At the end of December, 2019, any authentication certificates generated using the Certificates app in the Anaplan My Account page will expire. Anaplan will not be issuing new certificates at the end of this year. If you are using an Anaplan issued certificate, you will need to take action.
Integration Client
Authentication
Action Required?
Anaplan Connect 1.3.3.5 or lower
Anaplan Certificate
Yes
Anaplan Connect 1.4.x
Basic Authentication \
CA Certificate
No
Informatica Anaplan Connector
Anaplan Certificate
Yes
Informatica Anaplan Connector
Basic Authentication \
CA Certificate
No
Mulesoft 2.x
Basic Authentication \
CA Certificate
No
Snaplogic 1.x
Anaplan Certificate
Yes
Snaplogic 2.x
Basic Authentication \
CA Certificate
No
Boomi 1.x
Basic Authentication
No
Boomi 2.x
Basic Authentication \
CA Certificate
No
Tableau 1.0
Anaplan Certificate
Yes
Any client
Basic Authentication \
CA Certificate
No
Any client
Anaplan Certificate
Yes
If your integration client and authentication method has a "Yes" in the "Action Required" column, then you must take action prior to December-end, 2019 to prevent disruption to your integrations.
Note that web login, web SSO, and basic authentication to integrations are not impacted by this event. We recommend that you do this as soon as possible and give yourself time to update & test your integrations.
Anaplan-Issued Certificate Expirations
What is happening?
All Anaplan issued certificates are expiring by December-end 2019, and will not be renewed.
Why is this change happening?
As the Anaplan platform evolves, we are always looking to provide our customers with more features and ways to integrate with Anaplan. The new Anaplan APIs and integration connectors leverage Certificate Authority-issued certificates. Certificate Authority (CA) authentication offers a certificate hierarchy known as the "chain of trust" that enables you to verify the validity of a certificate issuer. This aligns with industry standards and provides a higher level of security for Anaplan customers.
How can you check if this impacts you and what steps do you need to take?
This change will impact your integrations if you are using Anaplan Certificates for authentication. After December 2019, you will have 2 options to continue running your integrations:
Switch to updated integration connectors or clients that support CA certificates. Procure a supported CA certificate and use that for authentication. If your integration connector or client already supports CA certificates, you only need to use that option.
Switch to basic authentication with your existing integration connector or client
Is it possible for Anaplan to edit the expiration date on your existing certificates?
No, the expiration date for a certificate cannot be changed.
Certificate Authority (CA) Certificates
Why this change to CA certificates?
As the Anaplan platform evolves, we are always looking to provide our customers with more features and ways to integrate with Anaplan. The new Anaplan APIs and integration connectors leverage Certificate Authority (CA) issued certificates. CA authentication offers a certificate hierarchy known as the "chain of trust" that enables you to verify the validity of a certificate issuer. This aligns with industry standards and provides a higher level of security for Anaplan customers.
Customers can leverage their own certificates from a trusted Certificate Authority that ends with a supported Root CA Certificate.
Customers can now specify the expiration dates for their certificates.
Customers have the ability to disable the cert themselves through a new interface on Administration.
These certificates can be obtained through your company's intermediary CA (typically issued by IT) or by purchasing it from a trusted Certificate Authority.
This method of authentication also supports Anaplan's new authentication framework which provides for a more secure method for sending credentials on API calls
Which currently available clients support CA certificates?
Anaplan Connect 1.4.x
Informatica Anaplan Connector v2.x
Mulesoft 2.x
Boomi 2.x
Snapchat 2.x
How do Customers use the CA (Certificate Authentication 2.0) option?
The following links will guide you through the procurement and registration of CA-issued certificates in Anaplan:
How to procure certificates.
How to manage them in Anaplan.
Please note that you can use certificates issued by an Intermediary CA with any of these supported Root CAs. Note that certificates from an Intermediary CA are typically managed by staff in your organization. If you are unsure about whether your intermediary certificate uses a supported Root CA, contact your internal technical staff.
What are the benefits of moving to CA Certificates?
CA certificates align with industry standards and provide a higher level of security for Anaplan customers. For more information, see Administration: Security - Certificates in Anapedia.
Is there a cost to your company for using CA Certificates?
You can obtain a CA certificate from your internal intermediary CA or purchase certificates from a Certificate Authority.
If you have an intermediate CA, you can issue the certificate yourself. Your IT team can advise on your internal processes for obtaining certificates based on an intermediate CA.
Integrations and APIs
What integration options and APIs are available to you?
Anaplan has two versions of Production REST APIs - v1.3 & v2.0. Authentication mechanisms with both API versions are:
v1.3 API:
Basic Authentication
Authentication with Anaplan Certificates
v2.0 API:
Basic Authentication
CA Certificate based authentication
NOTE: Both API versions support Basic Authentication.
Anaplan Integration clients use one or both APIs.
What if you are using a custom integration client?
If you have developed your own integration client to Anaplan, or are using a custom integration client developed by a partner or system integrator, the impact depends on what API version was used to develop your connector and the authentication method used. If you are using basic authentication to authenticate to Anaplan via integrations, you're not impacted.
If your custom integration client was developed using API v1.3 and you authenticate with Anaplan-issued certificates, you will not be able to do so after the expiration. If you want to use a CA certificate, you need to update your custom client to use API v2.0.
More information about the v2.0 Integration API can be found here: https://anaplanbulkapi20.docs.apiary.io
Anaplan Connect
What if you are using Anaplan Connect (AC) for Integrations?
If you are using Basic Auth (user ID and password) in AC 1.3.x.x. scripts, you can continue to do so. You can upgrade to AC 1.4.x at your convenience.
If you are currently using an Anaplan issued certificate, one option is to keep both AC 1.3.x.x and AC 1.4.x installed at the same time, and migrate your integration scripts one-by-one to AC 1.4.x prior to the end of the year.
AC 1.4.x supports authentication with CA Certificates and Basic Auth. Existing Anaplan Certificates (downloaded from Anaplan UI) are not compatible with AC 1.4.x. Please review this blog post for steps to port AC 1.3.x.x Integration scripts to AC 1.4.x: https://community.anaplan.com/t5/Knowledge-Base/Migrating-from-Anaplan-Connect-1-3-x-x-to-Anaplan-Co...
You can take the Anaplan Connect online training from Anaplan Academy: https://community.anaplan.com/t5/Academy-Classes/Data-Related-Training-Classes/ta-p/19566
You can find the Anaplan Connect 1.3.3.5 user guide here.
Is JAVA keystore mandatory for using CA certificates with Anaplan Connect 1.4.x?
Starting AC 1.4.1, JAVA keystore (JKS) has been made optional. Users can directly refer to CA certificate files in their integration scripts or create a JKS if they prefer. Refer to 'Certificate Authentication' section of AC 1.4.x user guide for more details & implementation steps: https://s3.amazonaws.com/anaplanenablement/Community/Anapedia/Anaplan_Connect.pdf
How do you create a JAVA keystore for use with Anaplan Connect 1.4.x?
You can refer to following sources for information on creating JAVA keystore for use with Anaplan Connect v1.4.x:
Refer to section "Certificate Authentication using Keystore" in https://s3.amazonaws.com/anaplanenablement/Community/Anapedia/Anaplan_Connect.pdf
Refer to "Certificate Authentication Process" video recording at https://community.anaplan.com/t5/Videos/bg-p/Videos
Additionally, you can refer to the full Anaplan Connect online training at Anaplan Academy: https://community.anaplan.com/t5/Academy-Classes/Data-Related-Training-Classes/ta-p/19566
Single Sign-On (SSO)
Does this impact Anaplan Single Sign-on (SSO)?
No. There is no impact on Anaplan Single Sign-on (SSO). The impact is only on the Anaplan data Integration API and Integration connector authentication.
What if you’re using SSO and need to integrate with Anaplan?
Accessing Anaplan via a browser with standard login or with SSO is not impacted by this change. The certificate used in SSO is unrelated to the certificates used for integration certificate authentication.
Customers who are configured to use SSO have two options to authenticate their integrations with Anaplan:
If the actions you want Anaplan Connect to run are for models in a workspace using single sign-on, you can use certificate authentication. We recommend using the new certificate authentication 2.0 if possible which supports CA Authentication .
If you are configured for Single Sign-on (SSO), but have a requirement for a user to bypass it and use basic authentication (username and password) instead, then the user must be configured as an Exception User. An Exception User can authenticate by username and password or by certificate, rather than through SAML. For more information, see Assign Exception Users in Anapedia.
Who should you contact in case of more questions?
Please post your questions in the Anaplan-Generated Certificates to Expire at the End of 2019 Discussion topic. Alternatively, you can contact your Anaplan Customer Success (CS) Business Partner.
... View more
