescribed here in your customer-specific system landscape. Ensure to check your requirements and systemsto determine whether these scenarios can be used productively at your site. Furthermore, we recommendthat you test these scenarios thoroughly in your test systems to ensure they are complete and free of errorsbefore going live.

· This Master Guide primarily discusses the overall technical implementation of SAP Innovation Management,rather than its subordinate components. This means that additional software dependencies might existwithout being mentioned explicitly in this document. You can find more information on component-specificsoftware dependencies in the corresponding installation guides.

http://service.sap.com/instguides




1.2 Related Information

1.2.1 Planning Information

For more information about planning topics not covered in this guide, see the following content on SAP ServiceMarketplace:

Content Location on SAP Service Marketplace

Latest versions of installation and upgradeguides


General information about SAP InnovationManagement

http://Help.sap.com -> SAP Business Suite -> SAPProduct Lifecycle Management -> SAP InnovationManagement

SAP Business Maps - information aboutapplications and business scenarios

http://service.sap.com/businessmaps

Sizing, calculation of hardwarerequirements - such as CPU, disk andmemory resource - with the Quick Sizertool

http://service.sap.com/quicksizer

Released platforms and technology-related topics such as maintenancestrategies and language support

http://service.sap.com/platformsTo access the Platform Availability Matrix directly,enterhttp://service.sap.com/pam

Network security http://service.sap.com/securityguide

High Availability http://scn.sap.com/docs/DOC-7848

Performance http://service.sap.com/performance

Information about Support PackageStacks, latest software versions and patchlevel requirements

http://service.sap.com/sp-stacks

Information about Unicode technology http://scn.sap.com/community/internationalization-and-unicode


http://help.sap.com/

http://service.sap.com/businessmaps

http://service.sap.com/quicksizer

http://service.sap.com/platforms

http://service.sap.com/pam

http://service.sap.com/securityguide

http://scn.sap.com/docs/DOC-7848

http://service.sap.com/performance

http://service.sap.com/sp-stacks

http://scn.sap.com/community/internationalization-and-unicode

http://scn.sap.com/community/internationalization-and-unicode



1.2.2 Further Useful Links

The following table lists further useful links on SAP Service Marketplace:

Content Location on SAP Service Marketplace

Information about creating error messages http://service.sap.com/message

SAP Notes search http://service.sap.com/notes

SAP Software Distribution Center (softwaredownload and ordering of software)

http://service.sap.com/swdc

SAP Online Knowledge Products (OKPs) – role-specific Learning Maps

http://service.sap.com/rkt

1.2.3 Related Master Guides

This Master Guide is based on Master Guides for cross-industry applications. You can find more informationabout the relevant applications in the following documents:

Title Location

Master Guide of SAP HANA Platform http://help.sap.com/hana_platform -> MasterGuide

1.2.4 Related Operations Information

SAP Innovation Management was originally based on SAP HANA, SPS 09. For new installations, it isrecommended to use HANA, SPS 10 revision 102.03 or higher with version 1.2.6 of SAP Innovation Managementor higher. For more details see release note 2175141.

The general operations information for the following areas is covered in the operations guide of SAP HANA.· Technical system landscape· Overview of technical runtime scenarios, which result from setting up the corresponding business scenarios· Monitoring concept· Logging and tracing· Technical configuration· Backup and recovery· Periodical tasks· High availability concept· Starting and stopping (by which means and in which sequence)· Scenario administration concept (possible dependencies between scenario components)

http://service.sap.com/message

http://service.sap.com/notes

http://service.sap.com/swdc

http://service.sap.com/rkt

http://help.sap.com/hana_platform

http://service.sap.com/sap/support/notes/2175141



· Concept for monitoring, error handling, restart and recovery of interfaces· Concept for data archiving and management of outdated technical data· Software change management· Scenario maintenance concept· Concept for handling customer development· Support desk management· Troubleshooting

You can find more information about the corresponding operations guide in the following table:

Title Location

SAP HANA Platform http://help.sap.com/hana_platform-> Technical Operations Manual

For a complete list of the available SAP Operations Guides, see http://service.sap.com/instguides.

1.2.5 Deployment

Deployment of SAP HANA Delivery units is covered in the SAP HANA Master Guide. You can find moreinformation about the corresponding section in the following table:

Title Location

SAP HANA Content http://help.sap.com/hana_platform-> Master Guide

Installing and UpdatingProducts

http://help.sap.com/hana_platform-> Developer Guide

1.3 Important SAP Notes

You must read the following SAP Notes before you start the installation. These SAP Notes contain the most recentinformation on the installation, as well as corrections to the installation documentation.Make sure that you have the up-to-date version of each SAP Note, which you can find on SAP Service Marketplaceat http://service.sap.com/notes.

SAP Note Number Title Description

SAP Note 2175141 SAP Innovation Management1.0 Release Note

This note contains the latestinformation about installingSAP Innovation Management





http://service.sap.com/notes



SAP Innovation Management 1.0SAP Innovation Management Overview

2 SAP Innovation Management Overview

SAP Innovation Management is used to manage innovation by collecting and filtering ideas of internal or externalusers. The basic scenario is innovation management.SAP Innovation Management uses the following software components:· SAP Innovation Management was originally based on SAP HANA, SPS 09. For new installations it is

recommended to use HANA, SPS 10 revision 102.03 or higher with version 1.2.6 of SAP InnovationManagement or higher. For more details see release note 2175141

· SAP HANA Support Package Stacks higher than SPS 10 are currently untested and not yet supported· Innovation Management

For more information about how to set up the system landscape, see Landscape Setup.For more information about the system landscape, see http://help.sap.com/hana_platform -> Master Guide.



SAP Innovation Management 1.0Installation Guide


3 Installation Guide

The installation of SAP Innovation Management requires the following steps to be carried out in the sequence inwhich they appear here.

NoteEven if you are setting up the system as a system's user, you can experience a lack of sufficientauthorization. This applies in particular to the authorizations for the SAP HANA XS Engine based tools.For more information about SAP HANA XS Administration Roles, see SAP HANA Administration Guide ->Chapter 5 - SAP HANA XS Administration Tools.

This chapter contains a comprehensive list of the roles required for these tools. Depending on your specificscenarios, you might need some or all of these roles in addition to the database system privileges.

3.1 Special Considerations for Upgrades

3.1.1 Installation Steps that can be omitted

In case of upgrades some of the configuration steps can be skipped because they were already done with theprevious installation. However, some steps are always mandatory.

The mandatory steps are:· Configuration of Batch Jobs· Execution of After Import Methods

NoteSAP Innovation Management cannot be upgraded while batch jobs are scheduled.

Thus it is mandatory to deactivate all SAP Innovation Management batch jobs prior to upgrades. For moreinformation, see chapter Schedule Batch Jobs on how to activate or deactivate batch jobs.As a consequence batch jobs must be reactivated after the upgrade.

The following steps can be skipped for upgrades:· System Configuration· Timeout Settings· Mail Configuration· Technical User Setup

http://help.sap.com/hana/SAP_HANA_Administration_Guide_en.pdf



· Innovation System Manager Setup· Application Security Setup· User and Group Administration· Innovation Manager Setup· Landscape Setup

3.1.2 Application Configuration

In SAP Innovation Management 1.0 SP1 you could deactivate the expert finder by adding a common applicationsetting in a CSV file as described in chapter Common Application Settings Error! Reference source not found.. InSP2 this setting has been moved to the Innovation Office (see chapter Settings in Innovation Office). If the settingin the CSV file has been done it won't be visible in the Innovation Office. To make it visible you need to delete therow in the CSV file and activate the configuration.Please note that for attachments, setting the maximum file size per file type is not considered any more. Instead aglobal setting for all files is made in the Innovation Office (see chapter Settings in Innovation Office).

3.1.3 Additional Hints

It is highly recommended to ensure that no user but only the administrator is logged in during an upgrade. Pleaseensure that all application users are not logged in during the upgrade.It is also recommended to not to use different administration tools at the same time to access the same objects.Do no use the HANA XS Web administration tools and or HANA Studio and or the command line tools withoutproperly logging out from the other tools. Otherwise there can be pending processes that may lock or dead lockthe concurrent accesses.

3.2 System Configuration

To optimize your system for SAP Innovation Management, we recommend some specific server configurations.These are described in the following chapters.

3.2.1 Timeout Settings

For most users, the default SAP HANA timeout settings are too short. For this reason, we recommend increasingthem substantially. Recommended values are shown in the following table:

Configuration File Section Parameter Target Value

indexserver.ini authentication session_cookie_validity_time 3600




xsengine.ini httpserver sessiontimeout 3600

You can set them either in the SAP HANA Studio, or directly from an SQL console, as shown in the following:alter system alter configuration ('indexserver.ini', 'SYSTEM')

set ('authentication', 'session_cookie_validity_time') = '3600';

alter system alter configuration ('xsengine.ini', 'SYSTEM')

set ('httpserver', 'sessiontimeout') = '3600';

3.2.2 Mail Configuration

SAP Innovation Management sends informational mails to its users. Therefore, the mail delivery must beconfigured. The configuration requires the mail transfer server host name and the port in the xsengine.ini filesection smtp.Some of the mails sent by SAP Innovation Management contain links pointing back to the server. Because ofdifferent DNS mappings for internal and external access, the base URL for such links can differ, depending on theintended recipient. This means 'internal' and 'external' users receive mails that contain different links. Of course,the difference is the fully qualified host name and or the port number. Thus it is possible to configure two differentbase URLs. Both are configured in the innovation_management section of the xsengine.ini configuration.All of the mails sent by SAP Innovation Management contain a response e-mail address. This is also configured inthe innovation_management section. Note that at this time SAP Innovation Management does not evaluateresponse emails. So, unless response mails are handled by somebody, they are ignored.If the external and internal host names are equal, the host_external parameter is optional. If it is missing, thesystem automatically uses the value stored in the host parameter.Since the system sends out mails asynchronously, the corresponding job must be scheduled. This is configuredlater. However, the scheduler must be enabled for the configuration to have any effect.


xsengine.ini smtp server_host <host name>

xsengine.ini smtp server_port <mail port, typically 25>

xsengine.ini innovation_management host <base url>

xsengine.ini innovation_management host_external <base url>

xsengine.ini innovation_management email_sender <email_sender>

xsengine.ini scheduler enabled true


set ('smtp', 'server_host') = '<fully qualified mail server host name>';




set ('smtp', 'server_port') = '25';


set('innovation_management','host') =

'http://<fully qualified host name>:<port>';


set ('innovation_management','host_external') =

'http://<fully qualified host name>:<port>';


set ('innovation_management','email_sender') =

'<email_sender>';


set ('scheduler', 'enabled') = 'true';

3.3 Installation

Installation and upgrade of SAP Innovation Management is carried out with hdbalm, the command line tool of SAPHANA application lifecycle management, which is available as part of the HANA SP09 client installation. Thefollowing command can be used to install SAP Innovation Management:

hdbalm -h <host> -p <port> -u <user> install <path to software archive>

Where <port> is the http port of the XS Engine (typically 80nn with nn as the instance number).

For more information, see Installing and Updating Add-On Products and Software Components underhttp://help.sap.com/hana_platform -> SAP HANA Administration Guides.

3.4 Technical User Setup

SAP Innovation Management is a SAP HANA XS application. Most of its logic resides in the Javascript code, whichis executed by the SAP HANA XS Engine. SAP Innovation Management implements its own application-specificuser and authorization concept. This concept is implemented on top of SAP HANA’s user and authorizationconcept and extends it.The persistency resides in the schema SAP_INO. No application must get access to this schema. Access must berestricted to the code running in the Javascript layer. This Javascript code requires a sqlcc (technical user)connection that has sufficient privileges though.

The technical user can be created with the following SQL code:




create user HCO_INO_TECHNICAL_USER password <some password>;

alter user HCO_INO_TECHNICAL_USER disable password lifetime;

call _sys_repo.grant_activated_role(

'sap.ino.authorizations::technical_user', 'HCO_INO_TECHNICAL_USER' );

The technical user can be assigned to the application with the SAP HANA XS Administration Tool.http://<fully qualified host name>:<port>/sap/hana/xs/admin/

Navigate to package sap.ino.xs.xslib and assign the technical user HCO_INO_TECHNICAL_USER as thedatabase user for the application’s SQL connection. This means follow the URL below and enter the user nameand password of the technical user (HCO_INO_TECHNICAL_USER).

http://<fully qualified hostname>:<port>/sap/hana/xs/admin/#/package/sap.ino.xs.xslib/sqlcc/dbuser

If you fail to assign this user due to missing authorizations, your user can be missing one or all of the followingroles:· sap.hana.xs.admin.roles::SQLCCAdministrator· sap.hana.xs.admin.roles::SQLCCViewer

NoteThese roles contain different privileges. None of these is a superset of any of the other during setup. Youmight prefer to have the privileges of all three roles.

3.5 Innovation System Manager Setup

Application user upload requires elevated privileges. We recommend granting these privileges to a special user forbootstrapping. For enhanced security, we highly recommend that this user is not an application user. In contrastto a SAP HANA system manager user, this user can access SAP Innovation Management.We refer to this user role as the Innovation_System_Manager.It is possible to assign this role to any administrative user – as long as this user does not become an applicationuser later. Depending on your system administration approach it may be reasonable to assign theInnovation_System_Manager to a SAP HANA system manager user.You may want to create such a role as described in the following:

create role "Innovation_System_Manager";


'sap.ino.authorizations::innovation_system_manager',

'Innovation_System_Manager'

);



NoteDo not combine the roles sap.ino.authorizations::backoffice_user,sap.ino.authorizations::community_user orsap.ino.authorizations::innovation_manager to this role.

Once this role is created, you need to grant it to a suitable user.grant "Innovation_System_Manager" to <innovation management system admin>;

Alternatively you can assign the preshipped role directly to the innovation system manager.create user INNOVATION_SYSTEM_MANAGER password <some password>;


'sap.ino.authorizations::innovation_system_manager',

'INNOVATION_SYSTEM_MANAGER'

);

NoteThese users must not get access to user interfaces of SAP Innovation Management. Especially, they mustnot get the roles sap.ino.authorizations::backoffice_user,sap.ino.authorizations::community_user orsap.ino.authorizations::innovation_manager.

Once an Innovation_System_Manager user exists, this user must self-register with SAP Innovation Management.call

"SAP_INO"."sap.ino.db.iam.admin::grant_innovation_management_system_admin_privileges"('<innovation management system admin>',

'<admin first name>',

'<admin last name>',

'<admin email address>',

?, ?);

It is possible that the result of this procedure contains error information, which is not the case if the procedure issuccessful. In case of success, it contains some internal IDs that can be ignored. These IDs are only relevant forSAP development support.

3.5.1 Additional Considerations

During setup and or troubleshooting, it is very helpful to be able to access the application schema SAP_INO. Allrequired privileges for this are contained in the role for the technical user sap.ino.authorizations::technical_user. Ifthis role is assigned to the innovation system administrator, troubleshooting and setup may become easier.




'sap.ino.authorizations::technical_user',

'INNOVATION_SYSTEM_MANAGER'

);

NoteAlthough this assignment is very convenient for the administrators, it may fail to comply with yoursecurity policies. The issue is that these privileges allow the administrators to access and alter any SAPInnovation Management table content. We recommend granting this authorization to administratorsduring setup. In productive systems this authorization role should be removed after successfulinstallation.

3.6 Admin User Setup Checkpoint and Troubleshooting

At this point in time the application should be 'technically' functional, but still not yet ready. To verify if this is thecase, call (as Innovation System Manager) the following URLs with a browser.

<hostname>:<port>/

<hostname>:<port>/sap/ino/xs/rest/support/ping.xsjs

<hostname>:<port>/sap/ino/xs/rest/support/pingDB.xsjs

<hostname>:<port>/sap/ino/xs/rest/support/pingSchema.xsjs

If all four URLs work as desired, you may proceed. Otherwise you need to figure out what might have failed so far.If the first URL does not work, the SAP HANA XS engine is not running or unreachable. This issue does not relateto SAP Innovation Management at all. Check why the SAP HANA XS engine is unreachable and fix this issue.If ping.xsjs does not respond, either SAP Innovation Management is not deployed or the user calling the ping hasinsufficient authorizations. The required privilege is sap.ino.xs.rest.support::execute. This privilege iscontained in the role sap.ino.authorizations::innovation_system_manager.If pingDB.xsjs fails to respond, most probably, the technical user cannot access the database. Double-check thetechnical user connection for SAP Innovation Management and verify the authorizations of the technical user.If pingSchema.xsjs fails to respond, although pingDB responds successfully, the technical user lacks sufficientauthorizations. Double check the authorizations of the technical user.Sometimes it is not easy to verify proper SAP HANA XS Engine setup with the UI-based administration tools. Inthis case, it is usually helpful to access schema _SYS_XS by means of SQL and verify the content of the tables_SYS_XS.SQL_CONNECTIONS and _SYS_XS.RUNTIME_CONFIGURATION.

3.7 Acquiring Repository Access

Some of the following steps require access to the SAP HANA XS Repository. The easiest way to access therepository is by means of the Web IDE, which can be reached with the URL<your_host>:<port>/sap/hana/xs/ide.



If you cannot access the IDE, you might be missing suitable privileges and or roles. Users with rolesap.hana.xs.ide.roles::Developer plus CONTENT_ADMIN can usually access it. Depending on yoursecurity policies, you may have to use more constrained authorizations though.

3.8 Application Security Setup

Use the SAP HANA XS Administration Tool also to set up the desired authentication mechanism for SAPInnovation Management. The setup must be maintained for the package sap.ino.You can use the HANA XS Admin tool to maintain this:

http://<fully qualified host name>:<port>/sap/hana/xs/admin/#/package/sap.ino/

If you want to activate SAML authentication, additional steps are necessary, which are described in one of thefollowing chapters. Unless you have prior experience with advanced authentication mechanisms it is advised tostart with the basic authentication and verify that everything works. Then establish https and finally enable x.509or SAML authentication. Once you have established the desired security level you might disable basicauthentication.

3.9 Run After Import Scripts

After installation and or upgrade of the SAP Innovation Management deliver unit the after import scripts must beexecuted. In order to trigger them issue an http POST request tohttp://<fully_qualified_host_name>:<port>/sap/ino/setup/rest/run.xsjs

You may issue such a POST request with a command line http client, for example with cURL:curl --user <USER>:<PASSWORD> -X POST http://<fully qualified hostname>:<port>/sap/ino/setup/rest/run.xsjs

In case of errors during the after import scripts you should look into the server response for any details on theerror. You might also want to consult SAP note '2069930 - After Import Method Driver'.

NoteDuring the after import run a system restart might be required. The driver does NOT trigger a restartthough. Instead it terminates with an error message stating that a system restart is required. Then therestart must be manually performed by an administrator. Once the restart is finished the driver can bestarted a second time. It will then automatically detect that the restart was executed and continue withoutfurther errors.



3.10 Schedule Batch Jobs

Batch jobs are scheduled with the SAP HANA XS Administration Tool (http://<fully qualified hostname>:<port>/sap/hana/xs/admin/#/package/sap.ino.xs.batch/). Navigate to the package sap.ino.xs.batch,open the jobs tab and activate each of the jobs. To activate the jobs you need to click on 'Configuration' and thenselect the 'active' checkbox. In addition, you need to enter the user for the batch job (we recommend the technicalapplication user, for example, HCO_INO_TECHNICAL_USER). It is also mandatory to choose a locale. Therecommended value is 'English (en)'. Do not enter start/end times as the jobs are intended to periodically withtheir preshipped defaults.

If you fail to edit the batch jobs due to missing authorizations, your user might be missing the following role:sap.hana.xs.admin.roles::JobAdministrator

If you want to double check whether batch jobs are properly scheduled have a look at thesap.ino.xs.batch::notification_mail job. This is the job with the highest scheduling frequency (every 5 minutes). Soif this job does not run within 5 minutes after activating it, then the activation was not performed properly.

3.11 User and Group Administration

3.11.1 Overview

The user and group concept of SAP Innovation Management assumes that users and groups are typicallyimported from some other system, for example, LDAP or some centralized user management. Alternatively usermanagement and authentication may be provided by a SAML identity provider. Depending on your companyspecific security policy, you may decide to go for an upload based administration approach, to rely on an IDP or amixed approach.Before we go into the details of the user management, have a look at how users and groups relate to each other.Both users and groups are derived from the abstract class Identity. This means, both users and groups areidentities. In addition, groups may refer to any number of other identities. In other words, groups may containboth users as well as further groups. Hence groups can be reused in the same way as, for example, emaildistribution lists. This is useful, for example, to assign innovation campaigns to groups instead of enumerating theusers over and over again.



Figure 1: User and Group as IdentitiesThe user upload/delete as well as the group assignment of users and groups is performed by the followingservices;

http://<Hostname>:<Port>/sap/ino/xs/rest/admin/system/user_upload.xsjs

http://<Hostname>:<Port>/sap/ino/xs/rest/admin/system/user_upload_delete.xsjs

http://<Hostname>:<Port>/sap/ino/xs/rest/admin/system/group_upload.xsjs

http://<Hostname>:<Port>/sap/ino/xs/rest/admin/system/group_upload_delete.xsjs

For troubleshooting purposes, it is also helpful to understand that HANA DB users are only loosely coupled withInnovation Management users. There are two user tables; for a user on the DB User table there is not necessarily auser on the Innovation Management User table and vice versa.

Figure 2: User TablesThis is a desired feature since HANA has technical users that are not intended for application access. On the otherhand it allows to upload application users without the corresponding database users. This improves performanceduring application user upload. It implies that both types of users must be created and linked with each otherbefore a login to the application is possible. There are several ways to achieve this.· Upload application users from CSV file and create the DB users with CREATE USER statements· Upload application users from CSV file and have DB users implicitly created by SAML login· Do not upload application users; have them automatically created by SAML login.

User Group

*

*

Identity



3.11.2 User Upload

For security reasons, the following service does not implicitly create any database users.http://<Hostname>:<Port>/sap/ino/xs/rest/admin/system/user_upload.xsjs

Therefore, the creation of the database users must be automated by other means, for example, by automaticallyissued CREATE USER statements. Once the users are in place, they can be imported into SAP InnovationManagement by sending suitable CSV files to the user_upload.xsjs service.

The format of the CSV files is described in the following table. The mandatory columns are in bold.

Column Name Comment

1 USER_NAME SAP HANA DB user name (like in table SYS.USERS)

2 IS_EXTERNAL Flag to indicate company external users, admissible values: 0 =internal, 1 = external

3 FIRST_NAME First name of the user

4 LAST_NAME Last name of the user

5 NAME Full name of the user incl. title

6 EMAIL Email address of the user

7 PHONE Phone number of the user

8 MOBILE Mobile phone number of the user

9 COST_CENTER Cost Center of the user

10 ORGANIZATION Organization of the user

11 OFFICE Office address of the user

A file can thus contain lines as follows:"USER_NAME","IS_EXTERNAL","FIRST_NAME","LAST_NAME","NAME","EMAIL","PHONE","MOBILE","COST_CENTER","ORGANIZATION","OFFICE"

JOHNSMITH,0,John,Smith,John Smith,[email protected],,,,,

JANESMITH,1,Jane,Smith,Jane Smith,[email protected],,,,,

Before you upload any users, you may want to verify if your user has sufficient credentials. You may also want toget used to the interface. We recommend creating a file empty.csv, which contains nothing at all.The file can be uploaded with any http client, for example, cURL:

curl --user <User>:<Password>http://<Hana_Server>:<XS_Engine_Port>/sap/ino/xs/rest/admin/system/user_upload.xsjs --upload-file empty.csv

The response of the server is a CSV file with a valid header line that is otherwise empty."USER_NAME","IS_EXTERNAL","FIRST_NAME","LAST_NAME","NAME","EMAIL","PHONE","MOBILE","FAX","COST_CENTER","ORGANIZATION","MANAGER","OFFICE",



You may notice additional columns in this file. These are for error handling. If a user entry gives rise to errorsthese columns get filled with additional information with regard to the error.

Since the upload service always adds or alters application users, there exist another service to delete users.http://<Hostname>:<Port>/sap/ino/xs/rest/admin/system/user_upload_delete.xsjs

This service is much simpler in its interface. It only expects one column "USER_NAME".The format of the CSV files is described in the following table. The mandatory columns are in bold.

Column Name Comment

1 USER_NAME SAP HANA DB user name (like in table SYS.USERS)

A file may thus contain lines as follows:

"USER_NAME"

JOHNSMITH

JANESMITH

You might want to leverage cUrl again to upload the file.curl --user <User>:<Password>http://<Hana_Server>:<XS_Engine_Port>/sap/ino/xs/rest/admin/system/user_upload_delete.xsjs --upload-file users_to_delete.csv

NoteThe CSV parser complies with the standard RFC 4180 (Attention: http://tools.ietf.org/html/rfc4180).If you are using a spreadsheet (for example, MS Excel) to generate CSV files, the spreadsheet might notcomply with the standard, thereby making it impossible to parse the input. In particular, a MS Excel mightuse a value separator different than a comma although it states to save the file with 'comma separatedvalues'. This behavior is locale dependent.For example, MS Excel by default uses a semicolon instead of a comma for the German locale. To ensurethat the MS Excel properly handles the CSV format, its list separator must be set to ',' (comma) instead ofsomething else. This is typically an operating system level setting that must be done outside of MS Excel.For more information about on how to change the list separator, see the screenshot given below. Noticethough that this might break other files that rely on ';' (semi colon) as a list separator.

http://tools.ietf.org/html/rfc4180



Figure 3: Steps to Change the Separator to a Comma

3.11.3 Group Upload

The group upload mechanism is similar to the user upload mechanism. Group member assignments are uploadedby posting a CSV file the group upload service.

http://<Hostname>:<Port>/sap/ino/xs/rest/admin/system/group_upload.xsjs

The service accepts only 3 columns as described below.

Column Name Comment

1 GROUP_NAME Name of the group

2 MEMBER_TYPE_CODE Either "GROUP" or "USER"

3 MEMBER_NAME Name of the group Member, DB User Name in case of User, GroupName in case of Group



Groups are created as needed. If group assignments are uploaded for a group, all existing assignments for thisgroup are deleted. Groups that are not present in the upload are not touched. Notice that group members that arereferenced must exist as Innovation Management Identities, otherwise the assignments result in error messages.

You might want to leverage cUrl again to upload groupscurl --user <User>:<Password>http://<Hana_Server>:<XS_Engine_Port>/sap/ino/xs/rest/admin/system/group_upload.xsjs --upload-file example.csv

For example your file might contain entries as follows:"GROUP_NAME","MEMBER_TYPE_CODE","MEMBER_NAME"

Group_1,USER,JOHNSMITH,

Group_1,USER,JANESMITH,

Group_2,GROUP,Group_1

The implied meaning is that John and Jane are members of Group_1 and Group_1 is also a member of Group_2. Inparticular John and Jane are also member of Group_2.

Since the upload service always adds or alters memberships; it becomes impossible to delete groups. Hencethere exist another service to delete groups.

http://<Hostname>:<Port>/sap/ino/xs/rest/admin/system/group_upload_delete.xsjs

This service is much simpler in its interface. It only expects one column "GROUP_NAME".The format of the CSV files is described in the following table. The mandatory columns are in bold.

Column Name Comment

1 GROUP_NAME Name of the group

A file may thus contain lines as follows:

"GROUP_NAME"

Group_1

Group_2

You might want to leverage cUrl again to upload the file.curl --user <User>:<Password>http://<Hana_Server>:<XS_Engine_Port>/sap/ino/xs/rest/admin/system/group_upload_delete.xsjs --upload-file groups_to_delete.csv



3.12 Automatic Grouping

Whenever users are newly registered with SAP Innovation Management they are implicitly assigned to the "Allusers" and one of the groups "External users" "Internal users". In addition, the user is also assigned to a groupdepending on the email domain name. The name is normalized to lower case. If these groups do not exist at thetime they are needed, the system will automatically create them. It is not possible to explicitly alter these groups.It is possible though to use these groups as members in other groups.In the exceptional case that a group with a particular domain name was created before the system could possiblyimplicitly create it, the system will replace this group accordingly.

Attention: if your setup allows users to set their email addresses (and thus their domain names) arbitrarily it maybe a good idea to NOT use mail domain based groups for restricting user access.

3.13 Setting Up DB Users

As mentioned in the introduction the user/group upload will only register the users with the application. Theycannot login to SAP HANA unless there is also a DB user for them. The obvious way is to create them by means ofSQL. This can be automated with the hdbcli command line tool. No additional provisions besides those mentionedare necessary. Once a HANA DB user logs in to Innovation Management the application checks if this is aregistered application user and automatically assign the necessary basic privileges to this user.Automatic DB user creation by means of x.509 authentication is also possible. However since x.509 certificatesusually do not contain enough attributes, automatic user enrollment with Innovation Management is notsupported. With other words: if you use x.509 you have to upload the users to register them with the application.The benefits of x.509 are single sign on support and from an administrator perspective that you do not need tocreate the DB users in advance (if you configure Hana accordingly).From an overall perspective SAML is to be preferred though as it supports single sign on and fully automatic userenrollment.

3.14 SAML Setup

SAP HANA as well as SAP Innovation Management support authentication by SAML. If a user is authenticated bySAML then the Innovation Management application automatically registers this user. This happens even if theuser was never uploaded before. Therefore, user upload is not required in system setups with SAMLauthentications.If you are already satisfied with the implicitly generated "automatic" groups then the user upload can be avoidedas well.Since the specific SAML setup does not depend on SAP HANA/Innovation Management alone but also on yourspecific SAML Identity provider we will only outline what needs to be done on the IDP side.To setup SAML you need to establish trust relationships between SAP HANA/Innovation Management and yourIdentity Provider (SAML IDP) and vice versa. Also you need to ensure that the SAML assertion parameters arecorrectly mapped (on the IDP side) for implicit user creation.



For details on the setup you may want to refer to the SAP HANA Administration Guide Section "Maintaining SingleSign On for SAP HANA XS Applications". If you do not have at least a basic understanding of SAML you may wantto consult a (HANA) security expert for this setup.

3.14.1 Maintaining the Trust Relation between the HANA Systemand the Identity Provider

Before we can enable SAML logon we need to establish the trust relation from HANA (in the role of SAML Serviceprovider "SP") to the Identity Provider ("IDP"). That is the SP must be configured to trust the IDP and vice versa.

3.14.1.1 Required Privileges

On the HANA (SP) side your user requires to maintain entries in the 'trust store'. To maintain the trust store (atleast) the "sap.hana.xs.admin.roles::TrustStoreAdministrator" role must be assigned to your user.On the IDP side the required privileges depend on your specific IDP. Please consult your IDP administrators for thespecific details and requirements.

3.14.1.2 Setting up the Hana System as a Service Provider

The HANA System can be configured as a SAML service provider with the help of the HANA XS Admin Tool(http://<Hana_Server>:<XS_Engine_Port>/sap/hana/xs/admin/#/samlSP.) as follows. Navigate to theSAML Service Provider Tab and click "edit". Then enter at least the service provider name. In SAML 2.0terminology this is name is the service provider entity descriptor unique ID. The fully qualified domain name of you system might be a reasonable service provider name. However, if thereare several HANA instances running on the same system the FQDN of the system will not provide a unique IDanymore. In this case you might want to add the instance number to the name to enforce uniqueness.After you have saved the setup you need to transfer (e.g. copy and paste) the metadata XML to your identityprovider.

3.14.1.3 Registering the Service Provider at the Identity Provider

Get administrative access to your IDP and register a new service provider (SP). You may want to import themetadata you obtained in the previous step. Although this establish trust this is not sufficient to ensure that theSAML assertion attributes actually will match. Please follow the steps below to fix this.



3.14.1.4 Configuring the Login User Name at the Identity Provider

Your identity provider may allow several choices for the login user name (also known as the "SAML Name IDAttribute"). The Name ID attribute will be used to create HANA DB users. Hence it is mandatory that this attributeis mapped to something that will establish valid HANA DB user names. In particular email addresses or IDs thatcontain special characters like dots or quotation marks are NOT suitable. Since the HANA User Name will not bevisible in the application technical user names like for example P<nnnnnn> with <nnnnnn> a unique number arerecommended. For the SAP IDP such a user name would be the "Profile ID".

3.14.1.5 Configuring the SAML Assertion Attributes

Typically Identity Providers can be configured to send more attributes than the Name ID attribute. Innovationmanagement expects the following attributes to be configured and properly mapped (mandatory attributes arerendered in bold):

SAP Innovation ManagementAssertion Attribute

Description

first_name First name of the user

last_name Last name of the user

name Display name of the user

email Email address of the user

is_external Flag to indicate if a user is "internal" or "external". Value 0 (=internal) or 1(=external) (optional)

phone Phone number of the user (optional)

mobile Mobile phone number of the user (optional)

cost_center Cost center assignment of the user (optional)

organization Organization of the user (optional)

Notice that the attributes must be written in lower case and match exactly as stated above.

3.14.1.6 Registering the Identity Provider at the HANA System

Once you have the IDP configured export its metadata XML and import it in the HANA System (SP). Again this canbe done with the HANA XS Admin Tool (under theURL (http://<Hana_Server>:<XS_Engine_Port>/admin/#/tenantSaml2Config). Use the tool to add anew identity provider entry with your IDP's metadata.



Before you save the new entry ensure that you have checked the "Dynamic User Creation" for your identityprovider. If this flag is checked the users will be automatically created once they are authenticated with a SAMLassertion. If you do not check this flag the users must be distributed to the HANA System before they try to login.This is also a valid option but requires performing the user upload (as described before). Since one of the points ofSAML is to get rid of the user upload it is assumed that most administrators want to check this box.

3.14.2 Enable SAML Logon

SAML logon can be enabled with the SAP HANA Admin Tool (the URL is(http://<Hana_Server>:<XS_Engine_Port>/sap/hana/xs/admin/#/package/sap.ino). Checkmark theauthentication method SAML and chose the desired identity provider in the checkbox. If there is no identityprovider to choose then repeat the step "Registering the Identity Provider at the HANA System".

3.14.3 Troubleshooting SAML Logon Configuration

Security mechanisms are typically designed to be "brittle" and SAML is no exception. Hence even the smallestmistake may lead you to a configuration that does not work. Here are some general hints on how to trouble shootthe configuration in case of failure.The most common failure in case of a basically correct configuration is a message "Assertion did not contain avalid MessageID" during logon. This is usually caused by a SAML assertion timeout. The remedy is to extend thetimeout to at least 30 seconds. To achieve this enter the following SQL (as administrator) in the SQL console:

alter system alter configuration ('indexserver.ini', 'SYSTEM')

Another common source of confusion is the choice of authentication method per package. Packages areorganized hierarchically and authentication settings are maintained on a package level. Thus, even if you maintainSAML at a package high in the hierarchy a lower package may be configured differently. This in turn can lead tostrange application behavior. With SQL you can query the database for the authentication settings of all packages. select

"PACKAGE_ID",

"CONFIGURATION",

"CHANGED_BY",

"CHANGED_AT"

from "_SYS_XS"."RUNTIME_CONFIGURATION"

order by

package_id

If these issues are not the cause of your issues then you need to dig deeper into the SAML handshake. The typicalapproach is to install a browser plugin (e.g. SSO Tracer for Firefox) and log the handshake during login. Ananalysis of the log files will then typically reveal hints about the root cause of the issues. If you fail to identify a rootcause you may want to consult some (HANA) SAML expert for further investigations.

http://ld8580.wdf.sap.corp:8000/sap/hana/xs/admin/#/package/sap.ino



3.15 Innovation Manager Setup

Once an initial set of users is uploaded, an innovation manager must be assigned. The innovation managerbasically controls the business aspects of SAP Innovation Management. In particular, this user can assigncampaign managers who are responsible for running campaigns.Unlike the innovation system manager, the innovation manager can access the user interface of the application.Do not mix these roles.To assign a user as innovation manager, the corresponding role sap.ino.authorizations::innovation_manager mustbe granted.


'sap.ino.authorizations::innovation_manager', '<user>' );

After this step you might want to login with the innovation manager user to the application. The two URLs arehttp://<Hana_Server>:<XS_Engine_Port>/sap/ino/ui/frontoffice

http://<Hana_Server>:<XS_Engine_Port>/sap/ino/ui/backoffice

The application is not yet configured with any content so the screens will not show any content. It is acceptable ifthe very first start of the application takes some time as the application caches are initially empty.

Additional Information

For more information about user management in SAP Innovation Management, see the related section in the SAPInnovation Management Application Help at http://Help.sap.com -> SAP Business Suite -> SAP Product LifecycleManagement -> SAP Innovation Management.



SAP Innovation Management 1.0Landscape Setup

4 Landscape Setup

The landscape topology for SAP Innovation Management is very simple. The minimal setup is a SAP HANA XSServer. In addition, a connection to a mail server is required.

Figure 4: Landscape Setup

If security policies require a DMZ or similar mechanisms, it is necessary to provide an additional proxy or firewallin front of the system. In this case, the proxy can also be used to take load from the system, for example, byterminating https already at the proxy. To increase security, such a proxy may constrain all requests to URLs withthe prefix <baseURL>/sap/ino/. To shift load from the system to the proxy, it may also cache content for URLswith the prefixes <baseURL>/sap/ino/ui and <baseURL>/sap/ino/xs/rest/static.

Web Dispatcher

XS Server

Index Server

R

Mail ServerIdentityManagement

R

smtp

Rhttp

R

sql

R

https



Figure 5: Landscape Setup with Enhanced Security

4.1 SAP Web Dispatcher Setup

If no proxy is deployed, or if the proxy does not cache, the SAP Web Dispatcher must be configured for caching.This can be done from the SQL console as follows.

alter system alter configuration ('webdispatcher.ini', 'SYSTEM') set ('profile','icm/http/server_cache_0') = 'PREFIX=/sap/ui5/, CACHEDIR=$(DIR_INSTANCE)/wdisp/cache'with reconfigure;

alter system alter configuration ('webdispatcher.ini', 'SYSTEM') set ('profile','icm/http/server_cache_0/max_entries') = '100000' with reconfigure;



alter system alter configuration ('webdispatcher.ini', 'SYSTEM') set ('profile','icm/http/server_cache_1') = 'PREFIX=/sap/ino/ui/,CACHEDIR=$(DIR_INSTANCE)/wdisp/cache_1' with reconfigure;


alter system alter configuration ('webdispatcher.ini', 'SYSTEM') set ('profile','icm/http/server_cache_2') = 'PREFIX=/sap/ino/xs/rest/static/,CACHEDIR=$(DIR_INSTANCE)/wdisp/cache_2' with reconfigure;


alter system alter configuration ('webdispatcher.ini', 'SYSTEM') set ('profile','icm/http/server_cache_2/memory_size_mb') = '500' with reconfigure;

alter system alter configuration ('webdispatcher.ini', 'SYSTEM') set ('profile','icm/http/server_cache_2/size_mb') = '2000' with reconfigure;

This configuration implies that the web dispatcher requires two additional directories icm/http/server_cache_1and icm/http/server_cache_2 at the OS level. Log into the operating system and create those two directories.They have to reside in the same directory icm/http as the /icm/http/cache directory. Also use OS commandschown, chgrp, and chmod, such that, the web dispatcher has the same privileges on these directories as on thecache directory.

After these changes you need to restart the web dispatcher. Restarting the XS Engine or restarting the HANAServer will implicitly restart the web dispatcher as well.For more information, see SAP Web Dispatcher Configuration Reference under http://Help.sap.com ->Technology -> User-Interface Add-on for SAP NetWeaver -> Application Help -> English -> Configuration andOperations.

4.2 Browser and Mobile Client Setup

SAP Innovation management exposes URLs with the path <baseURL>/sap/ino/. To enable the browser andmobile client, access to these URLs must be reachable. Configure your network firewalls or proxies accordingly.

4.3 URL Whitelists

In SAP Innovation Management, users can use URL references at various places, for example, in descriptions ofideas, as part of a campaign description template or in HTML code of campaign pages. Ideas can also containdedicated links to which URLs point. By default, these URLs are not restricted. To restrict the URLs, a whitelist canbe maintained. As soon as one whitelist entry is maintained, all URLs not contained in the whitelist are not validany more, that is, either directly rejected or rendered inactive for existing content.The whitelist is maintained by inserting values in table sap.ino.db.basis::t_url_whitelist

insert into "sap.ino.db.basis::t_url_whitelist" (protocol, host, port, path)

values ('http','www.sap.com', null, null)




The columns are as follows:· PROTOCOL: The protocol of the URL· HOST: The host of the URL· PORT: The port of the URL· PATH: The path of the URL

If a column is set to null, this is treated as a wildcard (*).


SAP Innovation Management 1.0Application Configuration

5 Application Configuration

5.1 Overview

Application configuration is organized in HANA repository packages. The package sap.ino.config containsSAP delivered default configuration. If any customer-specific configuration is required, the following steps mustbe implemented. Otherwise they are optional.Customer-specific configuration is maintained in a dedicated package that extends the SAP configurationpackage; this means customer-specific configuration overrules SAP configuration.

Figure 6: Configuration Packages

Common non-technical settings are maintained in the Innovation Office by the Innovation Manager. Technicalconfiguration settings are maintained as Comma-Separated Values (CSV) files directly in the HANA repository.Before the CSV settings can be productively used, the configuration activation needs to be triggered. Theconfiguration activation takes care that configuration can be used productively within the application. For moreinformation, see chapter Activate Configuration.Customer-specific configuration can be done either directly in the production system or in an upstreamdevelopment and/or test system from where it is transported to the production system. For one configurationpackage there must only be one system where its settings are maintained.As CSV files are stored in the SAP HANA Repository, they can be exported and imported as SAP HANA deliveryunits. Content maintained in Innovation Office needs to be exported into the repository beforehand, see chapterConfiguration Repository Report. For more information on packages, delivery units and transport, seehttp://help.sap.com/hana_platform -> Developer Guide.




5.2 General Steps

5.2.1 Create a Configuration Package

Configuration settings are stored as files in the SAP HANA Repository in a dedicated customer package. Thepackage and its content can be created with SAP HANA Studio or SAP HANA Web IDE. In the following text, werefer to this package as <your.config.package>. A suitable name for this package might becust.ino.config or <your company name>.ino.config. The configuration package is an extension of thepackage sap.ino.config, which contains delivered configuration of SAP Innovation Management. Allconfiguration packages need to directly extend this package.Create the files t_package_extension.csv and t_package_extension.hdbti in the package<your.config.package>. Please replace <your.config.package> in the following files with your actualpackage name:

t_package_extension.csv:EXT_PACKAGE_ID;BASE_PACKAGE_ID;LAYER<your.config.package>;sap.ino.config;99

t_package_extension.hdbti:import = [{ hdbtable = "sap.ino.db.basis::t_package_extension"; file = "<your.config.package>:t_package_extension.csv"; header = true; delimField = ";"; keys = [ "EXT_PACKAGE_ID" : "<your.config.package>"];}];

The layer column of the package extension entry is set to 99 to ensure that your configuration settings havealways priority over SAP settings.To make sure that the settings listed above are correct, the following SQL statement can be used:select * from "sap.ino.db.basis::t_package_extension" where ext_package_id ='<your.config.package>'

It should return exactly one row with the content exactly as in t_package_extension.csv. If nothing is returnedcheck the correct spelling of <your.config.package> everywhere it is used and whether the CSV file containsall necessary line breaks.You need to make sure that <your.config.package> is accessible by http, so that text bundles andconfiguration images are available to end users. Depending on your overall package structure you may need tocreate an empty .xsapp and an .xsaccess file in <your.config.package>, seehttp://help.sap.com/hana_platform -> Developer Guide for details.Here are some minimal examples:

.xsapp:{}

.xsaccess:




{

"exposed": true

}

If you want to enable non-technical configuration in the Innovation Office, you need to configure<your.config.package> as the content package. This is done using the following SQL statement:

call "sap.ino.db.config.admin::set_config_package"('<your.config.package>');

In a multi-system landscape this must only be done in the source system of the configuration. After you havemaintained configuration in Innovation Office, this setting must not be changed any more.To make sure that the settings listed above are correct, the following SQL statement can be used:select * from "sap.ino.db.config::v_config_content_package"

It should return exactly one row returning <your.config.package>. If nothing or a different package is returnedmake sure that the layer in t_package_extension.csv is higher than all other configuration packages that arein use.

5.2.2 Create Configuration Package for E-Mail Template Images

E-Mail templates can contain images. These images are stored in the HANA repository so that they can betransported to another system. For this purpose a new package called attachment needs to be created below<your.config.package>.To be able to upload new images, the technical user created in chapter TechnicalUser Setup, needs additional privileges to write into these package. The privileges can be granted by using thefollowing SQL statements:grant REPO.READ on "<your.config.package>.attachment" to <TECHNICAL_USER>;

grant REPO.EDIT_NATIVE_OBJECTS on "<your.config.package>.attachment"to <TECHNICAL_USER>;

grant REPO.ACTIVATE_NATIVE_OBJECTS on "<your.config.package>.attachment"to <TECHNICAL_USER>;

grant REPO.MAINTAIN_NATIVE_PACKAGES on "<your.config.package>.attachment"to <TECHNICAL_USER>;

5.2.3 Activate Configuration

Application configuration maintained in CSV files needs to be activated explicitly in the system where it is beingmaintained. To trigger it, issue as Innovation System Manager an http POST request to:http://<fully qualified host name>:<port>/sap/ino/xs/rest/admin/system/config.xsjs

You may issue such a POST request with a command line http client, for example, with cURL:curl --user <User>:<Password> -X POST

http://en.wikipedia.org/wiki/CURL



http://<fully qualified host name>:<port>/sap/ino/xs/rest/admin/system/config.xsjs

Configuration maintained in Innovation Office does not need to be activated. After transporting configuration to adifferent system, you need to trigger activation explicitly as described above.The privilege REPO.READ for all configuration packages is required to successfully activate. The rolesap.ino.authorizations::innovation_system_manager already contains the privilege for the packagesap.ino.config. Additionally the privilege for the customer specific extension package must be granted.The following SQL statement can be used to grant that privilege:grant REPO.READ on "<your.config.package>" to <Innovation_System_Admin>;

5.2.4 Configuration Repository Export

For multi-system landscapes the configuration settings maintained in Innovation Office need to be exported to theHANA repository to be able to transport them to other systems. Export is also needed for a single system whenconfiguration content needs to be translated. To trigger the repository export, issue an http PUT request to:http://<fully qualified hostname>:<port>/sap/ino/xs/rest/admin/system/config_export.xsjs

You may issue such a PUT request with a command line http client, for example, with cURL:curl --user <User>:<Password> -X PUT

http://<fully qualified hostname>:<port>/sap/ino/xs/rest/admin/system/config_export.xsjs

This will create CSV files and text bundle files in <your.config.package> for configuration maintained inInnovation Office. A repeated export overwrites the CSV files and text bundle files.

To successfully export, the configuration in Innovation Office needs to be enabled. For more information, seechapter Create a Configuration Package. The privileges REPO.EDIT_NATIVE_OBJECTS,REPO.ACTIVATE_NATIVE_OBJECTS and REPO.MAINTAIN_NATIVE_PACKAGE are required on<your.config.package>. In case change tracking is active the privileges REPO.MODIFY_CHANGE andREPO.MODIFY_OWN_CONTRIBUTION are required in addition.

The following SQL template can be used to grant those privileges:

grant REPO.EDIT_NATIVE_OBJECTS on "<your.config.package>"to <Innovation_System_Admin>;

grant REPO.ACTIVATE_NATIVE_OBJECTS on "<your.config.package>" to<Innovation_System_Admin>;

grant REPO.MAINTAIN_NATIVE_PACKAGES on "<your.config.package>"to <Innovation_System_Admin>;

http://en.wikipedia.org/wiki/CURL



5.3 Individual Application Configuration Settings

5.3.1 Common Application Settings

For common application settings, there is a general key-value-like configuration table. SAP delivers content forthis package. These values are contained in the file sap.ino.config::t_system_setting.csv. To change SAP settings,the following steps need to be performed:Create the file t_system_setting.csv in <your.config.package>:

t_system_setting.csv:CODE;VALUE

sap.ino.config.PPM_INTEGRATION_ACTIVE;1

The column CODE refers to the code of an SAP delivery setting. To avoid inconsistencies, we recommend copyingthe first two rows of the SAP CSV file, and then do the necessary adjustments.In the example above, integration with SAP Portfolio and Project Management is activated, as the column VALUEis set to 1. Important system setting codes are:

sap.ino.config.PPM_INTEGRATION_ACTIVE

It allows to activate (VALUE = 1) or deactivate (VALUE = 0) integration with SAP Portfolio and ProjectManagement.After the CSV file in the SAP HANA Repository has been created, configuration activation needs to be triggered.For more information, see chapter Activate Configuration.

5.3.2 Allowed File Types

SAP Innovation Management allows configuring which file types are allowed as an attachment. SAP alreadydelivers a number of file types. These values are contained in the filesap.ino.config::t_attachment_allowed_file.csv. The delivered values can also be retrieved byexecuting the following SQL statement:

select * from "sap.ino.db.attachment::t_attachment_allowed_file_stage"where package_id = 'sap.ino.config'

The active runtime values may be obtained with the following SQL statement:select * from "sap.ino.db.attachment::t_attachment_allowed_file"

To change SAP settings, the following steps must be performed:Create the file t_attachment_allowed_file.csv in <your.config.package>:

t_attachment_allowed_file.csv:CODE;FILE_EXT;MEDIA_TYPE



cust.ino.config.DXF;dxf;image/vnd.dxf

In this example, a new file type XPS is registered.When creating your own settings, the code has to be prefixed with <your.config.package>. To avoidinconsistencies, we recommend that you copy the first two rows of the SAP CSV file, and then do the necessaryadjustments.Please note that the column MAX_FILE_SIZE is not considered any more. Instead a global setting for all files ismade in Innovation Office (see chapter Settings in Innovation Office). After the CSV file in the SAP HANARepository has been created, configuration activation needs to be triggered. For more information, see chapterActivate Configuration. Your changes should now be included in the active runtime table.

5.3.3 Package Content at a Glance

The following picture shows your configuration package and its content when you have decided to adapt allpossible system configuration settings:

Figure 7: Customer-Specific Configuration Content

5.4 Settings in Innovation Office

Some application settings can be made by the Innovation Managers in the Innovation Office "Settings" tab, suchas setting the background image, activating the expert finder etc. For more information about innovation officesettings, see http://help.sap.com/inm -> Application Help -> SAP Innovation Management -> Innovation Office ->Settings.Those settings are not transported; they are only applied in the system where they are made. The following URLleads the Innovation Manager directly to those settings:

http://help.sap.com/inm



http://<fully qualified host name>:<port> sap/ino/ui/backoffice/#settings

Please be aware that usage tracking of the application is activated by default. In certain countries tracking issubject to data protection regulations or similar legal frameworks. The typical minimum requirement is a legaldisclaimer to notify the users about the collection of this data. If you activate this feature be sure to add a suitablelegal disclaimer in your terms and conditions statement.

Figure 8: Settings in Innovation Office

SAP Innovation Management 1.0Business Scenario of SAP Innovation Management


6 Business Scenario of SAP InnovationManagement

6.1 Run an Idea Campaign for Product Innovation

Overview

SAP Innovation Management is used to run an idea campaign for product innovation.

Software Units

· SAP HANA Platform SP09· SAP Innovation Management

Further Information

The following documents provide more information about Run an Idea Campaign for Product Innovation:

Content Location

Scenario Description See the documentation in SAP Solution Manager.

Configuration Documentation See the documentation in SAP Solution Manager.

Scenario Security Guide For more information, see SAP Service Marketplace athttp://service.sap.com/securityguide



SAP Innovation Management 1.0Security Considerations

7 Security Considerations

SAP Innovation Management is built on the SAP HANA Platform SP09. Therefore, the security settings of the SAPHANA Platform apply to SAP Innovation Management.

7.1 Fundamental Security Guides

The basic document to refer to for security considerations is the SAP HANA Security Guide. For more information,see http://help.sap.com/hana_platform -> Security Guide.

Additional Information

For more information about specific security topics, see the following locations on SAP Service Marketplace asshown in the table below:

Content Location

Security http://service.sap.com/security

Security Guides http://service.sap.com/securityguide

Released Platforms http://service.sap.com/platforms

Network Security http://service.sap.com/securityguide

Infrastructure Security http://service.sap.com/securityguide

SAP Solution Manager http://support.sap.com/solutionmanager


http://service.sap.com/security


http://service.sap.com/platforms



http://support.sap.com/solutionmanager

SAP Innovation Management 1.0Integration with SAP Portfolio and Project Management


8 Integration with SAP Portfolio and ProjectManagement

Integration of SAP Portfolio and Project Management with SAP Innovation Management requires advancedsystem administration skills and privileges. In particular it is easily possible to setup a configuration that seems towork but is insecure. We recommend that you take support from consulting for this task.

8.1 Integration from SAP Portfolio and Project Management toInnovation Management

To link an object in the SAP Portfolio and Project Management to ideas in the Innovation Management, SAPInnovation management uses http requests. These requests use a secure connection (SSL) and transmit the userauthentication information in an SAP assertion ticket. Since there is no user mapping available it is mandatorythat the user names on both the Innovation Management as well as the Project Management side are identical.

For the Project and Portfolio Planning relevant settings you may want to consult the attachment ConfigContPPMof SAP Note 2026421. The relevant section is 'Setting Up Object Links to Ideas in SAP Innovation Management'. Itis recommended to read the attachment to this note before you start the configuration.

Figure 9: Integration from Portfolio and Project Management to Innovation Management

8.1.1 Configure Innovation Management to accept SSLconnections

As a prerequisite for connections from PPM to Innovation Management the Innovation Management side must besetup to accept https connections.

http://service.sap.com/~form/handler?_APP=01100107900000000342&_EVENT=DISPL_TXT&_NNUM=2026421&



For information on how to setup SAP HANA to accept HTTPS connections seehttp://help.sap.com/hana_platform -> SAP HANA Administration Guides -> SAP HANA XS Administration Tools -> Configuring HTTPS (SSL) for Client Application Access.

8.1.2 Import the Innovation Management Server Certificate intoPortfolio and Project Management

For the customization of SAP PPM a HTTP RFC destination must be maintained. As a prerequisite this destinationmust be maintained with transaction SM59. As a prerequisite for this intermediate step the SSL server certificateof the SAP Innovation Management System must be imported into the Portfolio and Project Management system.You can use transaction strust to import the certificate into the PPM system. Depending on your desired setupyou may either import the certificate into the System PSE or into a dedicated PSE.For more information, see http://help.sap.com/netweaver -> SAP NetWeaver Platform -> SAP NetWeaver 7.0Including Enhancement Package 3 -> Security Guide -> Network and Communication Security -> Transport LayerSecurity -> Configuring the AS ABAP for Supporting SSL.

8.1.3 Configure Innovation Management Users

As of the current release of SAP HANA, there is no explicit mapping between the user names in the Portfolio andProject Management Server and SAP HANA. The user names on both systems must exactly match. The usersauthenticated by Portfolio and Project Management are also recognized by innovation management. EveryPortfolio and Project Management user who is supposed to create Portfolio and Project Management object linksto ideas in the Innovation Management must also be a user of Innovation Management.For upload of users into innovation management see chapter User and Group Administration. These users mustbe assigned to the innovation office user role.For more information, see http://Help.sap.com ->SAP Business Suite -> SAP Product Lifecycle Management ->SAP Innovation Management -> Application Help -> Innovation Office -> User Management -> Roles in SAPInnovation Management.Additionally the users must be enabled to authenticate with a SAP logon ticket. See the paragraph on UserConfiguration in the SAP HANA Security GuideFor more information, see http://help.sap.com/hana_platform ->Security Guide -> SAP HANA Authentication andSingle Sign-On -> Single Sign-On Using SAP Logon and Assertion Tickets.

8.1.4 Configure Single Sign-On with SAP Assertion Tickets

When a user in Portfolio and Project Management triggers a request to the Innovation Management system theuser shall be automatically authenticated with Innovation Management. To enable this, the InnovationManagement System needs to trust the Portfolio and Project Management authentication.


http://help.sap.com/netweaver





To enable the validation of the assertion tickets the innovation management needs to trust assertion tickets fromthe PPM system. To establish this, the HANA system needs to trust the PPM System's certificate. With otherwords the server certificate (or its root certificate) used by the PPM System needs to be in the HANA Systemtrust store.For more information, see http://help.sap.com/hana_platform -> Security Guide -> SAP HANA Authenticationand Single Sign-On -> Single Sign-On Using SAP Logon and Assertion Tickets.For more information, see http://help.sap.com/hana_platform -> Administration Guide ->SAP HANA XSAdministration Tools -> Maintaining Single Sign-On for SAP HANA XS Applications -> Configure SSO with SAPLogon Tickets for SAP HANA XS Applications.

8.2 Integration from SAP Innovation Management to thePortfolio and Project Management

In the Innovation Office all existing object links from Portfolio and Project Management are displayed, if the loggedon user has required privileges in Portfolio and Project Management. To enable this scenario innovationmanagement sends a secure request to a service on the Portfolio and Project Management side. Again singlesign-on with an SAP assertion ticket transfers the authentication information. This requires the followingconfiguration steps.

Figure 10: Integration from Innovation Management to Portfolio and Project Management

8.2.1 Enable Portfolio and Project Management for SSL

For more information, see http://help.sap.com/netweaver -> SAP NetWeaver Platform -> SAP NetWeaver 7.0Including Enhancement Package 3 -> Security Guide -> Network and Communication Security -> Transport LayerSecurity -> Configuring the AS ABAP for Supporting SSL.



http://help.sap.com/netweaver



8.2.2 Import the Portfolio and Project Management Certificateinto Innovation Management

For more information about Importing a Server Certificate see http://help.sap.com/hana_platform ->Administration Guide -> SAP HANA XS Administration Tools -> Managing Trust Relationships -> Import a ServerCertificate.

8.2.3 Configure Single Sign-On with SAP Assertion Tickets

To pass user authentication information from innovation management to Portfolio and Project Management thePortfolio and Project Management server must trust the innovation management's logon assertion tickets. Toestablish this trust relationship the innovation management's server certificate used for signing the assertiontickets must be imported into the Portfolio and Project Management system.The steps to enable the creation of the assertion ticket and to establish the trust between Portfolio and ProjectManagement and innovation management is described in the section Configure Outbound SSO with AssertionTickets, steps 1 through 5.For more information, see http://help.sap.com/hana_platform -> Administration Guide -> SAP HANA XSAdministration Tools -> Maintaining Single Sign-On for SAP HANA XS Applications -> Configure Outbound SSOwith Assertion Tickets,

8.2.4 Maintain the Portfolio and Project ManagementDestination in Innovation Management

Innovation Management uses a logical pointer to the Portfolio and Project Management service, which providesthe set of existing object links to a given idea. This logical pointer is an URL to be maintained in the SAP Hana XSAdministration tool. Open the administration tool, Select the sap/ino/xs/rest/ppm.httpdest object in the tree ofapplication objects(http://<system>:<port>/sap/hana/xs/admin/#/package/sap.ino.xs.rest/httpDestination/ppm) and create anextension for it (or edit an existing extension). As the target destination enter your Project and PortfolioManagement's system host and (ssl) port number and set the path prefix to"/sap/opu/odata/sap/inm_im_obl_integration_srv/".Then follow the steps 7 & 8 of the section Configure Outbound SSO with Assertion Tickets in the HANAAdministration Guide.As the target destination enter your Project and Portfolio Management's system host and (ssl) port number andset the path prefix to "/sap/opu/odata/sap/inm_im_obl_integration_srv/".For more information, see http://help.sap.com/hana_platform -> Administration Guide -> SAP HANA XSAdministration Tools -> Maintaining Single Sign-On for SAP HANA XS Applications -> Configure Outbound SSOwith Assertion Tickets,






8.2.5 Settings on SAP Portfolio and Project Management

For more information, see the attachment ConfigContPPM in SAP Note 2026421.



SAP Innovation Management 1.0References

9 References

List of Documents

The following table lists all documents mentioned in this Master Guide.

Title Where to Find

SAP HANA Platform http://help.sap.com/hana_platform

SAP HANA Master Guide http://help.sap.com/hana_platform-> Master Guide

SAP HANA Security Guide http://help.sap.com/hana_platform-> Security Guide

SAP HANA Operations andAdministration Guides

http://help.sap.com/hana_platform->Technical Operations Manualhttp://help.sap.com/hana_platform->Administration Guide

SAP HANA Developer Guide http://help.sap.com/hana_platform->Developer Guide

SAP Web Dispatcher ConfigurationReference

http://Help.sap.com -> Technology -> User-InterfaceAdd-on for SAP NetWeaver -> Application Help ->English -> Configuration and Operations

SAP Innovation Management ApplicationHelp

http://Help.sap.com -> SAP Business Suite -> SAPProduct Lifecycle Management -> SAP InnovationManagement.

List of SAP Notes

The following table lists all SAP Notes mentioned in this Master Guide.

SAP Note Number Title Description

SAP Note 2037158 SAP Innovation Management 1.0Release Note

This note contains the latestinformation about installing SAPInnovation Management










SAP Innovation Management 1.0Release Availability Information


10 Release Availability Information

For more information about currently available releases for SAP Innovation Management, and for each release,the SAP standard software required to install and use the solution, seehttp://www.service.sap.com/fbs/availability.

http://www.service.sap.com/fbs/availability

www.sap.com/contactsap

© 2015 SAP SE or an SAP affiliate company. All rights reserved.No part of this publication may be reproduced or transmitted in anyform or for any purpose without the express permission of SAP SE.The information contained herein may be changed without priornotice.Some software products marketed by SAP SE and its distributorscontain proprietary software components of other softwarevendors.National product specifications may vary. These materials areprovided by SAP SE and its affiliated companies ("SAP Group") forinformational purposes only, without representation or warranty ofany kind, and SAP Group shall not be liable for errors or omissionswith respect to the materials. The only warranties for SAP Groupproducts and services are those that are set forth in the expresswarranty statements accompanying such products and services, ifany. Nothing herein should be construed as constituting anadditional warranty.SAP and other SAP products and services mentioned herein as wellas their respective logos are trademarks or registered trademarks ofSAP SE in Germany and other countries. Please seehttp://www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademarkinformation and notices.