SAP NetWeaver comes with its own solution to prevent clickjacking for its most relevant UI frameworks. For more information about this protection, see the corresponding SAP Notes.
Check if clickjacking protection service is enabled or disabled. It is disabled, if no record with ENTRY_TYPE=30 is in the table, or if the table is empty.
Table name: HTTP_WHITELIST
Execute
Result
By default, no values are in the table and the service is not enabled. For data that needs to be inserted into table HTTP_WHITELIST, see SAP Note 2142551. Creating an entry type with vale 30 activates the whitelist.
Transaction: SE16
Select F5 or click on the new entry icon.
Insert data. See links below for additional information on possible values.
Click save to persist the entry in the table.
Afterwards, the table will contain one record. As the record has value 30 for column ENTRY_TYPE, the clickjacking protection service is enabled.
Activate ICF whitelist service
Adding a record activates the service, but to make apps working, additional configuration steps must be taken. For instance, accessing now a WDA app (e.g. SAML2) will resolve in a HTTP 500 internal server error. This is caused by having the clickjacking protection activated, but not the whitelist service.
To solve the HTTP 500 error, you need to activate the ICF whitelist service.
Transaction SICF_INST
Technical name: UICS_BASIC
Execute. This will activate the ICF node
/sap/public/bc/uics/whitelist
Result
After enabling the service and the ICF node, the above WDA app will open in the browser.
When you first start Docker, the size of this image is around 1.4GB. Adding containers, image, etc and it will grow to 64GB.
The 64GB default size can be seen when using qemu-img info:
qemu-img info ~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/Docker.qcow2
When this limit is reached, Docker should automatically increase the size of the image, but this isn’t working always. As a result, when the image is at 64 GB, you can get an error message stating that the device is full:
no space left on device
At least with my Dockerfile for SAP NetWeaver ABAP Developer Edition Docker is not increasing the image file dynamically. Because of this I had to split the automatic installation process in two parts: base image setup and installation. I guess that right now the SAP Installation is filling up space faster than Docker can react.
The Docker.qcow2 file is a VM disk. Therefore, it is possible to manipulate it like any other virtual disk: you can increase the disk size and access files within the VM disk when you mount the image in a VM. An easy solution to change the disk size Docker has available to store images and containers is to increase the disk size. This can be done by using Qemu and GParted.
Preparations
Locate qcow2 on your Computer
Click on open in finder. Finder opens at the specified location.
Starting the virtual machine will take some time. Be patient. Next you’ll have to configure the GParted ISO image.
The default values should be enough. This gives you a keyboard, mouse, English and X. After that, Gparted is started and you should see the Docker.qcow2 disk in the Gparted app.
Select the disk and click on Resize / Move. In the new size (MiB) field, enter the new size of the disk you need. The disk size is allocated dynamically and won’t occupy immediately space on your physical disk. So don’t be shy. Assign all free space to the partition.
Click on Resize/Move and on the Apply button
Last chance to stop. But as you need the new free space for Docker, click again on Apply.
The partition will be resized. In case something goes wrong, please restore the backup of the Docker.qcow2 file you made previously.
After the operation finishes, you can see that the partition is now offering 164GB.
Shutdown the VM. As the Docker.cqow2 file changed was the original one used by Docker, you have only to restart Docker to benefit from the new image size. Now you can use Docker to run SAP NetWeaver ABAP with just one command. As the Docker.qcow2 file is empty, even when the image size is reported as 4 GB, compressed (zipped) it’s just a few MB.
With the new Docker disk file you can even start SAP NetWeaver ABAP without getting the “no space left on device” message.
Image creation works. The space occupied by just the SAP NetWeaver ABAP image is already at 65 GB.
Start a container
docker run -P -h vhcalnplci --name nwabap751 -it nwabap:latest /bin/bash
In Kitematic
Start UUIDD
/usr/sbin/uuidd
Change to user npladm
su - npladm
startsap
Problem with starting SAP
When you log in to your container and run startsap, the program will fail. It will report that no instance profiles were found.
startsap
Take a look at the available profiles.
ls -1 /sapmnt/NPL/profile/
During the installation, the installation script installed the profile files for the container with the dummy name 4f65[…], after starting the container, we specified a specific host name: vhcalnplci. Of course, these do not match and make sapstart fail.
Let’s adjust the instance profile configuration.
Rename files
Substitute references to old hostname to correct one vhcalnplci
UUID is a good old problem when it comes to running SAP NetWeaver on Linux / SuSE. You have a problem when you log in to your SAP system and get an error message. The error message shows the root cause and solution: “The UUID daemon (uuidd) is not active (code 59999). Check SAP note 1391070.”
Solution
SAP NetWeaver isn’t meant to run in Docker. When the software was designed, Docker or event containerization wasn’t around (maybe SUN). NetWeaver assumes that it is executed inside a real Linux. And the Docker version of OpenSuSE isn’t 100% a real Linux. A lot of services you get “automatically” when installing OpenSuSE are not available. One of those is that the init.d system is not starting services. Because of this, there is no UUID daemon running.
Make sure that the UUIDD service is running. For a normal Linux distribution, I blogged about this at a previous blog of mine. In case you are using Docker with OpenSuSE, make sure that uuidd is installed and executed during the image creation:
Installation
RUN zypper --non-interactive install --replacefiles uuidd
Execution
RUN mkdir /run/uuidd && chown uuidd /var/run/uuidd && /usr/sbin/uuidd
Result
With the UUIDD running, the logon to SAP NetWEeaver ABAP is working. No restart of NetWeaver is needed.
Give a name for the connection and click on tab Advanced. I use NPL Docker. Activate expert mode and give the correct connection String. Check to which port the message server port is mapped to by Docker. Inside the container, the port is 3200, and in my case, the external port is 32771. Therefore, the connection String is:
Connection String: conn=/H/localhost/S/32771
Note: the port information is specified when you start the container. As an alternative, you can use Kitematic to see the port mapping.
Save and connect to NetWeaver.
The users and passwords can be found in the readme.html of the extracted SAP NW ABAP 751 download. Standard users are SAP* and Developer.
For this to work, first activate the ping service in SICF.
When you get the response “Server reached.” you can start using the HTTP access.
SAP WebGui
For general WebGui activation, you can see my previous blog “Activation of SAP WebGui”. Here is a short version of this guide. As in the previous HTTP service access, the same procedure must be followed to have access to NPL via WebGui.
Activate the service webgui
To activate the SAP WebGui service, activate the node:
/sap/bc/gui/sap/its/webgui
Activation of public resources
You also need to activate the public service that contains the HTML files (JS, etc):
/sap/public/bc/its
Note
It is not sufficient to only activate the webgui node. The app is using additional resources that are available under /sap/public/bc/its. If this node is not activated, you’ll get an error message when logging in to webgui.
Therefore, for SAP WebGui to load the node /sap/public/bc/its must be activated too.
Activate the node its and its subnodes. Select Activate Service.
The difference is that in Gregor’s version you download the NW ABAP installation files and when the container is build, you go manually through the installation. My Dockerfile assumes that you have downloaded the NW 7.51 ABAP installation files already and will automate the installation. Once you have downloaded the installation files from SAP you can make them locally available and create new Docker images / containers based on these, without having to download almost 16 GB again. And the installation script will run without prompting for user input.
Another differentiation is that you can “easily” change the Dockerfile to install NetWeaver 7.50 of the developer edition.
Pre-requisites
To be able to run the Dockerfile, you need
Docker installed
Downloaded and extracted installation files of SAP NW ABAP Developer Edition
Internet connection
Installation
1 Get the Dockerfile
From my GitHub repository, you can find a Dockerfile that helps you to create a Docker image and container that will install your downloaded NetWeaver version. All you need is the Dockerfile, so a simple download is sufficient. You can also download the file by cloning the GitHub repository: https://github.com/tobiashofmann/sap-nw-abap-docker
Un-compress them into a folder named NW751. The folder must be at the same location where your Dockerfile is.
Build the Docker image
Build the Docker image
Command:
docker build -t nwabap .
Sample output
After the build is finished, the last line you should see is
Successfully tagged nwabap:latest
To see the ID and name of the newly created image, run the following command:
docker images
Sample output
The command lists the ID, tag and size of the image. As you can see, it’s a 15 GB Docker image. Using this image, you can start a container and install NW ABAP 7.51 DE inside the container.
Create container from image
You can now create a container from the image. You’ll have to connect to the container and run the installation script run.sh. The file was created during docker build. It will run SAP’s install.sh and fill in the input automatically.
docker run -P -h vhcalnplci --name nwabap751 -it nwabap:latest /bin/bash
This will start the container and log you in. What you’ll get is the bash shell.
bash-4.3#
In case you have Kitematic installed, you can see the running container listed.
The container configuration for the ports is also visible there. The ports are automatically mapped by Docker. The message server port 3200 is accessible through localhost:32771, and the HTTP port 8000 through localhost:32769. This mapping can be changed either inside Kitematic or when the container is started on the command shell.
Run ls to see the content of the current directory. You can see the install.sh file from SAP (feel free to start the installation manually) and the run.sh script that will automate the installation.
Start installation
Run the script run.sh to install SAP NetWeaver ABAP 7.51. The script will enter all information requested by install.sh automatically. The installation will take some time, +/- 20 minutes.
./run.sh
Sample output
[…]
[…]
The installation worked when the script ends and you can see the output:
SAPinst is used to install SAP software. You can run the installation with its graphical user interface (GUI) directly on the target host, or use a remote installation. Remote installation is normally used when the target host offers no GUI and all work is done via remote logon, like SSH. In such a setup, on the target host sapinst is started in server mode, and on the admin laptop, sapinst is started in with a GUI. The admin then connects to the target and executes the installation of SAP software remotely.
Error: java.net.InetAddress.getHostAddress
The setup to reproduce the error is to have sapinst running on a target host and listening on the default port 21212 and connecting to this instance using sapinstgui.
Setup target host
Start sapinst on the target host:
./sapinst -nogui
Setup client host
Start sapinst in GUI mode: ./sapinstgui Inform the target host (computername or IP)
Accept the fingerprint.
Error
Sapinstgui hangs and is not advancing to the next screen. The status bar shows that it`s connected:
On the target server, sapinst gives this error message:
java.lang.NullPointerException: while trying to invoke the method java.net.InetAddress.getHostAddress() of a null object loaded from field com.sap.sdt.util.misc.Uid.address of an object loaded from local variable 'this'
Solution
To solve this error, a configuration on the client computer is needed. While not obvious, the error is caused by a misconfiguration of the client DNS resolution. Easiest solution is to manually change the hosts file and to ensure that the client computer name is listed. To find out the computers host name, run hostname.
hostname
In my case, the host name is linux-01sn.
Example: wrong hosts file
The host name is not listed in the hosts file. To correct this, insert the hostname for instance to localhost.
Example: working hosts file
Test
To see if sapinstgui can now connect to the target server without error, restart sapinstgui. After connecting to sapinst server, you`ll get the authentication screen.
After installing Personas 3.0 SP4, you have to do some additional tasks in your system to really enjoy the power of Personas 3.0. These steps are outlined in the release note 2376426, as well in the note 2383296 and 2376427. Both SAP Note are going to be uploaded manually to my NetWeaver system, as I do not have a connection to SAP. You can follow the steps my other blog on how to do this.
Check that Personas 3 add-on and is already installed. SP04 is a support package, therefore SPAM is used to install it. SP4 needs SPAM with patch 63 in NetWeaver 7.5. Ensure to update first your SPAM to the right version. See my other blog on how to update SPAM. Before you can update, check that there are not objects locked in a transport request.
Update
Transaction: SPAM
Client: 000
User: user with right permissions
Check that SPAM status is green and no queue is defined.
Upload SAR file: Support Package -> Load packages -> From Front End
Decompress.
Check the uploaded package. Select new support package under directory and then display.
The status needs to be yellow (not yet imported) and the perquisite set 01 all must be green and ok.
Select the package and click on Queue to define a new queue.
This SP04 is not protected with a password.
Select No. This brings you back to SPAM main screen. The status is now yellow and next action is given as import queue.
Import queue. Go to: Support Package -> Import queue.
You can now go get a coffee or follow the status messages in the status bar.
At the end of the import, a dialog is shown. It should be a nice “success!!” dialog, I got this:
What happened is that I applied a Personas 3 note that changed some standard objects. The dialog is SAP’s polite reminder to check if I want to keep these changes or discard them and let Personas 3 SP03 overwrite them. I want to not keep them and let Personas 3 use its own repository objects, so I selected continue. At the end you’ll see a short walk through what you should do (analyse the stuff, etc), although this isn’t possible in my demo system, as I do not have a SAP Note connection – something needed to run the validation.
