The Secure Store Service in SharePoint 2010 replaces the Single Sign-on Shared Service of MOSS 2007 and provides an easy way to map user credentials of external resources like SAP systems to Windows users. During the process of developing SAP interfaces using the very handy ERPConnect library from Theobald Software you have to open a R3 connection with the SAP system using SAP account credentials (username and password).
In most cases you will use a so called technical user with limited access rights to execute or query objects in SAP, but a SAP system saves a lot of sensitive data which cannot all be shown to all users. So, creating a new secure store in SharePoint 2010 to save the SAP user credentials will be the solution. Accessing the secure store from program code is quite simple.
A trail version of the ERPConnect library can be downloaded at www.theobald-software.com.
Secure Store Configuration
The Secure Store Service will be managed by the Central Administration (CA) of SharePoint 2010 under Application Management > Manage service applications > Secure Store Service:
As the screenshot above shows is it possible to create multiple target applications within one Secure Store Service.
Clicking the New button will open the Create New Secure Store Target Application page. In this dialog you have to enter the new Target Application ID, a display name, a contact email address and other application related details (see screenshot below).
Next, the application fields must be defined:
It's important to select the field type User Name and Password, because our implementation later on will check the target application for those two field types.
In the last dialog step the application administrator must be defined. After defining the administrator and clicking the Ok button SharePoint is creating a new secure store:
Next, the Windows users must be mapped to the SAP user credentails. Therefore mark the checkbox for the newly created secure store SAPCredentialsStore and click the Set button in the toolbar. This opens the following dialog:
The Credential Owner is the Windows user for whom the SAP user credentials will be set. Enter the SAP username and password and click the Ok button to save them.
That's it !
Secure Store Programming
Accessing the secure store by code is simple. We implement a SecureStore class which will encapsulate all the access logic. A second class called SecureStoreCredentials contains the retrieved user credentials returned by the method GetCurrentCredentials of the SecureStore class.
But first, we need to create a Visual Studio 2010 SharePoint project and reference a couple of assemblies. You can directly enter the file paths in the Reference dialog (Browse tab) to add the assemblies:
Microsoft.BusinessData.dll
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\ISAPI\Microsoft.BusinessData.dll
Microsoft.Office.SecureStoreService.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.SecureStoreService\14.0.0.0__71e9bce111e9429c\Microsoft.Office.SecureStoreService.dll
The following code shows the SecureStore class implementation:
internal class SecureStore { public string ApplicationId { get; private set; } public SecureStore(string applicationId) { if(string.IsNullOrEmpty(applicationId)) throw new ArgumentNullException("applicationId"); if(!IsApplicationValid(applicationId)) throw new ArgumentException(string.Format("Target application with ID '{0}' is not defined.", applicationId)); ApplicationId = applicationId; } public SecureStoreCredentials GetCurrentCredentials() { SecureStoreProvider provider = new SecureStoreProvider { Context = SPServiceContext.Current }; string userName = string.Empty; string password = string.Empty; using(SecureStoreCredentialCollection data = provider.GetCredentials(ApplicationId)) { foreach(ISecureStoreCredential c in data) { if(c != null) { if(c.CredentialType == SecureStoreCredentialType.UserName) userName = GetDecryptedCredentialString(c.Credential); else if(c.CredentialType == SecureStoreCredentialType.Password) password = GetDecryptedCredentialString(c.Credential); } } } if(string.IsNullOrEmpty(userName) || string.IsNullOrEmpty(password)) throw new SecureStoreException("Credentials for the current Windows user are not valid or not defined."); return new SecureStoreCredentials(userName, password); } public static bool IsApplicationValid(string applicationId) { if(string.IsNullOrEmpty(applicationId)) throw new ArgumentNullException("applicationId"); SecureStoreProvider provider = new SecureStoreProvider { Context = SPServiceContext.Current }; foreach(TargetApplication application in provider.GetTargetApplications()) { if(application.ApplicationId == applicationId) { ReadOnlyCollection<ITargetApplicationField> fields = provider.GetTargetApplicationFields(applicationId); bool existsUserNameDefinition = false; bool existsPasswordDefinition = false; foreach(TargetApplicationField field in fields) { if(field.CredentialType == SecureStoreCredentialType.UserName) existsUserNameDefinition = true; else if(field.CredentialType == SecureStoreCredentialType.Password) existsPasswordDefinition = true; } if(existsUserNameDefinition && existsPasswordDefinition) return true; } } return false; } public static string GetDecryptedCredentialString(SecureString secureString) { IntPtr p = Marshal.SecureStringToBSTR(secureString); try { return Marshal.PtrToStringUni(p); } finally { if(p != IntPtr.Zero) Marshal.FreeBSTR(p); } } }The constructor checks if an application ID is passed and if it's valid by calling the static method IsApplicationValid. In first place, the IsApplicationValid method is creating an instance of the SecureStoreProvider class to get access to Secure Store Service. The SecureStoreProvider class provides all methods to talk to the SharePoint service. Then, the method queries for all target applications and checks for the given application. If the application has been created and can be found, the method will analyse the application field definitions. The IsApplicationValid method then looks for two fields of type User Name and Password (see above).
The GetCurrentCredentials method is actually trying to get the SAP user credentials from the store. The method is creating an instance of the SecureStoreProvider class to get access to service and then calls the GetCredentials method of the provider class. If credentials are available the method decrypt the username and password from type SecureString using the internal method GetDecryptedCredentialString. It then will wrap and return the data into an instance of the SecureStoreCredentails class.
For more details of the implementation see the source code.
Accessing SAP Using The Secure Store Credentials
The sample and test code calls the SAP function module SD_RFC_CUSTOMER_GET to retrieve all customer data that match certain criteria (where NAME1 starts with Te*):
The following code shows the implementation of the Test button click event:
protected void OnTestButtonClick(object sender, EventArgs e) { string licenseKey = "<LICENSEKEY>"; string connectionStringFormat = "CLIENT=800 LANG=EN USER={0} PASSWD={1} ASHOST=HAMLET ..."; R3Connection connection = null; try { LIC.SetLic(licenseKey); ... SecureStoreCredentials credentials = new SecureStore(ApplicationID.Text).GetCurrentCredentials(); string connectionstring = string.Format(connectionStringFormat, credentials.UserName, credentials.Password); connection = new R3Connection(connectionstring); connection.Open(); RFCFunction function = connection.CreateFunction("SD_RFC_CUSTOMER_GET"); function.Exports["NAME1"].ParamValue = "Te*"; function.Execute(); ResultGrid.DataSource = function.Tables["CUSTOMER_T"].ToADOTable(); ResultGrid.DataBind(); OutputLabel.Text = string.Format("The test called...", ApplicationID.Text, Web.CurrentUser.Name, Web.CurrentUser.LoginName, credentials.UserName); } catch(Exception ex) { WriteErrorMessage(ex.Message); } finally { if(connection != null && connection.Ping()) connection.Close(); } }The interesting part is the retrieval of the SAP user credentials from the secure store defined in the text box named ApplicationID. The application ID will be passed as parameter to the constructor of the SecureStore class. After creating the instance the method GetCurrentCredentials will be called to ask the store for the credentials of the current Windows user.
After the user credential query has been successfully executed the SAP connection string will be constructed. Then the connection string will then be used to create an instance of the R3Connection class to connect with the SAP system. The remaining code is just calling the function module SD_RFC_CUSTOMER_GET and binding the result to the SPGridView.