SLD API Switching to secure storage, SAP security note 1161548

SAP security note 1161548, “SLD API: Switching to secure storage”. Below are the symptom and SAP recommended solution.

Description

Symptom

You use transaction SLDAPICUST to manage HTTP destinations for the System Landscape Directory (SLD) in Web AS ABAP. Passwords entered to log on to the SLD are encrypted and access-protected; however, they are stored outside of the secure storage.

Solution

By importing the specified Support Package, the storage of passwords in transaction SLDAPICUST is adjusted to use the secure storage in ABAP, which conforms to the SAP security standard.

After importing the Support Package, the passwords remain in their current storage. By executing the change operation in transaction SLDAPICUST, the passwords are automatically moved to the secure storage and deleted from the previous storage. It is sufficient to switch from display mode to change mode and back.

With the imported Support Package, storage in the secure storage becomes the standard setting. You can explicitly control the behavior by manually entering commands in the ‘OK code’ field in transaction SLDAPICUST:

• SECSTORE_OFF: Deactivates storage in the secure storage. Passwords are then saved in the old storage again.
• SECSTORE_ON: Activates storage in the secure storage and restores the standard behavior.

All content of the secure storage becomes illegible if the installation number is changed and must be migrated manually. For more information, see Note 816861.

In a newly installed system without a license (installation number "INITIAL"), the passwords of the SLD destinations are always stored outside the secure storage. Changing the installation number from "INITIAL" to a numerical value, required during licensing, does not require a migration of these passwords, as they are moved to secure storage only afterwards.

References

• SLD API: Error during connection test (Note 1244841)
• Migration of entries in secure storage (Note 816861)