SAP support backbone update

The SAP support backbone update is live per 1.1.2020. Blocking started as of 8.1.2020. If you did not prepare your systems for it, you might loose support functions.

Per 31.07.2020 the sending of EWA’s via RFC towards SAP will no longer work. See OSS note 2923799 – Final Shutdown of RFC Connections From Customer Systems to SAP. At the same date OSS notes downloads via RFC will be fully blocked. Also the RTCCTOOL will stop to work (see oss note 2934203 – ST-A/PI 01T* SP01 – 01U SP00: SAP backbone connectivity for RTCCTOOL on basis 700-731 after RFC shutdown).

You can get or will already get messages like:

Access denied

SAP note 2847665 – OSS RFC Connection fails will refer you to the SAP Backbone connection update site.

Also on the main SAP support site there is this warning message:

Which refers to first-aid kit OSS note: 2874259 – First Aid Kit for Problems Related to SAP’s Support Backbone Switch-Over Starting on 8 January 2020 .

Questions that will be answered in this blog are:

  • Where can I find more background information on the SAP support backbone update?
  • Why can I find first aid support?
  • Do I need to upgrade SAP solution manager?
  • How to switch to digitally signed OSS notes?
  • Do I need to change my OSS RFC’s?
  • What else do I need to do?
  • How to check the correct setup in the SAP EWA report?
  • Where can I find a checklist to see if I am completely done?

Background information on SAP support backbone update

The landing page for SAP support backbone update can be found by following this link.

The webinar recording explaining all the highlights can be found by following this link.

The official OSS note is 2737826 – SAP Support Backbone Update / upcoming changes in SAP Service and Support Backbone interfaces (latest) in January 2020.

2 important OSS notes for quick start of actions:

And the new first aid kit OSS note:

2874259 – First Aid Kit for Problems Related to SAP’s Support Backbone Switch-Over Starting on 8 January 2020

Quick overview of all your systems in SAP service marketplace

SAP now provides the overview of your systems which are not ok in a special online overview. Follow this link. Your result can look like this:

What will change per 1.1.2020?

Basically the connection from SAP solution manager and the on premise SAP systems connection to the SAP backbone will change. This will impact many areas like OSS notes, EWA’s, landscape planning etc.

What do you need to do if you don’t want to loose any functionality?

Solution manager

If you don’t want to loose any functionality in SAP solution manager you will need to upgrade to Solution manager 7.2 to support package 7 or 8. If you are on 8 you have to do less manual work than on 7. On solution manager support packs 5 and 6 some functions will work, but with manual work and limitations. On solution manager 7.1 and solution manager 7.2 up to support pack 3, the connection to SAP support backbone will be lost on 1.1.2020. You can already upgrade to SP8 now and prepare solution manager.

For the automatic configuration of the connectivity follow the instructions in OSS note 2738426 – Automated Configuration of new Support Backbone Communication.

OSS notes

For OSS notes there are 2 changes: the RFC to SAP and digitally signed OSS notes.

For the RFC connection read and follow the instructions from OSS note 2740667 – RFC connection SAPOSS to SAP Service & Support backbone will change (latest) in January 2020.

OSS notes via SNOTE must be switched to digitally signed OSS notes. How to do this: see blog.

Next to this, you will need to change the OSS note RFC destination. The generic user will no longer work. You will need to change it to named technical user, or change to the connection from RFC to https connectivity.

If you setup digitally signed OSS notes there is an option for fallback to insecure.

Attention: this fallback will no longer work after 1.1.2020.

ANST

ANST is a great function to help you find OSS notes relevant for your issue. For more explanation on ANST look at this blog. The ANST reaches out to the SAP support backbone to check for recent notes. To keep the function working you need to setup a new webservice in SOAMANAGER (if the SOAP runtime is not active follow instructions in this blog). To setup the specific webservice follow the instructions in oss note 2730525 – Consuming the Note Search Webservice. Then apply OSS note 2732094 – ANST- Implementing SOAP Based ANST Note Search and 2818143 – SEARCH_NOTES- Implementing SOAP Based Note Search.

While switching to new SAP support backbone you might get a connection error. Follow the instructions from OSS note 2781045 – ANST / ST22 note search “Connection cannot be established” to solve it.

Other calls

See OSS note 2722027 – Certain OSS RFC APIs calls replaced with corresponding web service calls.

Online checklists

SAP has now published online checklists, based on your solution manager version. You can find the checklists on this link.

Support backbone configuration check in EWA report

If you install ST-A/PI 01T sp02 or higher in your system (see OSS note 2827332 – Service Data not Complete due to ST-A/PI not Up-to-date), the EWA report of that system will give information about the correct connection to SAP support backbone and correct use of technical user for the communication.

Example:

In the process OSS note 2802999 - SDCCN activation fails without errors or red icons in Migrate tab might need to be applied as well to solve an SDCCN error.

All background information can be found in OSS note 2823658 – EWA Checks for SAP Backbone Connectivity.

SDCCN error notes

SAP is having some issues with the SDCCN coding for the backbone connectivity. If you experience issues there, check out the following OSS notes:

Digitally signed SAP notes

In the previous blog on SAP security notes you will see that security notes popup around “Digitally signed SAP notes”.

This blog will explain more on how to implement this.

Questions that will be answered in this blog are:

  • Why switch over to the new way?
  • How to implement the feature to download digitally signed SAP notes?
  • How to make the relevant settings?
  • Where to find more information?

Why switch over to the new way?

SAP keeps improving their security in all ways. Including OSS notes. There is no direct benefit. After downloading the OSS notes, the handling is identical for old and new way.

Switching over from current way of working to digitally signed SAP notes can be done any time.

SAP has announced the following: "Post January 1, 2020, the download and upload process will stop working unless Note Assistant (SNOTE transaction) is enabled in ABAP systems to work with digitally signed SAP Notes".

How to implement digitally signed SAP notes?

There are 2 basic ways to implement (you have to do only one):

  1. Apply OSS notes 2508268, 2408073 and 2546220.
  2. Apply TCI based OSS note  2576306, which contains all the notes (and manual work) in the notes mentioned in point 1. Your system needs to be able to handle TCI based OSS notes (see this blog on how to do this).
  3. Follow the guided procedure

Guided enablement procedure

The guided procedure is the easiest way to apply and check the digitally signed OSS notes way of working.

Follow the instructions from OSS note 2836302 – Automated guided steps for enabling Note Assistant for TCI and Digitally Signed SAP Notes. Attached this note is an explanatory PDF document that describes all steps in detail. After installation of the OSS note (and prerequisite notes), you can run program RCWB_TCI_DIGITSIGN_AUTOMATION, which will guide you through the steps and verifies the results at the end:

Settings after implementation

If you have done the TCI based import a new customizing node is available:

Spro extension for SNOTE

The first one (direct program in SE38 is called RCWB_SNOTE_DWNLD_PROC_CONFIG) is to set the way of downloading:

Note download procedure

The second one (direct program in SE38 is called RCWB_UNSIGNED_NOTE_CONFIG) is to allow only digitally signed SAP notes:

File type for SAP note

How to validate if the notes now are digitally signed?

To see if all is ok, download and implement a new OSS note. In the note log you can now see the digital signature download in the note log (in nice German words):

Digital signature in SAP note log

Known issue notes

Please read OSS note 2721941 – Download of digitally signed note – changes to configuration report and other minor changes carefully. It contains last minute fixes and changes.

Where to find more information?

More information can be found at the following sources: