You must configure the prerequisites that accessSterling B2B Integratorbefore using EBICS Client.
- Check in the public and private part of the certificates into the System and Trusted store ofSterling B2B Integrator. Check in the required Certificate Authority (CA) certificates into the CA store of Sterling B2B Integratoror create a self-signed certificate. The following types of certificates are used for configuring a user:
- Identification and authentication
- Encryption
- Signing
- From theIdentitiesmenu of Sterling B2B Integrator, create an identity record for your organization, indicating your organization as the base identity. This identity name should correspond to the EBICS partner name.
- From theUser Accountsmenu of Sterling B2B Integrator, create a User Account and assign permissions to the user. The user name should correspond to the EBICS user name.
- Configure an adapter (such as File system adapter, HTTP(S) adapter, SFTP adapter, FTP(S) adapter) inSterling B2B Integrator, that enables you to send and receive files and invokes the EBClientOrderPreProcess business process. For example, configure a File System Adapter to invoke the EBClientOrderPreProcess business process.
- Configure the following mailboxes and associate them with each user.
- EBClientOrderMetadata (preconfigured)
- Download (Inbox)
- Upload (Outbox)
- Verify that the EBClientMailboxArrivedMessage business process is associated with the EBClientOrderMetadata Mailbox. The automatic routing rule triggers the business process to perform automated functions, such as notifying an interested party about an incoming message in the mailbox.Note:It is recommended that you do not modify the existing configuration for EBICS Client routing rules. Modifying the routing rule configuration may create duplicate subsets and duplicate orders for an order submission.
- Ensure that the MailboxEvaluateAllAutomaticRulesSubMin Schedule is enabled.
A trading partner is represented by an identity record. An identity record describes the trading partner and contains information referenced when a business process involving trading partners is run.
- Log in toSterling B2B Integrator.
- From theAdministration Menu, select Trading Partner>Advanced>Identities.
- Under Create, next to New Identity, clickGo!
- On the Identities page, do one of the following:
- To create an identity record that inherits all the components of an existing trading profile, select an identity record fromSelect Base Identity, and click Next.
- To specify properties, leaveSelect Base Identityblank, and click Next.
- Specify the Information settings.On the Information page, complete the following fields and clickNext:
Information Fields Description Name Required. Name for the identity record to create for this trading profile. Reference URL Optional. Uniform Resource Locator (URL) is the Internet address of the trading partner. DUNS Optional. Data Universal Numbering System (DUNS) is a unique nine-character company identification number issued by Dun & Bradstreet Corporation. Identifier Required. Primary ID of this identity record. It could be a DUNS number, EDI interchange ID, e-mail address, or another unique string. Address Line 1 Required. Conventional mailing address of the trading partner organization. Address Line 2 Optional. Additional mailing address information of the trading partner organization. City Required. City where the trading partner is located. State or Province Optional. State or province where the organization of the trading partner represented by the identity is located. Zip or Postal Code Required. ZIP or postal code where the trading partner is located. E-mail Address Optional. E-mail address of the trading partner. Telephone Number Optional. Telephone number of the trading partner. Time Zone Optional. Time zone where the trading partner is located. Country Optional. Country where the trading partner is located. - ClickFinishto add the identity.
- ClickReturnto continue.
You can create user accounts from theAdministrationmenu.
Before you begin, you need to know whether you are using local or external authentication:
- Local – Authentication is completed against the application database (default).
- External – Authentication is completed against an LDAP server. External authentication does not require the LDAP adapter, which is used with business processes and enables the system to communicate with local or remote LDAP servers using a Java Naming Directory Interface (JNDI).
If you are assigning one or more Authorized User Keys to this account, the keys must be obtained from your trading partner and checked in before creating the user account.
You also need to know the following information:
Field | Description |
|---|---|
User ID | Required. User ID for the user account you are creating. The user ID must be at least 5 characters long. For the MySQL database only, the login is not case sensitive. You should always use uniquely spelled IDs, so that one user does not accidentally use another user's ID. |
Password (Local Authentication only) | Required for local users. Password for the user account you are creating. The password must be at least 6 characters long. This field does not display for external users. |
Confirm Password (Local Authentication only) | Required for local users. Type the password a second time. This field does not display for external users. |
Policy (Local Authentication only) | Optional. Password policy to associate with this user account. From the list, select from the policy you want to associate. This field does not display for external users. The system calculates the expiration date from the first date that the user logs on with this password. |
Authentication Host (External Authentication only) | The Lightweight Directory Access Protocol (LDAP) server on which the user is being authenticated. The server or servers listed in this field are specified in the authentication_policy.properties.in file. |
Session Timeout | Required. Amount of time in minutes that you can be inactive before you have to log in again. Time is in minutes. |
Accessibility | Optional. Portion of the dashboard user interface that the user account has access to. The following are accessibility options:
|
Dashboard Theme | Required if accessibility is set as Dashboard UI. Predefined dashboard that the user account has access to. The following are dashboard theme options:
|
Given Name | Required. Name used to identify the user. |
Surname | Required. User's last name. |
User's e-mail address. | |
Pager | User's pager number. |
Preferred Language | User's preferred language. Select from: English, French, Japanese, or Spanish. |
Manager ID | User ID of the user's manager. |
Identity | Identity of the trading partner to associate with the user account. Only one trading partner can be associated with a user account. A user account can be associated with many groups, each with its own trading partner identity association. This enables a user account to be associated with more than one trading partner. The Identity field is used for routing messages in Mailbox. Select a trading partner identity from the list. The default value is Hub Organization. |
For more information about creating users and assigning permissions to users, see theSterling B2B IntegratorSecurity documentation.
To create a user account:
- Log in toSterling B2B Integrator.
- From theAdministration Menu, select Accounts> User Accounts.
- Next toCreate a new Account, click Go!
- In the New Account page, select theAuthentication Type.
- Enter theUser IDand Password.
- Confirm the Password.
- Select thePolicy.
- Enter theSession Timeout.
- Select theAccessibility.
- Select theDashboard Theme.
- ClickNext.
- On the SSH Authorized User Key page, assign one or more public keys. Move the keys from theAvailablepane to the Assignedpane and click Next.
- On the Groups page, assign groups of permissions. Move the group names from theAvailablepane to the Assignedpane and click Next.
- On the Permissions page, assign individual permissions. Move the permissions from theAvailablepane to the Assignedpane and click Next. By default, the permissions associated with the groups that this user is assigned to are already selected.
- On the User Information page, enter theGiven Name.
- Enter theSurname.
- Enter theE-mail address.
- Enter thePager number.
- Select thePreferred Language.
- Enter theManager ID.
- Select theIdentity.
- ClickNext.
- Review the user account settings.
- ClickFinish. The user account is created and this message is displayed:
The system update completed successfully.If you created an external user, log out of the system, and then log back in with the external user ID or account. The system authenticates the external user ID on the external LDAP server.
Use the File System adapter to collect (import) files from a file system into a business process and extract (export) files from a business process to a file system.
You can configure the File System adapter to start a business process after files are collected from the file system or include the File System adapter in a business process flow. In addition, you can schedule the File System adapter to run at specific time intervals.
You can create multiple File System adapter configurations, one for each of several collection folders. Alternatively, you can use a single File System adapter configuration to point to different directories by specifying the directories for file collection and extraction in a business process. For more information about configuring the File System Adapter, see theFile System Adapterdocumentation.
Configure the File System Adapter to invoke the EBClientOrderPreProcess business process.
To create a File System adapter configuration, specify field settings inSterling B2B Integratorand in the Graphical Process Modeler (GPM).
The following table describes the fields used to configure the File System adapter in theSterling B2B Integrator.
| Field | Description |
|---|---|
| Name | Required. Unique and meaningful name for the service configuration. |
| Description | Required. Meaningful description for the service configuration, for reference. |
| Select a group | Group to associate with the adapter. Valid values:
|
| Collection folder (collectionFolder) | Required. The name of the folder or subfolder on the same computer whereSterling B2B Integratoris installed and where it collects (or picks up) files as part of a business process. If the path for the folder is not included as part of the name, the folder is assumed to be in the Sterling B2B Integratorworking directory. Note:
|
| Filename filter (filter) | Optional. Collect only files that match a specified filter within the collection folder. Examples include:
|
| Collect files from subfolders within and including the collection folder? (useSubFolders) | Required. Whether to scan for files in subfolders of the collection folder. Valid values:
|
| Use the absolute file path name for the document name? (keepPath) | Required. Whether to keep the absolute path name of the files collected when assigning the document name. Valid values:
|
| Start a business process once files are collected? (bootstrap) | Required. Whether to start a business process using the File System adapter after files are collected. Valid values:
|
| Business Process (initialWorkFlowId) | Required whenStart a business processis set to Yes. The business process to start after files are collected. Select EBClientOrderPreProcess from the Business Process drop-down list. Note:This field displays as an option only if Start a business process once files are collectedis set to Yes. If you specify a business process using the configuration, you cannot override this value using the GPM initialWorkFlowId option. If you select Not Applicable, a business process can be selected in the GPM. In either case, you can override this parameter using BPML. |
| Document storage type (docStorageType) | Required. Defines how the document is stored in the system. Valid values:
|
| Obscure File Contents? (obscure) | Specifies whether to obscure the file contents when collecting. Does not work withattachFileor importFile.
|
| User Parameter 1 (userParm1) | A user parameter that is passed to the bootstrapped workflow and placed in process data as UserParm1.Note:This field displays as an option only if Start a business process once files are collectedis set to Yes. If you specify this parameter using the configuration, you cannot override this value using the GPM userParm1 option. However, you can override this parameter using BPML. |
| User Parameter 2 (userParm2) | A user parameter that is passed to the bootstrapped workflow and placed in process data as UserParm2.Note:This field displays as an option only if Start a business process once files are collectedis set to Yes. If you specify this parameter using the configuration, you cannot override this value using the GPM userParm2 option. However, you can override this parameter using BPML. |
| User Parameter 3 (userParm3) | A user parameter that is passed to the bootstrapped workflow and placed in process data as UserParm3.Note:This field displays as an option only if Start a business process once files are collectedis set to Yes. If you specify this parameter using the configuration, you cannot override this value using the GPM userParm3 option. However, you can override this parameter using BPML. |
| User Parameter 4 (userParm4) | A user parameter that is passed to the bootstrapped workflow and placed in process data as UserParm4.Note:This field displays as an option only if Start a business process once files are collectedis set to Yes. If you specify this parameter using the configuration, you cannot override this value using the GPM userParm4 option. However, you can override this parameter using BPML. |
| User Parameter 5 (userParm5) | A user parameter that is passed to the bootstrapped workflow and placed in process data as UserParm5.Note:This field displays as an option only if Start a business process once files are collectedis set to Yes. If you specify this parameter using the configuration, you cannot override this value using the GPM userParm5 option. However, you can override this parameter using BPML. |
| Run As User | Applies to the scheduling of the business process. The Run As User field displays as an option only ifStart a business process once files are collectedis set to Yes. Type the user ID to associate with the schedule, or click the list icon and select a user ID from the list. Valid value is any authentic Sterling B2B Integratoruser ID. Note:This parameter allows someone who does not have rights to a specific business process to run it. If you select Adminas the user ID, you inherit administrative rights (for this run of the business process only), and can enable the scheduled run. |
| Use 24 Hour Clock Display | If selected, the adapter uses the 24-hour clock instead of the default 12-hour clock. |
| Schedule | Information about scheduling the business process after the File System adapter collects files. The Schedule field displays as an option only ifStart a business process once files are collectedis set to Yes. Valid values:
|
| Extraction folder (extractionFolder) | Required. The name of the folder or subfolder on the same computer whereSterling B2B Integratoris installed and where it extracts (or writes) data from the primary document as part of a business process. If you do not include the file path for the folder as part of the name, the folder is assumed to be the Sterling B2B Integratorworking directory. Note:This parameter is read-only in the GPM. |
| Unobscure File Contents? (unobscure) | Whether to unobscure the file contents when extracting. Does not work withexportFile. Valid values:
|
| Filenaming convention (assignFilename) | Required. Whether to override the document file name and use the assigned file name or not. Valid values:
|
| Filename (assignedFilename) | Required. File name you want to assign, including the file name extension. The Filename field displays onlyif theFilenaming conventionis set to assign a specific name. This field cannot be left blank. You can use “%^” to assign a unique file name in the format nodename_yyyyMMddHHmmssSSS. For example, specifying %^.dat as the Filename assigns the name nodename_20040203114020982.dat to the file.Note:This field can also be assigned in the GPM. If you select a filename using the File System adapter configuration, you cannot override it using the GPM assignedFilename parameter. However, you can override it using BPML. |
| Enable Service for Business Processes | Whether to enable the service for use by business processes. If not selected, the service is disabled. For more information about enabling a service, seeManaging Services and Adapters. |
You must associate each EBICS Client user with the preconfigured EBClientOrderMetadata mailbox.
You must create a Download (Inbox) and an Upload (Outbox) mailbox and associate each user with the mailboxes.
For more information about configuring mailboxes and assigning permissions to groups and users, see theSterling B2B IntegratorMailbox Help documentation.
To create a mailbox and assign permissions to groups and users to operate on this mailbox:
- Log in toSterling B2B Integrator.
- From theAdministration Menu, select Deployment>Mailboxes>Configuration.
- Next toCreate a new Mailbox, click Go!
- In the Mailbox: Name page, select the parent mailbox in which the mailbox you are creating is embedded. You can type a partial name in theFilter by Namefield and click the filter button for a filtered list. The root mailbox is denoted by a slash (/).
- In theNamefield, type a name for the mailbox you want to create. This name is used to identify the mailbox in the Application, for example, EBClientOrderMetadata.
- Required. In theDescriptionfield, type a short description for the mailbox and click Next. Use this field to describe the mailbox. This field is not used by any other resource in the system.
- In the Assign Groups page, use the arrows to add the groups to theSelected Groupslist and click Next. All groups in theSelected Groupslist will have permissions on this mailbox. Click the first double arrow to add all available groups to the Selected Groupslist.
- In theFilter by Namefield, type a partial group name in the field and click the filter button for a filtered list.
- In theAccountsmenu, multiple groups can be added. No groups are required.
- Use the arrows to add users to theSelected Userslist and click Next. All users in theSelected Userslist will have permissions on this mailbox. Click the double arrow to add all available users to the Selected Users list.
- In theFilter by IDfield, type a partial name in the field and click the filter button for a filtered list.
Enabling a schedule makes the schedule active and causes the associated activity to run according to the schedule settings. A schedule must be enabled in order to run.
For more information about setting up schedules to automate manual activities, see theSterling B2B IntegratorScheduling documentation.
The MailboxEvaluateAllAutomaticRulesSubMin schedule is automatically enabled.
Use the following procedure to enable a schedule:
- Log in toSterling B2B Integrator.
- From theAdministration Menu, select Deployment>Schedules.
- UseSearchor Listto locate the MailboxEvaluateAllAutomaticRulesSubMin schedule and click Go!
- On the Schedules page, locate the MailboxEvaluateAllAutomaticRulesSubMin schedule and ensure that the check box in the Enabled column is selected.
You can create a self-signed certificate from theAdministrationmenu.
Check in the public part of the self-signed certificate into the Trusted store ofSterling B2B Integrator. To create a self-signed certificate:
- Choose one of the following options:
- If you useSterling B2B Integrator, from the Administration Menu, select Trading Partner>Digital Certificates>System.
- If you use the AS2 Edition, from theAS2 Administrationmenu, select Certificates.
- Next toCreate Self-signed Certificate,click Go!
- Enter theNameof the self-signed certificate.
- Enter the name of theOrganization.
- Select theCountryor origin of the self-signed certificate.
- Enter a contacte-mailaddress for the person responsible for certificates in the organization and then click Next.
- Enter theSerial Numberfor the certificate. The serial number is the number you want to assign to the self-signed certificate.
- Enter theDuration(number of days) that the self-signed certificate is valid.
- Enter theIP addressesof the network interfaces you want to associate with the certificate as the SubjectAltName field.
- Enter theDNS Namesof the network interfaces you want to associate with the certificate as the SubjectAltName field.
- Select theKey Length. Select one of the following key lengths:
- 512
- 1024
- 2048
- Select theSigning Algorithm. Note:You must use the SHA256withRSA signing algorithm for certificates used with EBICS transactions.
- Select theValidate When Usedoption. Validation options are:
- Validity – Verifies dates in the validity period of the certificate are still in effect. If the dates are not in effect, the certificate is not used.Note:Before you set a value to the validity period of the certificate, you must read and apply the best practice recommendations from the Microsoft PKI Quick Guide. For information about the best practice recommendations for using certificates, see http://www.windowsecurity.com/articles/Microsoft-PKI-Quick-Guide-Part3.html.
- Auth Chain – Constructs a chain of trust for certificates that are not self-signed. If a chain of trust cannot be constructed using valid certificates, the certificate is not used. If the certificate is self-signed, this option verifies only the certificate signature.
- Set theCertificate Signing Bitby selecting the check box.
- ClickNext.
- Review the information about the self-signed certificate.
- ClickFinish.
Based on security policies at your site, Certificate Authority (CA) certificates in the Java Key Store (JKS) can also be checked in through the console.
Before you begin, save any CA certificates that you obtained externally to a local file.
Check in all the certificates (identification and authentication, signing, and encryption) the EBICS Client user requires to transact with the bank. If a CA-signed certificate is used for configuring a user, then check in the Root CA certificate. If 3SKey is used for signing, then check in the Root 3SKey certificate. Check in the public part of the HTTPS certificate of the server into the CA store ofSterling B2B Integrator. For more information about managing digital certificates, see the Sterling B2B IntegratorSecurity documentation.
To check in a CA certificate:
- Log in toSterling B2B Integrator.
- From theAdministration Menu, select Trading Partner>Digital Certificates>CA.
- Next toNew Certificate, click Go!
- Select a method to import certificates:
Import method
Next Steps
Import from JVM – Imports from the JKS keystore
- ClickImport from JVM.
- Accept the default password that appears in the password field and clickNext.
If the password field is empty, the system still uses the default password.
Import from File – Imports certificates saved as a file on a local drive
- ClickImportfrom File.
- Enter the file name or clickBrowseto select a CA certificate file. Click Next.
You may ignore the password that is displayed in the password field. There is no need to erase the entry.
Available certificates are listed with a summary of identifying information. All certificates are selected by default.
- Select the check boxes to the left of each entry to import the certificates.
- For each certificate selected, accept the suggested Certificate Name or edit it based on your file naming conventions.
- Select theValidate When Usedoption and click Next. Validation options are:
- Validity – Verifies dates in the validity period of the certificate are still in effect. If the dates are not in effect, the certificate is not used.
- Auth Chain – Attempts to construct a chain of trust for certificates that are not self-signed. If a chain of trust cannot be constructed using valid certificates, the certificate is not used. If the certificate is self-signed, this option verifies only the certificate signature.
- If you receive a message stating that the certificate duplicates a certificate already in the database, enter Y or N to indicate whether to import the duplicate or not.
This check is done on single certificates only. It does not take place when checking in one or more certificates from a file.
Certificates are identified by SHA1 or SHA256 hash for purposes of determining duplicates. More than one copy of a certificate can be present in the database, since each certificate populates a different row and has a distinct object ID. The existing certificate is not overwritten.
- Review the CA certificate information.
- ClickFinish.
You can check in a trusted system certificate from theAdministrationmenu.
Check in the public part of the user's certificate into the Trusted store ofSterling B2B Integrator.
Before you begin, save the trusted system certificate to a file on your local computer.
To check in a trusted system certificate:
- Choose one of the following options:
- If you useSterling B2B Integrator, from the Administration Menu, select Trading Partner>Digital Certificates>Trusted.
- If you use the AS2 Edition, from theAS2 Administration Menu, select Certificates.
- Next toNew Certificate, click Go!
- Enter theFilenameor click Browseto select the file name of the trusted certificate and then click Next.
- Enter theCertificate Name.
- Verify the name of the trusted certificate you are checking in.For each certificate you selected, the Certificate Name field shows a suggested name, followed by a summary of the identifying information in the certificate. You can change the name based on your file naming conventions.
- If you have more than one trusted certificate contained in the file you selected, select the check box to the left of each certificate to check in the certificate.
- Select theValidate When Usedoption and click Next. Validation options are:
- Validity – Verifies dates in the validity period of the certificate are still in effect. If the dates are not in effect, the certificate is not used.
- Auth Chain – Attempts to construct a chain of trust for certificates that are not self-signed. If a chain of trust cannot be constructed using valid certificates, the certificate is not used. If the certificate is self-signed, this option verifies only the certificate signature.
- CRL cache – Controls whether the Certificate Revocation List is consulted each time the system certificate is used.
- Review the trusted certificate information.
- ClickFinish.
You can check in a key system certificate from theAdministrationmenu.
Before you begin, save the key system certificate to a file on your local computer. Check in the private part of the CA-signed certificates into the Key system certificates ofSterling B2B Integrator.
To check in a key system certificate:
- Choose one of the following options:
- If you useSterling B2B Integrator, from the Administration Menu, select Trading Partner>Digital Certificates>System.
- If you use the AS2 Edition, from theAS2 Administrationmenu, select Certificates.
- Next toKey Certificate, click Go!
- Enter theCertificate Name.
- Enter thePrivate Key Password.This password is used to encrypt the private key.
- Enter theFilenameor click Browseto select the file name of the key certificate and click Next.
- Select theValidate When Usedoption and click Next. Validation options are:
- Validity – Verifies dates in the validity period of the certificate are still in effect. If the dates are not in effect, the certificate is not used.
- Auth Chain – Constructs a chain of trust for certificates that are not self-signed. If a chain of trust cannot be constructed using valid certificates, the certificate is not used. If the certificate is self-signed, this option verifies only the certificate signature.
- Review the key certificate information.
- ClickFinish.
Previous Topic
Sterling B2B Integrator - Install EBICS Client Module Manually
Parent Topic
Sterling B2B Integrator - EBICS Client User
Next Topic
Sterling B2B Integrator - Configuring EBICS Client