SAP offers a program to convert payslips to PDF format, but the forms are not encrypted. See how to encrypt payslips in SAP ERP Central Component and send them automatically by email to employees.
Key Concept
In order to securely email sensitive data over the Internet, users first must have the capability to convert documents into PDF format. SAP offers function modules to transfer pay slips in the spool file to PDF, but no functionality to encrypt this sensitive information. Encryption can be done in several ways, most of them manually, but there is way to automatically encrypt them, saving time and effort.
The SAP system uses standard programs to create payslips. Each country has its own program but they all have the same features. An example is program RPCEDTN0, which is specific to the Netherlands. These programs create payslips, which are placed in the spool of the SAP system. However, the SAP system does not automatically encrypt this sensitive data so that it can be sent securely over the Internet. I show you how to use the payslips in the spool, convert them to encrypted PDF files, and email them to the addresses stored in SAP ERP HCM infotype 0105 of the employees.
Note
This article assumes that you already have a program for transferring payslips to PDF format. I do, however, explain what such a program should look like, how it can be extended to enable encryption, and how to send the encrypted PDF via email. Please feel free to contact me at the email address listed with this article if you have questions about or problems with building this program.
Note
The functionality discussed in this article is available from SAP ERP Central Component (SAP ECC) version 4.5 on.
To be able to send payslips by email, the email address of the employee has to be present in the SAP system. Normally infotype 0105 (subtype 0010) is used to register an email address. (For the purposes of this article, I am assuming that you know how to register an email address in infotype 0105.)
Following is a list of the steps you should perform to enable converting payslips in the spool to encrypted PDF format.
Steps for Creating Encrypted PDF Files to Email
Create a Z_ program with the same start screen as program RPCEDTN0, and execute the following tasks sequentially. I have created source code files as downloadable PDF files to help you with these steps. You will find them interspersed in this article where you need them. Here is an explanation of what the program does and the steps you should take:
- Get the physical path where the encrypted PDF file is to be stored or you can write the files to a local path instead. (For security reasons, it is a better practice to place the encrypted file on the SAP server as fewer people have access to it there). I go into more detail about this step later.
- Check the payroll period (e.g., is the given payroll period, from the selection screen, released?).
- Get all the employee numbers from the selection screen. Put them in an internal table and loop over this table.
- Get the select options and parameters.
- Get the print parameters.
- Call program RPCEDTN0 for every employee.
- Get the spool number that RPCEDTN0 creates.
- Set the name of the PDF file, using the physical path from step 1.
- Create an encrypted PDF file from the spool file.
- Email the encrypted PDF file.
- Remove the spool file.
- Remove the PDF file.
Step 1. Get the physical path where the encrypted PDF file is to be stored.
To put the PDF files in a directory on the SAP server, you need to maintain transaction FILE. Here you can create a logical file path. Start transaction FILE as illustrated in Figure 1.

Figure 1
Transaction FILE
Choose the New Entries button. Fill in both the Logical file path and Name fields (Figure 2) and click the save icon
.

Figure 2
Create a new path
Next select the Logical file path by clicking the gray square to the left of the name of the path (HCM_PAYROLL_SLIP_OUT) in Figure 2. Double-click the Assignment of Physical Paths to Logical Path folder and a new window appears (Figure 3).

Figure 3
Assign the physical path to a logical path
Click the New Entries button again, and the following screen appears (Figure 4).

Figure 4
Details screen of the physical path to a logical path
Next click the look-up icon
next to the Syntax group field. A drop-down list of available syntax groups appears (Figure 5). Choose a syntax group by highlighting your choice, based on the operating system of your SAP server. In my example, I choose UNIX (Figure 5).

Figure 5
Select your syntax group
Put your path in the Physical path field (Figure 6). This should be an existing directory on the SAP server with read or write access (you need to contact the system administrator for this if you are not authorized). The file name — the last part — must be in capital letters and in brackets (< >), as shown in Figure 6. Save your new logical path name by clicking the save icon.

Figure 6
Physical path
Now you have created a logical file path that is easily accessed in ABAP by means of the function module FILE_GET_NAME_USING_PATH.
Step 2. Check the payroll period.
The next step is to check if the payroll period that is entered in the program parameters has been released. If it has not been released, make sure you set your program to respond with an error message. In Figure 7, you see the output of the start screen of your program (which is a copy of program RPCEDTN0).

Figure 7
Start screen of the program
When you select the Current period radio button, you are telling the program to get the payslip for the current period. When the payroll has not yet been released, the payslip is not available, so the check is necessary for the current period, but not for past periods. The status of the payroll area can be checked in table T569V. The key for the table is provided in the payroll area selection parameter of the program (Figure 7). Ensure that the table T569V STATE field is set to 3.
Step 3. Get all the employee numbers from the selection screen.
Create an internal table and put all the employees in it, ensuring that you match the selection parameters. This table is processed to call the program RPCEDTN0, which creates a spool file for every employee.
Step 4. Get the select options and parameters.
Since you call program RPCEDTN0 for every employee from your own program, you have to clear all the employees from the select options and parameters and fill it again with the new ones you are processing from the internal table.
Step 5. Get the print parameters.
Even though you won’t be printing the PDF file, the program needs print parameters in order to create a PDF. These parameters are filled here.
Step 6. Call program RPCEDTN0 for every employee.
Call the SAP program RPCEDTN0 to transfer the select parameters and print parameters to it.
Step 7. Get the spool number that program RPCEDTN0 creates.
Program RPCEDTN0 places the payslip in the spool area of the SAP system. You can get the number of the spool file here.
Step 8. Set the name of the PDF file (using the physical path from step 1).
Here the complete name is assembled, including the path you created in step 1.
Step 9. Create an encrypted PDF file from the spool file.
A PDF file is created from the spool file and placed on the SAP system’s server. The SAP system cannot encrypt the file, but you can use a third-party tool to encrypt the PDF file. In my example, I use program PDFTK to encrypt the file (note that this is for a Unix-based system, not a Windows-based system). You can download a free copy of program PDFTK here: https://www.pdflabs.com/tools/pdftk-the-pdf-toolkit. If your SAP system is a Windows-based system you can use another program. Whichever program you decide to use, it should be able to accept command-line options.
To use the command-line program PDFTK, you have to maintain transaction code SM69. Here I create an external operating system command that can be executed from an ABAP program. First, start transaction code SM69 (Figure 8).

Figure 8
Create an external operating system command
In the screen that appears, click the new command icon
, which results in the screen in Figure 9. Enter Z_ENCRYPT_PDF in the Command name field and pdftk (lowercase) in the Operating system command field. Make sure that the correct operating system is selected (LINUX in my example), and click the save icon to save your new external system command.

Figure 9
Create command Z_ENCRYPT_PDF
To delete the PDF file after it has been emailed, you maintain another command in transaction code SM69. You do this by creating another external operating system command with the Command name Z_DEL and an Operating system rm (lowercase) command (Figure 10). Save your new external system command by clicking the save icon.

Figure 10
Create command Z_DEL
Step 10. Email the encrypted PDF file.
The next step is to email the encrypted PDF file. First, infotype PA0105 with subtype 0010 has to exist for the employee. If there is no email address available, a central email address has to be used instead. Otherwise employees won’t get their payslips. In addition, the text for the body of the email has to be maintained.
In this example, I’m using standard text to create and maintain the body and the central email address. Standard texts can be maintained using transaction code SO10. You can use other methods to maintain the email body and central email address, but you have to change the program accordingly.
First, let’s look at how to create the body of the email message. Start transaction code SO10 and enter ZHR_MAIL_BODY for the Text Name, ST as the Text ID, and EN as the Language. Then click the Create button to create the message (Figure 11).

Figure 11
Create standard text ZHR_MAIL_BODY
In the next screen, fill in the text you want to appear in the body of the email and click the save icon (Figure 12)

Figure 12
Create the body of the email
Next to the Hi text in the screen, the program adds the nickname (or if this field is empty, the first name) of the employee from HCM infotype PA0002. Next to the Please find the attached Salary slip for text in the screen, my program adds the payroll period that was selected in the parameters of your program. Feel free to use these fields in other ways. In the program you can put any information next to the text you entered here (you can get the program source code in the Z_PAYROLL_2_PDF_FORMS download at the end of this article).
Next you need to maintain the central email address. Start transaction code SO10 again and enter ZHR_MAIL_GENERAL as the Text Name, ST as the Text ID, and EN as the Language (Figure 13). Then select the Create button again, which results in the screen in Figure 14.

Figure 13
Create standard text ZHR_MAIL_GENERAL

Figure 14
Maintain central email address
In Figure 14, fill in the central email address (Kees.bond@ciber.nl, in my example), and click the save icon.
The PDF-formatted file is then sent as an attachment to the email. I use the methods from the SAP class CL_BCS to fill in the required fields and send the email (see the Z_PAYROLL_2_PDF_FORMS download for the program source code at the end of this article).
Step 11. Remove the spool file.
After the PDF file is emailed, the spool file has to be deleted. Otherwise, it is visible to all users with authorizations to see the spool files. In the program’s form DELETE_SPOOLFILE you can see how it is done. You can access a download of this source code (Z_PAYROLL_2_PDF_FORMS ) at the end of this article.
Step 12. Remove the PDF file.
After the PDF file is emailed, it then has to be deleted. The program uses the external operating system command Z_DEL to do this.
Note
The PDF files are encrypted with the PERID field from Social Insurance (SI) number or Social Security (SS) number SAP ERP HCM infotype PA0002. When you want use another password or do not have a registered SI or SS number, you have to change the program.
Source Code Downloads
The following PDF files are downloadable code and text for you to use:
Kees Bond
Kees Bond is a senior HCM consultant and ABAP consultant with 17 years of experience with SAP. He followed an HBO education in Amsterdam and lives in the Netherlands.
He started his SAP career in the first Dutch hospital to implement SAP. He was responsible for the implementation of the HCM module components PA, OM, time, and payroll. Currently, Kees is working as a principal consultant for CIBER Netherlands BV.
You may contact the author at kees.bond@ciber.nl.
If you have comments about this article or publication, or would like to submit an article idea, please contact the editor.