Set up TraceLink applications

  1. Hover over Company Administration on the User profile in the top right of any screen, and then select Services.
  2. Select Configure Published Service for the Russia Compliance Service Type.
  3. To configure the Service Information, Identifiers, Service Administrators and SAP IDOC settings, follow below steps:
    1. Under Service Information:
      1. Enter the Service Name for the company's instance of the app (optional).
      2. Enter a brief Description of the app, used in Link invitations sent to Partners (optional).
      3. Select whether other Members can see the app in Community from the Visibility radio buttons:
        • No, only invited companies can subscribe – (default) Only TraceLink Members invited by the company can see the app.
        • Yes, TraceLink members can request to subscribe – Any TraceLink Member can see the app in Community and request to Link to the app.
    2. Under Identifiers in Messages My Company Sends (optional):
      1. Enter the unique identifier type and value that identifies My Company ID in messages sent to Partners.
      2. Enter the unique Service ID that the company identifies the app with, formatted as [App Abbreviation].[My Company ID Value] (e.g. RUGR.7728640746).
    3. Under Identifiers in Messages My Company Receives (optional):
      1. Enter the unique identifier type and value that identifies My Company ID in messages received from Partners.
      2. Enter the Partner Company ID Type assigned to Partner companies in messages sent to the company.
      3. Enter the Partner Location ID Type assigned to Partner locations in messages sent to the company.
    4. On the Service Administrators tab, enter the User who should be a Manager of the app (i.e. the user responsible for configuring the application, linking to other applications and Partners, and granting users access to the app).
      1. Select Add Another Service Administrator to add another Manager.
    5. On the SAP IDoc Settings tab, enter any receiver or Partner settings (optional):
      1. Specify SAP IDoc Receiver Settings:
        1. Enter the SAP client number for the company in the My SAP Client Number field.
        2. Enter the SAP logical system name for the company in the My Logical System Name field.
        3. Enter the SAP logical system port for the company in the My Logical System Port field.
      2. Specify the SAP IDoc Partner Profile:
        1. Enter the SAP Sender Partner Number of the Partner that sends messages to the company.
        2. Enter the SAP Sender Partner Port of the Partner that sends messages to the company.
        3. Select the Sender Partner Type of the Partner that sends messages to the company.
        4. Enter the Sender Partner Function of the Partner that sends messages to the company if the Sender Partner Type is KU (Customer), LI (Vendor), or LS (Logical System).

  4. Choose the following option to configure MDLP credentials:

  5. Select Submit.

    The Manage Services screen displays, and TraceLink updates the Russia Compliance app.

Configuring non-exportable domestic MDLP credentials requires both the Web UI and the Russia Report Signature Appender app (an app for digitally signing the reports). Administrators use the Web UI to specify the non-exportable Certificate ID and Digest information, and the Russia Report Signature Appender app to authenticate and attach the digital signature to the Russia Compliance reports submitted to MDLP.

For Owners using a non-exportable certificate, the certificate must be installed on the Owner's internal system. TraceLink provides the Russia Report Signature Appender app, an open source app that Owners can install on their internal systems to retrieve reports from Russia Compliance that must be signed and send the digitally signed reports back to TraceLink to submit to MDLP. Owners can use the TraceLink-provided Russia Report Signature Appender app or build their own app for digitally signing the reports.

Owners who choose to use the Russia Report Signature Appender app provided by TraceLink must configure and use the Russia Report Signature Appender app. TraceLink will not release any updates for the Russia Report Signature Appender app after the initial release.

  • To retrieve the Certificate ID and Certificate Digest for non-exportable certificates:

    1. The Certificate ID is available in Thumbprint Details in Crypto Pro Certificate Manager.

    2. Use the following commands in Powershell to retrieve the Certificate Digest:

      1. Convert .pfx certificate to .pem certificate: openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.pem

      2. Capture Digest value from certificate: openssl x509 -in certificate.pem -outform der | openssl dgst -sha1

  • To configure the app to retrieve reports from Russia Compliance:

    When using a non-exportable certificate to authenticate to MDLP, Owners can use the TraceLink-provided Russia Report Signature Appender app or can build their own app to retrieve reports.

  • To configure the Russia Report Signature Appender app:

    1. Download the Russia Report Signature app from https://github.com/tracelink/russia-report-signature-appender.

    2. Enter the TraceLink-provided User ID and Password in the Russia Report Signature Appender app.

      On successful authentication, the Russia Report Signature Appender app retrieves the reports from Russia Compliance that must be signed and sends the digitally signed reports back to TraceLink to submit to MDLP.

  • To configure the custom app:
    Owners who choose to build their own app to retrieve and sign reports must integrate their app with the Report retrieval APIs.

    See Report retrieval APIs for more information.

  1. Hover over Company Administration on the User profile in the top right of any screen, and then select Services.
  2. Select Configure Published Service for the Russia Crypto Codes Service Type.
  3. To configure Service Information, Identifiers, Service Administrators, and SAP IDOC Settings:
    1. Under Service Information:
      1. Enter the Service Name for the company's instance of the app (optional).
      2. Enter a brief Description of the app, used in Link invitations sent to Partners (optional).
      3. Select whether other Members can see the app in Community from the Visibility radio buttons:
        • No, only invited companies can subscribe – (default) Only TraceLink Members invited by the company can see the app.
        • Yes, TraceLink members can request to subscribe – Any TraceLink Member can see the app in Community and request to Link to the app.
    2. Under Identifiers in Messages My Company Sends (optional):
      1. Enter the unique identifier type and value that identifies My Company ID in messages sent to Partners.
      2. Enter the unique Service ID that the company identifies the app with, formatted as [App Abbreviation].[My Company ID Value] (e.g. RUGR.7728640746).
    3. Under Identifiers in Messages My Company Receives (optional):
      1. Enter the unique identifier type and value that identifies My Company ID in messages received from Partners.
      2. Enter the Partner Company ID Type assigned to Partner companies in messages sent to the company.
      3. Enter the Partner Location ID Type assigned to Partner locations in messages sent to the company.
    4. On the Service Administrators tab, enter the User who should be a Manager of the app (i.e. the user responsible for configuring the application, linking to other applications and Partners, and granting users access to the app).
      1. Select Add Another Service Administrator to add another Manager.
    5. On the SAP IDoc Settings tab, enter any receiver or Partner settings (optional):
      1. Specify SAP IDoc Receiver Settings:
        1. Enter the SAP client number for the company in the My SAP Client Number field.
        2. Enter the SAP logical system name for the company in the My Logical System Name field.
        3. Enter the SAP logical system port for the company in the My Logical System Port field.
      2. Specify the SAP IDoc Partner Profile:
        1. Enter the SAP Sender Partner Number of the Partner that sends messages to the company.
        2. Enter the SAP Sender Partner Port of the Partner that sends messages to the company.
        3. Select the Sender Partner Type of the Partner that sends messages to the company.
        4. Enter the Sender Partner Function of the Partner that sends messages to the company if the Sender Partner Type is KU (Customer), LI (Vendor), or LS (Logical System).

  4. Choose the following to configure MDLP credentials:

  5. To configure OMS Credentials, do the following:

    1. Select the OMS Credentials tab.

    2.  Select the Remove icon () to remove any credentials that need to be updated with the correct information (optional).

    3. Select Add Domestic Credentials or Add Foreign Credentials to add the appropriate Credential Type:
      • Domestic – The company manufactures product in Russia. The credentials are assigned to a single location (each location within Russia must use its own set of credentials to authenticate to the CRPT OMS).
      • Foreign – The company manufactures product in a country other than Russia. Each company has a single set of credentials that is shared between all of its locations outside of Russia.
      A company can have both Domestic and Foreign credentials if manufacturing takes place in Russia as well as in other countries.
    4. Enter the 36-digit OMS ID provided by CRPT.
    5. Enter the Address that the credentials are assigned to in the text field (optional).
    6. Select Retrieve Connection ID to retrieve a connection ID from OMS and populate the OMS Connection ID field.
    7. If the Credential Type is Domestic, select the manufacturing Location within Russia that the credentials are assigned to.

      or

      If the Credential Type is Foreign, select the identifier type and enter the identifier value of the MAH.

      This value must match the MAH ID entered in Product Master Data for each product with a Target Market of Russia and a Production Type of Imported.

    8. Select Submit to save the entered OMS Credentials.
      The domestic or foreign OMS credentials are saved.
    9. Select Configure Published Service for the Russia Crypto Codes Service Type.
    10. Select the OMS Credentials tab.
    11. Select Test to validate the credentials with the CRPT OMS.

      The screen displays a confirmation message that indicates whether the credentials are validated successfully.

  6. Select Submit.

    The Manage Services screen displays, and TraceLink updates the Russia Crypto Codes app.

Tips:

  • If MDLP credentials are not configured, the OMS credential test fails in Russia Crypto Codes application with the error message: "Your credentials could not be validated by the OMS".
  • To validate the OMS credentials, the Russia Crypto Codes application uses a client token retrieved from MDLP.

    • If the company uses only the Russia Crypto Codes application, configure MDLP credentials on the MDLP tab in the Russia Crypto Codes service configuration and verify OMS credentials on the OMS Credentials tab in the Russia Crypto Code service configuration.

    • If the company uses both Russia Crypto Codes application and Russia Compliance:

      1. Configure MDLP credentials in the Russia Compliance service configuration.

      2. Configure OMS credentials in the Russia Crypto Codes application service configuration.

      3. Ensure the MDLP credentials are configured for the same OMS account.

Configure foreign MDLP credentials if the reporting entity does not use a digital certificate when authenticating to MDLP.

  1. Select the MDLP Credentials tab.
  2. To update an existing credential:
    1. Select the Remove icon () next to any credentials that need to be updated.
    2. Select Submit.

      The Manage Services screen displays, and TraceLink updates the respective application.

    3. Select Configure Published Service.
    4. Select the MDLP Credentials tab, and proceed to the next step to add the updated information for the credentials.
  3. To add a credential:
    1. Select Add Foreign Credentials.
    2. Enter the Russia Account Number registered with MDLP, which identifies the Reporting Entity.

      This value must be entered as an identifier in Company or Partner Master Data and must be unique within the application.

    3. Enter the Login Information, which identifies the credentials that the Reporting Entity uses to log in to the MDLP portal:
      1. Enter the Russia-assigned MDLP User Name that the reporting entity uses to log in to the MDLP portal.
      2. Enter the Russia-assigned Password for the user name (displays and is required only if the Credential Type is Foreign).
    4. Enter the credentials for the Accounting System (i.e. TraceLink) that the Reporting Entity registered with MDLP:
      1. Enter the Russia-assigned Client ID for the Accounting System.
      2. Enter the Russia-assigned Client Secret for the Accounting System.

        This information is available on the MDLP portal in Administration > Accounting System.

Tips:

Select the Configure Published Service, depending on Russia Compliance service or Russia Crypto Codes service type.

Configure domestic MDLP credentials if the reporting entity must use an exportable digital certificate when authenticating to MDLP.

Russia Compliance supports exportable and non-exportable certificates to digitally sign reports that are submitted to MDLP. To configure non-exportable certificates, see Configuring non-exportable certificates for domestic credentials.

Configuring exportable certificates for domestic MDLP credentials requires both the Web UI and the Digital Certificate Upload REST API. Administrators use the Web UI to configure the app and the REST API to upload digital certificates to a secure TraceLink server in Russia, which MDLP requires for domestic credentials.

  1. Select the MDLP Credentials tab.
  2. To update an existing credential:
    1. Select the Remove icon () next to the credential to update.
    2. Select Submit.

      The Manage Services screen displays, and TraceLink updates the respective application.

    3. Select Configure Published Service.
    4. Select the MDLP Credentials tab, and proceed to the next step to add the updated information for the credentials.
  3. To add a credential:
    1. Select Add Domestic Credentials.
    2. Enter the Russia Account Number registered with MDLP, which identifies the Reporting Entity.

      This value must be entered as an identifier in Company or Partner Master Data and must be unique within the application.

    3. Enter the Login Information, which identifies the credentials that the Reporting Entity uses to log in to the MDLP portal:
      • Enter the Russia-assigned MDLP User Name that the reporting entity uses to log in to the MDLP portal.
    4. Enter the credentials for the Accounting System (i.e. TraceLink) that the Reporting Entity registered with MDLP:
      1. Enter the Russia-assigned Client ID for the Accounting System.
      2. Enter the Russia-assigned Client Secret for the Accounting System.

        This information is available on the MDLP portal in Administration > Accounting System.

    5. For DomesticCredential Type, generate a security token and upload a digital certificate to the TraceLink server in Russia:
      1. Select Submit.

        The Manage Services screen displays, and TraceLink updates the respective application.

      2. Select Configure Published Service.
      3. Select the MDLP Credentials tab.
      4. Select Request Token for the DomesticCredential Type.

        The Token for Domestic Credentials dialog box displays with the security token used when uploading the digital certificate.

        The security token is valid for 30 minutes after generation.
      5. Select Copy Token.

        The dialog box closes and the token is copied to the clipboard.

      6. Insert the token into the Digital Certificate Upload REST API to complete the digital certificate upload.

Tips:

Select the Configure Published Service, depending on Russia Compliance service or Russia Crypto Codes service type.

See Retrieve non-exportable certificates for domestic credentials for information about retrieving credentials for non-exportable certificates.

Configure non-exportable certificate for domestic MDLP credentials if the reporting entity must use a non-exportable digital certificate when authenticating to MDLP.

  1. Select the MDLP Credentials tab.
  2. To update an existing credential:
    1. Select the Remove icon () next to the credential to update.
    2. Select Submit.

      The Manage Services screen displays, and TraceLink updates the respective application.

    3. Select Configure Published Service.
    4. Select the MDLP Credentials tab, and proceed to the next step to add the updated information for the credentials.
  3. To add a credential:
    1. Select Add Domestic Credentials.
    2. Enter the Russia Account Number registered with MDLP, which identifies the Reporting Entity.

      This value must be entered as an identifier in Company or Partner Master Data and must be unique within the application.

    3. Enter the Certificate ID which identifies the non-exportable certificate when authenticating to MDLP.
    4. Enter the Certificate Digest which identifies the non-exportable certificate when authenticating to MDLP.
    5. Enter the Login Information, which identifies the credentials that the Reporting Entity uses to log in to the MDLP portal:
      • Enter the Russia-assigned MDLP User Name that the reporting entity uses to log in to the MDLP portal.
    6. Enter the credentials for the Accounting System (i.e. TraceLink) that the Reporting Entity registered with MDLP:
      1. Enter the Russia-assigned Client ID for the Accounting System.
      2. Enter the Russia-assigned Client Secret for the Accounting System.

        This information is available on the MDLP portal in Administration > Accounting System.

    7. Select Submit.
      The User ID and Password generated by TraceLink display in the confirmation message. Use this User ID and Password when configuring the app to retrieve reports from Russia Compliance.

      Administrators must copy and retain the User ID and Password before dismissing the confirmation message. The User ID and Password are not displayed outside of the confirmation message and cannot be retrieved elsewhere.

Tips:

Select the Configure Published Service, depending on Russia Compliance service or Russia Crypto Codes service type.