16115135 Virsa Compliance Installation Guide

Installation Guide

Virsa Compliance Calibrator™ Version 5.2for SAP WAS 700

COPYRIGHT

© Copyright 2006 SAP AG. All rights reserved.

SAP Library document classification: PUBLIC

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.

Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.

Microsoft, Windows, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation.

IBM, DB2, DB2 Universal Database, OS/2, Parallel Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400, iSeries, pSeries, xSeries, zSeries, z/OS, AFP, Intelligent Miner, WebSphere, Netfinity, Tivoli, and Informix are trademarks or registered trademarks of IBM Corporation in the United States and/or other countries.

Oracle is a registered trademark of Oracle Corporation.

UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.

Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc.

HTML, XML, XHTML, and W3C are trademarks or registered trademarks of W3C®, World Wide Web Consortium, Massachusetts Institute of Technology.

Java is a registered trademark of Sun Microsystems, Inc.

JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape.

MaxDB is a trademark of MySQL AB, Sweden.

Virsa, Virsa Systems, Access Enforcer, ComplianceOne, Compliance Calibrator, Confident Compliance, Continuous Compliance, Firefighter, Risk Terminator, Role Expert, the respective taglines, logos and service marks are trademarks of SAP Governance, Risk and Compliance, Inc., which may be registered in certain jurisdictions.

SAP, R/3, mySAP, mySAP.com, xApps, xApp, SAP NetWeaver, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves information purposes only. National product specifications may vary.

These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies (“SAP Group”) for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

2

SAP—Important Disclaimers

SAP Library document classification: PUBLIC

This document is for informational purposes only. Its content is subject to change without notice, and SAP does not warrant that it is error‐free. SAP MAKES NO WARRANTIES, EXPRESS OR IMPLIED, OR OF MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE.

Coding Samples

Any software coding and/or code lines/strings (“Code”) included in this documentation are only examples and are not intended to be used in a productive system environment. The Code is only intended to better explain and visualize the syntax and phrasing rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be liable for errors or damages caused by the usage of the Code, except if such damages were caused by SAP intentionally or were grossly negligent.

Internet Hyperlinks

The SAP documentation may contain hyperlinks to the Internet. These hyperlinks are intended to serve as a hint where to find supplementary documentation. SAP does not warrant the availability and correctness of such supplementary documentation or the ability to serve for a particular purpose. SAP shall not be liable for any damages caused by the use of such documentation unless such damages have been caused by SAP’s gross negligence or willful misconduct.

Accessibility

The information contained in the SAP Library documentation represents SAP’s current view of accessibility criteria as of the date of publication; it is in no way intended to be a binding guideline on how to ensure accessibility of software products. SAP specifically disclaims any liability with respect to this document and no contractual obligations or commitments are formed either directly or indirectly by this document. This document is for internal use only and may not be circulated or distributed outside your organization without SAP’s prior written authorization.

3

4

CONTENTS

About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8

Alert Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8

Product Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9Documentation Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9

Installation Guide, Configuration Guide, User Guide, and Release Notes . . . . . . . . . . . . . . . . . . . . .9

Online Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9

Contacting SAP GRC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10

1 Virsa Compliance Calibrator Installation Preparation

How to Use This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12Who Should Read This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12

Scope of This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12

Performing an Installation as Part of the Upgrade Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13Data Migration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

Installation Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14Related Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14

Installation Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15Installation Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16

Compliance Calibrator Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16

NetWeaver Web Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16

Supported NetWeaver Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

Recommended SAP Basis Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

Compliance Calibrator Real‐Time Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

Java Engine Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Back‐End Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Client Language Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Installation Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23

2 Virsa Compliance Calibrator Installation

Connecting and Installing Virsa Compliance Calibrator Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26Files That Are Added To Your Deployment During This Installation . . . . . . . . . . . . . . . . . . . . . . . .26

5

Compliance Calibrator for SAP Installation GuideInstallation Guide

Information You Will Need During Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26

Unpacking the Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

Using the Visual Administrator Tool to Configure a System Landscape Directory (SLD) Data Supplier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28

Configuring the Internet Graphics Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29

Converting Data from a Previous Compliance Calibrator Version . . . . . . . . . . . . . . . . . . . . . . . . . .32

Adding the Virsa Compliance Calibrator Files to Your Deployment . . . . . . . . . . . . . . . . . . . . . . . . .35

Connecting a Standalone J2EE System to the Remote SAP Server . . . . . . . . . . . . . . . . . . . . . . . . . . .44

3 Virsa Compliance Calibrator Setup

Creating JCo Connections to Back‐End Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48Setting Up JCo Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48

Importing Connector Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49

Creating an Administration Role and Assigning It To a User ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64Creating an Administrative Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64

Creating a User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71

Importing Predefined Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72

Assigning the Administrative Role To a User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73

Testing Your Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .76

Configuring your J2EE Adapters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78

Defining a Master User Source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80

Uploading System Message Text . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82Starting and Stopping the Background Job Daemon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83Access Enforcer Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84Importing and Migrating Rules During an Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85

6

PREFACE

TOPICS COVERED IN THIS PREFACE

About this Guide

Conventions

Alert Statements

Product Documentation

Documentation Formats

Installation Guide, Configuration Guide, User Guide, and Release Notes

Online Help

Contacting SAP GRC

7

Virsa Compliance Calibrator Version 5.2Installation Guide

About this Guide

Conventions

The following conventions are observed throughout this document:

• Bold sans‐serif text is used to designate file and folder names, dialog titles, names of buttons, icons, and menus, and terms that are objects of a user selection.

• Bold text is used to indicate defined terms and word emphasis.

• Italic text is used to indicate user‐specified text, document titles, and word emphasis.

• Monospace text (Courier) is used to show literal text as you would enter it, or as it would appear onscreen.

Alert Statements

The alert statements—Note, Important, and Warning—are formatted in the following styles:

Note Information that is related to the main text flow, or a point or tip provided in addition to the previous statement or instruction.

Important Advises of important information, such machine or data error that could occur should the user fail to take or avoid a specified action.

Warning Requires immediate action by the user to prevent actual loss of data or where an action is irreversible, or when physical damage to the machine or devices is possible.

8

Product DocumentationPreface

Product Documentation

Documentation Formats

Documentation is provided in the following electronic formats:

• Adobe® Acrobat® PDF files

• Online help

You must have Adobe® Reader® installed to read the PDF files. Adobe Reader installation programs for common operating systems are available for free download from the Adobe Web site at www.adobe.com.

Installation Guide, Configuration Guide, User Guide, and Release Notes

You can download the Installation Guide, Configuration Guide, User Guide, and Release Notes in PDF format.

Online Help

You can access online help by clicking the Help link from within the application.

9

Virsa Compliance Calibrator Version 5.2Installation Guide

Contacting SAP GRC

For information on contacting SAP Governance, Risks, and Compliance (SAP GRC), go to the SAP Support Portal which can be found on the SAP Service Marketplace at: service.sap.com.

In order to use the SAP Support Portal you will need to log in using your SAP user account. If you do not already have an existing SAP user account, you must first create a new account. At the bottom right area of the SAP Service Marketplace page, under the “Questions Regarding Login?” heading, click the “New User? Register here!” link. You will be prompted for a Customer Number or Installation Number which you can get from your SAP Basis Administrator. (In an SAP system you can find your installation number under System ‐> Status ‐> SAP System data.)

To submit your support request(s) from the SAP Support Portal, use the quick‐link “Messages” and follow the “SAP Message Wizard” procedure. All support requests should be logged under the following SAP GRC support components:

• GRC‐SCC Virsa Compliance Calibrator

• GRC‐SAE Virsa Access Enforcer

• GRC‐SRE Virsa Role Expert

• GRC‐SFF Virsa Firefighter for SAP

• GRC‐SPC GRC Process Control for SAP

For more information on the SAP Support Portal, use the quick‐links provided below:

• SAP Notes Search Here you can search for reference material and possible solutions for any questions regarding the GRC components.

• Messages Here you can create Support Messages for the GRC components.

• Software Download Here you can download installations, upgrades, and support packages.

• SAP Service Channel ‐ Your Inbox Here you can monitor the status of your open messages.

10

1VIRSA COMPLIANCE

CALIBRATOR INSTALLATIONPREPARATION

TOPICS COVERED IN THIS CHAPTER

How to Use This Guide

Scope of This Guide

Performing an Installation as Part of the Upgrade Process

Data Migration

Installation Prerequisites

Related Documents

Installation Overview

Installation Requirements

Compliance Calibrator Server

NetWeaver Web Application Server

Supported NetWeaver Versions

Recommended SAP Basis Versions

Java Engine Restart

Back-End Systems

Installation Preparation

11

Virsa Compliance CalibratorInstallation Guide

How to Use This Guide

This guide provides instructions to install the Virsa Compliance Calibrator Version 5.2 on SAP WAS 700 systems.

Who Should Read This Guide

The instructions in this guide presume you have a working familiarity with SAP, your company’s SAP implementations, and J2EE server configuration procedures.

Scope of This Guide

This guide provides instructions to install the Virsa Compliance Calibrator Version 5.2 on top of your existing SAP environment and J2EE engine.

This guide also describes how to migrate your existing Virsa Compliance Calibrator Version data to your new Virsa Compliance Calibrator Version 5.2 system, once you have it installed.

The guide is divided into three chapters. Each chapter describes one phase of the installation process.

• This chapter (“Virsa Compliance Calibrator Installation Preparation”) provides an introduction to the Virsa Compliance Calibrator installation process, identifies requirements for installation, and provides a checklist procedure to verify that you are ready to perform the installation.

• Chapter 2, “Virsa Compliance Calibrator Installation” provides instructions to choose your installation transport files, to install the Virsa Compliance Calibrator, and to verify that your installation was successful.

• Chapter 3, “Virsa Compliance Calibrator Setup” lists the procedures you must perform after installation. These are one‐time administrative tasks you must complete to make Virsa Compliance Calibrator ready for use.

When you have performed the tasks described in these three sections, you will have a functional and tested Compliance Calibrator installation, ready for implementation.

Note If you are already familiar with SAP software, use the pre-installation checklist to verify your configuration and skip to the next chapter, “Installation Tasks.”

12

Performing an Installation as Part of the Upgrade ProcessChapter 1 Virsa Compliance Calibrator Installation Preparation

Performing an Installation as Part of the Upgrade Process

When you install an Virsa Compliance Calibrator Version 5.2 as part of an upgrade from an older version, you must:

• upgrade any existing version 5.x Real‐Time Agents (RTAs) to version 5.2 RTAs, using the RTA upgrade patch, included with your installation software.

• convert and import your data to a new installation of Virsa Compliance Calibrator Version 5.2.The process of importing data to an existing installation would be destructive, because data on the existing system would be overwritten.

To import your upgraded data into a new Virsa Compliance Calibrator Version 5.2, you must install and configure that Virsa Compliance Calibrator as described in this guide, including the post‐installation setup tasks described in Chapter 3, “Virsa Compliance Calibrator Setup”.

Data Migration

For instructions to convert and migrate your existing data after you have performed this installation, refer to the Virsa Compliance Calibrator Data Conversion Utility instructions. Data conversion is required to migrate your data from any previous version of Compliance Calibrator.

13


Installation Prerequisites

This section describes the requirements your system must meet in order to install Virsa Compliance Calibrator, and provides a checklist to verify you are ready to begin your installation.

Related Documents

The following table provides SAP reference documentation that may be helpful when preparing to install Virsa Compliance Calibrator.

Note The procedures described in this document require system administrator-level knowledge and network access privileges. Before you begin the installation, read through this document completely, to ensure you have the required access privileges and network familiarity.

Table 1 SAP Informational Documents

For Information About... See SAP Note Number...

Support packages 865975

J2EE server memory configuration 716604, 723909, 693662

Add‐Ons 70228

Problems that occur while using SAINT to install or upgrade an Add‐On 179116

Internet Graphics Server (IGS) installation 458731, 454042

14

Installation OverviewChapter 1 Virsa Compliance Calibrator Installation Preparation

Installation Overview

Table 2 provides a list of each major step in the Virsa Compliance Calibrator Version 5.2 installation process and locates the instructions within this guide.

Table 2 Installation Processes Described in This Guide

Chapter Installation Process

Chapter 1, “Virsa Compliance Calibrator Installation Preparation”

Verify host system and environment meet Virsa hardware and software requirements, see Page 16.Verify client systems are properly configured, see Page 18.Perform pre‐installation verification steps, see Page 23.

Chapter 2, “Virsa Compliance Calibrator Installation”

Review files being added to your deployment and information you will require while installing, see Page 26.Unpack the transport files to your installation host system, see Page 27.Configure the Software Deployment Manager in the System Landscape Directory, see Page 28.Use the Visual Administrator Tool to specify the URL for the Internet Graphics Server Page 29.Use the Software Deployment Manager to add the Virsa files to your deployment, see Page 35.Connect your installation to a standalone J2EE server, see Page 44.

Chapter 3, “Virsa Compliance Calibrator Setup”

Set up the installed product by creating metadata and model data for JCo destinations, see Page 49.Use the UME to create an administrative role and assign it to a user account, see Page 64.Define the Master User Source, see Page 80.

15


Installation Requirements

To verify that you are ready to install Virsa Compliance Calibrator, review the following system requirements, then perform the installation checklist procedure that follows.

Compliance Calibrator Server

The server on which you intend to install Compliance Calibrator must meet the following requirements:

• Processor: IA386 (Dual Processor), 2.40GHz or greater

• Memory: 2048MB or greater

• Storage: 120GB or greater

NetWeaver Web Application Server

Your Virsa Compliance Calibrator installation can share the same host as your NetWeaver web application server. However, for high volume, high availability environments, Virsa recommends you use separate, dedicated hosts for your NetWeaver server and your Virsa Compliance Calibrator installation.

Your J2EE system must meet the following requirement:

• Memory Configuration: Your J2EE server must be configured as described in SAP Note 716604 and SAP Note 723909.

Changing the Web Application Server Default Memory Configuration

Your NetWeaver web application server includes a default configuration setting that you should change before you begin your installation.

If you do not make this change, the first time you run a large Risk Analysis job, your Compliance Calibrator installation may generate an “Out of Memory” exception that will cause your NetWeaver server to restart.

To ensure your Virsa Compliance Calibrator installation does not encounter this out‐of‐memory condition, you need to modify the NetWeaver server configuration as described in the following procedure, using the NetWeaver Config Tool.

To launch the Config Tool from a Unix or Linux operating system:

• /usr/sap/<SID>/DVEBMGS00/j2ee/configtool/configtool.sh

To launch the Config Tool from a Windows operating system:

• \usr\sap\JSA\JC00\j2ee\configtool\configtool.bat

Once you have launched the Config Tool, use the following procedure to modify your NetWeaver server configuration.

Note For instructions to configure J2EE server memory for SAP, refer to SAP note 693662.

16

Installation RequirementsChapter 1 Virsa Compliance Calibrator Installation Preparation

To modify the NetWeaver server default configuration:

1 In the Config Tool, navigate to the NetWeaver server instance that you plan to connect to your Compliance Calibrator.

2 On the General tab, scroll to the bottom of the Java parameters field.

3 Delete the following entry:

-XX:disableExplicitGC

4 Save your changes and exit the Config Tool.

Supported NetWeaver Versions

Virsa Compliance Calibrator supports the following NetWeaver versions:

• SAP NetWeaver version 640 SP9 or greater with SAP IGS version 640 or greater*

• SAP NetWeaver version 700 SP8 or greater with SAP IGS version 700 or greater

* For instructions to install Virsa Compliance Calibrator Version 5.2 on SAP Web Application Server (WAS) 640, see the Virsa Compliance Calibrator Version 5.2 Installation Guide for SAP WAS 640.

Recommended SAP Basis Versions

To use Virsa Compliance Calibrator, we recommend you install it on the following SAP Basis versions:

Compliance Calibrator Real-Time Agents

To enable the Virsa Compliance Calibrator to access your SAP system, you need to install at least one Virsa Compliance Calibrator Real‐Time Agent (RTA). If you have an existing installation of Virsa Compliance Calibrator, you can use the RTA from that installation only if it is a version 5.2 or greater RTA. Alternatively, you can install the Virsa

Table 3 Recommended SAP Basis Versions

Basis Version Package Name for Recommended Support Package Level

46C SAPKB46C53

46D SAPKB46D44

610 SAPKB61048

620 SAPKB62061

640 SAPKB64019

700 SAPKB70010

Note If you are installing Compliance Calibrator on an earlier SAP Basis Support Package level than those listed above, make sure you follow the required code fix information described in SAP Note 943796.

17


Compliance Calibrator RTA that is provided with your Compliance Calibrator 5.2 software.

Java Engine Restart

This installation procedure requires you to restart your Java server. If you are installing into a production environment, schedule your installation appropriately.

Back-End Systems

The Virsa Compliance Calibrator Java component requires at least one connection to a Virsa Compliance Calibrator Real‐Time Agent (RTA), installed on an SAP server.

In order to connect to the Virsa Compliance Calibrator, each RTA (back-end) system must:

• be version 5.2 or greater.

• have an entry in the operating system services file of the NetWeaver server.(The server must be restarted before new client entries are registered.)

• be defined as a Technical Landscape in the NetWeaver System Landscape Directory (SLD).

• have a system login account for the Virsa Compliance Calibrator to use for connection.You will need this account information during installation, as you configure the Java connections.

Client Language Setting

Once installed, Virsa Compliance Calibrator uses each user’s Language setting, as specified in the NetWeaver User Management Engine, to determine which language to use for screen text, log text, and reports. Though the Language setting for SAP users is optional, it is mandatory for Compliance Calibrator.

Virsa Compliance Calibrator supports the following Language settings:

• English

• French

• German

Note While all other sections of this document describe requirements to be met before you begin to install Virsa Compliance Calibrator software, this section, “Back-End Systems”, describes requirements that must be met, not before installation, but before clients can connect to the Virsa Compliance Calibrator. You do not have to ensure clients meet these requirements until after the installation.

Important Users who do not have a Language setting specified will receive an error message informing them that Compliance Calibrator requires this setting to be selected.

18


• Japanese

• Portugese

• Spanish

Specifying a Language with the User Management Engine

Use the following instructions to specify a Language setting using the NetWeaver User Management Engine. Choose the appropriate procedure for your NetWeaver installation: Java only, or both a Java and an ABAP stack.

To specify a user’s Language setting on a Java-only Web Application Server:

1 Launch the NetWeaver Web Application Server by entering the following URL in a web browser Address toolbar:

http://<server_name>:50000

where:

server_name is the name of your SAP Web Application Server.

2 From the SAP Web Application Server page, choose User Management.

3 On the NetWeaver Welcome page, enter your User ID and Password.

Note Make sure you specify a language setting for each Compliance Calibrator user account. If you do not specify this setting, your system defaults may select the wrong language when users try to log in to Compliance Calibrator.

19


4 Enter the Search Criteria for the Compliance Calibrator user account(s) you want to change and click Go.

5 In the results list, click the row with the account you want to modify.

Below the search results list, the Details of User <User_Name> region displays information about this user account, including any specified language setting.

6 Under Details of User <User_Name>, click Modify.

20


7 Choose your language setting from the Language drop‐down menu and click Save.

The account you modified now has the required language setting to run Compliance Calibrator.

To specify a user’s language setting on a Web Application Server with both a Java and an ABAP stack:

1 Log into the SAP system and execute transaction SU01.

2 In the User field of the User Maintenance: Initial Screen, enter the account you want to change.

The Maintain User page appears, with the Address tab in front.

21


3 In the Communication area of the Address tab, choose a supported language using the Language drop‐down menu and click Save.

The user account you modified now has the required language setting to run Compliance Calibrator.

22

Installation PreparationChapter 1 Virsa Compliance Calibrator Installation Preparation

Installation Preparation

Use the following procedure to ensure that your system is prepared for Virsa Compliance Calibrator installation.

To verify that your system is configured and ready to install the Virsa Compliance Calibrator:

1 Verify that your system meets all of the criteria described in the preceding section, “Installation Requirements” on page 16.

2 Verify that the J2EE Visual Administrator Tool is installed.

3 Verify that the Internet Graphics Server (IGS) is configured and running.

IGS configuration instructions are provided as part of the installation process.

4 Verify that the NetWeaver System Landscape Directory (SLD) is configured and running.

Compliance Calibrator uses the SLD for mapping, services and connections. The SLD does not have to reside on the same J2EE server you use for the Virsa Compliance Calibrator.

To verify that there is a default logon group in the back-end system:

1 Log in to the SAP server for your Compliance Calibrator installation.

2 Execute transition code smlg.

3 The SAP Maintain Logon Groups window appears.

4 Verify that there is a default logon group specified.You will select this group name later, when you are configuring your JCo destinations connector.

5 If you do not already have a group that includes all SAP users, create one, and name it “PUBLIC”

6 When you Create JCo Connectors during the post‐installation setup process, this is the logon group you will specify. (See “Importing Connector Data” on page 49.)

Once you have completed this pre‐installation check, you are ready to install the Virsa Compliance Calibrator.

23


24

2VIRSA COMPLIANCE

CALIBRATOR INSTALLATION


Connecting and Installing Virsa Compliance Calibrator Systems

Files That Are Added To Your Deployment During This Installation

Information You Will Need During Installation

Unpacking the Files

Using the Visual Administrator Tool to Configure a System Landscape Directory (SLD) Data Supplier

Configuring the Internet Graphics Server

Converting Data from a Previous Compliance Calibrator Version

Adding the Virsa Compliance Calibrator Files to Your Deployment

Connecting a Standalone J2EE System to the Remote SAP Server

25


Connecting and Installing Virsa Compliance Calibrator Systems

Use the information provided in this chapter to install the Virsa Compliance Calibrator.

Files That Are Added To Your Deployment During This Installation

The Virsa Compliance Calibrator installation package contains the following archived deployment files. For interface files identified as “Optional,” you only need to deploy the file if you intend to use the GRC products associated with that interface file (listed in the Contents column).

You install the deployment files in the order in which they are listed, using the Software Deployment Manager (SDM).

Information You Will Need During Installation

Before starting your installation, make sure you have the following information available.

Note You must have system administrator permissions to perform these installation procedures. This installation requires you to stop and start SAP, or your J2ee server (for standalone J2ee installations).

Table 1 Virsa Compliance Calibrator Deployment FilesListed in Required Deployment Order

Deployment Sequence

File Name Contents

1 virsa~ccxsysdb.sda Database

2 virsalib.sda Virsa J2EE Library

3 sap.com~ccume.sda UME Actions and Permissions

4 virsa~ccxsysbe.ear BAPI models: non‐HR

5 virsa~ccxsysbehr.ear BAPI models: HR

6 virsa~ccappcomp.ear User interface

7 virsa~ccxsysbgear.ear Background daemon

8 virsa~ccxsysws.ear Access Enforcer, Role Expert, and Process Controls interface — Optional

9 virsa~ccxsysactionws.ear Role Expert interface — Optional

Note When installing over a previous Compliance Calibrator version, you must undeploy the following file, or your installation will not work properly: virsa~ccwsproxy.ear.

26

Connecting and Installing Virsa Compliance Calibrator SystemsChapter 2 Virsa Compliance Calibrator Installation

Front-End Systems

• Java administrative user account and password

• Java server name

• Java engine instance ID(s)

Back-End Systems

• SAP administrative user account and password

• SAP System ID (SID)

• NetWeaver user account and password

• RFC login information for Virsa back‐end component(s). (See Table 1 on page 48 for connection limits.)

Unpacking the Files

This section describes how to unpack and deploy the Virsa Compliance Calibrator files.

Perform the following steps to unpack and import your Virsa files:

1 Log on to the installation host system for your Virsa Compliance Calibrator.

2 Unpack the SAR archive file using the command syntax appropriate to your platform.

Example:

SAPCAR -xvf c:\usr\sap\trans\eps\vircc01_03.sar

3 After the archive file has unpacked, look in the SAP root directory for a directory named \in\. The unpacked Virsa files should be in that directory.

For a list of file names contained in the archive, see Table 3, “Virsa Compliance Calibrator Files and File Contents” on page 35.

Operating System

Command

UNIX <SAP_SID>adm

Windows <SAP_SID>adm

Operating System

Command

UNIX SAPCAR -xvf /<PATH>/<FILENAME>

Windows SAPCAR -xvf <VOLUME>:\<PATH>\<FILENAME>

AS/400 SAPCAR '-xvf /<PATH>/<FILENAME>'

27


Using the Visual Administrator Tool to Configure a System Landscape Directory (SLD) Data Supplier

Use the following procedure to configure the System Landscape Directory (SLD).

1 Execute the Visual Administrator tool script or batch file.

See “Visual Administrator Tool Scripts and Batch Files” on page 30 for the path and file name.

2 Select an SAP J2ee Engine from the connection screen and click Connect.

3 Enter password for J2EE administrator.

4 Expand the navigation menu under your J2EE server name; expand the Services list item.

5 Click SLD Data Supplier.

6 Click the HTTP Settings tab.

7 Enter the host name and port number; enter the user name and password for your system connection.

The SLD uses port 5<xx>00

Where:

xx is the J2EE engine instance

For example, if the J2EE instance were 35, then the SLD message port assignment would be 53500.

Important Do not enter the Fully Qualified Domain Name for the SLD server. Enter the host name only and make sure the host is registered in the Domain Name Service (DNS).

28


8 Click Save.

9 Click the CIM Client Generation Settings tab.

10 Enter the same host, port, and user account information you entered in Step 7 on page 28.

11 Click Save.

12 Click the supplier (data transfer) icon at the top of the pane to transfer the information you have entered to the SLD server.

A pop‐up window displays the message “Trigger SLD data transfer?”

13 Click Yes.

A pop‐up window informs you that the data has been transferred successfully.

Configuring the Internet Graphics Server

The Internet Graphics Server (IGS) is included with your NetWeaver software. You configure the IGS URL using the Visual Administrator tool.

To specify the URL for the Internet Graphics Server

1 Launch the Visual Administrator tool by executing the script or batch file for your operating environment.

The name and location of the file you use to launch the Visual Administrator tool depend on your operating environment, as shown in Table 2.

29


In the preceding table:

• SAP_SID is the system ID for your SAP server

• instance is the instance ID of your J2EE engine

2 Under the Services item in the (left) navigation pane, click Configuration Adapter.

Table 2 Visual Administrator Tool Scripts and Batch Files

Operating Environment

Directory Path File Name

UNIX with Java only /usr/sap/<SAP_SID>/JC<instance>/J2ee/admin/Example/usr/sap/sap_system1/JC00/J2ee/admin/

Go.sh

UNIX with Java and ABAP add‐on

/usr/sap/<SAP_SID>/DVEBMGS<instance>/J2ee/admin/Example/usr/sap/sap_system1/DVEBMGS00/J2ee/admin/

Go.sh

Windows with Java only c:\usr\sap\<SAP_SID>\JC<instance>\j2ee\admin\Examplec:\usr\sap\sap_system1\JC00\j2ee\admin\

Go.bat

Windows with Java and ABAP add‐on

c:\usr\sap\<SAP_SID>\DVEBMGS<instance>\J2ee\admin\Examplec:\usr\sap\sap_system1\DVEBMGS00\J2ee\admin\

Go.bat

30


3 Under the Display Configuration tab, expand the webdynpro navigation list item; expand sap.com; expand tc-wd~disprwda; above the navigation list, click the Edit Mode (pencil) icon.

A pop‐up window warns that you are about to enter Edit Mode, and requests you to confirm that you want to proceed.

4 Click Yes.

5 In the navigation menu list, double‐click Propertysheet default.

The Change Configuration window appears.

6 In the Name column, click the IGSUrl list item.

31


The Change Property entry window appears.

7 In the Custom field, enter the IGS server name and port number, using the following format:

<server_name>:<port>

Where

server_name is the name of your IGS server.

port is the IGS server port, in the format 4<xx>80.

xx is the instance ID of your J2EE engine.

The default port assignment is 40080.

8 Click Apply custom; click OK.

9 Exit the Visual Administrator tool.

Converting Data from a Previous Compliance Calibrator Version

This section describes how to convert and import customized data from a previous Compliance Calibrator version. If you are not currently using a previous version, you do

32


not need to perform the data conversion tasks described in this section. Skip to the section, “Adding the Virsa Compliance Calibrator Files to Your Deployment” on page 35.

Before You Begin

Perform the following steps before you begin the data conversion process.

1 Make sure that you download any spooled ad hoc reports to a file.These spooled reports will not be transferred to your new installation.

2 Make sure that you have a current backup of your database.

3 Have your previous version of Compliance Calibrator running

Exporting Rules from Your Previous Compliance Calibrator Version

Use the following procedure to export (to a file) the Compliance Calibrator rules you need to convert.

To export rules from your existing Compliance Calibrator installation:

1 From the Rule Architect tab of your existing Compliance Calibrator installation, choose Utilities > Export Rules.

2 Click Get Rules.

Because you have not entered a Destination for each Source in the Export Rules list, the system displays the following warning:

Few Destinations are empty! Do you want to copy Source as Destination?

3 In the warning dialog box, click Ok.

4 Click Export Rules.

5 In the File Download dialog box, click Save; enter a name and location for the exported rules file.

The rule export process is complete. You will use the file you just created during the data conversion process.

Adding the Data Conversion Utility to Your Deployment

The data conversion utility is provided in one of the Compliance Calibrator version 5.2 deployment files: virsa~ccconvutil.ear. Because you only use this utility to convert existing rules as part of a Compliance Calibrator, you deploy this file during the data conversion process and you undeploy it as soon as you have performed the data conversion.

Important The data conversion utility does not convert critical action rules. If you created critical action rules in your previous version of Compliance Calibrator, make sure you record those rules at this point. You will need to manually re-enter those rules (using the Rule Architect), after completing the installation. For instructions to create critical action rules, see the Virsa Compliance Calibrator Users Guide.

33


To add the data conversion utility to your Compliance Calibrator version 5.2 deployment:

1 Perform Step 1 through Step 11 of the procedure “To add the Virsa Compliance Calibrator files to your deployment:” on page 36; during Step 7, choose the data conversion utility deployment file, virsa~ccconvutil.ear.

Once you have added this file to your deployment, you are ready to convert your rules data.

To convert a rules data file from previous versions to Compliance Calibrator version 5.2:

1 To launch the data conversion utility, enter the following URL into the Address field of a web browser:

http://<server_name>:<port>/webdynpro/dispatcher/virsa/ccconvutil/CC52ConvUtility

Where

server_name is the name of your Java application server.

port is the Java server port, in the format 5<xx>00.

xx is the instance ID of your Java engine.

For example, if your Java instance were 35, the port assignment would be 53500.

2 Click Convert Data.

3 In the 5.2 Migration form, click ExportRules.

4 In the File Download dialog box, click Open.

The rules data appears in your default text editor.

5 From your text editor, choose Save...; enter a name and location for the exported rules file.

6 Launch the Software Deployment Manager tool again and undeploy the conversion utility deployment file, virsa~ccconvutil.ear.

The rules data has now been converted. Once you have completed the remaining installation and post‐installation tasks, you will import the rules from the converted rules file, then migrate those into your new Compliance Calibrator installation.

Note Make sure you deploy the conversion utility deployment file in your (new) Compliance Calibrator version 5.2 installation. This utility does not run in earlier Compliance Calibrator versions.

Note Do not choose Save in the File Download dialog box. Instead, open the file and save it from a text editor, as described. Saving from the File Download dialog box can generate errors in the data file.

34


Adding the Virsa Compliance Calibrator Files to Your Deployment

The Virsa Compliance Calibrator installation package includes the following files:

The Software Deployment Manager (SDM) tool allows you to add and remove these files from your deployment. Launching options for the SDM tool vary, depending on your operating environment. See Table 4 for the location of the Software Deployment Manager batch file or shell script.

Table 3 Virsa Compliance Calibrator Files and File Contents

File Name Contents

virsa~ccxsysdb.sda Database

virsalib.sda Virsa J2EE Library

sap.com~ccume.sda UME Actions and Permissions

virsa~ccxsysbe.ear BAPI models: non‐HR

virsa~ccxsysbehr.ear BAPI models: HR

virsa~ccappcomp.ear User interface

virsa~ccxsysbgear.ear Background daemon

virsa~ccxsysws.ear Access Enforcer, Role Expert, and Process Controls interface — Optional

virsa~ccxsysactionws.ear RE interface ‐ Optional

Table 4 Software Deployment Manager Launch File Locations

Operating Environment Directory Path

File Name

UNIXJava Only

/usr/sap/<SAP_SID>/JC<instance>/SDM/program/Example/usr/sap/sap_system1/JC00/SDM/program/

remotegui.sh

UNIXABAP and Java add‐on

/usr/sap/<SAP_SID>/DVEBMGS<instance>/SDM/program/Example/usr/sap/sap_system1/DVEBMGS00/SDM/program/

remotegui.sh

WindowsJava only

c:\usr\sap\<SAP_SID>\JC<instance>\SDM\program\Examplec:\usr\sap\sap_system1\JC00\SDM\program\

remotegui.bat

WindowsABAP and Java add‐on

c:\usr\sap\<SAP_SID>\JC<instance>\SDM\program\Examplec:\usr\sap\sap_system1\JC00\SDM\program\

remotegui.bat

35


In the preceding table:

• SAP_SID is the system ID for your SAP server

• instance is the instance ID of your Java engine

If you need to undeploy any files other than ccsysdb.sda, you must also undeploy all the deployment files that follow it in the installation sequence, and deploy them again in the proper installation sequence.

Because it is important to add the deployment files in the proper order, you should add these files to your deployment one‐at‐a‐time, as described in the following procedure.

To add the Virsa Compliance Calibrator files to your deployment:

1 Navigate to the SDM batch file. (See Table 4.)

2 Double‐click RemoteGui.bat to launch the SDM.

3 Click the Connection icon.

4 In the Software Deployment Manager Login dialog box, enter the J2EE administrator name and password and click Login.

Important You cannot undeploy the first file in the installation sequence, the Virsa Compliance Calibrator database file, ccsysdb.sda. As you add this file to your deployment, tables get created in your SAP database. If an error occurs while deploying this file, you will need your SAP administrator remove all virsa_cc tables from the database and start again.

Note Before you deploy the SDA files, make sure that the J2EE engine is running.

36


The Software Deployment Manager GUI window appears.

5 Click the Deployment tab.

37


6 Click the Add to Deployment icon.

7 Select the Virsa Compliance Calibrator database file, ccsysdb.sda; click Choose.

8 Near the bottom of the pane, click Next..

a Click the details (up‐arrow) icon at the bottom of the deployment list.

Note When installing over a previous Compliance Calibrator release, you may see deployment files already in the Deployment list. If you see the file virsa~ccwsproxy.ear, make sure you Undeploy that file, or your installation will not function properly.

Note While deploying the first file, virsa~ccxsysdb.sda, you may receive the following message:

SDM has not calculated any deployment actions.Possible reasons: All selected archives have already been deployed before in the same or in a higher version.

If this happens, perform the following sub-steps. Otherwise, proceed to Step 9 on page 40.

38


b Select the option button to “Update displayed SDAs that have any version”.

c Click Next.

39


9 Click Next again.

40


10 Click Start.

The deployment file information gets added to database.

41


The status pane on the right displays a message letting you know whether the file deployed successfully. Click the Log Viewer tab for information about errors, if they occur.

11 Click Confirm.

12 Click the Add to Deployment icon again, as you did in Step 6 on page 38.

13 In the Choose window, click virsalib.sda (the Virsa library file); click Choose.

14 As you did in Step 8 on page 38 through Step 11 on page 42, click Next; click Next; click Start. Once the successful deployment message appears, click Confirm.

Note If you see error messages (indicated by a red deployment file icon) while adding the database file, ccxsysdb.sda, click the Log Viewer tab for information about where the error occurred.

Possible sources of error messages during this step include an insufficient database allocation. You may need to have your SAP administrator increase the space allocation. Make sure to remove the Virsa Compliance Calibrator tables that were added before you try to deploy this file again, as described on page 36

Note If you see an error while adding this file or subsequent files, (indicated by an error message and a red deployment icon), click the Log Viewer tab for information about where the error occurred. When an error occurs, you must undeploy the file and deploy it again.

42



16 In the Choose window, click sap.com~ccume.sda (the Virsa User Management Engine file. Includes all user information, such as Groups and Roles); click Choose.



19 In the Choose window, click virsa~ccxsysbe.ear; click Choose.



22 In the Choose window, click virsa~ccxsysbehr.ear; click Choose.



25 In the Choose window, click virsa~ccappcomp.ear; click Choose.



28 In the Choose window, click virsa~ccxsysbgear.ear; click Choose.



31 In the Choose window, click virsa~ccxsysws.ear; click Choose.



34 In the Choose window, click virsa~ccxsysactionws.ear; click Choose.


36 After you have successfully added all files to your deployment, stop and start SAP. (For J2EE‐only installations, restart your J2EE engine.)

Refer to your SAP documentation for instructions to stop and start your SAP engine using the SAPMMC tool.

37 In the Address field of a web browser, enter the following URL and click Go:

http//<server_name>:5<instance>00/webdynpro/dispatcher/virsa/ccappcomp/ComplianceCalibrator

Note Add the virsa-ccxsysws.ear deployment file only if you intend to use the Virsa Access Enforcer Interface, to connect Access Enforcer with Virsa Compliance Calibrator for risk analysis.

43


Where:

server_name is the name of your J2EE system.

instance is your Java engine instance ID.

Example:

http://SNW:50000/webdynpro/dispatcher/virsa/ccappcomp/ComplianceCalibrator

The Virsa Compliance Calibrator banner appears. This verifies that your installation was successful. There is no content below the banner until you:

create JCo destinations.

assign a role, provisioned to perform all Virsa Compliance Calibrator transactions, to a back‐end user account.

Connecting a Standalone J2EE System to the Remote SAP Server

If you are performing a “standalone” J2EE system installation, you need to connect it to the back‐end SAP server.

Use the following procedures to connect your J2EE system to a remote SAP server:

To add the required entry to your services file

1 Open the Windows services file in a text editor, such as NotePad. Use the following path and file name:

c:\windows\system32\drivers\etc\services

Note For UNIX installations, open your etc/services file with a text editor, and add an entry as described in Step 2 on page 45. (You do not need to restart your UNIX system after performing this procedure.)

44


The services file opens.

2 Add an entry in the services file in the following format:

sapms<sap_sid> 36<instance>/tcp

where:

sapms identifies the SAP message service

sap_sid is the name of your SAP server (always uppercase)

36 is the standard message port for SAP

instance is the SAP server instance ID

tcp is the message protocol

For example:

sapmsSNW 3600/tcp

3 Save your changes and Close the services file.

4 Restart Windows.

You are now ready to configure your new Virsa Compliance Calibrator installation. The product is not ready to be used or to import migrated data until it has been set up, using the instructions provided in the following chapter.

45


46

3VIRSA COMPLIANCECALIBRATOR SETUP


Creating JCo Connections to Back-End Systems

Setting Up JCo Connections

Importing Connector Data

Creating an Administration Role and Assigning It To a User ID

Creating an Administrative Role

Creating a User

Importing Predefined Roles

Assigning the Administrative Role To a User

Testing Your Installation

Configuring your J2EE Adapters

Defining a Master User Source

Uploading System Message Text

Starting and Stopping the Background Job Daemon

Access Enforcer Integration

Importing and Migrating Rules During an Upgrade

47


Creating JCo Connections to Back-End Systems

Once you have successfully installed Virsa Compliance Calibrator, you must perform the following procedures before you can use it:

• Import model data and metadata for each JCo destination you want to create, using the SAP NetWeaver Content Administrator (included in the Web Dynpro tools).

• Create an SAP User Management Engine (UME) role, and assign it to a user.

• Create a Master User Source.

• Start the background job daemon.

Setting Up JCo Connections

In order for the Virsa Compliance Calibrator Java component to access your SAP data, you need to establish one or more JCo connections between the Compliance Calibrator Java component, installed on a NetWeaver server) and a Compliance Calibrator ABAP component — the Real‐Time Agent installed on an SAP server. The Virsa Compliance Calibrator installation package includes connector model data and metadata files you use to establish these connections.

You can connect to as many as:

• Fifteen (18) Real‐Time Agents (RTAs) for HR‐only or Non‐HR SAP systems (such as CRM, APO, and SCM systems).

• Three (3) additional HR‐only Real‐Time Agents (RTAs) for SAP R3 systems.

For each back‐end SAP server you connect to your installation, you need to install an RTA and to establish a JCo destination with model data and metadata.

Table 1 provides JCo destinations for up to 21 back‐end systems.

Table 1 JCo Connector Files for Virsa Compliance Calibrator Systems

To Connect... Use These JCo Destinations:

An HR or a Non‐HR ABAP component (RTA) to the front‐end Java component.Connection limit: Fifteen (15) systems

VIRSAXSR3_01_MODEL & VIRSAXSR3_01_METADATAVIRSAXSR3_02_MODEL & VIRSAXSR3_02_METADATA....VIRSAXSR3_15_MODEL & VIRSAXSR3_15_METADATA

An HR or a Non‐HR ABAP component (RTA) to the front‐end Java component.Connection limit: Three systems

VIRSAR3_01_MODEL & VIRSAR3_01_METADATAVIRSAR3_02_MODEL & VIRSAR3_02_METADATAVIRSAR3_03_MODEL & VIRSAR3_03_METADATA

An HR‐only ABAP component (RTA) to the front‐end Java component.Connection limit: Three HR‐only systems

VIRSAHR_MODEL & VIRSAHR_METADATAVIRSAHR_01_MODEL & VIRSAHR_01_METADATAVIRSAHR_02_MODEL & VIRSAHR_02_METADATA

48

Creating JCo Connections to Back-End SystemsChapter 3 Virsa Compliance Calibrator Setup

Importing Connector Data

After you have installed the Virsa Compliance Calibrator Java component on your NetWeaver server and one or more Virsa Compliance Calibrator ABAP component RTAs on your SAP server(s), you need to import model data and metadata for each SAP back‐end server connection in your deployment.

Before you create model data and metadata, verify that each SAP server with a Virsa Compliance Calibrator RTA:

• is configured in the System Landscape Directory.

• has a default logon group defined.

• can be accessed by the NetWeaver server services file.

• includes an RFC user account for the Virsa Compliance Calibrator connection that includes the required permissions, as described in the “RFC Authorizations” chapter of the Virsa Compliance Calibrator Security Guide.

To Import Connector Model Data and Metadata:

1 Open an internet browser and enter the following address:

http://<server_name>:50000/index.html

For example:

http://localhost:50000/index.html

The SAP NetWeaver Startup page appears.

Note An administrative user account is required to complete the following procedure. If you do not already have an administrative account on your system, create one (such as WF_BATCH) before you begin.

49


2 In the NetWeaver Web Application Server window, click Web Dynpro.

3 Under Web Dynpro Tool Applications, click Content Administrator.

4 In the User Management Engine logon window, enter your User ID and Password.

50


The Web Dynpro Content Administrator window appears

51


5 Click Maintain JCo Destination.

Note If the buttons Create JCo Destination and Maintain JCo Destination are not enabled, the System Landscape Directory (SLD) bridge has not been properly configured. See “Using the Visual Administrator Tool to Configure a System Landscape Directory (SLD) Data Supplier” on page 28.

52


The JCo Destination Details page appears.

Important While performing the following steps, do not rename the Virsa Compliance Calibrator model data and metadata files, or the connectors you create will not function.

53


6 From the JCo Destination Details list menu in the right pane, locate the data file that corresponds to the back‐end system you are connecting and click Create.

Use the information provided in Table 1 on page 48 to select the JCo Destination model data or metadata for the back‐end system(s) you want to connect to this installation.

7 Enter the client number for the back‐end system. This must match the information you entered when you configured the System Landscape Directory in Step 7 on page 28.

8 Click Next.

The Create New JCo Destination J2EE Cluster pane appears.

Note Perform Step 6 through Step 20 twice for each back-end system you plan to connect: once to import the connector MODEL DATA file and once to import the connector METADATA file.

54


9 Select the local J2EE engine or select your remote J2EE engine from the drop‐down menu; click Next.

55


10 Select the appropriate option for the type of data you are generating:

For METADATA files, select the Dictionary Meta Data option.

For MODEL data files, select the Application Data option.

11 Click Next.

Important If you do not select the correct Connection Type for the data you are importing, your system will fail when you attempt to perform a Risk Analysis.

56


12 From the Message Server drop‐down menu, select the back‐end system for this connection.

The Message Server drop‐down menu lists servers that have been defined as an SLD Data Supplier in the System Landscape Directory. If the server you want to connect to does not appear in this drop‐down menu, use the Visual Administrator tool to verify the server configuration in the System Landscape Directory. See “Using the Visual Administrator Tool to Configure a System Landscape Directory (SLD) Data Supplier” on page 28.

57


13 In the Logon Group drop‐down menu, select the “default logon group” you identified in Step 4 on page 23.

14 Click Next.

Note When you are configuring model data (the second time through this process), there will be a drop-down menu allowing you to select Authentication Method. Currently, User/Password is the only supported setting for this option.

58


15 In the Name and Password fields, enter the user name and password for the back‐end system account this Virsa Compliance Calibrator installation will use.

16 Click Next.

17 Verify the information you have entered and click Finish.

Note When configuring data in Step 15, do not change the Language setting. English is the only supported language setting for Virsa Compliance Calibrator.

Note The back-end system account must be provisioned as a Compliance Calibrator administrator, per the specifications provided in the Virsa Compliance Calibrator 5.2 Security Guide.

59


18 After the process has completed, scroll down (if necessary) to verify you have received a message that states the connection has been successfully created.

60


Though the connector status may show a green light, you still need to test the connector to verify that it is functional.

19 For the connector you have just created, click Test.

61


The message at the bottom of the window indicates whether the test was successful. If the test is unsuccessful, click the Log Viewer tab to view information about where the connection problem occurs.

62


20 Locate the model data for the system you are installing and create a JCo destination for it, following the instructions provided in Step 6 through Step 19.

Remember to properly specify the Connection Type during in Step 10. To import model data, enable the Application Data option under the heading Data Type. To import metadata, enable the Dictionary Meta Data option under the heading Data Type.

Once you have created model data and metadata connections for each back‐end server connection, you need to create an administrative role using the User Management Engine (UME).

Note Whenever you establish or modify a JCo destination, you need to restart your Java engine in order to load the updated connection information to the NetWeaver server.

63


Creating an Administration Role and Assigning It To a User ID

This section describes procedures you perform to provision a user account that can perform the administrative tasks required to set up and manage the Virsa Compliance Calibrator.

Creating an Administrative Role

To make your new Virsa Compliance Calibrator installation configurable, you can import and use the predefined administrative roles for Compliance Calibrator, or you can use the User Management Engine to create a custom administrative role. You then assign the administrative role to a user account that will be used to configure and manage the Virsa Compliance Calibrator.

To create new roles:

1 Open an internet browser and enter the following address information:

http//<server_name>:5<instance>00/

Where


instance is the instance of your J2EE engine.

Example:

http://SNW:50000/index.html

The SAP NetWeaver startup page appears.

2 On the SAP NetWeaver startup page, click the User Management link.

Note The following information is provided for reference, in case you want to create a custom administrator role. Because Compliance Calibrator now includes several predefined roles you can import, you no longer need to create the Compliance Calibrator administrative role, unless your business needs require you to create an administrative role with customized permissions. You can skip this procedure and proceed with the next section, “Creating a User” on page 71.For a list of permissions (actions) assigned to predefined Compliance Calibrator administrative roles, see the Virsa Compliance Calibrator Security Guide.

64

Creating an Administration Role and Assigning It To a User IDChapter 3 Virsa Compliance Calibrator Setup

The User Management main page appears.

3 In the Search Criteria drop‐down menu, choose Roles.

4 Click Create Role.

65


5 In the Unique Name field, enter a name for the Compliance Calibrator administrative role; in the Description field, enter a description for this role; in the Details region, click Save.

66


The status line indicates that the role has been created.

67


6 Under the heading Details of Role <Role_Name>, click the Assigned Actions tab.

68


7 Under Available Actions, enter the following search string in the Get field, then click Add:

com.virsa.cc

The Available Actions list displays all Compliance Calibrator actions.

8 Under the Get field, (under Available Actions), click Select All; deselect any actions you do not want included in this administrative role.

9 At the bottom of the Available Actions list, click Add.

69


10 Under the heading Details of Role <Role_Name>, click Save.

70


You have now created a role with the necessary actions to set up and manage the Virsa Compliance Calibrator. You need to assign this role to an administrative user account.

Creating a User

If you need to create an administrative user account, use the SAP User Management Engine (UME) to create a user. An example of creating a user is provided, however, refer to your SAP documentation for information about creating users.

71


Importing Predefined Roles

Use the following procedure to import the basic, predefined roles that are included in the Compliance Calibrator installation package.

The action permissions provided for each role in this file are described in the Virsa Compliance Calibrator Security Guide.

To import Compliance Calibrator predefined roles:

1 From SAP NetWeaver, click User Management.

2 In the navigation pane of the User Management screen, click User Data Import.

72


3 Open UME Roles file, UMERoles_CC52.txt, in a text editor; Select All and Copy the contents of the UME Roles file.

This file is included in the root directory of your expanded Compliance Calibrator installation archive file.

4 In the Enter Data: field of the User Management screen, Paste the contents of the UME Roles file; click Import.

Assigning the Administrative Role To a User

Now that you have created or imported a role that contains all Virsa Compliance Calibrator actions, use the following procedure to assign the administrative role to a user.

73


To Assign the Administrative Role To a User

1 In the left navigation pane of the User Management Engine window, click Roles.

In the New Search field, enter the name of the administrative role you created or imported.

2 Click the Assign User(s) icon.

Note If you imported the predefined Compliance Calibrator roles, search for and assign the built-in administrator role: VIRSA_CC_ADMINISTRATOR.(The role shown in the following figures, z_virsa_cc_admin, is a custom-created administrative role.)

74


3 Click the Add User(s) to this Role (+) icon.

4 Using the search fields, locate the user account that want to assign to the administrative role.

75


5 In the Search Result(s) list, select the checkbox that corresponds to the user account.

6 Click Select.

The Assign Users window (not shown) now shows the account you have selected.

7 Click Continue.

The administrative role has now been assigned to the user you selected.

Testing Your Installation

Once you have completed your data and user setup, you are ready to test your installation.

To log on to the Virsa Compliance Calibrator:

1 Enter the following address into your web browser:

http//<server_name>:5<instance>00/webdynpro/dispatcher/virsa/ccappcomp/ComplianceCalibrator

Where:


instance is the instance of your J2EE engine.

Example:

Note If the administrator using this account will also be assigning JCo destinations, you can add the SAP built-in Administrator role to provision the user account for setting up connectors.

76


http://SNW:50000/webdynpro/dispatcher/virsa/ccappcomp/ComplianceCalibrator

2 Enter the account information for the user you created and click Logon.

The Virsa Compliance Calibrator main screen appears, showing the Informer tab. Because data has not yet been pulled into the system, the graphic display shows a broken pie chart and indicates a “Graphics Rendering Problem.”

77


Configuring your J2EE Adapters

In order to communicate to back‐end systems using the connectors you created during installation, you need to configure connector adapters on the Virsa Compliance Calibrator. These adapters connect to the JCo destinations you specified during installation. See “Setting Up JCo Connections” on page 48.

To Configure Your J2EE Adapters:

1 In the Virsa Compliance Calibrator by Virsa window, click the Configuration tab.

2 Navigate to Connectors > Create

The Create Connector window appears.

78


3 Enter the System ID for the back‐end system you want to connect to.

4 Enter the System Name for that back‐end system.

5 Leave the System Type drop‐down menu on its default setting: SAP.

6 Leave the Connection Type drop‐down menu on its default setting: Adaptive RFC.

7 From the JCO Destination drop‐down menu, select the connector (the JCo destination you created during installation) for the back‐end system you want to connect to.

8 In the Report Name field, enter the report name you intend to use for this connector.

9 If you intend to enable the Outbound Connection setting, enter the gateway connection in the SAP Gateway field.

10 If you are connecting to a Unicode system, enable the Unicode System checkbox.

11 Click Save.

12 Refresh your web browser window.

When you define a Master User Source, the JCo connectors you make do not appear in the drop‐down menu until you have refreshed the web browser.

You are now ready to define a Master User Source for this installation.

Note Perform Step 3 through Step 11 for each back-end system to which you configured a JCo destination.

79


Defining a Master User Source

Use the following procedure to define a Master User Source for your Virsa Compliance Calibrator installation. The Master User Source is the system you want the Virsa Compliance Calibrator to use for user ID, email address, and other account information used for audit reporting.

To Define a Master User Source

1 From the Virsa Compliance Calibrator Configuration tab, select Define Master User Source.

2 Click the Configured System option.

Using the User Management Engine as a Master User Source is not currently a supported configuration.

3 From the Select System drop‐down menu, select the connector for the system that Compliance Calibrator will use for user information.

4 Click Save.

80


The Status Bar indicates whether the connection was successful.

If you are installing your first version of Compliance Calibrator, the process is now complete. If you are upgrading from an earlier Compliance Calibrator version and you exported and converted your old rule set (as described in “Converting Data from a Previous Compliance Calibrator Version” on page 32), complete the remaining tasks that follow.

81


Uploading System Message Text

The text for Compliance Calibrator system messages is stored in a file called CC5.2_MESSAGES.TXT. This file is included at the root level of the unpacked Compliance Calibrator installation file archive.

As part of the installation process, you need to import the contents of this system message file to the Compliance Calibrator Rule Architect.

To import system message text into Rule Architect:

1 Under the Rule Architect tab, choose Utilities > Import Rules.

2 Next to the Local File: field, click Browse...

3 In the Choose File dialog, locate and select the CC5.2_MESSAGES.TXT file, then click Open; click Import.

The text import operation can take several minutes.

82

Starting and Stopping the Background Job DaemonChapter 3 Virsa Compliance Calibrator Setup

Starting and Stopping the Background Job Daemon

You now need to start the background job daemon before you can perform background tasks, such as Risk Analysis.

To start and stop the background job daemon, enter the following address into your web browser

http://<server_name>:<port>/virsa/CCBgStatus.jsp

where:

server_name is the Java application server name

port is 5<xx>00

xx is the Java engine instance ID

For example, if the Java engine instance ID were 19, the port assignment would be 51900.

Note Whenever you restart the Java engine, you need to restart the background job daemon.

83


Access Enforcer Integration

If you plan to use Access Enforcer workflows within Compliance Calibrator, the person installing Access Enforcer will need to import the following file, included in the root directory of the Compliance Calibrator installation files archive:

AE_init_append_data_CC.xml

For information about importing this XML file, see the Access Enforcer installation documentation.

If you are installing your first version of Compliance Calibrator, the installation is complete. You may now proceed to initial setup and configuration tasks described in the Configuration section of the Compliance Calibrator User and Configuration Guide.

If you are upgrading from an earlier Compliance Calibrator version and you exported and converted your old rule set (as described in “Converting Data from a Previous Compliance Calibrator Version” on page 32), continue to the next section, “Importing and Migrating Rules During an Upgrade”.

84

Importing and Migrating Rules During an UpgradeChapter 3 Virsa Compliance Calibrator Setup

Importing and Migrating Rules During an Upgrade

If you are upgrading from an earlier Compliance Calibrator version and you exported and converted your old rule set (as described in “Converting Data from a Previous Compliance Calibrator Version” on page 32), perform the following tasks to import rules from your converted rules data file, and to migrate the rules data into your new version of Compliance Calibrator.

To import rules from your converted rules data file:

1 From the Rule Architect tab, choose Utilities > Import Rules.

2 Click Browse...; locate the converted rules data file you created and click Open.

3 Click Import Rules.

A background job is automatically scheduled and run to import rules from the file you specified.

4 Verify that the rule import job completes successfully.

Once you have completed the rule import process, a new item, Data Conversion CC5.1->CC5.2, is added to the bottom of the navigation menu under the Configuration tab. (If you have migrated from an earlier version than Compliance Calibrator 5.1, that version is indicated instead of “CC5.1.”)

To migrate the rules data into your new Compliance Calibrator installation:

1 From the Configuration tab, choose Data Conversion CC5.1->CC5.2.

If you have migrated from an earlier version than Compliance Calibrator 5.1, that version is indicated instead of “CC5.1.”

A Confirmation dialog box appears.

2 Click Ok to proceed with the conversion.

Once the migration is complete, the Data Conversion CC5.1->CC5.2 item is removed from the Configuration tab navigation menu.

Your rules have now been converted and uploaded to your new Compliance Calibrator installation. If you had any critical action rules in your previous installation, you need to manually enter those rules using the Rule Architect. For information to enter critical action rules, see the Compliance Calibrator Users Guide.

Note Importing rules is performed as a background job process. Make sure the background job daemon is running before perform the following procedure.

85


86