## 13.7.11  E-Mail Response Management System
The E-Mail Response Management System (ERMS) is based on the AS ABAP and SAP S/4HANA Service. ERMS runtime runs on top of the workflow system. The design time uses the Web UI framework.
## Why Is Security Necessary?
ERMS deals primarily with e-mails. The openness of this communication channel allows anyone to send an e-mail to this system. The following measures ensure:
- High system availability (that is, make sure that the system is not brought down by massive numbers of requests)
- Protection from e-mails containing malicious content
- Protection of personal data stored in the system
## Checklist
| Feature                                                              | Check                                                                                               | How to Check                                                                                                                                                                                                                                                                                                                                                                                                  |
|----------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Restrict access to e-mail proc- essing                               | Workflow e-mail task can be processed only by authorized organizational units or au- thorized users | In the SAP Easy Access menu, choose Service Interaction Center E-Mail Response Management System Settings Assign Agent for E-Mail Handling . Choose Assign Agents . Expand workflow template ERMS1 and se- lect task TS 00207914 . Choose Attributes and select the item as re- quired. In the toolbar, choose Create agent assignment . (Not necessary for a general task because everybody can process this |
| Restrict access to e-mail proc- essing                               | Authorized agents are properly assigned to the organizational unit                                  | For the e-mail workflow task above, in the application in the Service Professional role, choose Service Operations Search: Organizational Model .                                                                                                                                                                                                                                                             |
| Restrict or allow access to cer- tain policies in ERMSrule mod- eler | ERMSauthorization group concept is used                                                             | To define your authorization groups, use transaction CRMC_ERMS_REPOSITORY . To define which policies users can read, change, create, and deploy, and under which ERMSauthorization groups such op- erations can be performed, use authoriza- tion object CRM_ERMS_P as a template.                                                                                                                            |
| Feature                      | Check                                                                                 | How to Check                                                                                                                                                                                                               |
|------------------------------|---------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Web form connector (if used) | Default implementation for the ERMSWeb Form Connector BAdI ( CRM_ERMS_WF_CON ) exists | 1. In the BAdI Builder (transaction SE18 ), display the BAdI CRM_ERMS_WF_CON . 2. Ensure that the Enhancement Implementations tab contains a BAdI implementation in which the Default Implementation checkbox is selected. |
## Technical System Landscape
The following figure illustrates the technical system landscape:
<!-- image -->
## Technical System Landscape
The entry point to ERMS runtime is SAPconnect. Once an e-mail is received by SAPconnect, it hands over the e-mail item to ERMS BOR object ERMSSUPRT2 . This starts the execution of workflow ERMS1 . Y ou can associate an e-mail address in the system with this ERMS BOR object under Inbound Distribution: Settings for Recipient Determination (transaction SO28 ). Once the workflow is triggered by the incoming e-mail, it starts the ERMS service manager.
## Authorizations
To enable ERMS administrators to use the ERMS design-time tools (such as the profile generator), you must assign ERMS administrators to the Service Professional role SAP\_S4C\_SRV\_PRO . This role includes the necessary authorization to access the following tools:
- Rule modeler
- Category modeler
- ERMS reporting
- E-mail workbench
In addition, authorization groups make it possible to restrict different permissions (for example, read, write, or, deploy) in the rule modeler. You can maintain authorization groups in Customizing for Service under E-Mail Response Management System Define Repository . Select the appropriate context (such as ERMS ) and select Authorization Groups .
Finally, add authorization CRM\_ERMS\_P to role SAP\_S4C\_SRV\_PRO , and set the following parameters accordingly:
- Activity
- ERMS authorization group
- Context
## Network and Communication Security
## Communication Channel Security: E-Mail
We recommend that you use a general purpose e-mail server, such as Microsoft Exchange. You must implement a virus scanner on the e-mail server to scan e-mails or e-mail attachments. After scanning, the e-mail is handed over to the ERMS for processing. If you allow HTML e-mails, you must install a filter for script on your e-mail server.
SAPconnect uses the Simple Mail Transfer Protocol (SMTP) to receive e-mails. Another option for configuring your system is to send an e-mail directly to SAP S/4HANA Service and have it processed by ERMS. Note that this latter option is not recommended. For more information about SAPconnect, see SAP Note 738326 .
To display or process HTML content of e-mails within the Interaction Center, your e-mail infrastructure must be able to secure or sanitize HTML mails with active content (such as, but not limited to, JavaScript) before they are sent to the Interaction Center. You must also guarantee that measures for securing or sanitizing these mails (for example filtering on the e-mail server) are switched on.
If you cannot guarantee that such measures are in place, you can disable or filter the display of HTML e-mails in the interaction center as follows:
1. Configure the display of HTML e-mails.
You do this in Customizing for Service under Interaction Center WebClient Basic Functions Communication Channels Define E-Mail Profiles , by setting the field Disp. HTML Mail (Display of HTML Mails) to Disabled or Filtered .
If you filter the display of HTML e-mails, the system triggers a warning message if a user opens an HTML e-mail that contains non-secure content. The user can decide whether the e-mail sender is trustworthy before displaying the entire content of the e-mail.
2. Assign the corresponding e-mail profile to each business role that uses the e-mail editor in the agent inbox or the ERMS e-mail workbench. In Customizing for Service , choose UI Framework Business Roles Define Business Role , and choose the step Assign Function Profiles . The relevant function profile ID for e-mail profiles is EMAIL . The value assigned to the function profile EMAIL should be the e-mail profile ID that you have changed in the first step. If there is no entry for the function profile EMAIL , you have to add one.
You can also define an ERMS rule to handle, that is delete, incoming HTML mails and inform the sender automatically that you are not able to view HTML mails. HTML mails can be recognized by the e-mail document type HTM in the ERMS rule modeler after adding the following in Customizing for Service under E-Mail Response Management System Define Repository :
1. Choose the context ERMS and go to the step Attributes .
2. Add the following entry:
Attribute: &lt;Attribute ID&gt; (for example, ZMAIL\_DOCTYPE )
Description: E-Mail Document Type
Show Attribute: X
XPath: /paths/EMAIL/OBJ\_TYPE/text ()
Fact Gathering Service:
FG\_EMAIL
Attribute Extension Class: CL\_CRM\_ERMS\_ATTR\_EXT\_EQUALS
## Communication Channel Security: Web Form Connector
If you are using the web form connector, you must do the following to handle undefined web form IDs:
- Create a default implementation of BAdI CRM\_ERMS\_WF\_CON . In the BAdI implementation, form data from undefined web form IDs must be rejected.
- Submit the form data to the confirmation.htm BSP page.
- Ensure that the form data has successfully passed a CAPTCHA before it is submitted to the web form connector.
## Data Storage Security
ERMS data is stored in the SAP HANA database. You do not need to implement additional security measures. The stored data can be classified as shown in the following table:
## Stored Data
| Data                | Stored Where                                                                       | Stored When                     | Type of Access            | Who Can Access It                                                                                                         |
|---------------------|------------------------------------------------------------------------------------|---------------------------------|---------------------------|---------------------------------------------------------------------------------------------------------------------------|
| E-mail document     | SAP S/4HANA business workplace persistence Database table CRMD_ERMS_CONTNT         | When an e-mail ar- rives        | Read/delete               | ERMSroutes the e-mail to an organizational unit. Users in that organization can access the e-mail document.               |
| ERMSfact base       | SAP S/4HANA under workflow container                                               | When ERMSproc- esses an e-mail. | Read/write/delete/ change | Service Professional in the ERMSlog, or the Selection Report for Work Items ( SWI1 ) transaction (only in read-only mode) |
| ERMSrules           | Customizing for Service under E- Mail Response Management System Define Repository | When rules are maintained       | Read/write/delete/ change | Service Professional                                                                                                      |
| ERMSconfigura- tion | SAP S/4HANA system under ERMSrepository (customizing data)                         | During configura- tion          | Read/write/delete/ change | ERMSadministrator Person who makes the Cus- tomizing settings in Service .                                                |
## Trace and Log Files
Log information is available in Check Automatic Processing Details (transaction CRM\_ERMS\_LOGGING ). The log provides information about the following:
- Services by ERMS service manager
- Data gathered by ERMS services
- Rules evaluation
- Category assignment
- Execution times for different services