## 14.2 Direct Connectivity: SAP S/4HANA as Client
When sending a cXML message to a business network, the sender must authenticate itself:
- SAP Fieldglass supports authentication by client certificate.
- Ariba Network offers authentication with client certificate or with shared secret password. Both authentication methods are also supported by SAP S/4HANA. For more information about the authentication methods on Ariba Network, contact SAP Ariba.
##  Note
Communication with the Ariba Network and with SAP Fieldglass is based on HTTPS. For HTTPS SSL encryption, SAP Cryptographic Library is required.
For information about installing the SAP Cryptographic Library, go to https:/ /help.sap.com/ s4hana\_op\_2021, enter The SAP Cryptographic Library Installation Package into the search bar, press Enter , and open the search result with that title.
## Authentication with Client Certificate (Ariba Network Only)
For authentication with client certificate it is strongly recommended that you use the latest version of the SAP Cryptographic Library ( SAPCRYPTOLIB ). For more information about latest SAP Cryptographic Library versions, bugs, and fixes see SAP Note 455033 .
##  Note
Only certificates in Personal Security Environment (PSE) format can be imported. Certificates in other formats must first be converted to PSE format. The conversion can be done using the command line tool SAPGENPSE . The tool can be installed with SAP Cryptographic Library installation package.
For example, to convert from P12 (Public-Key Cryptography Standards) format to PSE format, enter the following command line:
sapgenpse import\_p12 -v -r &lt;root certificate&gt; -p &lt;Target PSE file&gt; &lt;Source File&gt;
Setting up authentication with client certificate includes the following steps:
1. Get the client certificate from a Certification Authority (CA) that is trusted by Ariba.
2. Import the private key of the certificate into the SAP S/4HANA system by using Trust Manager (transaction STRUST ).
1. To store the client certificate in SAP S/4HANA, you have to create a new Client Identity in Trust Manager . Proceed as follows:
1. Choose Environment SSL Client Identities , enter ARIBA as the identity name and Ariba Network Client as the description.
2. Save your entries.
2. Import the private key of the certificate in Trust Manager. Proceed as follows:
1. Select the created ARIBA SSL Client ID and choose PSE Import to import the PSE file.
2. Enter the password for the certificate, if required.
3. Save your PSE file by choosing PSE Save as SSL Client , and enter ARIBA as the SSL Client.
4. Navigate to the Own Certificate group box on the Trust Manager screen, and double-click the certificate to add it to the certificate list. The certificate is now shown in Trust Manager in Certificate List .
3. Import the root certificate into the SAP S/4HANA system by using Trust Manager . Proceed as follows:
1. Double-click the SSL Client Identity ARIBA that you have created.
2. Navigate to the Certificate group box and choose Import certificate . Add the imported certificate to the certificate list by clicking Add to Certificate List .
4. For HTTPS SSL encryption, obtain the server certificate from Ariba. Proceed as follows:
1. Go to buyer.ariba.com.
2. Download the certificate using your browser. For example, if you are using Internet Explorer, choose View Security Report View Certificates . On the Details tab page, choose Copy to File and export it in the Base-64 encoded X.509 format.
3. Import the server certificate into the SAP S/4HANA system using Trust Manager .
4. Double click the ARIBA SSL Client ID that you have created.
5. Navigate to the Certificate group box and choose Import certificate . Add the imported certificate to the certificate list by clicking Add to Certificate List .
5. To activate the changes, restart the Internet Communication Manager (ICM) using transaction SMICM and choose Administration ICM Restart Yes . For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Using the ICM Monitor into the search bar, press Enter , and open the search result with that title.
6. Configure the Web services in SOA Manager (transaction SOAMANAGER ). Find the following consumer proxies:
- cXMLSynchronousOutboundAdapterMessage\_Out ( CO\_ARBFND\_PRX\_OADP\_OUT )
- cXMLGetPendingDataRequest\_Out ( CO\_ARBFND\_PRX\_GPDQ\_OUT )
In the Details of Consumer Proxy group box, navigate to the Configurations tab page and select the logical port. In the Configuration of Logical Port group box, navigate to the Consumer Security tab page, choose the X.509 SSL Client Certificate radio button, and enter Ariba in the SSL Client PSE of transaction STRUST field.
7. For Ariba Network: In the profile of your account on Ariba Network, select the Certificate authentication method in the cXML setup and enter the public key of the certificate.
## Authentication with User and Password
To set up authentication with a user and a password, proceed as follows:
1. Maintain the user and the password in the Define Credentials and Endpoints for Ariba Network Customizing activity or in the Define Credentials for SAP Fieldglass Customizing activity, respectively. The password is stored in the secure storage of your SAP S/4HANA system. SAP S/4HANA supports
passwords with a maximum length of 36 characters.
##  Note
According to security requirements, passwords must not be written to logs, protocols, or traces. Therefore, the password is not visible in transactions such as SRT\_MONI where the XML message
monitoring and tracing takes place, as business users can also have authorization for the message monitoring transactions. However, when activating an Internet Communication Framework (ICF) recording using transaction SICF, the system logs the password in the corresponding ICF trace. ICF recording is only intended for administrators and requires the S\_ADMI\_FCD authorization.
Ariba Network integration only : For authentication with shared secret password, the shared secret password has to be provided in the Sender element of the cXML payload.
2. For HTTPS SSL encryption, obtain the server certificate from the business network. Proceed as follows:
1. Go to buyer.ariba.com or to fieldglass.net, respectively.
2. Download the certificate using your browser. For example, if you are using Internet Explorer, choose View Security Report . Choose View Certificates . On the Details tab page, choose Copy to File and export the certificate in the Base-64 encoded X.509 format.
3. Import the server certificate into the SAP S/4HANA system using Trust Manager .
4. Double-click the SSL Client SSL Client (Anonymous) node. Navigate to the Certificate group box and choose Import certificate . Add the imported certificate to the
certificate list by clicking Add to Certificate List .
3. To activate the changes, restart the Internet Communication Manager (ICM) using transaction SMICM and choose Administration ICM Restart Yes .
4. In the profile of your account in the Ariba Network, select the shared secret authentication method in the cXML setup.