## 13.7.10  Interaction Center
## Why Is Security Necessary?
Security is necessary because:
- The Interaction Center WebClient (IC WebClient) synchronizes data from the communication management software. Such data could include personal data or restricted business data, such as contract order data, and must be protected.
- Interaction center agents (IC agents) can log on to SAP S/4HANA Service and access data such as Customer Master Data. Such customer-sensitive data must be protected.
## Technical System Landscape
The following figure illustrates the system landscape.
<!-- image -->
## Abbreviation Key for Figure Above
| Abbreviation   | Description                           |
|----------------|---------------------------------------|
| ICI            | Integrated Communication Interface    |
| OLTP           | Online Transaction Processing System  |
| RDBMS          | Relational Database Management System |
| BW             | Business Warehouse                    |
## Security Aspects of Data Flow and Processes
The figure below shows an overview of the communication channel integration into the IC WebClient:
Overview of Communication Channel Integration
<!-- image -->
The HTTP security session management ensures the security of the communication paths displayed in the graphic. For an overview of the communication paths and more detailed information, see the section Network and Communication Security in this chapter.
## Abbreviation Key for Figure Above
| Abbreviation   | Description                        |
|----------------|------------------------------------|
| ICI            | Integrated Communication Interface |
| ICM            | Internet Communication Manager     |
| BCB            | Business Communication Broker      |
| MCM            | Multi Channel Management           |
| Abbreviation   | Description                   |
|----------------|-------------------------------|
| SAM            | Simplified ABAP Messaging     |
| SOAP           | Simple Object Access Protocol |
## Authorizations
The IC WebClient uses the SAP S/4HANA Service standard for authorizations.
## ABAP Stack Standard Roles Used by SAP S/4HANA Service
| Role                        | Description                                    |
|-----------------------------|------------------------------------------------|
| SAP_CRM_UIU_UTIL_LEAN_AGENT | PFCG role for Utilities Interaction Agent      |
| SAP_S4C_UIU_SRV_ICAG        | PFCG role for Service Interaction Center Agent |
## ABAP Stack Standard Roles Delivered with SAP S/4HANA Service Used by Industry Solutions
| Role                           | Description                                      |
|--------------------------------|--------------------------------------------------|
| SAP_CRM_UIU_UTIL_IC_LEAN_AGENT | PFCG role for Utilities Interaction Center Agent |
## Network and Communication Security
## Communication Channel Security
The table below shows the communication channels used by the Interaction Center, the protocol used for the connection, and the type of data transferred.
| Communication Path                                                                                                               | Protocol Used                                                                                                                                         | Type of Data Transferred                                                                                                                                                       | Data Requiring Special Pro- tection                                                                                                                                                                                              |
|----------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Communication between a web browser and AS ABAP                                                                                  |                                                                                                                                                       | User requests are transfer- red between a web browser and AS ABAP. Logon infor- mation and subsequent re- quests from the browser are transferred from the browser to AS ABAP. | Used when IC agents log on to SAP S/4HANA Service from a web browser . User- sensitive data must be pro- tected. To configure secure sockets layer (SSL) over AS ABAP, see the Application Server ABAP Platform Security Guide . |
| Communication channel be- tween components residing in different ABAP sessions of IC WebClient                                   | HTTP/HTTPS                                                                                                                                            | Each IC WebClient applica- tion session consists of mul- tiple ABAP sessions running concurrently.                                                                             | Used when IC WebClient is initiated. To enable HTTPS, an additional HTTP destina- tion is created (see the Communication Destinations section). To configure SSL over AS ABAP, see the Application Server ABAP Security Guide .  |
| Communication between a remote SAP S/4HANA Serv- ice system or a remote SAP S/4HANA system                                       | HTTP/HTTPS through SAP Internet transaction server                                                                                                    | Business transactions and business objects are ex- changed between SAP S/ 4HANAService and SAP S/ 4HANA.                                                                       | (Optional) Used when an IC agent in SAP S/4HANA Serv- ice tries to access data in an SAP S/4HANA system by launching a transaction. Used when creating and pre- populating a service request from a remote SAP S/4HANA system.   |
| Communication within SAP S/4HANA                                                                                                 | HTTP through UI                                                                                                                                       | N/A                                                                                                                                                                            | (Optional) Used when an IC agent tries to launch a UI application by launching a transaction.                                                                                                                                    |
| Communication between an SAP S/4HANAService and communication manage- ment software (CMS), such as telephony or e-mail rout- ers | Business communication broker (BCB) application programming interface (API) communicates with theCMS using the Simple Object Ac- cess Protocol (SOAP) | Data (such as incoming call, contact attached data, and e- mail) is transferred from the CMSto the SAP S/4HANA Service system.                                                 | (Optional) Used when mul- tichannel is used in the IC WebClient to handle tel- ephone calls, e-mails, chat, and so on.                                                                                                           |
| Communication Path                                                                         | Protocol Used                                                                 | Type of Data Transferred                                                  | Data Requiring Special Pro- tection                                     |
|--------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------|---------------------------------------------------------------------------|-------------------------------------------------------------------------|
| Communication between an SAP S/4HANA Service sys- tem and a third-party teleph- ony switch | SAPphone API communi- cates with the third-party tel- ephony switch using RFC | Incoming call data is ex- changed.                                        | (Optional) Used when IC agents handle telephone calls through SAPphone. |
| Communication between SAP S/4HANA Service and Solution Manager                             | RFC and WebService                                                            | Incidents (both directions), from Solution Manager to SAP S/4HANA Service | Optional                                                                |
For more information, see the section Communication Channel Security [page 19] in this security guide.
## Communication Destinations
The table below shows an overview of the communication destinations used by the IC WebClient:
| Destination                       | Delivered?   | Type             | User, Authoriza- tions   | Description                                                                                                                         |
|-----------------------------------|--------------|------------------|--------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
| Remote SAP S/4HANA Service system | No           | RFC              | N/A                      | (Optional) Communication with a remote SAP S4/HANA system or a remote SAP S/ 4HANAService system through the trans- action launcher |
| SAP S/4HANA                       | No           | HTTP/HTTPS       | N/A                      | (Optional) Communication with a remote SAP S/4HANA system through SAP Fiori launchpad.                                              |
| SAP Solution Manager              | No           | RFC WebSer- vice | N/A                      | (Optional) Communication with a remote SAP Solution Manager system                                                                  |
| Third-party telephony server      | No           | RFC              | N/A                      | (Optional) Only if IC agents handle calls using SAPphone.                                                                           |
You must add the following additional communication destination for HTTPS:
| Destination                                    | Delivered?   | Type   | User, Authoriza- tions   | Description                                                                                                                                                                                   |
|------------------------------------------------|--------------|--------|--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Connection between two different IC ses- sions | No           | RFC    | SSL is activated         | Created by a system administrator using the CRMM_IC_GFS transaction to set up the communication between different IC WebClient sessions (agent session, worker session, or SAPphone session). |
## Network Security
The Business Server Page (BSP) ports for HTTP/HTTPS have to be opened in the firewall if agents access the IC WebClient from another network or from the Internet by launching the IC BSP URL.
## ICF and Session Security
Activate the services that are needed for the applications running in your system.
If your firewalls use URL filtering, also take note of the URLs used for the services and adjust your firewall settings accordingly.
For more information, see the section ICF and Session Security [page 21] in this security guide.
## Data Storage Security
The simplified ABAP messaging (SAM) component stores the HTTP(S) URLs of the different ABAP sessions of the IC WebClient as server-side cookies. (Each IC WebClient application session consists of multiple ABAP sessions running concurrently.) This URL contains the session ID of the ABAP session. This data is not sensitive and is not accessible from outside the current application server (AS), so there is no severe security risk. This information is deleted from the server-side cookie once the application session is shut down.
## Security for Text Message Integration in Interaction Center
- If you configure SAPconnect for sending text messages, check the security-related settings. For more information, search for SAPconnect (BC-SRV-COM) on SAP Help Portal at SAP S/4HANA.
- For general security information regarding RFC scenarios, search for RFC/ICF Security Guide on SAP Help Portal at SAP S/4HANA.
- If the default connector, which uses SAPconnect, does not meet your requirements in terms of the dedicated service provider, you can use a customer-defined connector. In this case, ensure that the network communication is secure. For more information, see the section Network and Communication Security [page 19] in this security guide.
- Authorization concept for text message integration in Interaction Center :
- Triggering text messages: The text message is triggered by service order actions. If a business user has the authorization to change the service order, there will be no additional authorization checks for the text message.
- Displaying text messages: The entry of the outbound plug mapping CRM\_SMS is enhanced for text messages in the navigation bar profile S4C\_SRV\_ICAGT . The entry is assigned to the PFCG role SAP\_S4C\_UIU\_SRV\_ICAG to control the authorization for displaying text messages.
## Security for Additional Applications
The following additional applications are associated with the IC WebClient or delivered with it:
- Third-party communication management software (CMS) It has its own authentication and authorization mechanism to provide security. Currently, it does not support HTTPS communication.
- Business communication broker (BCB)
- SAPphone Provides a telephony function for the interaction center (IC).
There are no particular frontend clients that deviate from the standard SAP system.
The following table lists details for the additional applications:
| Additional Application   | Vendor       | Security Guide                          | Special Security Settings                                                                                                      |
|--------------------------|--------------|-----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
| SAP ITS                  | SAP internal | ABAP Platform Security Guide            | No                                                                                                                             |
| UI                       | SAP internal | Security Guide for SAP S/ 4HANA Service | To use the UI-based applica- tion within the IC WebClient, users must have authoriza- tion to start the UI-based ap- plication |
| BCB                      | SAP internal | ABAP Platform Security Guide            | No                                                                                                                             |
| SAPphone                 | SAP internal | N/A                                     | No                                                                                                                             |
## Other Security-Relevant Information
| Active Code   | Location                | Functions Disabled Without This Active Code   |
|---------------|-------------------------|-----------------------------------------------|
| JavaScript    | Widely used in frontend | IC WebClient                                  |
## Trace and Log Files
The following information is traced in the AS cache:
- Messages exchanged between CMS and SAP S/4HANA Service
- Messages exchanged between ABAP sessions
The trace is turned off by default. For more information on turning on the trace and changing trace levels, search for Administration of the Internet Communication Manager on the SAP Help Portal at SAP S/4HANA.