Integration with SAP Hybris Marketing - Google AdWords and SAP Cloud Platform Integration

Integration Information SAP Hybris Marketing Document Version: 2.4.4 2018-02-05 Integration with SAP Hybris Marketing - Google AdWords and SAP Cloud Platform Integration How to Set Up the Integration with Google AdWords in SAP Cloud Platform Integration

Typographic Conventions Type Style Example Description Words or characters quoted from the screen. These include field names, screen titles, pushbuttons labels, menu names, menu paths, and menu options. Textual cross-references to other documents. Example EXAMPLE Example Example <Example> EXAMPLE Emphasized words or expressions. Technical names of system objects. These include report names, program names, transaction codes, table names, and key concepts of a programming language when they are surrounded by body text, for example, SELECT and INCLUDE. Output on the screen. This includes file and directory names and their paths, messages, names of variables and parameters, source text, and names of installation, upgrade and database tools. Exact user entry. These are words or characters that you enter in the system exactly as they appear in the documentation. Variable user entry. Angle brackets indicate that you replace these words and characters with appropriate entries to make entries in the system. Keys on the keyboard, for example, F2 or ENTER. 2 2018 SAP SE or an SAP affiliate company. All rights reserved.

Document History Caution Before you start, make sure that you have the latest version of this document. You can find the latest version at the following location: http://help.sap.com/mkt. The following table provides an overview of the most important document changes. If the information you are looking for is not described in this guide or if you find something described incorrectly, please send an email to mailto:saphybrismarketingfeedback@sap.com and we'll update this guide. Version Date Change 1.0 2016.02-03 Initial Version 1.0.1 2016.05.17 Added missing HCI customizing 2.3 2016.07.06 Added 2 new HCI services required for custom audience (OnPremise and Cloud) 2.3.1 2016.07.18 Changed component in section 1.3.1 from CEC-MKT-CEI-SEM-PSI to CEC- MKT-SEM-PSI 2.3.2 2016.07.25 Changed order of steps in section 1.3 2.3.3 2016.08.03 Added a note about installing certificates on HCI customer tenant in section 1.3.1 2.3.4 2016.09.14 Added Trigger the execution of Paid Search Service 1.3.8, change the sequence of steps for the OAuth 2.0 access token 2.3.5 2017.06.29 Changed all mentions of HCI to SAP Cloud Platform Integration 2.4.1 2017.07.27 Added appendix: Certificates for Integrating SAP Hybris Marketing Paid Search Application and Google AdWords using SAP Cloud Platform Integration 2.4.2 2017.08.09 Added appendix: Certificate Authentication Overview 2.4.3 2017.08.17 Added notes about Appendix 2 to sections 1.3.5 and 1.3.6 2.4.4 2017.12.12 Updated section 2.2.2.Import Google Authority Certificate in the SAP Cloud Platform Integration tenant keystore. Customer Client Certificate Document History 2018 SAP SE or an SAP affiliate company. All rights reserved. 3

Table of Contents 1 SAP Hybris Marketing - Google AdWords - SAP Cloud Platform Integration... 5 1.1 Overview of System Integration... 5 1.2 Google AdWords configuration... 5 1.3 SAP Cloud Platform Integration Configuration... 6 1.3.1 Create a SAP Support ticket to allow your SAP Cloud Platform Integration tenant to send request to Google AdWords via SAP central tenant.... 6 1.3.2 Ensure your SAP Cloud Platform Integration Admin User has the correct rights... 7 1.3.3 Create credentials for your SAP Cloud Platform Integration Admin User in your SAP Cloud Platform Integration tenant... 7 1.3.4 Install SAP Hybris Marketing Paid Search package... 8 1.3.5 On-Premise and SAP Cloud Platform Integration tenant... 10 1.3.6 Set up your connection between SAP Hybris Marketing Cloud and SAP Cloud Platform Integration tenant... 14 1.3.7 Set up your OAuth 2.0 access token... 17 1.3.8 Trigger the execution of Google AdWords Integration Service...20 2 Appendix 1: Certificates for Integrating SAP Hybris Marketing Paid Search Application and Google AdWords using SAP Cloud Platform Integration...23 2.1 Inbound Communication SAP Hybris Marketing SAP Cloud Platform Integration... 23 2.1.1 Step 1: Download Root SSL certificate for SAP Cloud Platform Integration... 24 2.1.2 Step 2: Import Root Certificate Used to Sign SAP Cloud Platform Integration SSL Server Certificate into SAP Hybris Marketing SSL Client... 27 2.2 Outbound Communication SAP Cloud Platform Integration tenant Google AdWords... 30 2.2.1 Step 1: Download Google Authority Certificates... 30 2.2.2 Step 2: Import Google Authority Certificate in the SAP Cloud Platform Integration tenant keystore... 31 3 Appendix 2: Certificate Authentication Overview... 34 3.1 Set authentication method as Client Based Certificate in Service Configuration... 34 3.1.1 SAP Hybris Marketing Cloud... 34 3.1.2 SAP Hybris Marketing On-Premise... 35 3.2 Import the authentication certificate in the IFLOWs... 37 4 Terms of Use... 38 4 2018 SAP SE or an SAP affiliate company. All rights reserved. Customer Client Certificate Table of Contents

1 SAP Hybris Marketing - Google AdWords - SAP Cloud Platform Integration 1.1 Overview of System Integration The following chart provides an overview of the configuration of SAP Hybris Marketing - Google AdWords Integration. SAP Cloud Platform Integration is used as a middleware between SAP Hybris Marketing and Google AdWords. It is responsible for account authentication with OAuth 2.0 and any other API communication routing between the two systems. Therefore, to run SAP Hybris Marketing - Google AdWords Integration, the following configuration is required on SAP Cloud Platform Integration and Google AdWords. 1.2 Google AdWords configuration You first need to have all of the Google AdWords accounts you want to manage from SAP Hybris Marketing - Google AdWords Integration under a single Google AdWords Manager Account. If you do not have one already, follow the link below to create one and grant access from all other accounts you want to manage from SAP Hybris Marketing - Google AdWords Integration to your Manager Account. https://www.google.com/adwords/manager-accounts/ 2018 SAP SE or an SAP affiliate company. All rights reserved. 5

1.3 SAP Cloud Platform Integration Configuration Prerequisites You must have an SAP Cloud Platform Integration Tenant and account. If not please get one: https://help.sap.com/viewer/368c481cd6954bdfa5d0435479fd4eaf/cloud/en- US/60359ca5fa9545149d279494320b6a5a.html http://go.sap.com/solution/cloud.html You have a Google AdWords MCC Account: https://www.google.com/adwords/manager-accounts/ Set Your SAP Cloud Platform Integration Admin User Credentials The Google AdWords integration is a three-step process, 1. SAP Hybris Marketing calling your SAP Cloud Platform Integration Tenant, 2. SAP Cloud Platform Integration Tenant calling our SAP Central Tenant. 3. SAP Central tenant calling Google AdWords. For step 2, you must maintain your SAP Cloud Platform Integration Admin user in a security artifact that will be used to call the SAP Central Tenant. Note that you will have to create an SAP Support ticket to enable your SAP Cloud Platform Integration Tenant admin user to get rights to call SAP Central Tenant services (see 1.3.1). 1.3.1 Create a SAP Support ticket to allow your SAP Cloud Platform Integration tenant to send request to Google AdWords via SAP central tenant. Open an incident ticket to SAP Support: https://support.sap.com/home.html under Component CEC-MKT-SEM- PSI (Paid Search Integration). In Description enter: User Request for PSI Central Tenant In the Communication section enter the ID of your SAP Cloud Platform Integration Admin User. SAP will then grant access to your SAP Cloud Platform Integration tenant to call Google AdWords via SAP Central tenant. Note Certificates for Integrating SAP Hybris Marketing Paid Search Application and Google AdWords using SAP Cloud Platform Integration : Appendix 1 at the bottom of this document outlines the required steps on customer side to configure the certificates in the context of integration between SAP Hybris Marketing Paid Search and Google AdWords using SAP Cloud Platform Integration. 6 2018 SAP SE or an SAP affiliate company. All rights reserved.

1.3.2 Ensure your SAP Cloud Platform Integration Admin User has the correct rights 1. Go to your tenant cockpit 2. Go to Authorization - Group Ensure the user Admin User has the following authorizations assigned o Application: <tenantid>iflmap o Role: ESBMessaging.send 1.3.3 Create credentials for your SAP Cloud Platform Integration Admin User in your SAP Cloud Platform Integration tenant Navigate to your tenant UI to the Monitor section and click on Security Material tile Click on Add button at the bottom right of the screen to create a new artifact Name it HCI_PROXY_SERVICE_USER Enter the SAP Cloud Platform Integration user and password you have provided in section 1.3.1 Click OK Click on the Refresh icon, the HCI_PROXY_SERVICE_USER credential should appear. 2018 SAP SE or an SAP affiliate company. All rights reserved. 7

1.3.4 Install SAP Hybris Marketing Paid Search package 1. From your SAP Cloud Platform Integration Tenant go to your Discover page. 2. Click on Show All on top right of central panel 3. Click on the filter icon on the top right of the central panel and select SAP hybris Marketing from the Product section 4. From the SAP Hybris Marketing Google AdWords Paid Search Integration tile, click on Copy to Workspace 5. Go to your Design section. 6. From the left panel select the SAP Hybris Marketing Google AdWords Paid Search Integration 7. Select the tab ARTIFACTS. 8. For each Artifact, from the central panel click on the Actions icon and select Deploy. Please note that com.sap.hybris.mkt.gaw.oauth_proxy must be deployed first because the other artifacts have a reference to this project. You now have your SAP Hybris Marketing Paid Search Integration package installed on your SAP Cloud Platform Integration tenant. Configure SAP Hybris Marketing Paid Search Integration package artifacts Get your tenant host address From your tenant, go to the Monitor section and click on the Manage Integration Content tile, you see a list of all Integration Content installed on your tenant. Or any entry Click on the Status column (i.e. Started(1)) of any entry On the top right corner there is an Endpoints URL copy somewhere the base URL (i.e. everything before /cxf/com.sap.hybris.mkt.gaw.performance, excluding HTTPS://) you will need it for the next step for the Receiver HostAddress. Set RECEIVER and PARAMTERS From the Design section, for each of the artifacts: Click the Actions button and select Configure and go to the RECEIVER section and select OAUTH_PROXY in the 8 2018 SAP SE or an SAP affiliate company. All rights reserved.

Receiver field, then paste the base URL you previously copied in the HostAddress input field For Read Google AdWords Campaign Performance Report additionally paste also the base URL you previously copied in the HostAddress input field for the REFRESH_PROXY receiver In the PARAMTERS section enter your MCC Google AdWords Account ID consisting of 10 digits. The format is: XXX-XXX-XXXX (including the dashes) Select Save in the bottom menu and then Deploy. 2018 SAP SE or an SAP affiliate company. All rights reserved. 9

1.3.5 On-Premise and SAP Cloud Platform Integration tenant There are six services used in the Google AdWords Integration. For each of these services a Web Service Logical Port configuration need to be made in Hybris Marketing so that it can invoke the services on your SAP Cloud Platform Integration Tenant. Note All the configuration steps below are based on basic authentication (user/password) between SAP Hybris Marketing and the SAP Cloud Integration Platform. Authentication based on Client Certificates is also possible. Please refer to Appendix 2: Certificate Authentication Overview. 1. From your ABAP server run transaction SOAMANAGER From the Web Interface, select Web Service Configuration Search for Object Name: CampaignServiceReadInterface Click the service from the result list Click Create to define a new Logical Port using Manual Configuration option o Set Logical Port Name: DEFAULT o Set Logical Port is Default o Click Next o set Authentication Setting: User ID / Paeddssword and enter it 10 2018 SAP SE or an SAP affiliate company. All rights reserved.

From the Messaging tab, ensure Message ID Protocol issuppress ID Transf From the Transport Setting tab, o Set URL Access Path:/cxf/com.sap.hybris.mkt.gaw.campaignServiceRead o Set Computer Name of Access URL: with the URL to your SAP Cloud Platform Integration tenant (without HTTP://) o Set Port Number of Access URL to :443 o Set URL Protocol Information to:https 2018 SAP SE or an SAP affiliate company. All rights reserved. 11

Repeat the same for these 3 other services and replace the value of the following steps: ManagedCustomerServiceInterface Search for Object Name: ManagedCustomerServiceInterface From the Transport Setting tab, o Set URL Access Path:/cxf/com.sap.hybris.mkt.gaw.managedCustomerService CampaignServiceCreateInterface Search for Object Name: CampaignServiceCreateInterface From the Transport Setting tab, o Set URL Access Path:/cxf/com.sap.hybris.mkt.gaw.campaignServiceCreate reportdefinition Search for Object Name: reportdefinition From the Transport Setting tab, o Set URL Access Path:/cxf/com.sap.hybris.mkt.gaw.performance AdGroupCriterionServiceInterface Search for Object Name: AdGroupCriterionServiceInterface From the Transport Setting tab, o Set URL Access Path:/cxf/com.sap.hybris.mkt.gaw.adGroupCriterionService AdwordsUserListServiceInterface Search for Object Name: AdwordsUserListServiceInterface From the Transport Setting tab, o Set URL Access Path:/cxf/com.sap.hybris.mkt.gaw.adwordsUserListService 2018 SAP SE or an SAP affiliate company. All rights reserved. 13

1.3.6 Set up your connection between SAP Hybris Marketing Cloud and SAP Cloud Platform Integration tenant There are six services used in the Google AdWords Integration. For each of these services a Web Service Logical Port configuration need to be made in Hybris Marketing so that it can invoke the services on your SAP Cloud Platform Integration Tenant. Note All the configuration steps below are based on basic authentication (user/password) between SAP Hybris Marketing and the SAP Cloud Integration Platform. Authentication based on Client Certificates is also possible. Please refer to Appendix 2: Certificate Authentication Overview. 1.3.6.1 Setting up the Communication System Before you can set up your Communication Arrangement, you must set up the communication system that points to the SAP Cloud Platform Integration tenant in use. To set up the communication system, follow these steps: 1. Log on to your SAP S/4 HANA, cloud marketing edition system with a user that has administrator authorizations. 2. From the SAP Fiori Launchpad choose the Communication Systems app. Choose New. Enter an ID and a system name for your communication system. Choose Create. In the Communication System Draft screen, fill in the following: o Under Technical Data, enter the Host Name:<your SAP Cloud Platform Integration tenant base URL>. o Under User for Outbound Communication: choose the plus (+) sign and type in: o Authentication Method:User Name and Password o User Name:<your SAP Cloud Platform Integration tenant admin user> o Password: <your SAP Cloud Platform Integration tenant admin user password> o Choose Create Save your changes and exit the app. 14 2018 SAP SE or an SAP affiliate company. All rights reserved.

1.3.6.2 Setting up the Communication Arrangement Once you have set up the communication system that points to the SAP Cloud Platform Integration tenant, you must set up the communication arrangement. There are four services used in the Google AdWords Integration. For each of these services a Web Service Logical Port configuration must be made in SAP Hybris Marketing to invoke the services on your SAP Cloud Platform Integration Tenant. Follow these steps to set up the communication arrangement: 1. Log on to your SAP S/4 HANA, cloud marketing edition system with a user that has administrator authorizations. 2. From the SAP Fiori launchpad, choose the Communication Arrangements app. 3. Create a new communication arrangement. 4. Choose the scenariosap_com_0030 (Marketing - Google AdWords Integration) 5. Enter an arrangement name. 6. Choose Create. 7. In the Communication Arrangement screen, fill out the following: 1. Choose the communication system that you created previously. 2. Choose the SAP Cloud Platform Integration User that you assigned to the communication system. 3. Under Outbound Services fill in the services as follows: o Service Status: Active Path: /cxf/com.sap.hybris.mkt.gaw.performance Port: 443 o Service Status: Active Path: /cxf/com.sap.hybris.mkt.gaw.campaignserviceread Port: 443 o Service Status: Active Path: /cxf/com.sap.hybris.mkt.gaw.campaignservicecreate Port: 443 o Service Status: Active Path: /cxf/com.sap.hybris.mkt.gaw.managedcustomerservice Port: 443 o Service Status: Active Path: /cxf/com.sap.hybris.mkt.gaw.adwordsuserlistservice Port: 443 2018 SAP SE or an SAP affiliate company. All rights reserved. 15

1.3.7 Set up your OAuth 2.0 access token All the SAP Hybris Marketing calls to Google AdWords APIs are authenticated using OAuth2. This step is to request from Google AdWords an authorization code that SAP Cloud Platform Integration will use to exchange for an access token. Please note that this is a onetime process. All the subsequent actions related to the acquisition and refresh of OAuth2 tokens are handled automatically by the SAP Hybris Marketing Google AdWords Integration application. Before you perform this step, you should be ready to trigger the execution of any of the SAP Hybris Marketing - Google AdWords Integration services. The reason is that the authorization code must be used within a few minutes after its acquisition from Google for an exchange of a refresh token. Otherwise it expires. Please refer to section 1.3.8 on how to trigger the execution of the one of the SAP Hybris Marketing - Google AdWords Integration services. Please make sure you are ready to trigger the call to Google AdWords as described in section 1.3.8 before you request and deploy the authorization code. If an issue occurs and you re a not able to trigger the call after you get and deploy the authorization code, you can request a new authorization code from Google AdWords and deploy it again as described in the steps below. To request your authentication token from OAuth2, click the following: Request Google Authorization Code If the hyper link didn't work, please paste the following URL in your browser: https://accounts.google.com/o/oauth2/auth?client_id=598700112637- qr3evdaj7ctgckak67l09rqqvc8nj5mq.apps.googleusercontent.com&response_type=code&scope=h ttps%3a%2f%2fwww.googleapis.com%2fauth%2fadwords&redirect_uri=urn:ietf:wg:oauth:2.0:oo b&access_type=offline&approval_prompt=auto You will then see a logon screen. Please note that you must sign in with the Google Account Email associated with your Google AdWords MCC account. 2018 SAP SE or an SAP affiliate company. All rights reserved. 17

After you accept the request, you will get an authorization code directly in your browser. That authorization code can be exchanged for an access token. Copy the Google Authorization code in your SAP Cloud Platform Integration tenant as follows: Navigate to your tenant UI to the Monitor section and click on Security Material tile 2018 SAP SE or an SAP affiliate company. All rights reserved. 19

Click on Add button at the bottom right of the screen to create a new artifact Name it GoogleAdWordsCode Set the User to GoogleAdWordsCode. Please make sure there is no empty space before or after GoogleAdWordsCode. Paste your Google Authorization Code in the Description, Password and Repeat Password fields Click OK Click on the Refresh icon, the GoogldAdWordsCode credential should appear. 1.3.8 Trigger the execution of Google AdWords Integration Service The first service to be called by the application is the service that reads the Google AdWords Accounts "com.sap.hybris.mkt.gaw.managedcustomerservice". If you have access to SAP Hybris Marketing UI: 1. Logon to SAP Hybris Marketing UI 2. Click on Tile "Campaigns" 3. Select "Create" and choose "AdWords Campaign" and click "Create" 4. Select the "ADWORDS CAMPAIGN" box and click on the "Google AdWords Account" selection box 20 2018 SAP SE or an SAP affiliate company. All rights reserved.

5. You should see a list of Google AdWords Accounts Screen shot If you do not have access to the SAP Hybris Marketing UI, you can use POSTMAN to trigger the call to the service as follow: Use Basic Authentication: Use the following Payload in the request body: <soapenv:envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/xmlschema" xmlns:xsi="http://www.w3.org/2001/xmlschemainstance"> <soapenv:body> <get xmlns="https://adwords.google.com/api/adwords/mcm/v201506" xmlns:ns0="https://adwords.google.com/api/adwords/cm/v201506">  <serviceselector >  <ns0:fields>customerid</ns0:fields> </serviceselector> </get> </soapenv:body> 2018 SAP SE or an SAP affiliate company. All rights reserved. 21

2 Appendix 1: Certificates for Integrating SAP Hybris Marketing Paid Search Application and Google AdWords using SAP Cloud Platform Integration This section outlines the required steps on the customer side to configure the certificates in the context of integration between SAP Hybris Marketing Paid Search and Google AdWords using SAP Cloud Platform Integration. Dsds 2.1 Inbound Communication SAP Hybris Marketing SAP Cloud Platform Integration The client should trust the server and the server should trust the client for a mutual SSL handshake to happen. In this context, SAP Hybris Marketing is the Client and SAP Cloud Platform Integration is the server accepting the request. 2018 SAP SE or an SAP affiliate company. All rights reserved. 23

The SAP Cloud Platform Integration load balancer authenticates itself as server against SAP Hybris Marketing based on a certificate. To enable this security measure, the keystore of the load balancer contains a server certificate signed by a certification authority. On the other side of the communication, the keystore of the connected SAP Hybris Marketing system must contain the SAP Cloud Platform Integration load balancer server root certificate. The other way around, the identity of the sender is checked by SAP evaluating the credentials (user and password) against the user stored in the SCN database. Steps to be performed by Customer: SAP Hybris Marketing should trust SAP Cloud Platform Integration as server The Customer SAP Cloud Platform Integration tenant worker node URL has the certificate chain which should be imported to SAP Hybris Marketing System Certificate Trust List. 2.1.1 Step 1: Download Root SSL certificate for SAP Cloud Platform Integration 1. Open a web explorer and enter the URL of the SAP Cloud Platform Integration tenant worker node that was provided in the onboarding e-mail adding the path/cxf at the end. 2. When connected use the web explorer to get the certificate. 3. In the Certification Path tab select first root certificate Baltimore CyberTrust Root and click View Certificate. 24 2018 SAP SE or an SAP affiliate company. All rights reserved.

2.1.2 Step 2: Import Root Certificate Used to Sign SAP Cloud Platform Integration SSL Server Certificate into SAP Hybris Marketing SSL Client 2.1.2.1 SAP Hybris Marketing On-Premise 1. Call transactionstrust 2. Open the folder SSL client SSL Client (Standard) 3. In the Certificate area, click the Import Certificate button. 4. Select the root certificate used to sign the SAP Cloud Platform Integration SSL server (Import the root certificate saved in Step 1: Download Root SSL certificate for SAP Cloud Platform Integration) 2018 SAP SE or an SAP affiliate company. All rights reserved. 27

5. Add the imported certificate to the certificate list by clicking Add to Certificate List and Save the changes. 6. Repeat steps number 1 to 5 but in step number 2, select the folder SSL client SSL Client (Anonymous) 2.1.2.2 SAP Hybris Marketing Cloud The CA for the SAP Cloud Platform Integration server certificate should be in the trust list of SAP Hybris Marketing. o Check if your Cloud application has the Baltimore certificate. o Login to SAP Hybris Marketing Cloud o Check if the Baltimore CyberTrust Root is listed under list of trusted root certificates in the Certificate Trust List view by selecting the following tile: 28 2018 SAP SE or an SAP affiliate company. All rights reserved.

o if not, import this certificate (saved in Step 1: Download Root SSL certificate for SAP Cloud Platform Integration). o Go to the Certificate Trust List view and select Add Certificate o Select the Baltimore CyberTrust Root Certificate File Saved in Step 1 o Check if the Baltimore Cybertrust Root Certificate was added successfully to the Certificate Trust List (as shown in screenshot above). 2018 SAP SE or an SAP affiliate company. All rights reserved. 29

2.2 Outbound Communication SAP Cloud Platform Integration tenant Google AdWords Steps to be performed by Customer: SAP Cloud Platform Integration should trust Google AdWords as server 2.2.1 Step 1: Download Google Authority Certificates Paste the following URL in a Web Browser: https://pki.google.com/ Google Internet Authority certificate can be downloaded by clicking on the following link: 30 2018 SAP SE or an SAP affiliate company. All rights reserved.

2.2.2 Step 2: Import Google Authority Certificate in the SAP Cloud Platform Integration tenant keystore Step 1: Import the Certificate in a new Keystore using an external tool 1. Install KeyStore tool (Example: KeyStore Explorer tool) 2. Create a new Keystore: 3. Import the Google Authority certificate into the new Keystore: o Select Tools Import Trusted Certificate o Select the certificate (that you got in step Error! Reference source not found. of the Integration Guide) 2018 SAP SE or an SAP affiliate company. All rights reserved. 31

4. Save Keystore. Step 2: Upload this Keystore in the existing tenant Keystore Monitor using the Add action Important: Please make sure you Add the new Keystore and not Replace the existing Keystore by following the instructions below 1. Go to Tenant WEB UI Operations View (Monitor). In the Manage Security area, you will find the Keystore tile, which informs you about the number of keys and certificates available in the tenant Keystore. 2. Click on the Keystore Tile and select the Add button: 32 2018 SAP SE or an SAP affiliate company. All rights reserved.

3. An upload dialog will appear asking for the Keystore to upload and the password of the Keystore. o Select the Keystore file created in Step 1 and enter the password for the keystore. Note: Ensure that you select the Add action. With the Replace and Overwrite options, existing entries will be overwritten. After the import, a confirmation screen will be shown summarizing which entries were added 2018 SAP SE or an SAP affiliate company. All rights reserved. 33

3 Appendix 2: Certificate Authentication Overview A stronger method of authenticating users is to use X.509 certificates. These certificates allow both parties in the conversation to verify their identities and have their identities bound to roles within the two landscapes. This is the SAP preferred means to communicate between the customer installation and the SAP Cloud Platform Integration tenant due to its high security and inbuilt mechanisms to prevent many kinds of security attacks. This comes at the cost of requiring a more complex skill set to implement. 3.1 Set authentication method as Client Based Certificate in Service Configuration 3.1.1 SAP Hybris Marketing Cloud Communication Scenario Select SSL Client Certificate as authentication method for Outbound Communication 34 2018 SAP SE or an SAP affiliate company. All rights reserved.

Communication Arrangement: Download SSL Certificate Download the authentication certificate and save the file locally 3.1.2 SAP Hybris Marketing On-Premise Customer Client Certificate The customer installation will be required to generate a certificate that has as a root a CA that is trusted by the SAP Load Balancer. This certificate will be added to a PSE (SSL Client Standard) (STRUST keystore). Please refer to a following link for the certificates list supported by the Load balancer: https://help.sap.com/viewer/368c481cd6954bdfa5d0435479fd4eaf/cloud/en- US/4509f605e83c4c939a91b81eb3a6cdea.html The certificate must be then downloaded and saved locally, because it will be needed in the IFLOW configuration. 2018 SAP SE or an SAP affiliate company. All rights reserved. 35

Web Services configuration In tranaction SOAMANAGER /Consumer Security Setting tab, when you configure your Paid Search Web Services, you must select SSL Client Certificate as Authentication method instead of User ID / Password as shown below. Please select the SSL Client PSE as defined in the previous section (Customer Client Certificate ). 36 2018 SAP SE or an SAP affiliate company. All rights reserved.

3.2 Import the authentication certificate in the IFLOWs Import the authentication certificate for each of the following IFLOWS: com.sap.hybris.mkt.gaw.managedcustomerservice com.sap.hybris.mkt.gaw.campaignserviceread com.sap.hybris.mkt.gaw.campaignservicecreate com.sap.hybris.mkt.gaw.adwordsuserlistservice com.sap.hybris.mkt.gaw.adgroupcriterionservice com.sap.hybris.mkt.gaw.performance (Please do not change com.sap.hybris.mkt.gaw.oauth_proxy) Follow these steps: 1. Open the IFLOW 2. Select Sender 3. Click on Browse in the Properties Tab and Import the certificate downloaded in (section 3.1.1 SAP Hybris Marketing Cloud or section 3.1.2 SAP Hybris Marketing On-Premise depending on your type of installation) 4. Save and Deploy the IFLOW 2018 SAP SE or an SAP affiliate company. All rights reserved. 37

4 Terms of Use Google API calls are restricted, to what is delivered as part of SAP Google AdWords SAP Cloud Platform Integration package. For any additional custom extensions or calls to AdWords, the customer should request its own API key and advise SAP. 38 2018 SAP SE or an SAP affiliate company. All rights reserved.

www.sap.com/contactsap 2018 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE. The information contained herein may be changed without prior notice. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE and its affiliated companies ( SAP Group ) for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE in Germany and other countries. Please see www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices. Material Number: