Set up TraceLink applications

Configure the Russia Compliance app

  1. Hover over Company Administration on the User profile in the top right of any screen, and then select Services.
  2. Select Configure Published Service for the Russia Compliance Service Type.
  3. Configure the options below:
    1. Under Service Information:
      1. Enter the Service Name for the company's instance of the app (optional).
      2. Enter a brief Description of the app, used in Link invitations sent to Partners (optional).
      3. Select whether other Members can see the app in Community from the Visibility radio buttons:
        • No, only invited companies can subscribe – (default) Only TraceLink Members invited by the company can see the app.
        • Yes, TraceLink members can request to subscribe – Any TraceLink Member can see the app in Community and request to Link to the app.
    2. Under Identifiers in Messages My Company Sends (optional):
      1. Enter the unique identifier type and value that identifies My Company ID in messages sent to Partners.
      2. Enter the unique Service ID that the company identifies the app with, formatted as [App Abbreviation].[My Company ID Value] (e.g. RUGR.7728640746).
    3. Under Identifiers in Messages My Company Receives (optional):
      1. Enter the unique identifier type and value that identifies My Company ID in messages received from Partners.
      2. Enter the Partner Company ID Type assigned to Partner companies in messages sent to the company.
      3. Enter the Partner Location ID Type assigned to Partner locations in messages sent to the company.
    4. On the Service Administrators tab, enter the User who should be a Manager of the app (i.e. the user responsible for configuring the application, linking to other applications and Partners, and granting users access to the app).
      1. Select Add Another Service Administrator to add another Manager.
    5. On the SAP IDoc Settings tab, enter any receiver or Partner settings (optional):
      1. Specify SAP IDoc Receiver Settings:
        1. Enter the SAP client number for the company in the My SAP Client Number field.
        2. Enter the SAP logical system name for the company in the My Logical System Name field.
        3. Enter the SAP logical system port for the company in the My Logical System Port field.
      2. Specify the SAP IDoc Partner Profile:
        1. Enter the SAP Sender Partner Number of the Partner that sends messages to the company.
        2. Enter the SAP Sender Partner Port of the Partner that sends messages to the company.
        3. Select the Sender Partner Type of the Partner that sends messages to the company.
        4. Enter the Sender Partner Function of the Partner that sends messages to the company if the Sender Partner Type is KU (Customer), LI (Vendor), or LS (Logical System).

    Configure domestic MDLP credentials if the reporting entity must use an exportable digital certificate when authenticating to MDLP.

    Russia Compliance supports exportable and non-exportable certificates to digitally sign reports that are submitted to MDLP. To configure non-exportable certificates, see Configuring non-exportable certificates for domestic credentials.

    Configuring exportable certificates for domestic MDLP credentials requires both the Web UI and the Digital Certificate Upload REST API. Administrators use the Web UI to configure the app and the REST API to upload digital certificates to a secure TraceLink server in Russia, which MDLP requires for domestic credentials.

    1. Select the MDLP Credentials tab.
    2. To update an existing credential:
      1. Select the Remove icon () next to the credential to update.
      2. Select Submit.

        The Manage Services screen displays, and TraceLink updates the Russia Compliance app.

      3. Select Configure Published Service for the Russia Compliance Service Type.
      4. Select the MDLP Credentials tab, and proceed to the next step to add the updated information for the credentials.
    3. To add a credential:
      1. Select Add Domestic Credentials.
      2. Enter the Russia Account Number registered with MDLP, which identifies the Reporting Entity.

        This value must be entered as an identifier in Company or Partner Master Data and must be unique within the application.

      3. Enter the Login Information, which identifies the credentials that the Reporting Entity uses to log in to the MDLP portal:
        • Enter the Russia-assigned MDLP User Name that the reporting entity uses to log in to the MDLP portal.
      4. Enter the credentials for the Accounting System (i.e. TraceLink) that the Reporting Entity registered with MDLP:
        1. Enter the Russia-assigned Client ID for the Accounting System.
        2. Enter the Russia-assigned Client Secret for the Accounting System.

          This information is available on the MDLP portal in Administration > Accounting System.

      5. For Domestic Credential Type, generate a security token and upload a digital certificate to the TraceLink server in Russia:
        1. Select Submit.

          The Manage Services screen displays, and TraceLink updates the Russia Compliance app.

        2. Select Configure Published Service for the Russia Compliance Service Type.
        3. Select the MDLP Credentials tab.
        4. Select Request Token for the DomesticCredential Type.

          The Token for Domestic Credentials dialog box displays with the security token used when uploading the digital certificate.

          The security token is valid for 30 minutes after generation.
        5. Select Copy Token.

          The dialog box closes and the token is copied to the clipboard.

        6. Insert the token into the Digital Certificate Upload REST API to complete the digital certificate upload.

    See Retrieve non-exportable certificates for domestic credentials for information about retrieving credentials for non-exportable certificates.

    Configure non-exportable certificate for domestic MDLP credentials if the reporting entity must use a non-exportable digital certificate when authenticating to MDLP.

    1. Select the MDLP Credentials tab.
    2. To update an existing credential:
      1. Select the Remove icon () next to the credential to update.
      2. Select Submit.

        The Manage Services screen displays, and TraceLink updates the Russia Compliance app.

      3. Select Configure Published Service for the Russia Compliance Service Type.
      4. Select the MDLP Credentials tab, and proceed to the next step to add the updated information for the credentials.
    3. To add a credential:
      1. Select Add Domestic Credentials.
      2. Enter the Russia Account Number registered with MDLP, which identifies the Reporting Entity.

        This value must be entered as an identifier in Company or Partner Master Data and must be unique within the application.

      3. Enter the Certificate ID which identifies the non-exportable certificate when authenticating to MDLP.
      4. Enter the Certificate Digest which identifies the non-exportable certificate when authenticating to MDLP.
      5. Enter the Login Information, which identifies the credentials that the Reporting Entity uses to log in to the MDLP portal:
        • Enter the Russia-assigned MDLP User Name that the reporting entity uses to log in to the MDLP portal.
      6. Enter the credentials for the Accounting System (i.e. TraceLink) that the Reporting Entity registered with MDLP:
        1. Enter the Russia-assigned Client ID for the Accounting System.
        2. Enter the Russia-assigned Client Secret for the Accounting System.

          This information is available on the MDLP portal in Administration > Accounting System.

      7. Select Submit.
        The User ID and Password generated by TraceLink display in the confirmation message. Use this User ID and Password when configuring the app to retrieve reports from Russia Compliance.

        Administrators must copy and retain the User ID and Password before dismissing the confirmation message. The User ID and Password are not displayed outside of the confirmation message and cannot be retrieved elsewhere.

    Configure foreign MDLP credentials if the reporting entity does not use a digital certificate when authenticating to MDLP.

    1. Select the MDLP Credentials tab.
    2. To update an existing credential:
      1. Select the Remove icon () next to any credentials that need to be updated.
      2. Select Submit.

        The Manage Services screen displays, and TraceLink updates the Russia Compliance app.

      3. Select Configure Published Service for the Russia Compliance Service Type.
      4. Select the MDLP Credentials tab, and proceed to the next step to add the updated information for the credentials.
    3. To add a credential:
      1. Select Add Foreign Credentials.
      2. Enter the Russia Account Number registered with MDLP, which identifies the Reporting Entity.

        This value must be entered as an identifier in Company or Partner Master Data and must be unique within the application.

      3. Enter the Login Information, which identifies the credentials that the Reporting Entity uses to log in to the MDLP portal:
        1. Enter the Russia-assigned MDLP User Name that the reporting entity uses to log in to the MDLP portal.
        2. Enter the Russia-assigned Password for the user name (displays and is required only if the Credential Type is Foreign).
      4. Enter the credentials for the Accounting System (i.e. TraceLink) that the Reporting Entity registered with MDLP:
        1. Enter the Russia-assigned Client ID for the Accounting System.
        2. Enter the Russia-assigned Client Secret for the Accounting System.

          This information is available on the MDLP portal in Administration > Accounting System.

  4. Select Submit.

    The Manage Services screen displays, and TraceLink updates the Russia Compliance app.

Retrieve non-exportable certificates for domestic credentials

Configuring non-exportable domestic MDLP credentials requires both the Web UI and the Russia Report Signature Appender app (an app for digitally signing the reports). Administrators use the Web UI to specify the non-exportable Certificate ID and Digest information, and the Russia Report Signature Appender app to authenticate and attach the digital signature to the Russia Compliance reports submitted to MDLP.

For Owners using a non-exportable certificate, the certificate must be installed on the Owner's internal system. TraceLink provides the Russia Report Signature Appender app, an open source app that Owners can install on their internal systems to retrieve reports from Russia Compliance that must be signed and send the digitally signed reports back to TraceLink to submit to MDLP. Owners can use the TraceLink-provided Russia Report Signature Appender app or build their own app for digitally signing the reports.

Owners who choose to use the Russia Report Signature Appender app provided by TraceLink must configure and use the Russia Report Signature Appender app. TraceLink will not release any updates for the Russia Report Signature Appender app after the initial release.

The Certificate ID is available in Thumbprint Details in Crypto Pro Certificate Manager.

Use the following commands in Powershell to retrieve the Certificate Digest:

  1. Convert .pfx certificate to .pem certificate: openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.pem

  2. Capture Digest value from certificate: openssl x509 -in certificate.pem -outform der | openssl dgst -sha1

When using a non-exportable certificate to authenticate to MDLP, Owners can use the TraceLink-provided Russia Report Signature Appender app or can build their own app to retrieve reports.

  1. Download the Russia Report Signature app from https://github.com/tracelink/russia-report-signature-appender.

  2. Enter the TraceLink-provided User ID and Password in the Russia Report Signature Appender app.

    On successful authentication, the Russia Report Signature Appender app retrieves the reports from Russia Compliance that must be signed and sends the digitally signed reports back to TraceLink to submit to MDLP.

Owners who choose to build their own app to retrieve and sign reports must integrate their app with the Report retrieval APIs.

See Report retrieval APIs for more information.

Configure the Russia Crypto Codes app

  1. Hover over Company Administration on the User profile in the top right of any screen, and then select Services.
  2. Select Configure Published Service for the Russia Crypto Codes Service Type.
  3. Configure the options below:
    1. Under Service Information:
      1. Enter the Service Name for the company's instance of the app (optional).
      2. Enter a brief Description of the app, used in Link invitations sent to Partners (optional).
      3. Select whether other Members can see the app in Community from the Visibility radio buttons:
        • No, only invited companies can subscribe – (default) Only TraceLink Members invited by the company can see the app.
        • Yes, TraceLink members can request to subscribe – Any TraceLink Member can see the app in Community and request to Link to the app.
    2. Under Identifiers in Messages My Company Sends (optional):
      1. Enter the unique identifier type and value that identifies My Company ID in messages sent to Partners.
      2. Enter the unique Service ID that the company identifies the app with, formatted as [App Abbreviation].[My Company ID Value] (e.g. RUGR.7728640746).
    3. Under Identifiers in Messages My Company Receives (optional):
      1. Enter the unique identifier type and value that identifies My Company ID in messages received from Partners.
      2. Enter the Partner Company ID Type assigned to Partner companies in messages sent to the company.
      3. Enter the Partner Location ID Type assigned to Partner locations in messages sent to the company.
    4. On the Service Administrators tab, enter the User who should be a Manager of the app (i.e. the user responsible for configuring the application, linking to other applications and Partners, and granting users access to the app).
      1. Select Add Another Service Administrator to add another Manager.
    5. On the SAP IDoc Settings tab, enter any receiver or Partner settings (optional):
      1. Specify SAP IDoc Receiver Settings:
        1. Enter the SAP client number for the company in the My SAP Client Number field.
        2. Enter the SAP logical system name for the company in the My Logical System Name field.
        3. Enter the SAP logical system port for the company in the My Logical System Port field.
      2. Specify the SAP IDoc Partner Profile:
        1. Enter the SAP Sender Partner Number of the Partner that sends messages to the company.
        2. Enter the SAP Sender Partner Port of the Partner that sends messages to the company.
        3. Select the Sender Partner Type of the Partner that sends messages to the company.
        4. Enter the Sender Partner Function of the Partner that sends messages to the company if the Sender Partner Type is KU (Customer), LI (Vendor), or LS (Logical System).
    1. Select the OMS Credentials tab.
    2. Select the Remove icon () to remove any credentials that need to be updated with the correct information (optional).
    3. Select Add Domestic Credentials or Add Foreign Credentials to add the appropriate Credential Type:
      • Domestic – The company manufactures product in Russia. The credentials are assigned to a single location (each location within Russia must use its own set of credentials to authenticate to the CRPT OMS).
      • Foreign – The company manufactures product in a country other than Russia. Each company has a single set of credentials that is shared between all of its locations outside of Russia.
      A company can have both Domestic and Foreign credentials if manufacturing takes place in Russia as well as in other countries.
    4. Enter the 36-digit OMS ID provided by CRPT.
    5. Enter the Address that the credentials are assigned to in the text field (optional).
    6. Select Retrieve Connection ID to retrieve a connection ID from OMS and populate the OMS Connection ID field.
    7. If the Credential Type is Domestic, select the manufacturing Location within Russia that the credentials are assigned to.

      or

      If the Credential Type is Foreign, select the identifier type and enter the identifier value of the MAH.

      This value must match the MAH ID entered in Product Master Data for each product with a Target Market of Russia and a Production Type of Imported.

    8. Select Test to validate the credentials with the CRPT OMS.

      The screen displays a confirmation message that indicates whether the credentials are validated successfully.

  4. Select Submit.

    The Manage Services screen displays, and TraceLink updates the Russia Crypto Codes app.