Crystal Reports 2013 Salesforce.com Driver Encryption Protocol

[Former Member]

What encryption protocol does Crystal Reports 2013 Salesforce.com Driver use - SSL or TLS? If SSL, can it be changed to TLS?

We are getting logon errors now that our Salesforce database has move to the new Salesforce Government Cloud that requires TLS 1.0 or greater.

Thanks!

[vitaly_izmaylov · Accepted solution]

According to SAP KBA 2092680 - SAP Crystal Reports, Salesforce.com and SSL vulnerability,

Salesforce.com announced disabling SSL 3.0 encryption: (https://help.salesforce.com/apex/HTViewSolution?urlname=Salesforce-disabling-SSL-3-0-encryption&lang...).

Resolution

SAP Crystal Reports 2013 is using Simba ODBC driver to connect to Salesforce.com. According to Simba developers the driver does not rely on SSL
3.0. The driver would not be affected.

For Crystal Reports 2008 and SAP Crystal Reports 2011 the Salesforce.com connectivity uses Java based driver and JDK 1.5 and 1.6 support both SSL 3.0 and TLS 1.0. There should not be any problem switching to TLS 1.0 encryption.

If users have any concerns about security it is possible to disable the SSL 3.0 suing the following registry key for SAP Crystal Reports 2011 on 64 bit
machine:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SAP BusinessObjects\Suite XI 4.0\Crystal Reports

“JVMOptions” =”-Dhttps.protocols=TLSv1”

[Former Member · Accepted solution]

In addition to TLSv1 or greater Salesforce Govt Cloud requires specific encryption:

AES256-SHA

AES256-SHA256 (TLSv1.2 only)

AES128-SHA

AES128-SHA256 (TLSv1.2 only)

DES-CBC3-SHA (aka 3DES)

Can we verify what the Simba OBDC driver is using?

Thanks!

[vitaly_izmaylov · Accepted solution]

Thank you, Mark,

Simba driver documentation you can find in CR Installation folder at:

C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sforce 

There are 4 pdf files, but I was not able to find encryption info there.

Could you please refer to the relevant SFDC documentation?

I will forward the request to Product Developers so they can verify with Simba.

Thanks

[Former Member]

Thanks Vitaly,

We were able to confirm that the salesforce driver is using the proper TLS 1 and AES256-SHA so this is not the issue.

The actual issue is a hard-coded reference in the Partner WSDL for the SOAP endpoint that the was used in building the driver.

<port binding='tns.SoapBinding" name="Soap">

<soap:address location="https://login.salesforce.com/services/Soap/u/33.0"/>

</port>

This needs to point to the "My Domain" configured for the target Salesforce org. In order to target a specific org on Gov Cloud, the Crystal Report user needs to be able to enter the my domain name for driver to use instead of login in the soap endpoint url:

e.g. replace "login" with "mydomain.my"

Thanks,

Greg

[vitaly_izmaylov]

Thank for the detailed investigation.

Before forwarding the issue to developers I would like to get the version number of Crystal reports 2013 you used for investigation.

There were many defects in SFDC driver fixed after the initial release of CR 2013.

Including the following:

2111879  - Unable to connect to Salesforce.com Sandbox from Crystal Reports

It sounds similar to what you described, so please repeat your tests with versions of CR 2013

Support Pack 04 Patch 8 or

Support Pack 05 Patch 4

where the Sandbox problem got fixed.

Thanks

[Former Member]

We are using CR 2013 SP 05 Version 14.1.5.1501. How do I tell what Patch we're on?

[vitaly_izmaylov]

The version number 14.1.5.1501 means SP05 , but no Patches applied.

You need Patch 4.

Do you have access to Service Market Place downloads?

[Former Member]

Thanks Vitaly!!!! Patch 4 fixed our issue!

[Former Member]

Of course now that I have been able to add the new Gov Cloud database connection to our current reports and then trying to use the Set Datasource Location it will not let me Update the table instead throwing a "Data Object cannot be opened/accessed", "Unknown Database Connector Error".

Thoughts?

[vitaly_izmaylov]

Mark,

There is a big chance the driver still have defects or CR 2013 unable migrate existing reports from old driver to the new driver. We need some more details.

I usually suggest to have CR 2008 (with temporary keycode) on the same machine and compare reports. Another option is to have CR 2011 on another machine, but with the same keycode as CR 2013.

Here is the list of questions:

1. Is existing report connected to a standard SFDC table, Custom tables, SOQL command object, mixed or stored procedures.

2. Is the problem reproducible on multiple reports? What is similar between reports?

3. Is it possible to recreate similar report from scratch in CR 2013?

4. Does the existing report still works in CR 2008 or CR 2011?

5. Is this a problem of your specific SFDC domain or the issue could be reproduced on standard SFDC account?

Thanks,

Vitaly  

[Former Member]

Will CR 2008 be able to work with Gov Cloud? Our old org on the commercial cloud is no longer available. Or, perhaps against on of our old sandboxes which are still on commercial?

[vitaly_izmaylov]

As far as I know CR 2008 works with Sandboxes and Custom Domains.

The only limitation could be SFDC API level support.

CR 2008 does not support the latest API, whereas CR 2013 should be more in sync with SFDC.

[Former Member]

Sorry to keep bothering you but do you know where I can download a trial Crystal Reports 2008?

[Former Member]

1. Custom table

2. Problem is the same across all reports

3. I can create a report from scratch. Given the number and complexity of the reports I do not want to have re-create all the reports from scratch.

4. I downloaded CR 2008 and was able to able to change the Datasource location.

5. N/A based on 4.

Thanks,

Greg

[vitaly_izmaylov]

Ok, It means problems with Set Datasource Location for Custom tables. I will test similar scenario.

If you Set Datasource Location in CR 2008, save it and then open in CR 2013, would it work?

[Former Member]

Exactly, yes. I'm going through all the reports resetting the datasource in CR 2008, then opening the report in CR 2013 and then setting the override table names, and finally saving the report in CR 2013.