Authenticate with JSON Web Tokens

This document shows how to set up authentication to access Google Cloud when your SAP system is running on a host that is on premises, on another cloud provider, in another environment outside of Google Cloud, or managed by SAP through the SAP RISE program.

For authentication to Google Cloud, you use Google Cloud signed JSON Web Tokens (JWT) to obtain access tokens from Google Cloud. The high-level configuration steps are as follows:

  1. Create a service account for JWT based authentication to Google Cloud.
    1. Grant the service account the IAM role that is required to create tokens.
    2. Create a service account key (P12).
    3. Enable JWT signing for the service account on the SAP LT Replication Server host.
  2. Configure security settings for Google Cloud on the SAP LT Replication Server host.
    1. Create a new SSF application and enable STRUST node for the SSF application.
    2. Import the service account key into STRUST.
  3. Create another service account for authorization to access BigQuery.
    1. Grant the service account the IAM roles that are required to access BigQuery.
    2. Add the BigQuery Connector for SAP service account as a principal to the BigQuery project.
    3. Set up TLS/SSL certificates and HTTPS.
  4. Create ABAP configurations.
    1. Create new RFC destinations.
    2. Specify access settings in /GOOG/CLIENT_KEY.
    3. Specify RFC destinations in /GOOG/SERVIC_MAP.

Create a service account for JWT based token retrieval

For JWT based authentication to Google Cloud, BigQuery Connector for SAP needs an IAM service account.

Create a service account

To create a service account for JWT based token retrieval, complete the following steps:

  1. In the Google Cloud console, go to the IAM & Admin Service accounts page.

    Go to Service accounts

  2. If prompted, select your Google Cloud project.

  3. Click Create Service Account.

  4. Specify a name for the service account and, optionally, a description.

  5. Click Create and Continue.

  6. In the Grant this service account access to project panel, select the Service Account Token Creator role.

  7. Click Continue.

  8. As appropriate, grant other users access to the service account.

  9. Click Done. The service account appears in the list of service accounts for the Google Cloud project.

Create a service account key

You need to create a P12 service account key for the service account used for JWT based token retrieval.

To create a service account key, complete the following steps:

  1. In the Google Cloud console, go to the IAM & Admin Service accounts page.

    Go to Service accounts

  2. Select your Google Cloud project.

  3. Click the email address of the service account that you created for JWT based token retrieval in the previous section, Create a service account.

  4. Under the service account name, click the Keys tab.

  5. Click the Add Key drop-down menu, and then select Create new key to create a service account key.

  6. Accept P12 as the key type and click Create.

    A private key is saved to your computer.

  7. Make a note of the password for the private key file, notasecret.

    Provide the private key and password to your SAP administrator to import the private key into STRUST, as described in Import the service account key into STRUST.

Enable JWT signing for the service account on the SAP LT Replication Server host

To enable JWT signing for the service account that you created for JWT based token retrieval, you need to add the parameter JWT_SERVC_ACCT to the table /GOOG/BQ_PARAM and configure the service account.

To enable JWT signing for a service account, complete the following steps:

  1. In the SAP GUI, enter the /GOOG/SLT_SETTINGS transaction preceded by /n:

    /n/GOOG/SLT_SETTINGS

  2. From the Settings Table drop-down menu in the launch screen for the /GOOG/SLT_SETTINGS transaction, select Parameters.

  3. Click the Execute icon. The BigQuery Settings Maintenance - Parameters screen displays.

  4. Click the Insert Row icon.

  5. In the displayed row, specify the following settings:

    1. In the Parameter Name field, enter JWT_SERVC_ACCT. The parameter description is automatically populated.
    2. In the Parameter Value field, enter the email address of the service account that you created for JWT based token retrieval in the previous section, Create a service account.

  6. Click Save.

    Your settings are stored as a record in the /GOOG/BQ_PARAM configuration table and the Changed By, Changed On, and Changed At fields are automatically populated.

Configure security settings for Google Cloud on the SAP LT Replication Server host

This section describes how to configure security settings for Google Cloud on the SAP LT Replication Server host, which involves creating an SSF Application entry and importing the service account key into STRUST.

Create a new Secure Store and Forward (SSF) Application

In the table SSFAPPLIC, the ZG_JWT entry is imported as part of the BigQuery Connector for SAP transport. In case, the ZG_JWT entry is not imported, you need to create a new entry with the name ZG_JWT by using transaction SE16.

To create a new entry in the table SSFAPPLIC, complete the following steps:

  1. In the SAP GUI, enter transaction code SE16.
  2. In the Table Name field, enter SSFAPPLIC, and then create a new entry.
  3. For the APPLIC field, enter ZG_JWT.
  4. Except the B_INCCERTS, B_DETACHED, B_ASKPWD, and B_DISTRIB fields, select all other fields.
  5. In the DESCRIPT field, enter JWT Signature for GCP.

  6. Save the new entry.

    This entry becomes a new node in transaction STRUST, where you import the service account key.

Enable the STRUST node

Use transaction SSFA to enable the STRUST node for JWT Signature for GCP.

To enable the STRUST node, complete the following steps:

  1. In the SAP GUI, enter transaction SSFA.
  2. Click New Entries.

  3. In the SSF Application drop-down list, select JWT Signature for GCP. This is the new entry that you created in the table SSFAPPLIC.

    The following screenshot shows the application-specific SSF parameters that are automatically populated by SAP.

    Application specific SSF parameters

  4. Save the new entry.

    A new node SSF JWT Signature for GCP is enabled in transaction STRUST. Now you import the service account key into this node.

Import the service account key into STRUST

To import the service account key into STRUST, complete the following steps:

  1. In the SAP GUI, enter transaction code STRUST.

    Verify the new node in transaction STRUST is SSF JWT Signature for GCP.

  2. Import the private key file:

    1. Select PSE > Import from the menu bar.
    2. Depending on your source system type, select the appropriate private key:
      • S4/HANA
        1. Select the P12 private key.
        2. Enter the file password notasecret, and then click OK.
      • ECC
        1. Select the PSE private key. You need to convert the P12 private key that you downloaded earlier into a PSE private key. For more information about converting a P12 key into a PSE key, see Convert P12 key into PSE key.
        2. Enter the file PIN that you created during the private key conversion from P12 key to PSE key, and then click OK.

  3. Select PSE > Save as.

  4. Select the SSF Application option button, and in the corresponding field, select the new SSF Application node that you created in Create a new Secure Store and Forward (SSF) Application.

  5. Save the new entry.

    The service key is attached to the SSF application node SSF JWT Signature for GCP.

Convert the P12 private key into PSE key

If your source system is SAP NetWeaver 7.0x (SAP ECC), then you need to convert the P12 key into a PSE key.

To convert the P12 key into a PSE key, complete the following steps:

  1. Go to the path: 

    /usr/sap/SID/SYS/exe/run/

    Replace SID with the SAP system ID.

  2. Run the following command after replacing the placeholders: 

    sapgenpse import_p12 -p PSE_PATH_AND_FILE_NAME P12_PATH_AND_FILE_NAME.p12

    Replace the following:

    • PSE_PATH_AND_FILE_NAME: specify the path and filename for the PSE file
    • P12_PATH_AND_FILE_NAME: specify the path and filename for the P12 key file

  3. Enter the password of P12 private key file, notasecret.

  4. Create a new PIN for the PSE private key and re-enter your PIN.

  5. Make a note of the PIN, you need to provide this PIN when importing the PSE private key file into STRUST.

For information from SAP about about how to convert a P12 key into a PSE key, see:

Create a service account for authorization to access BigQuery

The section describes the process of creating a service account, adding it to the BigQuery project with the necessary roles, and setting up TLS/SSL certificates for secure communication.

Create a service account

BigQuery Connector for SAP needs an IAM service account for authentication and authorization to access BigQuery.

This service account must be a principal in the Google Cloud project that contains your BigQuery dataset. If you create the service account in the same project as the BigQuery dataset, the service account is added as a principal to the project automatically.

If you create the service account in a project other than the project that contains the BigQuery dataset, you need to add the service account to the BigQuery dataset project in an additional step.

To create a service account, complete the following steps:

  1. In the Google Cloud console, go to the IAM & Admin Service accounts page.

    Go to Service accounts

  2. If prompted, select your Google Cloud project.

  3. Click Create Service Account.

  4. Specify a name for the service account and, optionally, a description.

  5. Click Create and Continue.

  6. If you are creating the service account in the same project as the BigQuery dataset, in the Grant this service account access to project panel, select the following roles:

    • BigQuery Data Editor
    • BigQuery Job User

    If you are creating the service account in a different project than the BigQuery dataset, do not grant any roles to the service account.

  7. Click Continue.

  8. As appropriate, grant other users access to the service account.

  9. Click Done. The service account appears in the list of service accounts for the project.

  10. If you created the service account in a different project than the project that contains the BigQuery dataset, note the name of the service account. You specify the name when you add the service account to the BigQuery project. For more information, see Add the service account to the BigQuery project.

The service account is now listed as a principal on the IAM Permissions page of the Google Cloud project in which the service account was created.

Add the service account to the BigQuery project

If you created the service account for BigQuery Connector for SAP in a project other than the project that contains the target BigQuery dataset, you need to add the service account to the BigQuery dataset project.

If you created the service account in the same project as the BigQuery dataset, you can skip this step.

To add an existing service account to the BigQuery dataset project, complete the following steps:

  1. In the Google Cloud console, go to the IAM Permissions page:

    Go to IAM permissions

  2. Confirm that the name of the project that contains the target BigQuery dataset is displayed near the top of the page. For example:

    Permissions for project "PROJECT_NAME"

    If it is not, switch projects.

  3. On the IAM page, click Add. The Add principals to "PROJECT_NAME" dialog opens.

  4. In the Add principals to "PROJECT_NAME" dialog, complete the following steps:

    1. In the New principals field, specify the name of the service account.
    2. In the Select a role field, specify BigQuery Data Editor.
    3. Click ADD ANOTHER ROLE. The Select a role field displays again.
    4. In the Select a role field, specify BigQuery Job User.
    5. Click Save. The service account appears in the list of project principals on the IAM page.

The service account can now be used to access the BigQuery dataset in this project.

Set up TLS/SSL certificates and HTTPS

Communication between BigQuery Connector for SAP and the BigQuery API is secured by using TLS/SSL and HTTPS.

  1. For connecting to Google services, follow the Google Trust Services advice. At a minimum, you must download all root CA certificates from the Google Trust Services repository.

    To ensure that you're using the latest trusted root CA certificates, we recommend that you update your system's root certificate store every six months. Google announces new and removed root CA certificates at Google Trust Services. For receiving automatic notifications, subscribe to the RSS feed on Google Trust Services.

  2. In the SAP GUI, use the STRUST transaction to import the root CA certificates into the SSL client SSL Client (Standard) PSE folder.

    For more information from SAP, see SAP Help - Maintain PSE Certification list.

  3. On the SAP LT Replication Server host, confirm that any firewall rules or proxies are configured to allow egress traffic from the HTTPS port to the BigQuery API.

    Specifically, SAP LT Replication Server needs to be able to access the following Google Cloud APIs:

    • https://bigquery.googleapis.com
    • https://iamcredentials.googleapis.com

    If you want BigQuery Connector for SAP to access Google Cloud APIs through Private Service Connect endpoints in your VPC network, then you must configure RFC destinations and specify your Private Service Connect endpoints in those RFC destinations. For more information, see RFC destinations.

For more information from SAP about setting up TLS/SSL, see SAP Note 510007 - Additional considerations for setting up TLS/SSL on Application Server ABAP.

Create ABAP configurations

This section describes the essential ABAP configurations for enabling secure communication and data transfer.

Create RFC destinations

RFC destinations GOOG_OAUTH2_TOKEN, GOOG_IAMCREDENTIALS, and GOOG_BIGQUERY are imported as part of the BigQuery Connector for SAP transport. In case these RFC destinations are not imported, then you need to create new RFC destinations GOOG_OAUTH2_TOKEN, GOOG_IAMCREDENTIALS, and GOOG_BIGQUERY, by using transaction SM59.

For information about creating RFC destinations, see Configure RFC destinations.

Specify access settings in /GOOG/CLIENT_KEY

Use transaction SM30 to specify settings for access to Google Cloud. BigQuery Connector for SAP stores the settings as a record in the /GOOG/CLIENT_KEY custom configuration table.

To specify the access settings, complete the following steps:

  1. In the SAP GUI, enter transaction code SM30.

  2. Select the /GOOG/CLIENT_KEY configuration table.

  3. Enter values for the following table fields:

    Field Data type Description
    Name String The name of this CLIENT_KEY configuration.
    Service Account Name String

    The name of the service account, in email address format, that was created for BigQuery Connector for SAP in the step Create a service account. For example: sap-example-svc-acct@example-project-123456.iam.gserviceaccount.com.

    Scope String The access scope.

    Specify the https://www.googleapis.com/auth/cloud-platform API access scope, as recommended by Compute Engine.

    Project ID String The ID of the project that contains your target BigQuery dataset.
    Command name String Leave this field blank.
    Authorization Class String The authorization class.

    Specify /GOOG/CL_GCP_AUTH_JWT.

    Authorization Field Not applicable Leave this field blank.
    Token Refresh Seconds Integer Leave this field blank.

Specify RFC destinations in /GOOG/SERVIC_MAP

Use transaction SM30 to specify RFC destinations in the service mapping table /GOOG/SERVIC_MAP.

To specify the RFC destinations, complete the following steps:

  1. In the SAP GUI, enter transaction code SM30.

  2. In the /GOOG/CLIENT_KEY table that you created in the preceding section, note the value for the Name field.

  3. In the table /GOOG/SERVIC_MAP, create entries with the following field values:

Name Service Name RFC Destination
CLIENT_KEY_TABLE_NAME googleapis.com/oauth2 GOOG_OAUTH2_TOKEN
CLIENT_KEY_TABLE_NAME iamcredentials.googleapis.com GOOG_IAMCREDENTIALS

Replace CLIENT_KEY_TABLE_NAME with the table name that you noted in the preceding step.

What's next