SAP Multi-Bank Connectivity Connector

Configuration Guide SAP Multi-Bank Connectivity Date: 20-Aug-2020

CUSTOMER

SAP Multi-Bank Connectivity Connector Configuration Guide

2 CUSTOMER © 2020 SAP SE or an SAP affiliate company. All rights reserved.

SAP Multi-Bank Connectivity Connector Typographic Conventions

Typographic Conventions

Typ e Style Des cription

Example Words or characters quoted from the screen. These include field names, screen titles, pushbuttons labels, menu names, menu paths, and menu options.

Textual cross-references to other documents.

Example Emphasized words or expressions.

EXAMPLE Technical names of system objects. These include report names, program names, transaction codes, table names, and key concepts of a programming language when they are surrounded by body text, for example, SELECT and INCLUDE.

Example Output on the screen. This includes file and directory names and their paths, messages, names of variables and parameters, source text, and names of installation, upgrade and database tools.

Example Exact user entry. These are words or characters that you enter in the system exactly as they appear in the documentation.

<Example> Variable user entry. Angle brackets indicate that you replace these words and characters with appropriate entries to make entries in the system.

EXAMP LE Keys on the keyboard, for example, F2 or ENTER .

SAP Multi-Bank Connectivity Connector Document History

CUSTOMER © 2020 SAP SE or an SAP affiliate company. All rights reserved. 3

Document History

Version Status Date C hange

1.0 Released to Customer 21-Oct-2019 Initial Release of renamed document

1.1 Final 8-Jan-2020 Updates:

• Link to certificates added

• Screenshot removed

• Instructions for sending certificates to SAP

• Mandatory steps for Message Level Security (MLS)

1.2 Final 17-Jan-2020 New sections for Lockbox option

1.3 Final 20-Aug-2020 Updates:

• Feedback invitation added

• Connector Configuration installation instructions link

• Instruction to add S/4HANA client number to XI Configuration

• Associated integration server configuration added to XI Queue Retry Functionality

SAP Multi-Bank Connectivity Connector Contents


Contents

1 About This Document ........................................................................................................................................... 6 1.1 Purpose and Scope.................................................................................................................................................. 6 1.2 Target Audience....................................................................................................................................................... 6 1.3 Prereq uisites ............................................................................................................................................................ 6 1.4 Glossary .................................................................................................................................................................... 7

2 Introduction ............................................................................................................................................................ 8 2.1 About SAP Multi-Bank Connectivity ...................................................................................................................... 8 2.2 SAP Multi-Bank Connectivity Connector............................................................................................................... 8

3 STRUST Configuration for Transport Level Security .................................................................................... 9 3.1 SAP MBC Firewall Trusted Certificate Authorities ............................................................................................... 9 3.2 Send SSL Client Public Certificate to SAP MBC Team......................................................................................... 9

3.2.1 Export Certificates .................................................................................................................................. 9 3.2.2 Email Certificates to SAP ..................................................................................................................... 10

3.3 Configure SSL Client Standard PSE..................................................................................................................... 10

4 XI Configuration ................................................................................................................................................... 11 4.1 Activate XI Engine Using Transaction SIC F.......................................................................................................... 11 4.2 Define Logical System in Table LCRT_CLNTCACHE.......................................................................................... 12 4.3 Integration Engine Configuration in SXMB_ADM ............................................................................................... 12 4.4 Activate Queues for XI Message Processing....................................................................................................... 13 4.5 Configuring Interface-specific XI Engine ............................................................................................................. 14

4.5.1 Create Sender/Receiver ...................................................................................................................... 14 4.5.2 Create RFC ..............................................................................................................................................15 4.5.3 Specify Interface-Specific Integration Server URL ............................................................................ 16 4.5.4 Specify the Associated Integration Server ..........................................................................................17

4.6 XI Queue Retry ........................................................................................................................................................17 4.6.1 Setup MBC XI Queue Retry .................................................................................................................. 18

5 Configure Message Level Security ..................................................................................................................24 5.1 Set Up MLS Key Store SSF BSNAGT PSE ...........................................................................................................24

5.1.1 Email Certificates to SAP .....................................................................................................................24 5.2 Install SAP MBC MLS Certificate in SSF BSNAGT PSE ...................................................................................... 25 5.3 Configure SSFA Parameters .................................................................................................................................26 5.4 Maintaining Application-dependent Parameters for Secure Store and Forward (SSF) ................................. 27 5.5 Maintaining Secure Store and Forward (SSF) Profile Data ............................................................................... 27

6 Configuring SAP MBC Connector ................................................................................................................... 30 6.1 Defining Number Ranges for Message IDs..........................................................................................................30 6.2 Maintaining Sender ID for Payment Medium Workbench.................................................................................. 31 6.3 Configuring SWIFT Parameters............................................................................................................................ 31 6.4 Creating Bank Statement Import Format Variant ..............................................................................................32 6.5 Maintaining Selection Variants for Bank Statements ........................................................................................33 6.6 Lockbox Bank Statements Option .......................................................................................................................34

6.6.1 Creating Lockbox Import Variant ........................................................................................................34 6.6.2 Maintaining Selection Variants for Lockbox .......................................................................................34

6.7 Maintaining Custom Sender IDs (Optional) ........................................................................................................ 35

SAP Multi-Bank Connectivity Connector Contents


7 Preparing Outbound Payment .......................................................................................................................... 37 7.1 PMW and Files ........................................................................................................................................................ 37

7.1.1 Configuring Payment Medium Formats (PMW)................................................................................. 37 7.1.2 Configuring File Pick-up Report (Optional).........................................................................................38

8 Pulling Messages by Scheduled Background Jobs ..................................................................................... 40 8.1 Procedure ...............................................................................................................................................................40

9 Issues During Onboarding to MBC ..................................................................................................................42 9.1 How do I obtain a signed SSL Client Certificate?................................................................................................42 9.2 I cannot verify the connectivity on an MBC RFC destination in SM59 ..............................................................42 9.3 I receive a “No Concatenated Concept Exists” error when I send (payment run) or receive (Pull MBC

Message) data........................................................................................................................................................43 9.4 I receive data, but the system cannot decrypt the data.....................................................................................43

10 Important Disclaimers and Legal Information ..............................................................................................44

SAP Multi-Bank Connectivity Connector About This Document


1 About This Document

1.1 Purpose and Scope

This document describes necessary configuration tasks performed by MBC customers or their consulting partners to manually set up communication between the customer’s ERP system and the SAP Multi-Bank Connectivity tenant.

Configuration is a prerequisite to start technical onboarding.

1.2 Target Audience

Customer’s:

• Implementation and integration teams

• System Administrators

• Information Security Officers

1.3 Prerequisites

• SAP Multi-Bank Connectivity Connector Installation

SAP Multi-Bank Connectivity Connector installation is a prerequisite. See How to install BSNAGT 200.

Confirm with your SAP Multi-Bank Connectivity Customer Success Manager (CSM) the latest support package applicable for the ERP system and version in scope.

• Review the SAP Multi-Bank Connectivity Bank Preboarding Guide which contains information relevant for Corporates

• Request Tenant URL

Request the SAP Multi-Bank Connectivity Tenant URLs + Certificate packs from your SAP onboarding team representative.

Related Information

• SAP Help

• SAP Multi-Bank Connectivity Help page

Feedback Welcome

The SAP MBC Team welcome feedback to improve this document.

Please email [email protected]

https://launchpad.support.sap.com/#/notes/1781614

https://help.sap.com/viewer/product/BANKING%20SERVICES%20NETWORK/Latest/en-US

https://help.sap.com/viewer/index

https://help.sap.com/viewer/product/BANKING%20SERVICES%20NETWORK/Latest/en-US

mailto:[email protected]

SAP Multi-Bank Connectivity Connector About This Document


1.4 Glossary

Term Ab b reviation Def inition

SAP Multi-Bank Connectivity MBC Opens the corporate-to-bank relationship with a secure business network

SAP ERP Enterprise Resource Planning

ERP integrates all the core processes needed to run a company: finance, HR, manufacturing, supply chain, services, procurement, and others, into a single system.

Transport Level Security TLS The security protocol designed to facilitate privacy and security for communications between ERP and MBC Cloud. TLS is mandatory within MBC. All channels in the E2E scenario of MBC are secured by TLS.

Message Level Security MLS MLS relates to the activity of signing and encrypting data which is transmitted within the TLS secured channel / protocol between ERP and MBC. All channels in the E2E scenario of MBC are secured by MLS.

Personal Security Environment PSE PSE is analogous to “key store”. It is the container of key / certificate material in the SAP ERP.

Payment Medium Workbench PMW The Payment Medium Workbench (PMW) is a tool used to configure and create payment media sent by organizations to their house banks.

Tenant A tenant is the term for the dedicated portion of MBC which is reserved for the customer. Upon the tenant, which runs on SAP Cloud Platform the necessary cloud integration content is deployed to allow the customer to integrate with your financial institutions.

https://www.sap.com/products/multi-bank-connectivity.html

https://www.sap.com/products/what-is-erp.html

SAP Multi-Bank Connectivity Connector Introduction


2 Introduction

2.1 About SAP Multi-Bank Connectivity

SAP Multi-Bank Connectivity is an innovative solution that connects Corporate Customers with their banks and other financial institutions with their Corporate Customers on a secure network managed by SAP. When interacting with SAP Multi-Bank Connectivity, Corporate Customers send payment instructions via an API. Banks in turn send transaction status information and account reports back to the Corporate customer.

SAP Multi-Bank Connectivity combines SAP expertise in applications, automation, analytics, and in-memory computing to provide a standard, on-demand innovative technology for financial institutions and their corporate customers on a platform that accommodates future integration needs.

Related Documentation

• SAP Multi-Bank Connectivity Product Page

• SAP Multi-Bank Connectivity Help

2.2 SAP Multi-Bank Connectivity Connector

A corporate connects to SAP Multi-Bank Connectivity using the Connector for the SAP Multi-Bank Connectivity (Multi-Bank Connectivity connector).

The Multi-Bank Connectivity connector is an add-on available for releases of SAP ERP 6.0 EHP 0 and higher. Within SAP S/4HANA this add-on is already available, and can be used when a customer subscribes to SAP Multi-Bank Connectivity and undertakes the necessary configuration steps described in this guide.

The Multi-Bank Connectivity connector is integrated with multiple components within an SAP ERP or S/4HANA. This includes AP/AR, TRM and FI-CA.

Following a payment run or an approval step within SAP Bank Communication Management, corporates can send payment files automatically to financial institutions through SAP Multi-Bank Connectivity. Corporates then receive payment status reports and financial service provider statements through SAP Multi-Bank Connectivity. The SAP ERP or S/4HANA system processes these messages automatically.

A corporate can communicate with multiple financial service providers using a single instance of the Multi-Bank Connectivity connector, provided that the corporate has performed the required service activation with the respective financial service provider during onboarding to SAP Multi-Bank Connectivity. This can be achieved by a direct (Host-2-Host or EBICS) integration with the bank or via embedded SWIFT connectivity which requires a contract with SWIFT.

The Multi-Bank Connectivity connector also provides a programming interface that enables corporates to enhance their ERP system to send and receive other message types from different business processes.

https://www.sap.com/uk/products/multi-bank-connectivity.html

https://help.sap.com/viewer/p/BANKING%20SERVICES%20NETWORK

SAP Multi-Bank Connectivity Connector STRUST Configuration for Transport Level Security


3 STRUST Configuration for Transport Level Security

This section describes configuration required to establish the “SSL Client Standard” PSE on your ERP. This PSE / key store in ERP stores necessary certificates for Transport Level Security between the ERP system and MBC.

In the case of S/4HANA Public Cloud systems, the SAP team performs this configuration.

In other cases, such as ECC On-Premise, S/4HANA Private Cloud, SAP HEC, this configuration is undertaken by the customer or integration partner.

3.1 SAP MBC Firewall Trusted Certificate Authorities

SAP MBC uses a firewall that limits access to the MBC network to clients who present SSL Certificates that are signed by an SAP-trusted Certificate Authority.

Ensure that your SSL Client Standard *Own Certificate* is signed by a Trusted Authority in the SAP Multi-Bank Connectivity Firewall. See Secure Connection and SAP Trusted Certificate Authorities.

3.2 Send SSL Client Public Certificate to SAP MBC Team

To exchange messages with MBC, during onboarding each organization must provide a certificate that is signed by an SAP Trusted CA to the SAP onboarding team. If your organization does not have a certificate signed by an SAP Trusted CA, see SAP MBC Secure Connection.

The SAP team install the certificate on your MBC tenant, to allow for authorization of the connection.

You must:

• Export Certificates

• Email the certificates to SAP MBC Onboarding team

3.2.1 Export Certificates

Log on to your SAP ERP system.

Use transaction:

SAP Menu N/A

Transaction Code STRUST

Navigate to the PSE for SSL Client Standard and double click the PSE.

To edit, choose Ctrl + F1. Double click the Subject of the Own Certificate to display the Certificate. Choose Export certificate.

https://wiki.scn.sap.com/wiki/display/SAPFS/Secure+Connection

https://wiki.scn.sap.com/wiki/display/SAPFS/Trusted+Certificate+Authorities

https://wiki.scn.sap.com/wiki/display/SAPFS/Secure+Connection

SAP Multi-Bank Connectivity Connector STRUST Configuration for Transport Level Security


3.2.2 Email Certificates to SAP

Email the public certificates to the SAP MBC Onboarding Team.

State whether the certificate is for your Test or Production MBC tenant.

Because of your organization’s email security settings, you may need to change the file extension, for example to .txt or .zip.

3.3 Configure SSL Client Standard PSE

You must import the root CA and intermediate certificate of the SAP Multi-Bank Connectivity Load Balancers to your Test and Production landscapes.

1. Download the root CA and intermediate certificate zip file from the SAP Multi-Bank Connectivity Wiki. 2. Extract the certificates from the zip file to local system. 3. Use transaction STRUST and navigate to the PSE for SSL Client Standard. To open it, double click the PSE. 4. Select Edit or Ctrl + F1. 5. Select Import certificate 6. In the Import Certificate popup, enter or select the path to the certificates, and press Enter. 7. The certificate is in the Certificate area. 8. To add the certificate to the Certificate List of the SSL server Standard PSE, select Add to Certificate List. 9. Save. 10. Repeat steps 5-9 until you have installed all SAP Certificates.

Note: This is necessary on all your systems that integrate with MBC, such as, Development, Test, Staging, Production.

https://wiki.scn.sap.com/wiki/display/SAPFS/SAP+Multi-Bank+Connectivity+Load+Balancers+-+Root+CA

SAP Multi-Bank Connectivity Connector XI Configuration


4 XI Configuration

This section describes necessary configuration of the XI engine to support data transmission and receipt through MBC. You must:

• Set up relevant XI nodes

• Activate XI queues

• Configure the MBC interface and corresponding RFC destinations

4.1 Activate XI Engine Using Transaction SICF

This section describes necessary activation of nodes in SICF for XI engine operation. Some nodes may already be activated. To begin, ensure that SICF node path /sap/xi/engine is activated.

Use one of the following:

Transaction code SICF

SAP Menu Architecture and Technology → System Administration → Administration → Network → HTTP Service Hierarchy Maintenance

Choose Execute (F8).

Check that the following services are activated.

If the services are not activated, right-click the service and choose Activate service.

List of services:

/sap/bc/bsp/sap/alertinbox /sap/bc/bsp/sap/sxms_alertrules /sap/bc/webdynpro/sap/appl_bckgnd_moni_jobs /sap/bc/webdynpro/sap/appl_log_trc_viewer /sap/bc/webdynpro/sap/c_srt_seq_mon /sap/public/bc/pictograms /sap/public/bc/webicons /sap/xi/adapter_plain /sap/xi/cache /sap/xi/cache_gui /sap/xi/cache_gui_ssl /sap/xi/cache_ssl /sap/xi/engine /sap/xi/simulation



4.2 Define Logical System in Table LCRT_CLNTCACHE

To define the logical system in table LCRT_CLNTCACHE, use transaction SE16. Cross client customizing must be authorized.

Use one of the following to start:

Transaction code SE16

Table Name LCRT_CLNTCACHE

SRFTD = <SID><Client> AEDAT = <current date> BS KEY Name = <SID>_<Client> BS Role = LOC BS Caption = <SID>_<Client>

4.3 Integration Engine Configuration in SXMB_ADM

In this section, we begin the configuration of the XI engine. It is important that the role of the business system is set to “Application System”.

Use:

Transaction code SXMB_ADM

Choose Integration Engine Configuration

Choose Edit from Top-Menu, and then Change Selected Configuration Data

Set Role of Business System = Application System



4.4 Activate Queues for XI Message Processing

In order for the system to process MBC messages using the XI Engine, activate and register relevant queues.

Use:


Choose Manage Queues

Ensure that all queues in the “Manage Queues” screen are selected.

Select Register Queues



4.5 Configuring Interface-specific XI Engine

MBC uses three interfaces for transmission of payment instructions to MBC, and receipt of status and statement data.

4.5.1 Create Sender/Receiver

You must create the following:

• FSN Payment

• This interface is responsible for the sending payment instructions from MBC Connector to MBC.

• FSN Connector Pull

• This interface is responsible for the polling MBC to retrieve status and statement data.

• FSN Connector Acknowledgement

• This interface is responsible for clearing data (duplicate removal) from MBC, which has already been received successfully by the MBC Connector.

Use:

Transaction code SXMSIF

Choose Edit then New Entries, and create the three interfaces.

MBC Payment

Sender/ReceiverID FSN_PAYMENT

Description FSN Payment

Component *

Interface Name FSNInterface_Out

Interface Namespace http://sapcd.com/fsnagt

MBC Connector Pull

Sender/ReceiverID FSN_PULL

Description FSN Connector Pull

Component *

Interface Name FSNInterfaceSync_Out


MBC Connector Acknowledgement

Sender/ReceiverID FSN_ACK

Description FSN Connector Acknowledgement

Component *

Interface Name FSNInterface_Pull_Receipt_Out


http://sapcd.com/fsnagt





4.5.2 Create RFC

During onboarding to MBC, the MBC Onboarding team provides three URLs to connect to the MBC service. To add the URLs, each in a separate RFC profile, use SM59,.

Use one of the following to start:

Transaction code SM59

SAP Menu Architecture and Technology → System Administration → Administration → Network → RFC Destinations

RFC Connection for FSN_Payment RFC Destination: FSN_CORP_PAYMENTS-<CLIENT>

Typ e: G

Target Host: <Corporate MBC Tenant host>

Path Prefix: /cxf/fsn/corp/payments_<SIDCLNT>

Service No: 443

Prox y: None, use existing global configuration

Select Logon & Security/Security Options tab

Status of Secure Protocol: SSL Active

SSL Certificate: DFAULT (SSL Client Standard)

Perform a connection test. If you get a CONNECTION REFUSED error, check and adjust network settings, for example, whitelist IP addresses or ranges. HTTP 500 is the expected result.

RFC Connection for FSN_Pull RFC Destination: FSN_CORP_PULL-<CLIENT>

Typ e: G


Path Prefix: /cxf/fsn/corp/statements/pull_<SIDCLNT>

Service No: 443

Proxy, None, use existing global configuration

Logon & Security/Security Options




RFC Connection for FSN_ACK RFC Destination: FSN_CORP_ACK-<CLIENT>

Typ e: G




Path Prefix: /cxf/fsn/corp/statements/ack_<SIDCLNT>

Service No: 443

Proxy None, use existing global configuration

Logon & Security/Security Options




4.5.3 Specify Interface-Specific Integration Server URL

This section synchronizes the RFC destinations created in SM59, see section 4.5.2, to XI Engine configuration.

You must set up an Interface-Specific Integration Server URL for each sender and receiver.

Use:


Choose Manage Queues Choose on Integration Engine Configuration

Choose Configuration

Choose EDIT - New Entries

For FSN_PAYMENT, enter: Category: RUNTIME

Parameters: IS_URL

Subparameter: FSN_PAYMENT

Current Value: dest://FSN_CORP_PAYMENTS-<CLIENT>

For FSN_PULL, enter: Category: RUNTIME

Parameters: IS_URL

Subparameter: FSN_PULL

Current Value: dest://FSN_CORP_PULL-<CLIENT> Insert S/4HANA client number.

For FSN_ACK, enter: Category: RUNTIME

Parameters: IS_URL

Subparameter: FSN_ACK

Current Value: dest://FSN_CORP_ACK-<CLIENT>



4.5.4 Specify the Associated Integration Server

An “Associated Integration Server” is required as part of MBC configuration in XI.

Unless a dedicated Integration Server is available in the landscape, the recommendation is to set the Associated Integration Server as MBC – specifically, the endpoint URL used to process payments.

This section assumes that no alternative or dedicated integration server is available in your system landscape. Consult the administrators of your landscape.

Use:


Choose Integration Engine Configuration Place the active cursor / click inside the field denoted “Associated Integration Server”.

Choose More Edit Change Selected Configuration Data”(the “Associated Integration Server” field becomes editable).

Paste in the value configured in the previous step for “FSN Payment” in the format:

dest://FSN_CORP_PAYMENTS-<CLIENT>

4.6 XI Queue Retry

XI Queues in an ERP are shared between all applications.

If an XML message or an XI queue fails in delivery (usually caused by a HTTP error), it blocks further messages in the queue.

MBC needs separate queues for its XML messages. XI needs to retry messages that fail in these separate MBC queues in an orderly manner, while the error is fixed.



4.6.1 Setup MBC XI Queue Retry

This section describes how to create separate MBC queues in XI, configure how queues retry and fail messages to prevent queue blocking.

Use:


Choose Configuration.

Configure MBC Specific XI Queues to prevent non-MBC messages from blocking MBC messages.

Enable Automatic retry of a queue (SYSFAIL), stop blocking next payments in MBC queues.

Note: Retry is every two minutes. If you set IS_RETRY_LIMIT to 10, this causes a message retry for 20 minutes before the message goes to FAIL state, and drops from the XI queue.



1. Define job to reprocess FAILED messages produced in Step 1, with a schedule that covers all FAILED messages. Use:

Transaction code SE38

Enter program/report name RSXMB_RESTART_MESSAGES in program field

Choose Variants

Choose Create Variant

Enter Variant name, for example RESTART_FSN_1

Choose Create



a. Set the Variant settings

.

b. Save the Variant (RESTART_FSN_1)



2. Schedule RSXMB_RESTART_MESSAGES variant RESTART_FSN_1 to reprocess ALL FAILED messages that have dropped from XI queues as defined in Step 1.

Use:

Transaction code SM36

a. Define Start conditions

i. Choose Date/Time

ii. Choose Period values

iii. Choose Other Period

iv. Choose and Set Minutes

Note: Set frequency to less than the value you entered for variant settings in Step 2. Restart messages with errors from last nnn mins, for example, if variant settings is set to 30, then set Minutes to 25.

v. Check and Save

vi. Specify a Start Time for the Scheduled Task, for example, today and now



vii. Save

b. Define Step(s) to be executed (RSXMB_RESTART_MESSAGES (variant RESTART_FSN_1).

i. Choose Step

ii. Set Name to RSXMB_RESTART_MESSAGES, if not already set

iii. Set Variant to RESTART_FSN_1 through lookup

iv. Save. Job Status changes to Scheduled.

v. Check that scheduled job is running successfully

Choose Own Jobs



View Status of previously executed Scheduled tasks to ensure your task is running.

SAP Multi-Bank Connectivity Connector Configure Message Level Security


5 Configure Message Level Security

In conjunction with Transport Level Security, MBC also uses Message Level Security (MLS), for:

• Sending Data: Data is signed and encrypted by the MBC Connector

• Receiving Data: Data is decrypted and verified by the MBC Connector

This section describes necessary steps to configure the key store for MLS keys, including keys owned by the customer system where the customer is the owner and custodian of the corresponding private key, and keys shared by MBC.

This section also describes setting up the algorithms and parameters in conjunction with the key material for integration to MBC.

5.1 Set Up MLS Key Store SSF BSNAGT PSE

This section describes configuration of SSF BSNAGT PSE which is the key store in STRUST that hosts the customer private key for MLS, and the shared SAP MBC public key.

1. Use:

SAP Menu N/A

Transaction Code STRUST

2. To open the context menu of SSF BSNAGT, select SSF BSNAGT and choose Create

3. Change the Algorithm to RSA with SHA-256

4. Set Key Length = 2048

5. Save

6. Navigate to the PSE for SSF BSNAGT and open by double clicking the PSE

7. To edit, choose Ctrl + F1. 8. Double click the Subject of the Own Certificate to display the Certificate

9. Choose Export certificate

10. Send the BSNAGT certificate to your CSM in the MBC Onboarding team.

Note: This step is necessary on any system that integrates to MBC.

Each MBC customer receives two MBC tenants, a TEST tenant and a PROD tenant.

Your DEV and QA ERP integrate to the MBC TEST tenant.

Your Production ERP connects to the MBC PROD tenant.

Therefore, this you must perform this step for each ERP you wish to integrate to MBC.

5.1.1 Email Certificates to SAP

Email the public certificates to the SAP MBC Onboarding Team.



State whether the certificate is for your Test or Production MBC tenant.

Because of your organization’s email security settings, you may need to change the file extension, for example to .txt or .zip.

5.2 Install SAP MBC MLS Certificate in SSF BSNAGT PSE

This section describes how to install the SAP MBC MLS certificates provided by the SAP MBC Onboarding Team to SSF BSNAGT PSE.

1. The SAP team emails the certificates to you. You must upload the certificates to STRUST.

2. To add the certificate to the Certificate List of the SSF BSNAGT PSE, choose Import Certificate, choose the file, and upload.

3. Choose Add to Certificate List

4. Save

5. Select the imported certificate and copy the Subject to a temporary text-file. This information is required to configure SSFA Parameters for Message Level Security, see section 5.5.

6. Use transaction SMICM, and restart ICM (Administration ICM EXIT SOFT GLOBAL).

Note: This step must necessary on any system that integrates to MBC.

Each MBC customer receives two MBC tenants, a TEST tenant and a PROD tenant.

Your DEV and QA ERP integrate to the MBC TEST tenant.

Your Production ERP connects to the MBC PROD tenant.

Therefore, you must perform this step for each ERP you wish to integrate to MBC.



5.3 Configure SSFA Parameters

This section describes how to set the “Secure Store and Forward” parameters for integration with MBC using the SHA256 hashing algorithm, and the AES128-CBC encryption algorithm.

Use:

SAP Menu N/A

Transaction Code SSFA

1. On the Change View “Application-Specific SSF Parameters”: Overview screen, choose New Entries. 2. On the New Entries: Details of Added Entries screen, in the SSF Application field enter BSNAGT and

choose Enter

3. On the New Entries: Details of Added Entries screen, in the SSF Profile ID (opt) field enter CN=<SID> SSF BSNAGT, OU=<Installation Number>, OU=SAP Web AS, O=SAP Trust Community, C=DE

4. HASH Algorithm = SHA256 5. Encryption Algorithm = AES128-CBC 6. Check Include Certificates 7. Check Digital Signature with Data 8. Save.



5.4 Maintaining Application-dependent Parameters for Secure Store and Forward (SSF)

Applications that use the Secure Store and Forward (SSF) functions (digital signatures and digital envelopes) do not all need to use the same security environment for applying SSF functions. For example, different applications can use different security products. This section describes how to specify application-dependent parameters for using SSF. 1. Use:

Transaction code SSFA

2. On Change View "Application-Specific SSF Parameters": Overview, choose New Entries:

Field name Description User action and values Comment SSF Application

BSNAGT Choose from the drop-down list.

3. Save. 4. On Application-Specific SSF Parameters section, maintain the parameters if you need or keep default

setting. 5. Save.

5.5 Maintaining Secure Store and Forward (SSF) Profile Data

This section describes how to enter secure store and forward (SSF) profile data. 1. Use:

Transaction code SPRO

IMG menu Multi-Bank Connectivity Connector → Maintain Secure Store and Forward (SSF) Profile Data

2. On Change View Maintain Secure Store and Forward (SSF) Profile Data screen, choose New Entries:

Field name Description User action and values

Comment

Message Type Input the message type used for SAP Multi-Bank Connectivity (Optional)

If you leave this field blank, all message types are transferred to SAP Multi-Bank Connectivity. Most customers leave the “Message Type” field blank.




Comment

SenderID/ ReceiverID

The previously defined Sender ID(Optional)

Most customers leave the “Message Type” field blank.

Appl. SSF Application BSNAGT

Signatory/

Recipient Name

SSF Name for Signatory/Recipient

Mandatory – Copy this string exactly (copy from STRUST) from the “Subject” field of the public certificate provided by SAP MBC team which is stored in SSF BSNAGT PSE. Note: This is the certificate installed in section 5.2.

For example: "CN=System12345, OU=Consulting, O=SAP, C=DE" are typical X.509 names.

Sign Sign Flag for Secure Store and Forward (SSF)

Mandatory – Field must be selected.

If not selected, the system does not digitally sign messages. Field Signatory/ Recipient Name must be filled as a prerequisite.

Encrypt Encrypt Flag for Secure Store and Forward (SSF)


If not selected, the system does not encrypt message content. Field Signatory/ Recipient Name must be filled as prerequisite.




Comment

Decrypt Decrypt Flag for Secure Store and Forward (SSF)


If not selected, the system does not decrypt message content. Field Signatory/ Recipient Name has to be filled as prerequisite.

Verify Verify Flag for Secure Store and Forward (SSF)


If not selected, the system does not verify message content. Field Signatory/ Recipient Name has to be filled as prerequisite.

3. Save. 4. Confirm the dialog box and Save your entries.

Result: The Secure store and forward (SSF) profile data is defined.

Message Type and SenderID/ReceiverID are optional. If you do not specify a Message Type, the settings you enter apply to all message types. Therefore, you can configure default settings for all messages, and override those settings for a specific message type. Similarly, if you do not enter a SenderID/ReceiverID, the settings you enter apply to all senders and receivers. For message types, you can configure default settings for all senders and receivers, and override those settings for a specific sender or receiver. If you choose one or more of the security options, you must also enter the Signatory/Recipient Name. If you select none of the security options, it is not necessary to enter the Signatory/Recipient Name.

SAP Multi-Bank Connectivity Connector Configuring SAP MBC Connector


6 Configuring SAP MBC Connector

All steps are mandatory except steps to set up the Lockbox option.

If your organization connects to MBC through SWIFT, then you must configure SWIFT parameters.

6.1 Defining Number Ranges for Message IDs

You define the number range for Message IDs. The system uses a number range to generate a unique message ID when a message ID is not provided to the system during message creation.

An example is data transmitted through MBC that is not generated in PMW, but generated using the Create MBC Message report.

1. Use:

Transaction code SPRO

IMG menu Multi-Bank Connectivity Connector → Maintain Number Range for Message ID

2. On the Range Maintenance: NR for file screen, choose Display intervals to check whether an internal number range is defined. If necessary, choose Change intervals and Insert Line(F6) to define a new number range or choose Change intervals to change existing entries:


No Number range number

N2

From No. 0000000001

To Number 9999999999

Ext External number range flag

Uncheck

3. Save. 4. Confirm the dialog box and Save.



6.2 Maintaining Sender ID for Payment Medium Workbench

MBC uses an MBC Message Envelope for routing data within MBC. The message envelope includes a SenderID (identifying the house bank of the sending or customer system) and the ReceiverID of the recipient or bank. For payments using the Payment Medium Workbench, the corporate customer identification (SenderID) is taken from the “Customer Number” field from the House Bank settings. For each house bank, you must enter a valid customer number. 1. Use:

Transaction code FBZP IMG menu Financial Accounting (New) → Bank Accounting → Bank

Accounts → Define House Banks 2. Choose House Banks. 3. In the Company Code field, enter your company code.

Perform the following steps for each company code if you have multiple company codes.

4. Choose Continue (Enter). 5. Choose your house bank for the specified company code. 6. Choose Details. 7. Expand Data medium exchange. 8. On Data Medium Exchange section:

Field name Description User action and values Comment Customer number

Example: CUSTOMERID123 This is an example. Enter your house bank customer identification.

9. Save.

6.3 Configuring SWIFT Parameters

This section is only relevant for customers who connect to financial institutions on the SWIFT Network.

1. Use

Transaction code SPRO IMG menu Multi-Bank Connectivity Connector → Maintain Swift

Parameters 2. On the View "Maintain Swift Parameters" Overview screen, choose New Entries:

Field name

Description User action and values Comment

Receiver ID

Specifies the ID of the recipient of the message.

Input the receiver of the message (typically the bank identifier code (BIC)).

Message Type

Indicates the message type as specified in the message.

Input the message type used for communication to MBC

For example:

PAIN.001.001.03



Field name

Description User action and values Comment

Parameter Name

Parameter for SWIFT communication

Select one of the parameter names of the value help

For example: Service

Parameter Value

Value of a parameter used for SWIFT communication

Enter the value used in MBC to generate the SWIFT envelope

For example: swift.fin

3. Save. 4. Confirm the dialog box and Save. • Result SWIFT parameters are configured and sent to MBC with every message. MBC generates the corresponding SWIFT envelope.

6.4 Creating Bank Statement Import Format Variant

MBC Connector allows for automated consumption of Bank Statements using the FF_5 / Bank Statement Upload Utility. This section is relevant for customers who wish to automatically consume MT940 / MT942 / CAMT based bank statements received.

To create the import variant and configure the import format for bank statement:

1. Use:

Transaction code FF_5 2. On View Bank Statement: Various Formats (SWIFT, MultiCash, BAI...) screen:

Only perform step 2 for message type “MT940”. Only perform step 3 for message type “MT942”. Only perform step 4 for message type “CAMT.053”.

Field name Description User action and values Comment

Elect. bank statement format

”SWIFT MT940 - Field 86: Structure Recognized Automatically”

3. If you choose message type for “MT942”, then On View Bank Statement: Various Formats (SWIFT, MultiCash, BAI...) screen:



”SWIFT MT940 - Field 86: Structure Recognized Automatically”

Account Balance Checked



4. If you choose message type for “CAMT.053.001.02”, then On View Bank Statement: Various Formats (SWIFT, MultiCash, BAI...) screen:



X XML or Bank-Specific Format

XML or Bank Specific Format

CAMT.053.001.02

Import data Checked

5. Choose Save. 6. On View “Variant Attributes”


Variant Name Name the Variant according to the message type you choose. Example: MT940

Description Enter description.

7. Save.

6.5 Maintaining Selection Variants for Bank Statements

This steps in this section continue from steps performed in section 6.4. You set up the Bank Statement variant created for a given message type. You maintain the Variant for a SenderID/ReceiverID and Message Type. The system processes incoming messages according to the message type specified in the Web service interface. For MT940 (bank statement), MX camt.053 and MT942 (account report), or MX camt.052, the report RFEBKA00 (transaction FF.5) is executed with the relevant variant, as configured in this customizing activity.

• Prerequisites

You saved the variant in transaction FF_5.

1. Use: Transaction code SPRO IMG menu Multi-Bank Connectivity Connector → Maintain Selection

Variants for Bank Statements 2. On the Change View "Maintain Bank Statement Selection Variants": Overview screen, choose New

Entries:



Field name Description User action and values Comment Sender ID Input the bank identifier code

(BIC).

Message Type Input the message type used for SAP Multi-Bank Connectivity

Message Type for Bank Statement

Variant Name of variant (without program name)

Variant defined in section 6.4


6.6 Lockbox Bank Statements Option

MBC customers have the option to receive and process Lockbox bank statements through MBC. This section is only relevant for customers who choose the option to receive and process Lockbox bank statements through MBC.

6.6.1 Creating Lockbox Import Variant

To create the import variant and configure the import format for bank statements:

1. Use:

Transaction code FLB2 2. Open variant SAP&FSN_BAI which is a standard example for import of Lockbox messages through the

MBC Connector. If necessary, adjust the standard variant settings and save as a new variant.

6.6.2 Maintaining Selection Variants for Lockbox

You maintain the Variant for a SenderID/ReceiverID and Message Type. The system processes incoming messages according to the message type specified in the Web service interface. For Lockbox messages, for example BAI or BAI2, the RFEBLB00 report (transaction FLB2) runs with the relevant variant, based on the following steps. • Prerequisites

You saved the variant in transaction FLB2. See section 6.6.



1. Use: Transaction code SPRO IMG menu Multi-Bank Connectivity Connector → Maintain Selection

Variants for Bank Statements 2. On the Change View "Maintain Bank Statement Selection Variants" Overview screen, choose New

Entries. Field name Description User action and values Comment Sender ID Input the bank identifier code

(BIC).

Message Type

Enter the message type used for MBC

Message Type for Lockbox, for example, BAI_LOCKBOX or BAI2_LOCKBOX

Variant Name of variant without program name

The Variant name you defined in section 6.6.

3. Save. 4. Confirm the dialog box to save.

6.7 Maintaining Custom Sender IDs (Optional)

You can define a custom Sender ID for a Message Type and/or Receiver ID. For example, you can define different Sender IDs for communicating with different banks. These custom Sender IDs are used by the MBC Connector when a message is created. For payment messages created using Payment Medium Workbench, the system uses the Customer Number maintained at House Bank level as the Sender ID. Corresponding Custom Sender ID entries are ignored. However, the system uses the Custom Sender ID you maintain in this customizing step as a fallback. It is used if the Customer Number has not been maintained at House Bank level. You can leave the Message Type and/or Receiver ID blank. The system treats such entries as relevant for all Message Types and/or Receiver IDs. In the event of multiple valid entries, the system uses the Sender ID you specify. This method is based on the “SWIFT code”, available as part of the house bank address control data. For the MBC Connector, the SWIFT code represents the “Receiver ID”: House bank Swift Code = SAP Multi-Bank Connectivity Connector Receiver ID.

1. Use:

Transaction code SPRO IMG menu Multi-Bank Connectivity Connector → Maintain Custom Sender IDs

2. On Change View "Maintenance of Sender IDs": Overview screen, choose New Entries:



Field name User action and values Comment Message Type The previously used

Message Type

Receiver ID For outbound messages, this is the bank identifier code (BIC) of the bank. For inbound messages, this is the corporate identifier agreed with the bank.

Sender ID For outbound messages, this is the corporate identifier agreed with the bank. For inbound messages, this is the bank identifier code (BIC).


SAP Multi-Bank Connectivity Connector Preparing Outbound Payment


7 Preparing Outbound Payment

This section describes configuration of Outbound Payments using Payment Medium Workbench (PMW) as the default payment engine.

The File Pick-up Report in the MBC Connector facilitates automated and regular transmission of data to MBC, that has not been generated from PMW.

7.1 PMW and Files

The following are used in financial integration in the SAP ERP: 1) PMW/DMEE: an SAP ERP tool that provides transformation and enrichment. 2) Files: SAP ERP Financials provides built in programs to produce and read files. Corporates are not required to migrate, decommission or change the way they currently use these tools. The following steps describe how to enable the integration technologies into your SAP ERP system.

Note Only perform the steps that apply to your choice, for example, if you choose PMW, only perform the steps labelled PMW.

7.1.1 Configuring Payment Medium Formats (PMW)

To maintain payment medium formats and assign payment medium type SAP Multi-Bank Connectivity Connector to the relevant formats:

1. Use:

Transaction code OBPM1 2. Locate the format to be redirected to SAP Multi-Bank Connectivity from Payment Medium Formats

list.

If you follow the manual steps for SAP NOTE 1665873 strictly, the format name is CGI_XML_CT. If you changed the format name when implementing the Note, select the changed name.

3. Choose Details. 4. On Change View "Payment Medium Formats": Details screen.

Field name Description User action and values Comment Payment medium without docs

Checked

https://launchpad.support.sap.com/#/notes/1665873



Field name Description User action and values Comment Type Choose SAP Multi-Bank

Connectivity Connector For field Payment medium without docs

Country Select your country code External format description

Enter the external format, for example, PAIN.001.001.03

Documentation module FPM_DOCU_CGI_XML_CT Struct. for format parameters

FPM_CGI

Mapping using DME engine

Checked

Company code Checked

House bank Checked 5. Choose Customer settings for Format. 6. In the Dialog Structure, double-click Event Modules. 7. On Display View "Event Modules": Overview screen, check that the function module

/BSNAGT/FI_PAYMEDIUM_DMEE_20 is defined as the format for event 21. 8. Save.

7.1.2 Configuring File Pick-up Report (Optional)

You can configure the “File Pick-Up Report” which allows the MBC Connector to retrieve or “Pick Up” files from a predefined folder on the Application Server or Network share, in the event that the customer wishes to transmit files to MBC that have not been generated in PMW, for example, files routinely generated by an external system such as, external payroll.

SAP MBC Connector provides a file interface that relies on logical file path configurations. The Pick-up Files report integrates the connector with other processes and third-party applications running on your SAP application server, that is, business processes other than an SAP ERP payment run. The Pick-up Files report reads files from a defined directory on the application server, and uses them to create messages in the appropriate format for SAP MBC.

1. Use:

Transaction code FILE → Logical File Path Definition

2. On the Change View "Logical File Path Definition": Overview screen, choose New Entries. 3. On the New Entries: Overview of Added Entries screen, enter:

Field name Description User action and values Comment Logical file path Enter the logical file path for

file pick-up

Name Define path name 4. Select the path name you just created.



5. Double-click Assignment of Physical Paths to Logical Path left screen. 6. On the Change View " Assignment of Physical Paths to Logical Path": Details screen, choose New

Entries and enter: Field name

Description User action and values

Comment

Syntax group

Indicate the syntax for file and path names

Example: “Windows NT” or “UNIX”

Physical path

The physical path + < <FILENAME>

Example: “\\hostname\MBCShare\<FILENAME>”

To perform this step, contact your system administrator.

7. Save.

SAP Multi-Bank Connectivity Connector Pulling Messages by Scheduled Background Jobs


8 Pulling Messages by Scheduled Background Jobs

In the context of MBC, an ERP always acts as a client, and must be configured to poll MBC for data such as bank status messages or bank statement messages. This section describes how to create the variant, and background scheduling to allow the system to routinely pull data from MBC.

8.1 Procedure

Step #

Step Name Instruction Field Name and Value Expected Result

1 Pulling Message (/BSNAGT/MSG_PULL)

On the Pull Messages from the SAP Multi-Bank Connectivity screen, fill in value in the fields for selection criteria if you want to limit the messages to be pulled, otherwise leave the fields blank to pull all messages

Variant Name: for example, PUSHPULL

Description: for example, PUSHPULL test

2 Choose Save as variant Variant PUSHPULL saved

3 Scheduling background job (SM36)

Use transaction SM36, and enter data using the Job Wizard. Job Name: for example,

PUSHPULL Job Class: for example, C

4 Choose Spool List Recipient

5 Enter Recipient data Recipient: for example, the user who schedules the background job

6 Choose Copy and Continue

7 On the Define Background Job screen, choose Define steps. On the Create Step 1 screen, enter data for the ABAP program

Name: /BSNAGT/MESSAGES_PULL

Variant: PUSHPULL

8 Choose Check and Save

9 On the Step List Overview screen, choose Back

10 On the Define Background Job screen, choose Specify start condition.

On the Start Time screen, set job start time according to business needs

SAP Multi-Bank Connectivity Connector Pulling Messages by Scheduled Background Jobs


Step #

Step Name Instruction Field Name and Value Expected Result

11 Choose Check and Save

12 Choose Save System shows Job PUSHPULL saved with status: Released

13 Use SM37, on the Simple Job Selection screen, enter Job Name PUSHPULL and choose Sched. for job status, choose Execute to check the status for the scheduled job

14 Checking Message Status (/BSNAGT/FILE_MONI)

Choose Execute

15 On the Connector Monitor screen, choose Incoming tab, messages pulled from MBC are displayed

16 Check the field Status to see if the file is processed

File is processed.

SAP Multi-Bank Connectivity Connector Issues During Onboarding to MBC


9 Issues During Onboarding to MBC

This section offers guidance for commonly observed issues when onboarding to MBC.

9.1 How do I obtain a signed SSL Client Certificate?

If you are using S/4HANA Public Cloud, the SAP team are responsible for the creation and signing of your SSL Client Certificate which uniquely identifies your ERP system. Configuration is described in section 3.

In all other cases, it is the responsibility of the customer to create the keypair and undertake the process for third party CA signing. An SAP Trusted CA is required to sign the certificate used for Transport Level Security.

The most common approach is to create the keypair in STRUST and generate a Certificate Signing Request (CSR) and send it to an SAP trusted CA.

Alternatively, SAPGENPSE can be used to generate the keypair, and corresponding CSR. Once the CSR has been processed by the CA, the CA returns the signed response, which is uploaded to the previously created key store – which in turn, converts the “self-signed” keypair into a CA Signed Keypair.

The CA that a customer uses is the decision of the customer, however, it must be an SAP trusted CA.

9.2 I cannot verify the connectivity on an MBC RFC destination in SM59

MBC requires the creation of three RFC destinations on an ERP. As part of the configuration, run a connectivity test on each destination. If the result of the connectivity test is not an HTTP:500 response, see the following:

• HTTP: 401 Response

This indicates that the client certificate of the ERP system is not authorized on MBC.

Ensure that the RFC destination references the “SSL Client Standard” / “DFAULT” key store, see section 4.5.2.

After verifying, and if the issue persists, contact your appointed MBC onboarding team member to validate that the ERP system SSL Certificates are maintained correctly in MBC.

• HTTP: 403 / 404 Response

This indicates that the endpoint provided by MBC has been incorrectly configured in the system.

Ensure you have correctly entered the URL received from MBC. Check the configuration steps when you created the RFC. See section 4.5.2.

If the issue persists, contact your appointed MBC onboarding team member to validate the address.

https://wiki.scn.sap.com/wiki/display/SAPFS/Trusted+Certificate+Authorities

SAP Multi-Bank Connectivity Connector Issues During Onboarding to MBC


9.3 I receive a “No Concatenated Concept Exists” error when I send (payment run) or receive (Pull MBC Message) data

The “Associated Integration Server” parameter has not been correctly set.

See section 4.5.4, and ensure that the MBC Payment destination is set correctly in the “Associated Integration Server” field.

In the event that a dedicated integration server is available and correctly configured, for example as SAP PI / SAP PO system, contact your organization’s system administrator for relevant details.

9.4 I receive data, but the system cannot decrypt the data

The necessary SSFA settings have not been entered correctly.

See section 5.5, and ensure you have accurately copied from STRUST, and pasted the Subject of the SAP MLS Certificate into the “Signatory / Recipient Name” field, and that all tick-boxes are checked for the MLS activities in the SSFA configuration screen (Sign / Encrypt / Decrypt / Verify).

Ask your bank to resend the data.

If issues persist, contact your appointed MBC Onboarding Team representative.

SAP Multi-Bank Connectivity Connector Important Disclaimers and Legal Information


10 Important Disclaimers and Legal Information

Coding Samples

Any software coding and/or code lines/strings ("Code") included in this documentation are only examples and are not intended to be used in a productive system environment. The Code is only intended to better explain and visualize the syntax and phrasing rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be liable for errors or damages caused by the usage of the Code, unless damages were caused by SAP intentionally or by SAP's gross negligence.

Accessibility

The information contained in the SAP documentation represents SAP's current view of accessibility criteria as of the date of publication; it is in no way intended to be a binding guideline on how to ensure accessibility of software products. SAP in particular disclaims any liability in relation to this document. This disclaimer, however, does not apply in cases of wilful misconduct or gross negligence of SAP. Furthermore, this document does not result in any direct or indirect contractual obligations of SAP.

Gender-Neutral Language

As far as possible, SAP documentation is gender neutral. Depending on the context, the reader is addressed directly with "you", or a gender-neutral noun (such as "sales person" or "working days") is used. If when referring to members of both sexes, however, the third-person singular cannot be avoided or a gender-neutral noun does not exist, SAP reserves the right to use the masculine form of the noun and pronoun. This is to ensure that the documentation remains comprehensible.

Internet Hyperlinks

The SAP documentation may contain hyperlinks to the Internet. These hyperlinks are intended to serve as a hint about where to find related information. SAP does not warrant the availability and correctness of this related information or the ability of this information to serve a particular purpose. SAP shall not be liable for any damages caused by the use of related information unless damages have been caused by SAP's gross negligence or willful misconduct. All links are categorized for transparency (see: http://help.sap.com/disclaimer).

http://help.sap.com/disclaimer

SAP Multi-Bank Connectivity Connector Important Disclaimers and Legal Information


© 2020 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies. Please see http://www. sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices.

http://www.sap.com/corporate-en/legal/copyright/index.epx#trademark

http://www.sap.com/corporate-en/legal/copyright/index.epx#trademark

SAP Multi-Bank Connectivity Connector

Documents

Transcript of SAP Multi-Bank Connectivity Connector