Java Add-on Guide

SP15

June 2024
Copyright 2024 Onapsis and/or its affiliates. All rights reserved.

The Products (which include both the software and documentation) contain proprietary information; they are provided under a
license agreement containing restrictions on use and disclosure and are also protected by copyright, patent, and other
intellectual and industrial property laws. Reverse engineering, disassembly, or decompilation of the Products, except to the
extent required to obtain interoperability with other independently created software or as specified by law, is prohibited.

The information contained in this document is subject to change without notice. If you find any problems in the documentation,
please report them to us in writing. This document is not warranted to be error-free. Except as may be expressly permitted in your
license agreement for these Products, no part of these Products may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose.

Unless otherwise noted, the example companies, organizations, products, domain names, email addresses, people, places, and
events depicted herein are fictitious, and no association with any real company, organization, product, domain name, email
address, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the
responsibility of the user. Without limiting the rights under copyright, no part of this documentation may be reproduced, stored in
or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying,
recording, or otherwise), or for any purpose, without the express written permission of Onapsis, Inc.

Onapsis may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject
matter in this documentation. Except as expressly provided in any written license agreement from Onapsis, the furnishing of this
documentation does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Onapsis is a
registered trademark of Onapsis Inc. and/or its affiliates.

All other trademarks are property of their respective owners.

Updated: 2.2024.62 | 6/12/2024

 Java Add-on Guide (SP15)

Contents
About this Guide .............................................................................................................................................................. 4
Audience .................................................................................................................................................................................................. 4
Contact support ................................................................................................................................................................................... 4

Java add-on overview ................................................................................................................................................... 5

About Java add-on functionality ................................................................................................................................................ 5
Upgrade considerations .................................................................................................................................................................. 6
Supported SAP versions .................................................................................................................................................................. 6

Java add-on files ............................................................................................................................................................. 7

Install and manage Java add-on................................................................................................................................. 8

Pre-installation..................................................................................................................................................................................... 8
Supported installation methods ................................................................................................................................................. 9
Install Java add-on with SUM ....................................................................................................................................................... 9
Upgrade the Java add-on .............................................................................................................................................................. 12
Verify the Java add-on installation ......................................................................................................................................... 12
Uninstall Java add-on ..................................................................................................................................................................... 13
Uninstall with SUM ........................................................................................................................................................................ 13
Uninstall with Telnet .................................................................................................................................................................... 14
Uninstall with SDM ........................................................................................................................................................................ 15

Create Java add-on role and user ............................................................................................................................ 17

Create Java add-on role ................................................................................................................................................................ 17
Create Java add-on user and assign Java role ................................................................................................................. 18

Update Java add-on role ............................................................................................................................................. 19

Appendix A: Onapsis Java role authorizations ................................................................................................... 20

iii
 Java Add-on Guide (SP15)

About this Guide

This guide provides information on how to complete the installation of the Onapsis
Platform on SAP Java systems. It includes information on how to install and update
the Onapsis add-on for Java and the required add-on user and role. It also provides
information on how to check if the Onapsis add-on is already installed on your SAP
systems and how to uninstall it.

For more information on installing the platform, see the Onapsis Platform Installation
Guide.

Audience
This guide is for SAP Basis and Information Security individuals who are responsible
for installing and configuring the Onapsis Platform.

Contact support
If you need assistance, you can submit a case through the customer support portal at:
[Link] Our support team is available Monday - Friday: 2 a.m. – 8
p.m. ET, excluding Christmas Day (December 25) and New Year's Day (January 1).

Supported add-on versions: Onapsis supports the newest release of any licensed
add-on and the release directly prior to the newest release in a twelve-month period. If
more than two new versions are released within a twelve-month period, support is
extended to the oldest version made available within the relevant twelve-month
period.

4
 Java Add-on Guide (SP15)

Java add-on overview

The Onapsis Java add-on is required for Java systems and must be installed before
you can use the full functionality of the Onapsis Platform.

In addition to installing the add-on, you must also create a system-specific user and
role that the Onapsis Platform uses to authenticate to the SAP system and interact
with the add-on. This user requires minimal rights, which are assigned by the role
provided by Onapsis. You create the user on the SAP system on which you are
installing the add-on.

NOTE: At a minimum, the Onapsis Platform requires a user and role for each SAP Java,
ABAP, or HANA target system. If you have dual stack systems, you need to create the
respective users and roles in the Java and ABAP stacks. For more information on
ABAP system installation requirements, see the ABAP add-on overview topic in the
product help.

About Java add-on functionality

The SAP-certified Java add-on enables the Onapsis Platform to discover your SAP
systems and extract and analyze technical information. The add-on runs as a
component on top of your SAP systems and, therefore, does not interact with any
functional (business-related) SAP modules.

Specifically, the add-on is deployed in the vendor space [Link], and the
Onapsis Platform communicates with the application through HTTP requests. The
add-on exposes certain web services that are used by the Onapsis Platform to extract
information such as the SAP Audit Log, query configuration parameters, and SAP
component versions.

NOTE: The Web Services do not run automatically on the SAP system as background
jobs. Instead, the Onapsis Platform sensor calls them remotely at the frequency
defined in the Onapsis vulnerability, compliance, and detection modules.

5
 Java Add-on Guide (SP15)

As an SAP certified integration, the add-on conforms to all SAP requirements,

including development using the SAP AAK, multiple consistency checks, and
adherence to SAP technology and standards. Certification ensures that the
installation and upgrade process is reliable.

Upgrade considerations
NOTE: Java add-on SP07 or higher is required to ensure both shipped and custom
modules can be executed without errors. If you notice multiple Java modules are
failing when executing jobs, check your Java add-on version first as lower Java add-
on versions have been deprecated.

To take advantage of the latest Onapsis Platform features and improvements,

Onapsis strongly recommends that you upgrade your add-on whenever a new Support
Package (SP) version is released (usually every six to twelve months). You must also
upgrade the role if the new SP requires it and to ensure compatibility with the latest
SAP versions and Onapsis Platform features.

To stay current, consider including add-on updates to your change management

process.

Upgrading with each add-on release has the following benefits:

▪ For Assess and Comply, compatibility with new and modified modules
▪ For Assess and Comply, sufficient authorizations needed to execute new and
modified modules
▪ For Defend, ability to execute log extractors at optimum efficiency
▪ For Defend, ability to enable and configure new log extractors
▪ For Assess, Comply, and Defend, optimized performance and execution times

If you anticipate updating any of your SAP systems, Onapsis recommends that you
uninstall the add-on prior to the update. After the SAP system update, you must install
the add-on again. If you have any questions or concerns, contact Onapsis support.

Supported SAP versions

Java add-on SP15 supports the following SAP NetWeaver AS JAVA versions:
Version Minimum Support Package

7.50 00

6
 Java Add-on Guide (SP15)

Java add-on files

Your Onapsis implementation specialist will provide the add-on ZIP file. Or you can
download it from the support portal [Link]

The add-on package contains one file for installing and upgrading the add-on,
Onap_v100_SPXX.sca (where XX is the latest version of the add-on).

7
 Java Add-on Guide (SP15)

Install and manage Java add-on

To ensure the Java add-on is fully functional, you must also create the SAP role and
user to ensure the add-on can properly access your SAP systems. For more
information, see Create Java add-on role and user (on page 17).

You must install the add-on and create the user and role for each SAP Java system you
want to monitor.

Pre-installation
Before you install the Java add-on, you can use the following procedure to verify
whether it's already installed.

To check if add-on is installed, take the following steps:

1. Navigate to the following URL to open the SAP NetWeaver Administrator:

[Link]

Where:

▪ <host> is the location of the SAP NetWeaver application server.

▪ XX is the instance number of the application server.
2. Click System Information.
3. Enter your credentials to log on.
4. Click the Components Info tab.
5. In the Development Components section, for Display, select All Development
Components.

A list of installed items displays.

6. Search for the name Onapsis.

7. If you find an Onapsis component with the vendor listed as [Link], the add-on is
already installed (see Upgrade the Java add-on (on page 12)).

8
 Java Add-on Guide (SP15)

Supported installation methods

Install the Java add-on using the supported and recommended method for your SAP
system version.

SAP Minimum SAP Maximum Version Install Method

Version Supported Supported

7.50 Latest Software Update Manager (SUM)

Install Java add-on with SUM

You need to copy the add-on files and install them on every SAP system you want to
monitor.

To copy the add-on files, take the following steps:

1. Copy the Java add-on SCA file to the inbox directory usr/sap/trans/EPS/in or
folder C:\usr\sap\trans\EPS\in.
2. Assign SIDadm or root as the owner.
3. Assign sapsys as the group.
4. Grant the owner and group read access to the file.

To install the add-on, take the following steps:

1. If not already installed, install the latest version of SUM from the SAP website.
2. Log on to the SAP application server as the <sid>adm user.
3. Navigate to the SUM program directory and execute the command:
./STARTUP <SID>

This registers the SUM in the SAPHOSTAGENT and provides the URL to connect to
the SUM installation page.

The SUM is executed and initialized, and the program starts.

9
 Java Add-on Guide (SP15)

4. To open the SUM installation window, go to the appropriate URL:

▪ If HTTPS is
enabled: [Link]
▪ If HTTPS is not
enabled: [Link]

Where

IP_ADDRESS is the IP of the SAP server.

<SID> is the SAP system identifier for your instance.

5. Ensure that the JRE is installed.

6. Log on to SUM. If this is the first time you are logging on:
a. Enter the log on credentials for <sid>adm.
b. Click OK.
c. Click Next.

The Welcome to the Software Update Manager screen appears.

7. To specify OS credentials, enter the <sid>adm credentials and click Next.

8. On the Define Target page, select Manually prepared directory.

10
 Java Add-on Guide (SP15)

9. To define the target:

a. For Stack file or Directory, enter the path where you copied the files
(usr/sap/trans/EPS/in or C:\usr\sap\trans\EPS\in).

b. Click Next.
c. When the extraction is complete, click Next.
10. Enter the SAP AS Java administrator credentials and click Next.

The Onapsis components display.

11
 Java Add-on Guide (SP15)

11. Click Continue and Next until the installation is complete.

When completed, the following components are installed:

If you upgraded from Java add-on version SP11 or earlier, the onapsis~dictionary
component is also listed. As this component is no longer needed, you can use the
following TELNET command to uninstall it:

undeploy vendor=[Link] name=onapsis~dictionary

"undeploydb=yes"

Upgrade the Java add-on

To make full use of Onapsis Platform features you must upgrade to the latest Java
add-on support package each time a new version is released. To upgrade, follow the
instructions for installing the file based on your SAP system version (refer to the
Supported installation methods (on page 9)).

When you upgrade the add-on, you also need to update the role.

Verify the Java add-on installation

To check if the JAVA add-on, user, and role is properly installed on the target Java
systems, take the following steps:

1. Depending on your security policy, use HTTP or HTTPS to navigate to the following
URL:

[Link]

or

[Link]

Where:

<host> is the location of the SAP NetWeaver application server.

XX is the instance number of the application server.

12
 Java Add-on Guide (SP15)

2. Enter the username and password for the onapsis user on the Java system.
3. Click Log in.

An Onapsis page displays the installed version of the add-on and indicates
whether the user has the required authorizations assigned.

Uninstall Java add-on

You can uninstall the Java add-on from your SAP systems, regardless of which version
of the add-on you have installed. When you uninstall the add-on, all files are deleted.
You must uninstall the add-on from one SAP system at a time using the supported and
recommended method for your SAP system version.

SAP Minimum Version SAP Maximum Version Uninstall Method

Supported Supported

7.50 Latest SUM

7.40 <7.50 SUM or Telnet

7.10 < 7.40 Telnet

7.00 < 7.10 SDM

Uninstall with SUM

To uninstall the add-on, take the following steps:

1. Log on to the application server using SSH.

2. Log in as the <sid>adm user.
3. Navigate to the SUM program directory, and run the command:

./STARTUP

The SUM is executed and initialized, and the program starts.

13
 Java Add-on Guide (SP15)

4. To open the SUM installation GUI:

a. Navigate to:

[Link]

Where IP ADDRESS is the IP of the SAP server.

The SDT GUI opens.

b. Ensure that the JRE is installed.

c. Log on to SUM with administrator credentials.
5. Select Manually prepared directory.
6. Click the Underemployment tab.
7. Select the Onapsis components.
8. Click Select.
9. To uninstall the add-on, click Start Undeployment.

Uninstall with Telnet

To uninstall the add-on, take the following steps:

1. Log on to the application server using SSH and run the telnet localhost 5XX08
command.

The SAP Telnet Console opens.

2. Log on with administrator privileges.

3. Run the following commands:

lsc—List the available server nodes.

Jump <server node>—This is usually jump 0.

Undeploy -h—Displays the Help for the available uninstall command syntax
options, based on your version of Telnet.

14
 Java Add-on Guide (SP15)

4. Run the applicable uninstall commands to uninstall the Onapsis components:

Telnet commands:
UNDEPLOY name=onapsis~dictionary vendor=[Link] on_undeploy_error=stop
UNDEPLOY name=onapsis~permissions vendor=[Link] on_undeploy_error=stop
UNDEPLOY name=onapsis~javaint_ea vendor=[Link] on_undeploy_error=stop

Telnet commands for vendor [Link]:

UNDEPLOY name="Onapsis J2EE Application" vendor=[Link] on_undeploy_error=stop
UNDEPLOY name=Onapsis_Java_Agent_Dict vendor=[Link] on_undeploy_error=stop
UNDEPLOY name="Onapsis Java Agent" vendor=[Link] on_undeploy_error=stop

Uninstall with SDM

To uninstall the add-on, take the following steps:

NOTE: Do not use the SIDadm system to execute SDM.

1. Log on to the application server using SSH.

2. Navigate to the SDM directory:

usr/sap/<SID>/<INSTANCE_NAME>/SDM/program

3. Run the following command:

./[Link]

4. Run the following to set SDM to start in standalone mode:

./[Link] jstartup "mode=standalone"

5. Run each of following commands to remove add-on versions SP03 and higher:

./[Link] undeploy "compvendor=[Link]"

"compname=onapsis/dictionary" "undeploydb=yes"

./[Link] undeploy "compvendor=[Link]"

"compname=onapsis/javaint_ea" "undeploydb=yes"

./[Link] undeploy "compvendor=[Link]"

"compname=onapsis/permissions" "undeploydb=yes"

15
 Java Add-on Guide (SP15)

For add-on versions SP00 for SP01, use the following commands:

./[Link] undeploy "compvendor=[Link]" "compname='Onapsis

J2EE Application'" "undeploydb=yes"

./[Link] undeploy "compvendor=[Link]"

"compname=Onapsis_Java_Agent_Dict" "undeploydb=yes"

6. Run this command to leave the system with the SDM running:

./[Link] jstartup "mode=integrated"

./[Link]

16
 Java Add-on Guide (SP15)

Create Java add-on role and user

The Java add-on role uses HTTP to let the Onapsis Platform connect to the add-on to
validate user authorization, check profile parameters, and access security
configurations in your SAP target systems. Onapsis recommends that you update the
role with each new release to ensure the Onapsis Platform works as expected. For role
details, see Onapsis Java role authorizations (on page 20).

You must create the user and role and install the add-on for each system you want to
monitor.

Create Java add-on role

To create the role, take the following steps:

1. Navigate to the SAP AS Java site:

[Link]

Where <hostname> is the location of the application server.

2. Click User Management (UME).

3. Log on using the SAP AS Java administrator credentials (or the credentials of a
user with access to maintain UME).
4. For Search Criteria, select Role.
5. To create the role:
a. Click Create Role.
b. In the Details section, for Unique Name, enter /ONAPSIS/XSUSER.
c. (Optional) For Description enter a description of the role.
6. To assign actions:
a. Click the Assigned Actions tab.
b. In the Available Actions section, enter *onapsis* as the search string and
click Go.

17
 Java Add-on Guide (SP15)

c. Select the Administrate Onapsis option and click Add.

d. Select the Execute Onapsis option and click Add.

The options appear in the Assigned Actions section.

7. Click Save.
8. Continue below to create the user and assign the role to the user.

Create Java add-on user and assign Java role

To create the user and assign the role, take the following steps:

1. Create the Java add-on role.

2. In the User Management screen, for Search Criteria, select User. (Or, log into User
Management the same way you did when you created the role.)
3. To configure the user:
a. Click Create User.
b. For Logon ID, enter ONAPSISXS.
c. For Define Password, enter a password for this user.
d. For Confirm Password, reenter the password for this user.
e. For Last Name, enter a last name for this user.
f. For Security Policy, select Technical User.
4. To assign the role to the user:
a. Click the Assigned Roles tab.
b. In the Available Role section, for Search, enter *onapsis*.
c. Click Go.
d. Select the /ONAPSIS/XSUSER role you created previously.
e. Click Add.

The role appears in the Assigned Roles section.

5. Click Save.

18
 Java Add-on Guide (SP15)

Update Java add-on role

After updating the Java add-on, you must update the Java role to assign new actions
to it.

To update the role, take the following steps:

1. Navigate to the SAP AS Java site:

[Link]

Where <hostname> is the location of the application server.

2. Click User Management (UME).

3. Log on using the SAP AS Java administrator credentials (or the credentials of a
user with access to maintain UME).
4. To select the add-on role:
a. For Search Criteria, select Role.
b. Click Create Role.
c. For Data Sources search, select UME Database.
d. Enter /ONAPSIS/XSUSER and click Go.
5. To assign actions:
a. Click the Assigned Actions tab.
b. In the Available Actions section, for Get, enter *onapsis*.
c. Click Go.
d. Click Modify.
e. Select the Administrate Onapsis option and click Add.
f. Select the Execute Onapsis option and click Add.

The options appear in the Assigned Actions section.

6. Click Save.

19
 Java Add-on Guide (SP15)

Appendix A: Onapsis Java role

authorizations
When you install the Onapsis Platform's Java add-on and role, your SAP system
receives the permissions required to perform two Java Agent actions: Administrate
and Execute.

Action required Functionality provided

Administrate This action is required to access the Administration Page to check

that the user has the correct role and to verify the Java Agent version.

Execute This action is required to call every function available to the Java
Agent using HTTP POST method requests. All Onapsis Platform Java
modules require a role with the Execute action. The functions are:

By URL By Command Description

/systemcatsv getSystemCategSV Retrieves the effective severity of

the Log Category
System/Security/Audit and child
categories. (Only supported in
SAP NetWeaver AS JAVA version
7.50 or higher.)

/services getActiveService Retrieves the list of active

services. (Only supported in SAP
NetWeaver AS JAVA version 7.50
or higher.)

/customjdbc getCustJDBCProps Retrieves the name and the

additional properties of a Custom
JDBC Connection. (Only
supported in SAP NetWeaver AS
JAVA version 7.50 or higher.)

/vminfos getJavaVirMaInfo Retrieves the list of the Java

instance properties. (Only
supported in SAP NetWeaver AS
JAVA version 7.50 or higher.)

20
 Java Add-on Guide (SP15)

Action required Functionality provided

/kernelInfo getSAPKernelInfo Retrieves the NetWeaver base

version and patch level. (Only
supported in SAP NetWeaver AS
JAVA version 7.50 or higher.)

/discovery getDiscoveryInfo Gets the discovery information

(authenticated discovery)

/resolve getResolvedHosts Resolves the hostname (FQDN, IP)

/paths getAppServerPath Obtains all the application paths

(locations of [Link])

/logtraces getListLogTraces Obtains the log events

(deprecated since 1.5.0, instead
use /logs and /trace)

/binary getBinaryFileCon Obtains a binary file (encoded in

base 64)

/text getPlainFileCon Obtains a text file

/directory getDirectoryList Lists the contents of a directory

/query ExecuteRemoteSQL Executes a SQL SELECT query

/property getSingParameter Obtains a single parameter by

name

/differences getDifferencesLG Used to check local configuration

vs global configuration

/components getComponentsVer Obtains the version of the

components

/properties getAllParameters Obtains all parameters

/version getApplicVersion Gets the agent version

/status getJAInformation Gets information about the agent

(NW version, available
commands)

/logs getLogsFromNodes Obtains the necessary log file

from each node

/trace getTraceFromNode Obtains the trace of the log file

passed by parameter (used for
events in Defend)

21
 Java Add-on Guide (SP15)

Action required Functionality provided

/paramvalue getParamValueSap Obtains the value associated to

any parameter

/os getSAPOperSystem Obtains the OS where the Java is

installed

/lastlog getLastLogFileDR Obtains the last log modified in

the SAP system

/events getFileContentDR Obtains the content of the last

modified file

22