AVM -RTA Design Studio Installation and Configuration Guide v2

AVM-RTA Design Studio Installation and Configuration Guide v2.0SP07


Greenlight Technologies, Inc. Page 2 of 75

COPYRIGHT INFORMATION

COPYRIGHT NOTICES

2004-2018 Greenlight Technologies, Inc. All Rights Reserved. The information in this document is provided for informational purposes only, is subject to change without notice, and should not be construed as a commitment by Greenlight Technologies, Inc. Greenlight Technologies, Inc. assumes no responsibility or liability for any errors or inaccuracies that may appear in this book. Except as permitted by license, no part of this document may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means – electronic, mechanical, recording, or otherwise – without the prior written permission of Greenlight Technologies, Inc. Printed in the U.S.A. CAUTION This document contains proprietary, confidential information that is the exclusive property of Greenlight Technologies, Inc. If you do not have a valid contract with Greenlight Technologies for the use of this document, or have not signed a non-disclosure agreement with Greenlight Technologies, then you received this document in an unauthorized manner and are not legally entitled to possess or read it. Use, duplication, and disclosure are subject to restrictions stated in your contract with Greenlight Technologies, Inc. Use, duplication, and disclosure by the Government are subject to restrictions for commercial software and shall be deemed to be Restricted Rights software under Federal Law.



DOCUMENT REVISION HISTORY

Sr. No Date Version Comments

1 09/23/2009 1.3 Documented for v1.3 release.

2 04/30/2010 1.3.1 Documentation changes for SAP EBS.

3 04/02/2011 1.3.2 Documented for v1.3.2 release.

4 12/22/2011 2.0 Document for v2.0 release.

5 02/22/2012 2.0 Updated for enhancements.

6 04/15/2013 2.0SP03 Updated for v2.0SP03 release.

7 08/02/2013 2.0SP04 Updated for v2.0SP04 release.

8 07/16/2014 2.0SP04_1 Updated for Enhancement.

9 07/29/2016 2.0SP05 Updated for Enhancement.

10 05/05/2017 2.0SP06 Removed SAP NWA 7.02 and GRC 5.3 related references.

11 09/29/2017 2.0SP07 Updated for Enhancement.

12 02/16/2018 2.0SP07 Updated for enhancement.



TABLE OF CONTENTS

1 ABOUT THIS GUIDE ................................................................................................................. 6

1.1 DOCUMENT PURPOSE ........................................................................................................ 6

1.2 DOCUMENT CONVENTIONS ............................................................................................ 6

1.3 RELATED DOCUMENTS ..................................................................................................... 6

1.4 TARGET AUDIENCE ............................................................................................................. 6

1.5 CONTACT GREENLIGHT .................................................................................................... 6

2 PREREQUISITES ........................................................................................................................ 7

3 DEPLOY AVM RTA DS ON SAP NW 7.31+ ............................................................................ 8

3.1 DEPLOY AVM RTA DS ON SAP NW 7.31+ THROUGH JSPM ...................................... 8

3.2 DEPLOY 7.4 THROUGH TELNET ..................................................................................... 14

3.3 DEPLOY THROUGH SUM ................................................................................................. 16

4 POSTS INSTALL STEPS .......................................................................................................... 34

4.1 ROLE IMPORT ..................................................................................................................... 34

4.2 START/STOP/RESTART AVM RTA DS APPLICATION ............................................... 35

4.3 CREATING USER ................................................................................................................ 37

5 AVM RTA DS CONFIGURATION ........................................................................................ 41

5.1 AVM-RTADS APPLICATION PROPERTIES FILE .......................................................... 41

5.2 PLATFORM REGISTRATION........................................................................................... 41

5.3 CREATE APPLICATION .................................................................................................... 43

5.4 IMPORT MASTER DATA .................................................................................................. 44

5.5 IMPORT ADAPTER ............................................................................................................. 45

5.6 CREATE CONNECTORS ................................................................................................... 46

5.7 CREATING A SYSTEM ....................................................................................................... 48

5.8 UPLOAD SOD RULES ......................................................................................................... 51

5.9 UPLOAD SOD RULE CONFIGURATION ....................................................................... 51

5.10 APPLICATION CONFIGURATION .................................................................................. 52

5.11 REGISTERING AN APPLICATION .................................................................................. 52

5.12 REGISTERING A SYSTEM ................................................................................................. 55

5.13 SMTP SETTINGS ................................................................................................................. 57

6 NETWORK AND COMMUNICATION SECURITY ............................................................ 59

6.1 COMMUNICATION CHANNEL SECURITY................................................................... 59

6.2 COMMUNICATION DESTINATIONS ............................................................................ 59



7 BACKUP AND RESTORE ........................................................................................................ 61

8 LOGS .......................................................................................................................................... 62

8.1 LOGGING IN AVM RTA DS ............................................................................................. 62

8.2 SWITCH OFF THE LOG FILES........................................................................................... 66

8.3 CHANGING LOG LEVEL ................................................................................................... 67

8.4 ENABLE/DISABLE LOGS ................................................................................................... 68

9 TROUBLESHOOTING ............................................................................................................. 70

10 APPENDIX ................................................................................................................................. 72

10.1 AVM-RTADS APPLICATION PROPERTIES FILE .......................................................... 72

11 SUPPORT ................................................................................................................................... 73

12 TERMS AND DEFINITIONS .................................................................................................. 74



1 ABOUT THIS GUIDE

Greenlight’s AVM RTA Design Studio (RTA DS) is a software application that extends the SAP GRC applications for Access Control (AC) and Process Control (PC) to non-SAP systems in the customer’s IT landscape. The application establishes connections to non-SAP ERP systems and provides data to Access risk Management. AVM RTA DS has many valuable features including the ability to establish real time connections to target ERP systems, databases, legacy systems, as well as reading data from flat files.

1.1 DOCUMENT PURPOSE

This document provides details for the installation and configuration of the AVM RTA DS.

1.2 DOCUMENT CONVENTIONS

The document conventions are as follows:

1. Bold Book Antiqua- to designate names of icons, buttons, and menus and emphasize important terms.

2. Italic Book Antiqua texts in blue-to designate hyperlinks and cross-

1.3 RELATED DOCUMENTS

The list of related document is as follows:

1. AVM RTA_DS_User_Guide_v2.0SP07.pdf– this document contains detail information about how to use the AVM RTA DS application.

1.4 TARGET AUDIENCE

The target audience for this manual is system administrators, solution administrators and/or technical people, who are responsible for installing AVM

RTA DS.

1.5 CONTACT GREENLIGHT

For any questions or queries related to contact:

Email: [email protected]

Web: www.greenlightcorp.com

mailto:[email protected]


http://www.greenlightcorp.com/



2 PREREQUISITES

Before you start the installation, ensure that:

1. Users have basic knowledge of SAP GRC configuration.

2. Users should have database knowledge to execute database scripts.

3. Knowledge of SAP NW 7.31+ Onwards to deploy the AVM RTA DS application.

4. The users have access for the following applications:

a. The Net Weaver Java Stack.

b. GRC Database where AVM RTA DS is being installed. This access is required to run the initial DB configuration scripts.

Note: Data given screenshot demonstrates sample data. You can create data as per your requirement.



3 DEPLOY AVM RTA DS ON SAP NW 7.31+

This chapter provides information on deploying the AVM RTA DS application on SAP NW AS (Application server).

3.1 DEPLOY AVM RTA DS ON SAP NW 7.31+ THROUGH JSPM

This section provides information on deploying the AVM RTA DS application on SAP NW AS (Application server) JAVA 7.3 onwards through the Java Support Package Manager (JSPM).

1. Place the build at /usr/sap/trans/EPS/in.

2. Launch the Java Support Manager (JSPM).

The SAP NetWeaver screen opens.

3. Enter the administrator credentials in the User Name and Password text box as shown in the following screenshot.

Figure 3.1: Java Support Package Manager

4. Click on the Log On button.



The following screen opens.

Figure 3.2: Select Package Type

5. Under the Select a package type to apply, choose the option as New

Software Components.

6. Click on the Next button.

The New Software Components > Specific Queue screen opens as shown in the following screenshot.



Figure 3.3: New Software Components > Specific Queue

7. Select new components to deploy and click on Next.

The New Software Components > Check Queue screen opens as shown in the following screenshot.



Figure 3.4: New Software Components > Check Queue

8. On the New Software Components > Check Queue screen, validate the selected software components.

9. Click on the Start button to deploy the selected new components.

The New Software Components > Deploy Queue screen opens as shown in the following screenshot.



Figure 3.5: New Software Components > Deploy Queue

10. The New Software Components > Deploy Queue screen shows the deployment of the selected software components with their details under the column headings Order, Vendor/Name, Old Release. SPLevel.PatchLevel, Target Release.SPLevel. Patch Level, and Status.

11. The Status column displays the status of the deployment as IN PROGRESS.



Figure 3.6: New Software Components > Deploy Queue

12. After successful completion of the deployment, the New Software

Components > Completed screen opens as shown in the following screenshot.



Figure 3.7: New Software Components > Completed

13. The New Software Components> Completed screen displays the message as, "Deployment of software components has finished" as shown in the above screenshot 3.7

14. The Status column displays the status of the deployment as DEPLOYED.

3.2 DEPLOY 7.4 THROUGH TELNET

SAP NW 7.4 does not have JSPM for deployment and undeployment. Instead of that, you can use SUM (software update manager) or Telnet. The below section describes deployment through Telnet. Before actual deployment, ensure the following: You should have access to the path /usr/sap/trans/EPS/in (Linux/Unix or similar path on Windows). This is required to copy .sca files. The steps to deploy 7.4 through telnet are as follows.

1. Login to NetWeaver JAVA system using Putty or similar tool.



2. On the PuTTY screen, provide User name as <sid>adm and relevant user password.

Figure 3.8: PuTTY

3. Connect to SAP telnet as: telnet localhost 5NN08

Where NN is system number. Ex. telnet localhost 50908

The following screen appears.

Figure 3.9: PuTTY

4. On the PuTTY screen, provide User name as administrator (or any other user with Administrator rights) and relevant password.

5. For deployment enter following command:

a. DEPLOY /usr/sap/trans/EPS/in/< AVM RTA DS.sca > on_deploy_error=stop



Figure 3.10: PuTTY- Deployment

3.3 DEPLOY THROUGH SUM

This section explains how to install AVM RTA DS using SAP SUM (Software Update Manager) tool.

For additional details on using SUM, refer: Software Update Manager (SUM): introducing the tool for software maintenance.

Copy the .sca file in a folder accessible from NW 7.4 JAVA server.

The steps for deployment through SUM are as follows:

1. Login to the SAP SUM tool with administrator role and appropriate credentials as shown in the following screenshot.

http://scn.sap.com/community/it-management/alm/software-logistics/blog/2012/11/07/software-update-manager-sum-introducing-the-tool-for-software-maintenance

http://scn.sap.com/community/it-management/alm/software-logistics/blog/2012/11/07/software-update-manager-sum-introducing-the-tool-for-software-maintenance



Figure 3.11: Software Update Manager

2. Click on the OK button.

The Welcome to the Software Update Manager screen appears.





The Install Certificates screen appears as shown in the following screenshot.





The Specify User Credentials screen appears as shown in the following screenshot.




5. Enter appropriate credentials in the User Name and Password text box, click on the Next button.

The Select Target System Version screen appears as shown in the following screenshot.

6. Choose the option as Manually prepared directory.

7. Click on the Browse button and select the path where .sca file is located.





The Initialization- System Analysis screen appears as shown in the following screenshot.

9. The Monitor tab indicates the progress of the phases in the current roadmap step.




10. To start the Extraction roadmap step, choose Next.

The Initialization- System Analysis screen appears displaying message as shown in the following screenshot.




11. To start the Extraction roadmap step, choose Next.

The Configuration- Information Gathering screen opens as shown in the following screenshot.




12. The Monitor tab indicates the progress of the phases in the current roadmap step.

Note: Please ignore any warning like below during SUM patching of AVM RTA DS.

The Configuration- Information Gathering screen opens.




13. Enter all required information for configuring the process such as system users and passwords and click on Continue button.

The Configuration- Information Gathering screen displays details of Manually prepared directory. You should be able to see Greenlight AVM RTA DS .sca file for installation.




14. Click on Continue.

The Configuration- Information gathering screen appears as shown in the following screenshot.





The Checks- Requirements Check screen appears as shown in the following screenshot.





The Preprocessing – Update Preparation screen appears as shown in the following screenshot.




17. Click on Continue button.

The Preprocessing – Update Preparation screen displays message as shown in the below screenshot.





The Execution- Actual Update screen appears as shown in the following screen.




19. The Software Update Manager performs the actual update in the system.





The Postprocessing – Post-Update Activities screen appears as shown in the following screenshot.




21. Click on the Continue button.

The screen displays message for completion of deployment.




4 POSTS INSTALL STEPS

This chapter provides information about various post installation steps. After successful deployment of AVM- RTA DS application it is mandatory to perform below steps.

4.1 ROLE IMPORT

The steps to import the role are as follows.

1. Logon to the SAP NetWeaver with the administrator credentials.

2. Go to Configuration> Identity Management.


3. Click on the Import button as shown in the following screenshot.

Figure 4.1: Import

Figure 4.2: Import of User/Group/Role Data



4. In the Text File Upload text box, click on the Browse button and select the rtads_ume_roles.txt file.

5. Click on the Upload button to import the roles from the file.

4.2 START/STOP/RESTART AVM RTA DS APPLICATION

The steps to start/stop/restart the AVM RTA DS application are as follows.

1. Logon to the SAP NetWeaver with the administrator credentials.


Figure 4.3: SAP NetWeaver Administrator

2. Click on the Operations tab as shown in the following screenshot.

Figure 4.4: SAP NetWeaver Administrator- Operations tab

3. Click on Start & Stop link.

The Start& Stop: Java Instances screen opens as shown in the following screenshot.

Figure 4.5: Start& Stop: Java Instances

4. Click on the Java Applications tab.

The Start& Stop: Java Applications screen opens as shown in the following screenshot.



Figure 4.6: Start& Stop: Java Applications

5. In the Filter text box, enter the value as xPlat/Platform as shown in the following screenshot.

Figure 4.7: Start & Stop: Java Applications: filter

6. The screen displays details as per the entry in the filter as shown in the following screenshot.



Figure 4.8: Figure: Start & Stop: Java Applications

7. Click on the Start button to start the application

8. Click on the Stop button to stop the application.

9. Click on the Restart button to restart the application.

Note: In the figure 4.8, the Start button is disabled as the application is running.

4.3 CREATING USER

After deploying the AVM RTA DS application on SAP NW 7.31, it is necessary to create user to logon to the AVM RTA DS application.

The steps to create user are as follows.

1. Logon to the SAP User Management Administrator with appropriate credentials as shown in the following screenshot.



Figure 4.9: SAP NetWeaver

2. Click on Log On.


Figure 4.10: Create User

3. Click on the Identity Management> Create User tab.


4. In the Logon ID section, enter administrator credentials. For Example: rtadsadmin.

5. Choose the option as Define Initial Password.

6. In the Define Password text box, enter appropriate password.

7. In the Confirm Password text box, enter appropriate password.

8. Enter all the mandatory fields.

9. Click on the Assigned Roles tab.

The following screen appears.



Figure 4.11: Assigned Roles

10. On the Available Roles screen, Select criteria as "All Data Sources" and value as "DS_SYS*". Click on Go button. Select the imported role/roles for AVM RTA DS. For example: to create the Admin User, select the DS_SYS_ADMIN role and assign it to the created user. Select the role and click on Add button.


11. Role is added in Assigned Role Pane as shown below.


12. Click on Save.

13. The login Id is created.

The system prompts with the message, “User Created” as shown in the screenshot below.

Figure 4.14: User Created



14. The login id is created with the Define Initial Password option.

15. To activate the Login Id and password, login to the NWA (SAP NetWeaver

Administration) with newly created user Id and password.

16. The UME screen prompts to change the password.

17. Enter the Old and the New passwords in the respective text boxes.

18. After changing the password successfully, login to the AVM RTA DS application with the new credentials.

Figure 4.15: SAP NetWeaver

19. Open the web browser and access the following link to the AVM RTA DS:

http://NetWeaverServerIP:port_number/xPlatformAdapter/checkLogin.do



5 AVM RTA DS CONFIGURATION

After completing installation steps, start with AVM RTA DS configuration. For this purpose, you need to create a login for users to login to the AVM RTA DS application as mentioned in the installation section.

Open the web browser and access the following link to the AVM RTA DS:

http://NetWeaverServerIP:port_number/xPlatformAdapter/checkLogin.do

5.1 AVM-RTADS APPLICATION PROPERTIES FILE

The rtads_application.properties file resides in the build. For more information on this refer: section 10.1 AVM RTA DS Application Properties File.

5.2 PLATFORM REGISTRATION

The steps to register the platform are as follows.

1. Launch the AVM RTA DS application.

2. Click the Registration link.

3. Enter the User ID and Password of system administrator.

4. Click on the Register the Platform.

Figure 5.1: Platform Registration

5. The Platform Registration screen opens.




1. Click on the Execute Install Script button.

2. The Details screen opens.

Figure 5.3: Details

3. Click on Browse button and select appropriate install script.

Note: This script is provided in the build/package folder. The database scripts should not be having than one semi colons in a query. Single Query should be written on single line.

4. Click on the Execute Install Script button. The screen displays message as shown in the below screenshot. Detail information about the executed script is displayed under the Script Execution Summary section under the column headings Table Name, Operation and No. Of Executed

Queries.

Figure 5.4: Details

5. Click on the Cancel/Close (image in the right corner) button and go to the Platform Registration screen.

6. Enter appropriate Customer Id, Customer Name, Contact Name, and Address (of customer), State Code, Zip Code and Email Address (of customer).




7. Click on Save. The screen displays message as shown in the below screenshot.


8. All the modifications are grayed out and the License Key field appears on the screen.

9. Click on the Browse button and import the GLT_RTADS_PLAT.xml file provided with the build.


10. Click on Save. The screen displays message as shown in the below screenshot.


5.3 CREATE APPLICATION

The steps to create a new application are as follows.

1. Click the Configuration tab.



2. In the left navigation menu, click Applications Center>Applications.

The Application>Search screen opens.

3. Click on Create.

The Application>Create page opens as shown in the screenshot below.

4. In the Name field, enter appropriate name of the application. The application is used to group similar systems. For Example: Oracle

5. In the Description field, enter appropriate description of the application.

Figure 5.9: Applications > Create

6. Click Save to save the newly created application.

7. Once the applications details are saved, they are displayed on the Application>Search page.

5.4 IMPORT MASTER DATA

The Master_Data.xml file is provided in the Metadata folder of the package. The Master Data file contains important information such as programs, APIs which are required for configuration of AVM- RTA DS application.

The steps to import master data are as follows.


2. Click the Utilities>Import Master Data.

The Import Master Data page is displayed.

3. Click the Browse button.

4. In the Choose File to Upload window, select the appropriate XML file for example: Master_Data.xml to be uploaded and click Open.

5. The file path is displayed in the Master Data File (Local) text box.



Figure 5.10: Import Master Data

6. Click on Import.

The application prompts with the message, “Master data imported successfully”.

7. To overwrite the previously imported master data xml file, click on Over

write and re-import the master data.

If you are importing master data import file with Overwrite option, the xml file deletes all the adapters and programs defined in the AVM RTA DS application.

Note: after reimporting master xml in overwrite mode ensure to reimport existing adapter xml and perform system API mapping again. While importing master data xml, if there are two separate files for RAR and CUP then select the override option for RAR only.

5.5 IMPORT ADAPTER

The Adapter files are provided in the Metadata folder of package. It contains important information about adapters and APIs.

The steps to import the adapter are as follows.

1. Click on Configuration tab.

2. Click Utilities> Import Adapter.

The Import Adapter Data screen is displayed.

3. In the Application dropdown list, select appropriate application name.

4. In the GRC Application dropdown list, select appropriate application.

5. Click Browse button and select appropriate xml file in the Adapter Metadata (Local) text box.



Figure 5.11: Import Adapter Data

6. Click and select the Overwrite checkbox.

If the checkbox is checked, the Standard Adapters Components such as Program Definition, Program Configuration, and Adapter to Program mapping and Program to API field mapping gets over written.

7. The validation checks are as follows:

a. The Program name imported through the xml is unique.

b. The data types of the program output fields imported through xml should match with the master data for the Output fields defined in the RTA tables.

c. All the API fields stated in the xml should be present in the master data tables of RTA.

d. The output field names to which the API fields are mapped should be the same as defined in the section for Programs in the same xml.

8. Click Import.

The adapter is imported.

5.6 CREATE CONNECTORS

You need to create connectors to connect to the corresponding system. For each system, create at least one connector.

The steps to create the connector are as follows:


2. In the left menu bar, click on Connectors.

The Connectors>Search screen opens.

3. Click on Create.

The Connector>Create page opens.



Figure 5.12: Connectors> Create

4. In the Name field, enter appropriate name of the connector.

5. In the Description field, enter brief description of the connector.

6. In the Status dropdown list, by default status is selected as Active.

7. In the Connection Type drop-down list, select appropriate connector type. Based on the selection of the connector type some additional field appears on the screen.

Note: refer to corresponding AVM RTA DS User Guide v2.0SP07. Based on the selected connector type other fields appears on the Connector>Create screen. The field varies based on the system to which you want to make a connection. The examples of the connection type are LDAP, JDE, SAP UME, JDBC.

Example 1: If you select the connector type as JDBC, then the Driver Name, URL, User ID and Password fields appears on the screen.

a. In the Driver Name text box, enter appropriate driver name.

b. In the URL text box, enter appropriate URL.

c. In the User ID text box, enter appropriate user ID.

d. In the Password text box, enter appropriate password.

e. Click Save to add new connector.



Figure 5.13: JDBC Connector

5.7 CREATING A SYSTEM

The steps to create a new system are as follows.


2. In the left navigation pane, click the Application Center>Systems.

3. The Systems>Search page opens.

4. Click on Create.

5. The Systems>Create page opens as shown in the following screenshot.

Figure 5.14: Systems>Create

6. In the Name field, enter appropriate name of the system.

7. In the Description field, enter brief description of the system.



8. In the External System Id field, enter appropriate id.

Note: the System creation has one External System Id associated that denotes the exact name of the System that is configured into the SAP RAR. There is one to one mapping between the System Name and the External System Id and the validation has been placed for the External System Id to be unique.

9. In the Application drop-down list, select appropriate application. This field is mandatory.

10. In the Status drop-down list, and select the status as Active.

11. In the SOD Datasource Connector dropdown list, select appropriate value.

Note: the SOD Datasource Connector dropdown list displays all the active connectors. This field is not mandatory. This setting is required for upload SOD. If you are not using Upload SOD or Offline feature this configuration is not required.

12. Mark the AVM-RTADS Repository checkbox. When you check the RTADS

Repository checkbox, you can conduct offline analysis. Instead of real time call, you can fetch data from AVM RTA DS table. This feature is added for performance enhancement. For More information on this refer, Chapter 10 Appendix. When the AVM-RTADS Repository checkbox is not checked, it indicates you need to do online (Real time) analysis. In that case, while creating Autobatch Extraction, under the Adapter Manager> Auto Batch

Extraction>Job Scheduler-Create page, the Create File checkbox is by default checked and non-editable. Files are auto generated. When the AVM-

RTADS Repository checkbox is checked, it indicates offline analysis mode. In that case while creating Autobatch Extraction, under the Adapter

Manager> Auto Batch Extraction>Job Scheduler-Create page, the Create

File checkbox is not checked and is editable. You can create .zip files as required.

13. Click on the Add Connector button.

14. The Connector page opens displaying the list of connectors under the column headings Select, Connectors and Description as shown in the screenshot below.

Figure 5.15: Connector

8. Click on Select, next to the connector, which you want to add.

9. Click on Select button.



The connector is added to the system and is displayed under the column headings Select, Id, Connector, Connector For, Description, and Connection Type.

Figure 5.16: Systems>Open

Note: under Informer>Report, when you click Run Report, at that time only that connector is selected for which Connector For type is Report.

10. To add new parameter, click on the arrow image corresponding to the System Parameter.

Note: It is mandatory to enter system parameter as IMPORT_PROFILE for importing CSV Data. The Configuration tab> Utilities> Import CSV Data screen displays only those systems for which system parameter is added as IMPORT_PROFILE.

11. Enter appropriate name and parameter value. Click on Save. The screen displays message as, “<Name>: System updated successfully.”

12. Click on the Edit image .

13. Edit the Parameter Value as required and click Save to save the system.

14. Click on the Delete image to delete the selected parameter.

15. Click on Save to save the newly created System.

The System>Search screen displays message as SYSTEM NAME: System created successfully.

16. Once the Systems details are saved, they are displayed on the System>Search page.

Note: the System and Application Name created in these screens will be available for all the screens where in System and Application fields are present. The Registration Status of the Application and System do not hamper these to be available in other screens (like Custom Adapter configuration, Add System –Connector Screen). However, the APIs attached to the system will only function if the system is registered.



5.8 UPLOAD SOD RULES

The SOD is the segregation of duties. For risk analysis, GRC uses the actions and permissions data (of users/ roles) for which SOD rules are defined. The Upload SOD Rules feature is designed to filter SOD rules data (actions/permissions). The “Upload SOD Rules” functionality uploads the SOD rules from GRC table to custom table in ERP. In the custom table the SOD Rules for given system are stored. RTA uses SOD rules data in the ERP custom table to filter the actions and permissions data for users/roles. This filtering is done for real time analysis as well as analysis using RTADS repository. In turn, this reduces the returned data volume to GRC. In addition, helps to improve the performance for both real time analysis and analysis using RTADS repository. Before uploading SOD rules, ensure to set upload SOD Rules Configuration.

Note: if you are not using Upload SOD or Offline feature this configuration is not required.

5.9 UPLOAD SOD RULE CONFIGURATION

Using the Upload SOD Rules Configuration feature, you can configure GRC

Application Connector for the Upload SOD Rules functionality.

The steps to set Upload SOD Rules Configuration are as follows.

1. Click on the Configuration tab.

2. In the left navigation pane, click the Utilities> Upload SOD Rules

Configuration link.

The Upload SOD Rules Configuration page opens as shown in the following screenshot.

Figure 5.17: Upload SOD Rules Configuration

3. In the GRC Application Connector dropdown list, select appropriate value.

4. Click on the Save button.

The screen displays message. The information is saved in the AVM RTA DS database.



5.10 APPLICATION CONFIGURATION

The Application Configuration feature is used to set RTA DS and ResQ applications URL.

The steps to configure Application Configuration are as follows:


2. Click Utilities>Application Configuration.

3. The Application Configuration page opens as shown in the following screenshot.

Figure 5.18: Application Configuration

4. In the RTA DS URL text box, enter RTA DS application URL. For Example: http://192.168.2.15:50100/xPlatformAdapter/

5. In the ResQ URL text box, enter ResQ application URL. For Example: http://192.168.2.15:50100/ResQAdpt/

6. Click on Save to save the settings.

Figure 5.19: Application Configuration

5.11 REGISTERING AN APPLICATION

For importing and configuring the API Information, the registration of the application and system are required. After registering the application and system,



the external system id will become non-editable. Hence, before registering the application/system, verify the connector name of GRC and external system id.

First, register the application then the system.

The steps to register an application are as follows:


2. Click Registration in the left menu bar.

The Registration >Application - System>Search screen opens.

Figure 5.20: Registration > Application- Systems > Search

3. To find all the previous records, click Go.

-Or-

To find a particular parameter, enter the value in the Name/Description/Customer Name field and click Go.

4. The screen displays search results under the column headings Select, Name, Description, Customer Name, Type and Status.

5. Select Application whose status is non-registered.

6. Click on Open.

The Registration screen opens as shown in the screenshot below.

Figure 5.21: Registration



7. The Customer Id field is non-editable.

8. In the Customer Name text box, enter appropriate Customer Name.

9. In the Contact Person text box, enter appropriate name.

10. In the Email Address text box, enter appropriate contact mail address.

11. In the Telephone text box, enter appropriate contact number.

12. In the Address text box, enter appropriate customer address.

13. The Application Name fields are non-editable.

14. In the Operating System text box, enter appropriate operating system.

15. In the Datasource Type dropdown list, select appropriate value.

16. In the Access Control Version dropdown list, select appropriate value.

17. Click Save.

18. The screen displays message as shown in the below screenshot.


19. Select the application and click on the Open button.

20. The below screen opens.


21. Click on the Browse button and import the GLT_RTADS_APPL.XML license key provided in the build.

22. Click on Save.

23. The screen displays message as shown in the following screenshot.




24. After saving the application its status changes to REGISTERED.

5.12 REGISTERING A SYSTEM

The AVM RTA DS application processes the GRC requests only after the system is registered. Before registering the system, ensure to register the application.

You can register the system only when, the application status is in-progress and its status is registered.

Note: if the configuration for the system in AVM RTA DS and GRC side is complete then you can schedule the jobs from GRC.

The steps to register an application are as follows:


2. Click Registration in the left menu bar.

The Registration >Application - System>Search screen opens.


To find all the previous records, click Go.

-Or-



To find a particular parameter, enter the value in the Name/Description/Customer Name field and click Go.

3. The screen displays search results under the column headings Select, Name,

Description, Customer Name, Type and Status.

4. Select the System whose status is non-registered.

5. Click on Open.

The Registration screen opens.

6. The Customer Id field is non-editable.

7. In the Customer Name text box, enter appropriate Customer Name.

8. In the Contact Person text box, enter appropriate name.

9. In the Email Address text box, enter appropriate contact mail address.

10. In the Telephone text box, enter appropriate contact number.

11. In the Address text box, enter appropriate customer address.

12. The Application Name fields are non-editable.

13. In the Operating System text box, enter appropriate operating system.

14. In the Datasource Type dropdown list, select appropriate value.

15. In the Access Control Version dropdown list, select appropriate value.


16. Click on Save.

17. The system is listed on the Registration screen.

18. Select the system with status as In-Process and click on Open.

19. The below screen opens.




20. Click on the Browse button and import the GLT_RTADS_SYS.XML license key provided in the build.

21. Click on Save.

22. The screen displays message as shown in the following screenshot.


23. After saving the system its status changes to REGISTERED.

5.13 SMTP SETTINGS

The SMTP Settings are required to send emails to Greenlight, in case of Platform, Application or System Registration.

If the SMTP server is not available for GRC server, you can send mails manually using RTA DS application.

The steps for SMTP settings are as follows:

1. On the RTA DS login page, click on the SMTP Settings link.

2. Enter appropriate credentials in the User Id and Password.

3. Click on the SMTP Settings button.

The SMTP Settings >Open page opens as shown in the following screenshot.



Figure 5.29: SMTP Settings>Open

4. Enter appropriate information in the User Name, Password, Port and IP for the SMTP server.

5. Click and mark the Authentication checkbox if the SMTP server requires authentication.

6. Click on Save to save the configured SMTP Settings.

Note: only the administrator can configure SMTP Settings and save them. The Save button is disable for non-admin roles. The SMTP settings are not mandatory, as the license files required for the registration of a system, application and platform comes along with the Greenlight package. While registering SMTP settings, you may get an error message. Ignore the message as the license files are delivered with the package.



6 NETWORK AND COMMUNICATION SECURITY

A well-defined network topology can eliminate many security threats. Todays’ network supports the communication that business needs and prevents unauthorized access. This section describes the network and communication security for the AVM RTA DS.

The network topology for the AVM RTA DS is based on the SAP Net Weaver topology. Hence, some of the security guidelines and recommendations described in the SAP Net Weaver Security Guide are also applicable to the AVM RTA DS. The AVM RTA DS specific details are as follows:

6.1 COMMUNICATION CHANNEL SECURITY

This topic describes the communication channels and protocols used by AVM

RTA DS. The following table contains the communication paths used by AVM

RTA DS, the protocol used for the connection, and the type of data transferred.

High-level steps to setup SSL are as follows:

1. Generating the Keystore file.

2. Configuring NW AS (NetWeaver Application Server) for using the Keystore file.

3. Configuring web application to work with SSL.

For more information on configuring HTTPS refer: Configuring the use of SSL on the AS Java on SAP Help Portal.

Note: AVM RTA DS resides on the same NetWeaver java stack as that of SAP GRC. Therefore, the default communication is done using http and not http secure. However, the SSL or http over secure socket layer can be enabled for the communication with additional configurations depending upon client request.

6.2 COMMUNICATION DESTINATIONS

The AVM RTA DS communicates to Non-SAP Applications. This topic lists the required connection types and authorizations.

The following table describes communication paths and their communication method.

Communication Path Protocol Type Of Data

SAP GRC to AVM RTA DS HTTP Application Data

AVM RTA DS to the application database

SLD data source defined in visual admin

Application Data



Data Storage Security: secure communication between AVM RTA DS and its application database depends on the communication method allowing secure communications over it. For Example: if the application DB is Oracle, then communication happens on TCP using JDBC Thin Driver. SSL security over the JDBC Thin Driver is an additional configuration not provided by default. It needs to be set explicitly.

Communication Path Communication Method Type of Data

AVM RTA DS to Hyperion

RMI (Remote Method Invocation)

Application Data.

AVM RTA DS to Oracle JDBC Application Data.

AVM RTA DS to JDE Dynamic Java Connector Application Data.



7 BACKUP AND RESTORE

The AVM RTA DS serves to connect the SAP Access Control (AC) product with a Target ERP system like Oracle Financials to extract data from the target ERP and feed that ERP data to AC for analysis. The ERP data does not persist in RTA DS therefore no storage or backup and restore function exists in RTA DS for the data. It is important that the client follow good procedures to make regular backup copies of the target ERP system such as Oracle financials using the appropriate ERP tools and methods for the specific system as well as backups of the SAP GRC products and data.

The companies have their own disaster recovery plan. One of the benefits of having a streamlined IT infrastructure is that it enables companies to recover faster in the event of failure or environmental disaster. It is important to ensure that backup devices are not lost with normal data storage (separation of storage locations).

The backup and restore strategy for system landscape should consider SAP systems. It should be embedded in overall business requirements and incorporate the entire process flow of the company. Taking back up of the Java AS and the relevant database prevents the data loss. It is also essential for the recovery of the server after the system break down.

The backup data to restore the system is used in the following scenarios:

1. Restore the initial state of the system, if an installation or upgrade fails.

2. Restore an SAP NetWeaver AS installation when operating system or file system problems occur.

3. Restore SAP system data in case of the database crash.

The backup strategies to be applied are as follows:

1. Offline Backup - This strategy enables you to create a full backup of your system that can be restored from a hard disk crash or operating system problems. It requires system downtime and is not practical to do on a daily basis.

2. Online Backup - This strategy allows you to back up the database and the file system to recover particular components of your system. For this backup full system shutdown is not required, thus making this strategy convenient for creating regular incremental data backups. Online backup does not guarantee a full backup of all system components.

Note: you can use the standard SAP NetWeaver 7.0 operations for backup and restore for the RTA DS. The RTA DS Application has several tables in the file system and database to back up and restore. Use the parameter: SAP<SID>DB, where SID is the system ID. You need to back up all tables with the following prefixes: GLT.



8 LOGS

Logs are available and can be viewed either through the application or directly on the server as an operating system file.

AVM RTA DS maintains error and debug logs at following server operating system path:

/usr/sap/<SID>/../j2ee/cluster/RTADS_LOGS, where SID is the system identifier.

To see the logs from the AVM RTA DS application, please follow this path:

Configuration >Logs Monitor >Application Log >xapp.debug.log, xapp_info.log and xapp_error.log

Log files are used by administrators to view the status of the system, database, and applications. AVM RTA DS logging API uses the log4j to produce logs in a common format and the status of the log files can be displayed using a browser. The actual log files are invoked using a hyperlink to individual log file. Log files are automatically written and contain a predefined severity that cannot be modified in the current release.

Apart from the logs provided by AVM RTA DS, the NW AS Java log and defaultTrace.trc, the default log and trace file for the J2EE engine are also available. There are primarily three levels of severity it supports:

1. Debug

2. Info

3. Error

Each log file records the following events:

1. Source of the record

2. Event timestamp

3. Message

4. Severity Level

8.1 LOGGING IN AVM RTA DS

The logging levels in the AVM RTA DS have appender properties as

1. debug_appender- shows messages classified as DEBUG, INFO, and ERROR.

2. info_appender- shows messages classified as INFO and ERROR.

3. Error_appender- shows messages classified as ERROR.

4. Initially during product deployment, the tag <appender-ref> is not commented for any appender.

a. The <appender-ref> appears as follows in the log4j.xml file.level. The tag is set to the debug_appender as



<level value="debug_appender"/>.

b. After successful deployment, the logging level can be changed. If the applications have been deployed for some time, there might be some log files, which can be deleted, and the new logging level can be set; the application would require a restart after changing the logging levels. For Example, if you want to create only ERROR logs file and does not want to create INFO and DEBUG logs file, then in that case, you need to comment <append-ref> tag for info_appender and debug_appender. Add error_appender value to <level> tag as shown below.

<level value="error_appender"/>.

c. Similarly, if you want to create only INFO logs file and does not wish to create DEBUG, ERROR logs then you can comment as:



<append-ref> tag for error_appender and debug_appender and add info_appender value to <level> tag as shown below. <level value="info_appender"/>.

d. Similarly, if you want to create only DEBUG logs file and does not want to create INFO, ERROR logs then you need to comment, <append-ref> tag for error_appender and info_appender. Add debug_appender value to <level> tag as shown below.

<level value="debug_appender"/>.

5. Maximum size of generated file would be 5000KB. After that new log file would be generated.

6. To view the logs, login to the AVM- RTA DS application, click Configuration tab.



7. Click Application Logs under Logs Monitor in the left menu bar.

8. The Application Log > screen opens as shown in the screenshot below.

Figure 8.1: Application Log >View Screen

9. The Application Log>View table displays Name column with Node link and last modified date time.

10. Click on the Node link.

11. The Application Log > <Node link> >View screen opens as shown in the following screenshot displaying details under columns Name, Size and Last Modified Date Time.

Figure 8.2: Application Log > Node

12. Click on the Name link to view and download the log files.

13. Click on the breadcrumb link to visit application log page.

14. The Log files are used by administrators to view the status of the system, database, and applications. The AVM RTA DS logging API uses the log4j to produce logs in a common format and the status of the log files can be displayed using a browser. The actual log files are invoked using a hyperlink to individual log file. Log files are automatically written and contain a predefined severity that cannot be modified in the current release.



15. For debugging purposes, apart from the logs provided by AVM RTA DS; the logs available from NW AS Java and the default log and trace file for the J2EE engine can also be referred.

16. There are primarily three levels of severity it supports:

1. Error

2. Info

3. Debug

17. Each log file records the following events:

1. Source of the record

2. Event timestamp

3. Message

4. Severity Level

8.2 SWITCH OFF THE LOG FILES

The steps to switch off the log files are as follows.

1. Go to <RTA DS HOME PATH>/servlet_jsp/xPlatformAdapter/root/WEB-INF/classes/config/xapp_log4j.xml

2. In the xapp_log4j.xml file, remove the appropriate line if you want to switch off particular log.

3. The examples of logs are:

a. <appender-ref ref="info_appender"/>

b. <appender-ref ref="debug_appender"/>

c. <appender-ref ref="error_appender"/>

4. For Example:

To remove debug log, remove< appender-ref ref="debug_appender"/>. ”

Note: Greenlight recommends retaining info logs and error logs.

The following table displays the list of important log objects.

Log Objects Descriptions

/usr/sap/<SID>/JC<instance nor.>/j2ee/cluster/server0/log

Default location of AS JAVA log file.

defaultTrace.trc The standard log & trace file for the J2EE engine.

/usr/sap/<SID>/JC<instance

no.>/j2ee/cluster/apps/sap.com/xPlatform/servlet_jsp/xPlatformAdapter/root/logs

Location of RTA DS log files.

xapp_debug.log Contains additional information about



Log Objects Descriptions

the flow of execution and error details for troubleshooting/debug purposes.

xapp_info.log Contains the information about the flow of execution of the programs

xapp_error.log Contains the exceptions and various errors occurred if any during the flow of execution of the programs.

8.3 CHANGING LOG LEVEL

This section describes information about changing log level.

The steps to configure xapp_log4j file are as follows:

1. Configure “MaxFileSize” and “MaxBackupIndex” parameters in the xapp_log4j file.

2. Open the xapp_log4j.xml file, on all the server nodes (server0,server1…) located at:-

/usr/sap/<SID>/../j2ee/cluster/server(N)/apps/sap.com/xPlatform/servlet_jsp/xPlatformAdapter/root/WEB-INF/classes/config/xapp_log4j.xml

--where ‘server(N)’ refers to server nodes (server0,server1… and so on.)

Note: in the clustered environment, perform the steps (1 and 2) on all the nodes e.g. server0, server1 etc. Restart the application.

3. Modify following parameters in xapp_log4j.xml for all the appenders (info_appender, debug_appender, and error_appender):

<param name="MaxFileSize" value="5000KB"/>

4. The values specified indicate that the appender will back-up the log files when they reach a size of 5000 KB.



Figure 8.3: xapp_log4j file

Note: you can modify the values as per the requirement.

8.4 ENABLE/DISABLE LOGS

This section describes how to enable /disable log levels.

1. In order to disable any log level (debug, info, error), remove <appender-ref> tag residing under <root> tag as shown in the following screenshot.

<root> <appender-ref ref="debug_appender"/> <appender-ref ref="info_appender"/> <appender-ref ref="error_appender"/> </root>

2. To disable debug log, remove:

<appender-ref ref=" debug _appender"/>

3. To disable info log, remove:

<appender-ref ref=" info _appender"/>

4. To disable error log, remove:

<appender-ref ref="error_appender"/>



Figure 8.4: Appender Log Level



9 TROUBLESHOOTING

The list of the troubleshooting scenarios about installation of AVM RTA DS with the solution is as follows:

A. Not able to login to AVM RTA DS application.

Solution:

To be able to login to the AVM-RTA Design Studio application;

First make sure the platform has been properly registered.

Go to Platform Registration on the applications Home Page and check whether the status is REGISTERED.

Second, make sure the User Id you are trying to enter into the system has the appropriate RTA roles to login through SAP UME.

Ensure the UME password is correct and if necessary have the Administrator reset the password.

B. Why I am not getting risks in CC/RAR?

Solution:

For this problem there could be any of the following possibilities:

Please make sure that System name in CC/RAR is same as External ID of the corresponding System in RTA.

Please check whether System in AVM RTA DS is registered.

Please make sure that system is mapped to your Adapter APIs.

C. Why the connector types are not showing when the master data is imported?

Solution:

Make sure that the installation scripts were run during the installation of the AVM RTA DS.

If not run then, run the delete scripts once on the Database schema where AVM RTA DS application is installed to delete the data that might have already been created.

Run the installation scripts and then try re – importing the Master data.

D. Not able to find pre-configured roles to be attached to AVM RTA DS application users.

Solution:

To be able to associate roles to the AVM RTA DS application user;



Make sure you have imported the pre-configured role file into Sap UME through NetWeaver administrator.

E. The RTA cannot connect to the target ERP database because the database crashed or was offline. How do I reconnect it?

Solution:

Ensure that all the services are restarted in SAP Management Console. If this does not help then the server needs to be restarted.

This will clear all the inconsistencies. Once the server is started, bring up all the services in SAP Management Console.



10 APPENDIX

This chapter provides information about AVM RTA DS application properties file.

10.1 AVM-RTADS APPLICATION PROPERTIES FILE

The rtads_application.properties file resides in the build. The file contains following parameters. You can change the parameters as required.

1. MAX_POOLSIZE= 40. This is count of maximum no. of connections; you can open on the ERP. If this max no. of connections is exceeded, then you can see error in logs indicating no more connections should be open through AVM RTA DS application.

2. Jdbc.fetch.size= 100. This count indicates maximum no. of records you can fetch from the RTADS database in one go.

Refer the following screenshot.

Figure 10.1: rtads_application.properties file



11 SUPPORT

The AVM RTA DS application comes with the software and the installation and configuration documents. For any technical queries, please login to the SAP Support system once the implementation is completed. If you do not have access to support system, please send an email to [email protected] and we will provide the required login credentials to raise messages. After submitting the request, it will be routed to the appropriate party at Greenlight and they will contact you. The support person may set up a WebEx session or similar process to diagnose and resolve the problem. For any other query/support related issues send us an email at [email protected].

For information on Greenlight, products visit www.greenlightcorp.com



http://www.greenlightcorp.com/



12 TERMS AND DEFINITIONS

Terms Definitions

API

API stands for “Application Programming Interface”. An API is the definition of how a programmer can access the functionality contained within a code library.

Application The application is a homogeneous group of systems.

Application Registration The process of registering the applications created in AVM RTA DS with a valid key provided by Greenlight Technologies.

AVM Access Violation Management

Custom Adapters

Adapters created by the customer in-house or delivered by System Integration Partners of Greenlight Technologies without the use of Import Adapter utility.

Customer ID When Greenlight Technology receives the request for Platform Registration, it provides specific id to customer.

CUP Compliance User Provisioning

DB Database

External System ID External System ID is the system name as defined in the SAP RAR.

FTP File Transfer Protocol (FTP), a standard Internet protocol, is the simplest way to exchange files between computers on the Internet.

GRC Governance Risk and Compliance

JDBC

Java Database Connectivity (JDBC) is an application program interface (API) specification for connecting programs written in Java to the data in popular databases. The application program interface lets you encode access request statements in Structured Query Language (SQL). These requests go to the program that manages the database. It returns the results through a similar interface.

Logs The AVM RTA DS application maintains the all error and debug logs.

Master Data

Master Data refers to the configuration data imported into RTA DS in the form of xml that defines the connector types and the SAP and GRC APIs, various constraints and mapping between the two.



Terms Definitions

NWA NetWeaver Administrator

Platform Registration It is the process for registration of the RTA DS platform with a valid key. (Greenlight provides the key).

RTA DS

Real Time Analysis Design Studio abbreviated as RTA DS is the Java based application that extends and leverages SAP GRC capabilities to non-SAP systems.

SAP UME

SAP User Management Engine (UME). The data repositories or persistence layers from which the SAP User Management Engine (UME) retrieves user management data are referred as data sources. With UME you can leverage existing user data repositories in your system infrastructure by connecting to them using configurable persistence adapters. You can read data from and write data to multiple data sources in parallel. For example, you can configure UME so that user data is read from an existing corporate directory, while new users are written to a database. A persistence manager is responsible for reading the data from or writing the data to the correct data source. The data source to which the persistence manager writes is transparent to applications using UME.

SID System Identifier

SMTP SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and receiving e-mail.

Standard Adapters Adapters delivered by Greenlight Technologies, by importing the xml through the Import Adapter utility of RTA DS.

SSL Secure Socket Layer

System Registration The process of registering the systems created in RTA DS with a valid key provided by Greenlight Technologies.

UME User Management Engine

XML

XML (Extensible Markup Language) is a flexible way to create common information formats and share both the format and the data on the World Wide Web, intranets, and elsewhere. For example, computer makers might agree on a standard or common way to describe the information about a computer product (processor speed, memory size, and so forth) and then describe the product information format with XML.

Documents

AVM -RTA Design Studio Installation and Configuration Guide v2