MDM Security Guide - SAP Help Portal

1 CUSTOMER. SAP NetWeaver master data management Document Version: December 2016. MDM Security Guide Content Document History.. 4. 1 Overview.. 6. 2 Users, Roles, and Authentication.. 8. Users.. 8. Roles and Authorizations.. 9. Predefined Users, Roles, and Passwords.. 9. Single Sign-On.. 9. Authentication and SSO-like Feature in MDM Java Components.. 10. User management .. 10. Trusted Connections.. 10. iViews and UWL Authentication and the SSO-like Feature..11. MDM Web Services Security .. 11. Password Change Enforcement.. 12. Strong and Secure Passwords.. 12. Password Validity Timeframe..14. Unused Authorization Credentials.. 14. User Account Locking.. 14. CLIX Commands for Managing Passwords.. 15. User Administration Tools.. 16. Emergency User Creation.. 16. LDAP Support..17. LDAP in MDM.. 17. Preparing MDM for LDAP .. 18. MDM LDAP Parameters.

2 19. LDAP Server data Cache.. 22. LDAP Search Algorithms.. 24. LDAP Errors and MDM .. 26. 3 Network and Communication Security .. 28. Secure Communication Channels Using SSL..28. Secure Connection Prerequisites.. 29. MDM Server Configuration for SSL.. 30. Connecting Securely from MDM Clients.. 31. Server Landscape..33. Communication Channels.. 33. Network Ports.. 34. MDM Security Guide 2 CUSTOMER Content Remote Function Call.. 34. Secure Connection to Microsoft Active Directory..35. Authentication of Trusted Connections..35. IP-Based Trusted Connections.. 36. SSL-Based Trusted Connections..37. ABAP API Trusted Connections.. 40. Java/.NET Trusted Connections.. 41. 4 Authorization Concepts and management .. 42. Separation of Duties.. 42. Change Log for Authorization management .. 42. Change Log Archiving.. 49. 5 Auditing.. 50. Logging of Security -Relevant Information.

3 50. 6 Content Security .. 52. 7 MDM File System Security .. 53. MDM File Locations.. 53. Session IDs.. 54. User Session Locks..54. 8 Regulatory Compliance.. 55. Person-Related data ..55. MDM Security Guide Content CUSTOMER 3. Document History Table 1: Document Version Description of Change / December 2016 Guide updated for MDM SP17. / June 2016 Guide updated for MDM SP16. Minor corrections to the section on LDAP support. / December 2015 Guide updated for MDM SP15. Added new MDM LDAP parameters in the section, MDM LDAP Parameters [page 19]. / December 2014 Guide updated for MDM SP13. Guide updated to standard format. Reorganized section LDAP Support [page 17]. / June 2014 Corrected description of User Filter parameter in the section,MDM LDAP. Parameters [page 19]. / March 2014 Guide updated for MDM SP12. / December 2013 Guide updated for MDM SP11.

4 Added three new parameters and updated descriptions of other parameters in the section, MDM LDAP Parameters [page 19]. / March 2013 Guide updated for MDM SP10. New password requirement enforcement options added. See Strong and Secure Passwords [page 12]. Updated the section,LDAP Support [page 17]. / August 2012 Guide updated for MDM SP09. Added note that you can configure a secure connection from MDS to the Active Directory only when MDS is installed on a Windows platform. / April 2012 Consolidated information from the MDM Console Reference Guide into the following sections: LDAP Support [page 17]. Authentication of Trusted Connections [page 35]. MDM Security Guide 4 CUSTOMER Document History Document Version Description of Change / September 2011 Guide updated for MDM SP08. Secure Trusted Connection support added. See Authentication of Trusted Connections [page 35].

5 New option added for securing connections to Microsoft Active Di . rectory LDAP Server (MDS on Windows only). See Secure Connection to Microsoft Active Directory [page 35]. Default Admin user password changed to sapmdm. See User Administra . tion Tools [page 16]. New CLIX commands added for password management operations. See CLIX Commands for Managing Passwords [page 15]. New CLIX command added for emergency Admin user password creation. See Emergency User Creation [page 16]. / May 2011 Guide updated for MDM SP07. SSL support added. See Network and Communication Security [page 28]. MDM Security Guide Document History CUSTOMER 5. 1 Overview An overview of the intended audience and scope of this Security Guide for SAP NetWeaver master data management (MDM) Target Audience Technology consultants System administrators CIOs Security experts This document is not included as part of the Installation Guides, Configuration Guides, Technical Operation Manuals, or Upgrade Guides.

6 Such guides are only relevant for a certain phase of the software lifecycle, whereby the Security Guides provide information that is relevant for all phases of the lifecycle. Scope of this Guide The MDM Security Guide describes the Security only for SAP NetWeaver master data management . For information about other SAP components used in MDM scenarios, see the MDM master Guide on the SAP. Help Portal at Fundamental Security Guides See the corresponding Security Guides for the SAP components that are a part of the MDM scenarios. Table 2: Application Guide Most Relevant Sections or Specific Restrictions SAPECC SAP ERP 2005 Security Guide In the SAP ERP 2005 Security Guide , choose Security Guides for SAPECC. SAP NetWeaver Process Integration SAP NetWeaver Security Guide In the SAP NetWeaver Security Guide , choose Security Guides for SAP.

7 NetWeaver Products SAP Security Guide PI . MDM Security Guide 6 CUSTOMER Overview Application Guide Most Relevant Sections or Specific Restrictions Operating Systems and Database Plat SAP NetWeaver Security Guide In the SAP NetWeaver Security Guide , forms choose Operating System and Database Platform Security Guides. For a complete list of SAP Security Guides, see on SAP Service Marketplace. Components of SAP NetWeaver MDM. For a complete list of SAP NetWeaver MDM components, see the MDM master Guide on the SAP Help Portal at MDM Security Guide Overview CUSTOMER 7. 2 Users, Roles, and Authentication MDM provides its own user management . There are no user and role features delivered on top of the MDM. user management . Users You can set passwords for MDM Servers and users of MDM repositories. master data Servers By default, access to new master data Servers is not limited.

8 You have to set a password to control access. When mounting a master data Server for the first time using the MDM Console, make sure that you set a password for the server. Select the MDM Server in the left window pane of the MDM Console window, and choose MDM Servers Change Password . MDM Repositories You access MDM repositories with a user and password. SAP NetWeaver MDM uses its own mechanisms to define users. You have to set passwords for the users to control access: When creating a new repository, make sure that you set a password for the predefined Administrator user. When updating an existing repository or unarchiving a shipped repository template, you have to use the users and passwords that were already defined for the repository. Note You must log on to the repository at least once during an MDM Console session. This means that you have to log on to a repository each time you start the MDM Console.

9 The icon next to the repository name indicates whether you have to log onto the repository. For more information about updating repositories, see the MDM Upgrade Guide on the SAP Help Portal at MDM Security Guide 8 CUSTOMER Users, Roles, and Authentication Roles and Authorizations SAP NetWeaver MDM uses its own mechanisms for roles and authorizations. Roles Roles are assigned to users. Each repository contains the standard roles: Admin and Default. They cannot be deleted. The Admin role cannot be changed. The Default role is predefined with full privileges. Authorizations Authorizations (called privileges in MDM) are assigned to roles and are edited in the Roles table. You can granularly enable or disable authorizations for specific functions (such as Add Records or Delete Records) or limit access to tables and fields (such as read/write access and constraints).

10 The following privileges are required to manage users, roles, and passwords: Add user or role object Modify user or role object Delete user or role object For more information, see the section, MDM User and Role management , in the MDM Console Reference Guide on the SAP Help Portal at Predefined Users, Roles, and Passwords A new repository has one predefined user and two predefined roles. When creating a repository from scratch, there is one predefined user and there are two predefined roles. The predefined user is the Admin user and the predefined Admin role is assigned to it. A password is not maintained initially for this user. It is very important to maintain a strong password for this user shortly after creating the repository. The other predefined role is the Default role. Initially it has full privileges. It is important to reduce these privileges shortly after creating the repository.