Sap Btp Connectivity

SAP BTP Connectivity Skill

Related Skills

• sap-btp-cloud-platform: Use for platform fundamentals, BTP account setup, and integration patterns
• sap-btp-best-practices: Use for implementation guidance, security best practices, and production deployment
• sap-cap-capire: Use for CAP service connectivity, destination consumption, and secure API access
• sap-fiori-tools: Use for configuring Fiori app destinations and frontend connectivity
• sap-abap: Use when connecting to ABAP systems via RFC or implementing principal propagation

When to Use This Skill

Use this skill when configuring BTP destinations, Cloud Connector, OAuth flows, principal propagation, RFC/LDAP/MAIL/TCP connectivity, Kubernetes/Kyma connectivity proxies, multitenant destination access, or troubleshooting connectivity errors such as 405, 407, 503, and proxy failures.

Table of Contents

1. Overview 2. Quick Start 3. Connectivity Scenarios 4. Destination Types 5. Authentication Configuration 6. Cloud Connector Setup 7. Kubernetes/Kyma Connectivity 8. Common Issues & Troubleshooting 9. Security Best Practices 10. Critical Rules 11. Bundled Resources

---

Overview

SAP BTP Connectivity provides secure access from SAP BTP applications to remote services across cloud, on-premise, and VPC environments.

Core Components

Supported Environments: Cloud Foundry, ABAP Environment, Kyma Supported Protocols: HTTP/HTTPS, RFC, TCP (SOCKS5), LDAP/LDAPS, Mail

---

Quick Start

Create HTTP Destination (Cloud Foundry)

1. Navigate: Connectivity > Destinations in BTP Cockpit 2. Select: Create > From Scratch 3. Configure:

   Name: my-destination
   Type: HTTP
   URL: https://api.example.com
   ProxyType: Internet
   Authentication: OAuth2ClientCredentials
   clientId: <your-client-id>
   clientSecret: <your-client-secret>
   tokenServiceURL: https://auth.example.com/oauth/token

Set Up Cloud Connector

1. Download from SAP Tools 2. Access: https://localhost:8443 3. Login: Administrator / manage (change immediately) 4. Add subaccount connection

Access Destination in Application (Node.js)

const { getDestination } = require('@sap-cloud-sdk/connectivity');
const destination = await getDestination({ destinationName: 'my-destination' });

---

Connectivity Scenarios

Cloud-to-Cloud

ProxyType: Internet
Authentication: OAuth2ClientCredentials | OAuth2SAMLBearerAssertion

Cloud-to-On-Premise

ProxyType: OnPremise
Authentication: BasicAuthentication | PrincipalPropagation

Requires Cloud Connector installation in on-premise network.

On-Premise-to-Cloud (Service Channels)

For on-premise systems accessing SAP BTP services via Cloud Connector.

---

Destination Types

Detailed configuration: See references/http-destinations.md, references/rfc-destinations.md, references/mail-tcp-ldap-destinations.md

---

Authentication Configuration

OAuth2ClientCredentials (Service-to-Service)

Authentication: OAuth2ClientCredentials
clientId: <client-id>
clientSecret: <client-secret>
tokenServiceURL: https://auth.example.com/oauth/token

OAuth2SAMLBearerAssertion (User Propagation)

Authentication: OAuth2SAMLBearerAssertion
audience: <target-audience>
clientKey: <client-key>
tokenServiceURL: https://auth.example.com/oauth2/token
KeyStoreLocation: <certificate-location>

PrincipalPropagation (On-Premise SSO)

Authentication: PrincipalPropagation
ProxyType: OnPremise

Requires Cloud Connector X.509 certificate generation.

Complete reference: references/authentication-types.md (all 17+ types)

---

Cloud Connector Setup

Installation

• Production: Windows MSI/Linux RPM packages (service registration)
• Development: Portable archive (manual execution)

Initial Configuration

1. Access UI: https://<hostname>:8443 2. Login: Administrator / manage 3. Change password immediately 4. Select mode: Master or Shadow 5. Add subaccount connection

Access Control

Configure on-premise resource access:

• Backend Types: ABAP System, SAP Gateway, Non-SAP System, SAP HANA
• HTTP Access Control: System mapping + resource paths + policies

High Availability

• Master-Shadow: Primary + backup with synchronized config
• Requirements: Stable network, separate machines, identical versions

Complete guide: references/cloud-connector.md

---

Kubernetes/Kyma Connectivity

Connectivity Proxy

Enables Kubernetes workloads to access on-premise systems.

Installation:

helm install connectivity-proxy \
  oci://registry-1.docker.io/sapse/connectivity-proxy \
  --version <version> --namespace <namespace> -f values.yaml

Transparent Proxy

Exposes BTP destinations as Kubernetes Services.

Installation:

helm install transparent-proxy \
  oci://registry-1.docker.io/sapse/transparent-proxy \
  --version <version> --namespace <namespace> -f values.yaml

Usage: Create Destination Custom Resource, access as Kubernetes Service.

Complete configuration: references/kubernetes-connectivity.md

---

Common Issues & Troubleshooting

HTTP Error Codes

Cloud Connector Issues

Cannot connect to subaccount:

• Verify region host URL
• Check firewall allows outbound HTTPS
• Verify subaccount credentials

Access denied to resource:

• Check access control configuration
• Verify virtual host mapping
• Check resource path policy

Complete troubleshooting: references/troubleshooting.md

---

Security Best Practices

Cloud Connector

• Deploy in DMZ under IT control
• Change default password immediately
• Configure LDAP for user management
• Enable audit logging (All level for production)
• Deploy high availability (master + shadow)

Destinations

• Use OAuth over basic authentication
• Store credentials in Destination Service, not code
• Enable TLS for all connections
• Use mTLS for enhanced security

---

Critical Rules

Always Do

• Change Cloud Connector default password immediately
• Use HTTPS for all external connections
• Configure access control before exposing resources
• Enable audit logging in production
• Cache tokens and destinations appropriately

Never Do

• Expose Cloud Connector UI to internet
• Store credentials in application code
• Skip access control configuration
• Modify Cloud Connector Tomcat config files
• Run multiple master instances (split-brain)

---

Bundled Resources

Configuration References

• references/http-destinations.md - Complete HTTP destination properties
• references/rfc-destinations.md - RFC destination properties and pooling
• references/mail-tcp-ldap-destinations.md - Mail, TCP, LDAP configuration
• references/authentication-types.md - All 17+ authentication configurations

Setup & Configuration

• references/cloud-connector.md - Cloud Connector setup and configuration
• references/kubernetes-connectivity.md - Connectivity Proxy and Transparent Proxy
• references/destination-service-api.md - REST API reference

Advanced Topics

• references/advanced-configuration.md - MTA, config.json, chaining, ZTIS
• references/identity-propagation-scenarios.md - ABAP, NetWeaver Java, custom IDP
• references/operational-guides.md - Network zones, solution management
• references/connectivity-alternatives-and-config.md - Reverse proxy, user roles, RFC config

Development & SDK

• references/java-sdk-development.md - Java APIs, JCo, SAP Cloud SDK
• references/mail-protocols.md - SMTP, IMAP, POP3 configuration

Templates

• templates/destination-http-oauth.json - HTTP destination with OAuth template
• templates/destination-onpremise.json - On-premise destination template
• templates/connectivity-proxy-values.yaml - Helm values for Connectivity Proxy
• templates/transparent-proxy-values.yaml - Helm values for Transparent Proxy

---

Documentation Links

• Official SAP Documentation: https://help.sap.com/docs/connectivity
• GitHub Repository: https://github.com/SAP-docs/btp-connectivity
• Destination API: https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination
• Release Notes: https://help.sap.com/whats-new/cf0cb2cb149647329b5d02aa96303f56

---

Last Updated: 2025-11-27 Next Review: 2026-02-27 Source: https://github.com/SAP-docs/btp-connectivity (383 files, 352+ analyzed)

SAP BTP Connectivity Skill

---

Capability Index

Overview

This skill provides comprehensive knowledge for SAP BTP Connectivity, covering all components needed for secure cloud-to-cloud, cloud-to-on-premise, and on-premise-to-cloud connectivity.

Components Covered

• Destination Service: Manage connection metadata, authentication, routing
• Connectivity Service: Enable Kubernetes on-premise connectivity
• Cloud Connector: Secure tunnel for on-premise systems
• Connectivity Proxy: Kubernetes component for on-premise access
• Transparent Proxy: Unified destination access in Kubernetes

---

Auto-Trigger Keywords

Primary Keywords

• SAP BTP Connectivity
• Destination Service
• Cloud Connector
• Connectivity Proxy
• Transparent Proxy
• Principal Propagation

Secondary Keywords

• SAP BTP destination
• on-premise connectivity
• hybrid connectivity
• OAuth2SAMLBearerAssertion
• OAuth2ClientCredentials
• PrincipalPropagation
• service channel
• SOCKS5 proxy
• RFC destination
• LDAP destination
• TCP destination
• Kyma connectivity
• Cloud Foundry connectivity
• reverse proxy tunnel
• virtual host mapping
• access control configuration

Error-Based Keywords

• HTTP 405 connectivity proxy
• HTTP 407 proxy authentication
• HTTP 503 Cloud Connector
• destination not found
• principal propagation failed
• Cloud Connector connection failed
• cannot connect to subaccount
• access denied resource

---

What This Skill Does

Provides Knowledge For

1. Destination Configuration

• HTTP, RFC, LDAP, MAIL, TCP destinations
• 17+ authentication types
• Internet, OnPremise, PrivateLink proxy types

2. Cloud Connector Setup

• Installation on Windows, Linux, macOS
• Access control configuration
• High availability (master-shadow)
• Security best practices

3. Kubernetes/Kyma Connectivity

• Connectivity Proxy installation and configuration
• Transparent Proxy setup and usage
• Destination Custom Resources
• Service channels

4. Authentication Flows

• OAuth2ClientCredentials
• OAuth2SAMLBearerAssertion
• OAuth2JWTBearer
• Principal Propagation
• Client certificates

5. REST API Usage

• Destination Service endpoints
• Token retrieval
• CRUD operations
• Multitenancy support

---

When to Use This Skill

Use When

• Creating or modifying BTP destinations
• Setting up Cloud Connector for on-premise access
• Implementing user propagation between systems
• Deploying connectivity in Kubernetes/Kyma
• Troubleshooting connectivity errors
• Configuring OAuth authentication for destinations
• Setting up high availability for Cloud Connector
• Implementing multitenancy for destinations

Do Not Use When

• Configuring SAP Integration Suite flows (use integration-suite skill)
• Setting up BTP identity and access (use btp-iam skill)
• Developing CAP applications (use sap-cap skill)
• Working with SAPUI5/Fiori (use sapui5 skill)

---

Known Issues Prevented

---

Token Efficiency Metrics

---

Quick Usage Examples

Create HTTP Destination

"Create an HTTP destination named 'my-api' with OAuth2ClientCredentials authentication"

Set Up Cloud Connector

"How do I install and configure Cloud Connector for Windows?"

Deploy Connectivity Proxy

"Help me deploy Connectivity Proxy in my Kubernetes cluster"

Troubleshoot Connection

"I'm getting HTTP 503 when connecting to my on-premise system"

---

Skill Contents

sap-btp-connectivity/
├── SKILL.md                              # Main skill file (317 lines - optimized)
├── README.md                             # This file
├── references/
│   ├── http-destinations.md              # HTTP destination properties
│   ├── rfc-destinations.md               # RFC destination & pooling
│   ├── mail-tcp-ldap-destinations.md     # Mail, TCP, LDAP config
│   ├── authentication-types.md           # All 17+ auth types
│   ├── cloud-connector.md                # Cloud Connector setup
│   ├── kubernetes-connectivity.md        # Kubernetes proxies
│   ├── destination-service-api.md        # REST API reference
│   ├── advanced-configuration.md         # MTA, chaining, ZTIS
│   ├── java-sdk-development.md           # Java APIs, JCo, SAP Cloud SDK
│   ├── mail-protocols.md                 # SMTP, IMAP, POP3 configuration
│   ├── identity-propagation-scenarios.md # ABAP, NetWeaver Java, IDP
│   ├── operational-guides.md             # Network zones, solution mgmt
│   ├── connectivity-alternatives-and-config.md # Reverse proxy, RFC config
│   └── troubleshooting.md                # Common issues
└── templates/
    ├── destination-http-oauth.json       # HTTP destination templates
    ├── destination-onpremise.json        # On-premise templates
    ├── connectivity-proxy-values.yaml    # Helm values
    └── transparent-proxy-values.yaml     # Helm values

---

Documentation Sources

Official SAP Documentation

• Main: https://help.sap.com/docs/connectivity
• GitHub: https://github.com/SAP-docs/btp-connectivity (383 files)

SAP Business Accelerator Hub

• Destination API: https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination

Release Notes

• What's New: https://help.sap.com/whats-new/cf0cb2cb149647329b5d02aa96303f56

---

Version Information

---

Maintenance Schedule

• Quarterly: Check for SAP documentation updates
• On Release: Update for major version changes
• Continuous: Address reported issues

---

Related Skills

• sap-btp-setup: BTP account and subaccount configuration
• sap-cap: Cloud Application Programming Model
• sap-integration-suite: Integration flows
• sap-btp-security: IAM and authentication

---

License

GPL-3.0 License - See LICENSE file in repository root.

---

Last Updated: 2025-11-27 Next Review: 2026-02-27 Maintainer: Eduard Jiglau Email: hello@sap-ai-skills.com Website: https://sap-ai-skills.com

Advanced Configuration - Complete Reference

Source: https://github.com/SAP-docs/btp-connectivity/tree/main/docs/1-connectivity-documentation

---

Destination Deployment Methods

MTA Descriptor

Deploy destinations via Multi-Target Application (MTA) descriptors.

mta.yaml Structure:

_schema-version: "3.2"
ID: my-mta-app
version: 1.0.0

modules:
  - name: my-app
    type: nodejs
    requires:
      - name: dest-service

resources:
  - name: dest-service
    type: org.cloudfoundry.managed-service
    parameters:
      service: destination
      service-plan: lite
      config:
        init_data:
          subaccount:
            existing_destinations_policy: update
            destinations:
              - Name: my-destination
                Type: HTTP
                URL: https://api.example.com
                Authentication: NoAuthentication

Existing Destinations Policy:

Config.JSON for Service Instance

{
  "HTML5Runtime_enabled": true,
  "init_data": {
    "subaccount": {
      "existing_destinations_policy": "update",
      "existing_certificates_policy": "update",
      "destinations": [
        {
          "Name": "my-destination",
          "Type": "HTTP",
          "URL": "https://api.example.com",
          "Authentication": "OAuth2ClientCredentials",
          "clientId": "...",
          "clientSecret": "...",
          "tokenServiceURL": "..."
        }
      ],
      "certificates": [
        {
          "Name": "my-cert",
          "Content": "base64-encoded-certificate"
        }
      ]
    },
    "instance": {
      "existing_destinations_policy": "update",
      "destinations": []
    }
  }
}

---

Destination Chaining

Predefined Chains

IAS-Generated SAML Bearer Chain

Provider Destination (SAML Token):

{
  "Name": "ias-saml-provider",
  "Type": "HTTP",
  "URL": "https://ias-tenant.accounts.ondemand.com",
  "Authentication": "OAuth2TokenExchange",
  "tokenServiceURL": "https://ias-tenant.accounts.ondemand.com/oauth2/token"
}

Consumer Destination (Bearer Token):

{
  "Name": "target-api",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "Authentication": "OAuth2SAMLBearerAssertion",
  "x_chain_name": "com.sap.iasGeneratedOAuth2SamlBearerAssertion",
  "x_chain_var_saml_provider": "ias-saml-provider"
}

Dynamic Lookup (Destination Gateway)

Single custom resource for multiple destinations:

apiVersion: destination.connectivity.api.sap/v1
kind: Destination
metadata:
  name: dynamic-destination
spec:
  destinationRef:
    name: "*"

Request Headers:

---

Cloud Connector Advanced

System Mappings REST API

Create Mapping:

POST /api/v1/configuration/subaccounts/{region}/{subaccount}/systemMappings

{
  "virtualHost": "virtual-erp",
  "virtualPort": 443,
  "localHost": "erp.internal.corp",
  "localPort": 443,
  "protocol": "HTTPS",
  "backendType": "ABAP",
  "authenticationMode": "NONE",
  "description": "ERP System"
}

Supported Protocols:

• HTTP, HTTPS
• RFC, RFCS
• LDAP, LDAPS
• TCP, TCPS

Backend Types:

• ABAP (HTTP, RFC, TCP)
• SAP_GATEWAY (HTTP, RFC, TCP)
• SAP_HANA (HTTP, TCP)
• OTHER_SAP (HTTP, TCP)
• NON_SAP (HTTP, TCP, LDAP)
• SAP_JAVA (HTTP)

Domain Mappings for Cookies

When on-premise servers set cookies with internal domains:

1. Navigate to Cloud To On-Premises > Cookie Domains 2. Add mapping:

• Virtual Domain: cloud-facing domain
• Internal Domain: on-premise domain

3. Cloud Connector rewrites Set-Cookie domain attributes

Kerberos Configuration

For Kerberos-enabled backends (non-ABAP):

1. Navigate to Configuration > On Premise > Kerberos 2. Configure:

• Realm name
• KEYTAB file (with rc4-hmac key)
• Service user credentials
• KDC addresses (host:port, default port 88)

Note: Not supported for ABAP backends (use certificate-based).

Named Cloud Connector Users

For audit trail and multi-user access:

1. Enable LDAP user administration 2. Configure user groups with appropriate roles 3. Map LDAP groups to Cloud Connector roles

Certificate Rule-Based Mapping

For principal propagation to ABAP systems:

1. Enable login/certificate_mapping_rulebased parameter in RZ10 2. Import sample certificate in transaction CERTRULE 3. Create mapping rules for certificate attributes to users

---

Cache Configuration

Transparent Proxy Caching

Resilience Behavior

When services unavailable:

• Proxy continues using cached data
• Updates cache when services restore
• Expired tokens trigger re-authentication

---

System Requirements

Disk Space

Runtime Space

Log Files Location

---

Service Channels

Port Overview

View all configured service channels: 1. Navigate to Connector > Service Channels Overview 2. Filter by status: All, Enabled, Disabled, Failed 3. View details: Status, Type, Subaccount, Tenant Host

Service Channel Types

Kubernetes Service Mapping

apiVersion: servicemapping.connectivityproxy.sap.com/v1
kind: ServiceMapping
metadata:
  name: my-service
spec:
  type: TCP
  subaccountId: <subaccount-id>
  serviceId: my-virtual-host
  internalAddress: my-service.namespace:8080
  locationIds:
    - loc1

---

Destination Service Notifications

Subscribe to alerts via SAP Alert Notification Service:

1. Create Alert Notification service instance 2. Configure event subscriptions 3. Receive notifications for:

• Certificate expiration
• Configuration changes
• Service health events

---

Zero Trust Identity Service (ZTIS)

Workload Attestation Method

1. Create Zero Trust service credentials for each Transparent Proxy component 2. Configure x509 attestation for Destination service 3. Set Helm values for SPIRE agent socket path

SVID Store Method

1. Configure credentials for Kubernetes Secret-based identity 2. Set Helm values for secret name and namespace 3. ZTIS stores identity documents in specified secrets

---

Documentation Links

• MTA Destinations: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/create-destinations-using-mta-descriptor
• Config.JSON: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/use-config-json
• Destination Chaining: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/destination-chaining
• System Mappings API: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/system-mappings
• ZTIS Integration: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/integration-with-zero-trust-identity-service

---

Last Updated: 2025-11-22

Authentication Types - Complete Reference

Source: https://github.com/SAP-docs/btp-connectivity/tree/main/docs/1-connectivity-documentation

---

Overview

SAP BTP Destination Service supports 17+ authentication types for HTTP destinations, covering various OAuth flows, certificate-based authentication, and principal propagation.

---

Authentication Type Summary

---

NoAuthentication

No authentication required for the target endpoint.

{
  "Name": "public-api",
  "Type": "HTTP",
  "URL": "https://api.public.example.com",
  "ProxyType": "Internet",
  "Authentication": "NoAuthentication"
}

---

BasicAuthentication

Username and password authentication.

{
  "Name": "basic-auth-destination",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "BasicAuthentication",
  "User": "username",
  "Password": "password"
}

Properties:

---

ClientCertificateAuthentication

X.509 client certificate authentication.

{
  "Name": "cert-auth-destination",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "ClientCertificateAuthentication",
  "KeyStoreLocation": "cert.p12",
  "KeyStorePassword": "keystorepassword"
}

Properties:

---

OAuth2ClientCredentials

OAuth 2.0 client credentials flow for service-to-service communication.

{
  "Name": "oauth-cc-destination",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

Required Properties:

Optional Properties:

Token Caching: Automatic caching with auto-renewal before expiration.

---

OAuth2JWTBearer

Exchanges incoming user JWT for new access token.

{
  "Name": "oauth-jwt-bearer",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2JWTBearer",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

Required Properties:

Requires: User JWT in request context (e.g., from XSUAA).

---

OAuth2SAMLBearerAssertion

OAuth 2.0 SAML Bearer Assertion flow for user propagation between cloud systems.

{
  "Name": "oauth-saml-bearer",
  "Type": "HTTP",
  "URL": "https://api.successfactors.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2SAMLBearerAssertion",
  "audience": "www.successfactors.com",
  "clientKey": "my-client-key",
  "tokenServiceURL": "https://api.successfactors.com/oauth/token",
  "KeyStoreLocation": "signing-cert.p12",
  "KeyStorePassword": "password"
}

Required Properties:

Optional Properties:

User ID Resolution Order: 1. SystemUser property (deprecated) 2. JWT field via userIdSource or nameIdFormat 3. Custom user attributes from IdP

---

OAuth2Password

OAuth 2.0 Resource Owner Password flow.

{
  "Name": "oauth-password",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2Password",
  "User": "username",
  "Password": "password",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

Deprecation Warning: This flow is deprecated. Use OAuth2ClientCredentials or OAuth2SAMLBearerAssertion instead.

---

OAuth2UserTokenExchange

Exchanges user token for new access token.

{
  "Name": "oauth-ute",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2UserTokenExchange",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

Requires: User token in request context.

---

OAuth2TokenExchange

Generic OAuth 2.0 Token Exchange (RFC 8693).

{
  "Name": "oauth-token-exchange",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2TokenExchange",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

---

OAuth2TechnicalUserPropagation

Propagates technical user identity via OAuth.

{
  "Name": "oauth-tech-user",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2TechnicalUserPropagation",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

---

OAuth2RefreshToken

Uses refresh token to obtain access tokens.

{
  "Name": "oauth-refresh",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2RefreshToken",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "refreshToken": "stored-refresh-token"
}

---

OAuth2AuthorizationCode

OAuth 2.0 Authorization Code flow for interactive authorization.

{
  "Name": "oauth-auth-code",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2AuthorizationCode",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

---

SAMLAssertion

SAML assertion authentication without OAuth token exchange.

{
  "Name": "saml-destination",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "SAMLAssertion",
  "audience": "target-audience"
}

---

PrincipalPropagation

Cloud-to-on-premise user identity propagation via Cloud Connector.

{
  "Name": "onprem-pp-destination",
  "Type": "HTTP",
  "URL": "http://virtual-host:443/api",
  "ProxyType": "OnPremise",
  "Authentication": "PrincipalPropagation"
}

Requirements: 1. Cloud Connector installed and configured 2. Subject pattern configured in Cloud Connector 3. Trust established between Cloud Connector and on-premise system 4. User JWT in request context

How It Works: 1. Application sends request with user JWT 2. Connectivity Service forwards to Cloud Connector 3. Cloud Connector generates X.509 certificate from user identity 4. Certificate used for on-premise system authentication

---

Client Assertion

Alternative to client secret for OAuth flows using SAML or JWT assertions.

SAML Client Assertion

{
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "clientAssertion.type": "urn:ietf:params:oauth:client-assertion-type:saml2-bearer",
  "clientAssertion.destinationName": "saml-provider-destination"
}

JWT Client Assertion

{
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "clientAssertion.type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
  "clientAssertion.destinationName": "jwt-provider-destination"
}

---

X.509 Certificate Authentication with OAuth

Combine OAuth flows with X.509 client certificate for token service.

{
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "tokenService.KeyStoreLocation": "cert.p12",
  "tokenService.KeyStorePassword": "password"
}

---

Decision Guide

Service-to-Service (No User Context)

→ OAuth2ClientCredentials

User Propagation (Cloud-to-Cloud)

→ OAuth2SAMLBearerAssertion or OAuth2JWTBearer

User Propagation (Cloud-to-On-Premise)

→ PrincipalPropagation

Simple Credentials

→ BasicAuthentication

Certificate-Based

→ ClientCertificateAuthentication

Public API

→ NoAuthentication

---

Documentation Links

• Authentication Types Overview: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/http-destinations#authentication
• OAuth2SAMLBearerAssertion: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/oauth-saml-bearer-assertion-authentication
• OAuth2ClientCredentials: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/oauth-client-credentials-authentication
• Principal Propagation: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/principal-propagation

---

Last Updated: 2025-11-22

Cloud Connector - Complete Reference

Source: https://github.com/SAP-docs/btp-connectivity/blob/main/docs/1-connectivity-documentation/cloud-connector-e6c7616.md

---

Overview

The Cloud Connector is an on-premise agent that acts as a reverse invoke proxy between on-premise networks and SAP BTP. It enables secure tunneling without exposing on-premise systems directly to the internet.

Key Features

• Fine-grained access control
• Automatic connection recovery
• Audit logging
• High availability support
• HTTP, RFC, LDAP, and TCP protocols

---

Installation

Supported Platforms

Production Installation (Installer)

Windows:

# Download MSI from SAP Tools
# Run installer as Administrator
# Service registered as "SAP Cloud Connector"

Linux (RPM):

sudo rpm -i sapcc-<version>-linux-x64.rpm
# Service: scc_daemon
sudo systemctl start scc_daemon
sudo systemctl enable scc_daemon

Linux (DEB):

sudo dpkg -i sapcc-<version>-linux-x64.deb
sudo systemctl start scc_daemon
sudo systemctl enable scc_daemon

Development Installation (Portable)

# Extract archive to empty directory
unzip sapcc-<version>-linux-x64.zip -d /opt/scc-portable

# Set JAVA_HOME
export JAVA_HOME=/path/to/jdk

# Start manually
cd /opt/scc-portable
./go.sh  # Linux/macOS
go.bat   # Windows

Portable Limitations:

• Cannot run as background service
• No automatic upgrades
• Not for production use

---

Initial Configuration

Access Administration UI

URL: https://<hostname>:8443
Default Port: 8443 (HTTPS)

Default Credentials

Username: Administrator
Password: manage

CRITICAL SECURITY REQUIREMENT: Complete password change before proceeding to subaccount configuration.

Setup Wizard

1. Accept license agreement 2. Change administrator password (mandatory - do not skip) 3. Select installation mode:

• Master: Primary instance
• Shadow: Backup for high availability

4. Add optional description 5. Add first subaccount

---

Subaccount Configuration

Add Subaccount

1. Navigate to Connector > Define Subaccount 2. Enter:

• Region: SAP BTP region (e.g., cf.eu10.hana.ondemand.com)
• Subaccount: Technical name (subaccount ID)
• Display Name: Friendly name
• Subaccount User: Email of BTP user
• Password: BTP password
• Location ID: Optional identifier for multiple connectors

Connection Status Indicators

---

Access Control

Backend System Types

HTTP Access Control

1. Add System Mapping

• Virtual Host: Name exposed to cloud applications
• Internal Host: Actual hostname in on-premise network
• Virtual Port: Port exposed (typically 443)
• Internal Port: Actual port
• Protocol: HTTP or HTTPS

2. Add Resources

• Path: URL path to expose
• Policy:
• Path Only: Exact path match
• Path and All Sub-Paths: Path and children
• Access Policy: Allowed or Denied

RFC Access Control

1. Add System Mapping

• Virtual Host: Name for RFC destinations
• Internal Host: SAP system hostname
• Virtual Port: Instance number × 100 + 33 (e.g., 3300 for instance 00)
• Protocol: RFC or RFC/SNC

2. Optionally restrict function modules

LDAP Access Control

1. Add System Mapping

• Virtual Host/Port
• Internal Host/Port
• Protocol: LDAP or LDAPS

---

High Availability

Master-Shadow Architecture

                    ┌─────────────────┐
                    │   SAP BTP       │
                    │   Cloud Region  │
                    └────────┬────────┘
                             │ Tunnel
                    ┌────────┴────────┐
         ┌──────────┤   Connectivity   ├──────────┐
         │          │     Service      │          │
         │          └─────────────────┘          │
         │                                        │
    ┌────┴────┐                              ┌────┴────┐
    │ Master  │◄─────── Config Sync ────────►│ Shadow  │
    │   CC    │                              │   CC    │
    └────┬────┘                              └────┬────┘
         │                                        │
         └────────────┬──────────────────────────┘
                      │
              On-Premise Systems

Configuration

Master Instance: 1. Select "Master" during initial setup 2. Configure normally

Shadow Instance: 1. Select "Shadow" during initial setup 2. Enter Master hostname and port 3. Shadow connects to Master and syncs configuration

Failover Behavior

1. Shadow monitors Master via ping checks 2. If Master unreachable, Shadow becomes active 3. Shadow takes over tunnel connection 4. When Master recovers, manual switchback may be needed

Warning: Network issues between Master and Shadow can cause split-brain scenarios.

Split-Brain Recovery: 1. Stop both instances immediately 2. Check logs to identify which instance was most recently active 3. Designate one as Master, one as Shadow 4. Clear state on the Shadow instance if needed 5. Restart both in correct roles (Master first) 6. Verify configuration sync completes successfully

---

Sizing Recommendations

Master Instance

Shadow Instance

• Same as Master for failover capability

Server Requirements

• Minimum: 3 servers (dev, prod master, prod shadow)
• Recommended: Separate physical hardware for master/shadow
• Consider disaster recovery instances

---

Monitoring

Windows Service Status

sc query "SAP Cloud Connector"

Linux Daemon Status

systemctl status scc_daemon
# or
service scc_daemon status

Administration UI

1. Subaccount Dashboard: Connection states 2. Hardware Metrics: CPU, memory, disk 3. Performance Monitor: Request statistics 4. Audit Logs: Configuration changes and access

Monitoring APIs

Cloud Connector exposes REST APIs for external monitoring tools:

• Health check endpoints
• Performance metrics
• Connection status

---

Audit Logging

Configuration

1. Navigate to Configuration > Audit 2. Set audit level:

• Off: No logging
• Security: Authentication and authorization events
• All: Complete audit trail (recommended for production)

Log Management

• Logs stored locally
• Configure rotation and archival
• Export for SIEM integration

---

Backup and Restore

Configuration Backup

Via UI: 1. Navigate to Configuration > Backup 2. Click Download Backup 3. Save encrypted backup file

Via REST API:

curl -X GET "https://localhost:8443/api/v1/configuration/backup" \
  -H "Authorization: Basic <credentials>" \
  --output backup.zip

Restore

1. Fresh install on new machine 2. Navigate to Configuration > Backup 3. Upload backup file 4. Restart Cloud Connector

---

Security Guidelines

Network Deployment

• Deploy in DMZ
• Under IT department control
• Firewall between Cloud Connector and internal systems

OS-Level Protection

• Restrict OS access to administrators
• Dedicate machine to Cloud Connector
• Enable hard-drive encryption
• Enable OS audit logging

Administration UI

• Change default password immediately
• Configure LDAP for user management
• Replace self-signed certificate
• Restrict UI access to localhost (high-security)

Protocols

• Use HTTPS for HTTP connections
• Use SNC for RFC connections
• Use LDAPS for LDAP connections

---

Common Operations

Upgrade

1. Download new version 2. Stop Cloud Connector service 3. Run installer (configuration preserved) 4. Start service 5. Verify functionality

Certificate Renewal

1. Navigate to Configuration > On Premise > System Certificate 2. Generate new CSR or upload new certificate 3. If using Cloud Connector CA: renew via subaccount dashboard

Change Administrator Password

1. Navigate to Configuration > User Interface 2. Enter current password 3. Enter new password 4. Click Change Password

---

Troubleshooting

Cannot Connect to Subaccount

1. Verify region URL 2. Check firewall allows outbound HTTPS (port 443) 3. Verify credentials 4. Check proxy settings if behind corporate proxy

Access Denied to Resource

1. Verify system mapping exists 2. Check resource path matches 3. Verify policy allows access 4. Check virtual host/port in destination

Performance Issues

1. Check hardware metrics 2. Increase JVM heap if needed 3. Review access control rules (too permissive can cause overhead) 4. Consider additional instances

---

Documentation Links

• Cloud Connector Overview: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector
• Installation: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/installation
• Initial Configuration: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/initial-configuration
• High Availability: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/high-availability-setup
• Security Guidelines: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/security-guidelines
• FAQ: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/frequently-asked-questions

---

Last Updated: 2025-11-22

Connectivity Alternatives and Configuration Reference

Alternative connectivity approaches, user roles, target system configuration, and getting started guide.

Source: https://github.com/SAP-docs/btp-connectivity/tree/main/docs/1-connectivity-documentation

---

Getting Started

Core Components Overview

Quick Start Path

1. Store Configuration: Use Destination Service for credentials, certificates, URLs 2. Choose Architecture:

• Cloud Foundry → Cloud Connector + Connectivity Service
• Kubernetes → Connectivity Proxy or Transparent Proxy

3. Enhance: Deploy Transparent Proxy for automated destination handling

---

Connectivity Alternatives

Reverse Proxy vs Cloud Connector

Organizations may choose between Cloud Connector and a reverse proxy/ADC for on-premise connectivity.

Reverse Proxy Approach

Configuration:

ProxyType: Internet

Advantages:

• Reuses existing reverse proxy/ADC infrastructure
• Cloud-agnostic (works with any cloud)
• Centralized entry point to corporate network

Disadvantages:

• Services exposed to Internet (DoS vulnerability)
• IP filtering allows only one BTP outbound address
• Cannot restrict to customer-specific apps
• RFC requires WebSocket (S/4HANA 1909+ only)
• No straightforward principal propagation
• Requires intensive IT involvement

Cloud Connector Approach

Configuration:

ProxyType: OnPremise

Advantages:

• TLS tunnel with reverse invocation
• No DMZ/firewall changes needed
• Prevents Internet-based attacks
• Simplified setup
• Granular access controls
• Supports HTTP, RFC, LDAP, TCP
• Principal propagation built-in

Decision Matrix

---

User Roles

Cloud Connector Roles

BTP Role Collections

Permission Requirements

View Connected Cloud Connectors:

• Requires readSCCTunnels permission
• Cloud Connector Administrator role satisfies this

Configure Access Control:

• Requires Administrator role in Cloud Connector UI
• Not configurable via BTP Cockpit

---

Target System Configuration (RFC)

Connection Types

1. Direct Connection

Use When: Single application server target

Proxy Type: OnPremise (Load Balancing: unchecked)

Cloud Connector: Virtual port must be sapgw<##> (e.g., sapgw00)

2. Load Balancing Connection

Use When: Multiple app servers with message server

Proxy Type: OnPremise (Load Balancing: checked)

Cloud Connector: Virtual port must be sapms<###> (e.g., sapmsERP)

3. WebSocket Connection (Internet)

Use When: Direct Internet access to ABAP (S/4HANA 1909+)

Proxy Type: Internet

Trust Store Options:

• Dedicated trust store with location/password
• Default client trust store
• Trust all (demo only)

Supported Targets:

• SAP S/4HANA Cloud
• BTP ABAP Environment
• On-premise ABAP 1909+

---

User Logon Properties (RFC)

Core Properties

Password Behavior

Authentication Types

`jco.destination.auth_type`:

Certificate-Based Login

When certificate login enabled, username/password fields hidden.

Technical User Propagation

---

SAP SuccessFactors Integration

OAuth Client Setup

Prerequisites: 1. Download X.509 certificate from BTP Cockpit

• Navigate to Connectivity > Destinations
• Click "Download Trust"

Configuration Steps:

1. Access OAuth Management:

• SuccessFactors Admin Center
• Search "OAuth"
• Select "Manage OAuth2 Client Applications"

2. Register Application:

   Application Name: <descriptive-name>
   Application URL: https://api.cf.<region>.ondemand.com/<subaccount-GUID>
   X.509 Certificate: <paste downloaded certificate>

3. Get API Key:

• Find client by name
• Click "View" in Actions
• Copy the API Key

Use in Destination:

{
  "Name": "successfactors-dest",
  "Type": "HTTP",
  "URL": "https://<sf-instance>.successfactors.com",
  "Authentication": "OAuth2SAMLBearerAssertion",
  "ProxyType": "Internet",
  "audience": "www.successfactors.com",
  "apiKey": "<API-Key-from-SF>",
  "companyId": "<company-id>",
  "clientKey": "<client-key-from-sf-oauth>",
  "tokenServiceUrl": "https://<sf-api>.successfactors.com/oauth/token",
  "tokenServiceUser": "<token-service-user>",
  "tokenServicePassword": "<token-service-password>"
}

---

Common Properties (Cloud Connector API)

Instance Properties

API Endpoints

Role Requirements

---

Prerequisites

Cloud Foundry Environment

• SAP BTP subaccount with Cloud Foundry enabled
• Destination Service instance
• Connectivity Service instance (for on-premise)
• Cloud Connector (for on-premise systems)

Kubernetes/Kyma Environment

• Kubernetes cluster with BTP integration
• Connectivity Proxy (for on-premise)
• Transparent Proxy (for simplified access)
• Destination Service instance

Cloud Connector

• Supported OS (Windows, Linux, macOS)
• Java 8+ runtime
• Network access to BTP region hosts
• Network access to target backend systems

On-Premise Systems

• SAP NetWeaver 4.6C+ (for RFC)
• SAP NetWeaver 7.0+ (for principal propagation)
• S/4HANA 1909+ (for WebSocket RFC)

---

Connectivity Support

Getting Help

SAP Support Portal:

• Component: BC-CP-CON (Connectivity)
• Component: BC-CP-CF-SEC-DST (Destination Service)
• Component: BC-CP-TOOLS-SCC (Cloud Connector)

SAP Community:

• Tag: SAP BTP Connectivity
• Tag: Cloud Connector

Log Collection

Cloud Connector:

# Windows
%PROGRAMDATA%\SAP\scc\logs\

# Linux
/opt/sap/scc/logs/

Kubernetes:

kubectl logs deployment/connectivity-proxy -n <namespace>
kubectl logs deployment/transparent-proxy -n <namespace>

---

Last Updated: 2025-11-22 Source Files:

• connectivity-via-reverse-proxy-dde01af.md
• user-roles-b922fc8.md
• target-system-configuration-ab6eac9.md
• user-logon-properties-8b1e1c3.md
• create-an-oauth-client-in-sap-successfactors-69130a7.md
• common-properties-8aed644.md
• getting-started-daca64d.md
• prerequisites-e23f776.md
• connectivity-support-e5580c5.md

Destination Service REST API - Complete Reference

Source: https://github.com/SAP-docs/btp-connectivity/blob/main/docs/1-connectivity-documentation/destination-service-rest-api-23ccafb.md

API Specification: https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination

---

Overview

The Destination Service REST API enables programmatic management of destinations, certificates, and destination fragments on SAP BTP.

---

Authentication

Get OAuth Access Token

# Extract credentials from service key
clientId="<from-service-key>"
clientSecret="<from-service-key>"
tokenUrl="<from-service-key>/oauth/token"
destinationUri="<from-service-key>"

# Request access token
curl -X POST "${tokenUrl}" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  --data-urlencode "client_id=${clientId}" \
  --data-urlencode "client_secret=${clientSecret}"

Response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "bearer",
  "expires_in": 43199,
  "scope": "uaa.resource"
}

Using mTLS (Recommended)

For enhanced security, use X.509 certificates instead of client secrets:

curl -X POST "${tokenUrl}" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --cert client-cert.pem \
  --key client-key.pem \
  -d "grant_type=client_credentials" \
  --data-urlencode "client_id=${clientId}"

---

Base URL

{destinationUri}/destination-configuration/v1

The destinationUri is obtained from the service key (field: uri).

---

Endpoints

Subaccount Destinations

List All Destinations

GET /subaccountDestinations

curl -X GET "${destinationUri}/destination-configuration/v1/subaccountDestinations" \
  -H "Authorization: Bearer ${access_token}"

Response:

[
  {
    "Name": "my-destination",
    "Type": "HTTP",
    "URL": "https://api.example.com",
    "Authentication": "OAuth2ClientCredentials",
    "ProxyType": "Internet"
  }
]

Get Specific Destination

GET /subaccountDestinations/{destinationName}

curl -X GET "${destinationUri}/destination-configuration/v1/subaccountDestinations/my-destination" \
  -H "Authorization: Bearer ${access_token}"

Create Destination

POST /subaccountDestinations

curl -X POST "${destinationUri}/destination-configuration/v1/subaccountDestinations" \
  -H "Authorization: Bearer ${access_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "Name": "new-destination",
    "Type": "HTTP",
    "URL": "https://api.example.com",
    "Authentication": "BasicAuthentication",
    "ProxyType": "Internet",
    "User": "username",
    "Password": "password"
  }'

Update Destination

PUT /subaccountDestinations/{destinationName}

curl -X PUT "${destinationUri}/destination-configuration/v1/subaccountDestinations/my-destination" \
  -H "Authorization: Bearer ${access_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "Name": "my-destination",
    "Type": "HTTP",
    "URL": "https://api.updated.example.com",
    "Authentication": "BasicAuthentication",
    "ProxyType": "Internet",
    "User": "newuser",
    "Password": "newpassword"
  }'

Delete Destination

DELETE /subaccountDestinations/{destinationName}

curl -X DELETE "${destinationUri}/destination-configuration/v1/subaccountDestinations/my-destination" \
  -H "Authorization: Bearer ${access_token}"

---

Service Instance Destinations

List Instance Destinations

GET /instanceDestinations

curl -X GET "${destinationUri}/destination-configuration/v1/instanceDestinations" \
  -H "Authorization: Bearer ${access_token}"

CRUD Operations

Same as subaccount destinations but using /instanceDestinations path.

---

Find Destination (with Authentication)

The most commonly used endpoint - retrieves destination configuration with authentication tokens.

GET /destinations/{destinationName}

curl -X GET "${destinationUri}/destination-configuration/v1/destinations/my-destination" \
  -H "Authorization: Bearer ${access_token}"

Response Structure:

{
  "owner": {
    "SubaccountId": "abc123",
    "InstanceId": null
  },
  "destinationConfiguration": {
    "Name": "my-destination",
    "Type": "HTTP",
    "URL": "https://api.example.com",
    "Authentication": "OAuth2ClientCredentials",
    "ProxyType": "Internet",
    "clientId": "...",
    "tokenServiceURL": "..."
  },
  "authTokens": [
    {
      "type": "Bearer",
      "value": "eyJhbGciOiJSUzI1NiIs...",
      "http_header": {
        "key": "Authorization",
        "value": "Bearer eyJhbGciOiJSUzI1NiIs..."
      },
      "expires_in": "43199",
      "scope": "read write"
    }
  ],
  "certificates": []
}

With User Token (Principal Propagation)

For destinations requiring user context:

curl -X GET "${destinationUri}/destination-configuration/v1/destinations/my-destination" \
  -H "Authorization: Bearer ${access_token}" \
  -H "X-user-token: ${user_jwt}"

With Destination Fragment

curl -X GET "${destinationUri}/destination-configuration/v1/destinations/my-destination" \
  -H "Authorization: Bearer ${access_token}" \
  -H "X-Fragment-Name: my-fragment"

---

Certificates

List Certificates

GET /subaccountCertificates

curl -X GET "${destinationUri}/destination-configuration/v1/subaccountCertificates" \
  -H "Authorization: Bearer ${access_token}"

Upload Certificate

POST /subaccountCertificates

curl -X POST "${destinationUri}/destination-configuration/v1/subaccountCertificates" \
  -H "Authorization: Bearer ${access_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "Name": "my-certificate",
    "Type": "CERTIFICATE",
    "Content": "base64-encoded-certificate"
  }'

Delete Certificate

DELETE /subaccountCertificates/{certificateName}

curl -X DELETE "${destinationUri}/destination-configuration/v1/subaccountCertificates/my-certificate" \
  -H "Authorization: Bearer ${access_token}"

---

Destination Fragments

List Fragments

GET /subaccountDestinationFragments

curl -X GET "${destinationUri}/destination-configuration/v1/subaccountDestinationFragments" \
  -H "Authorization: Bearer ${access_token}"

Create Fragment

POST /subaccountDestinationFragments

curl -X POST "${destinationUri}/destination-configuration/v1/subaccountDestinationFragments" \
  -H "Authorization: Bearer ${access_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "Name": "my-fragment",
    "FragmentProperties": [
      {
        "Name": "URL.headers.X-Tenant-Id",
        "Value": "tenant-123"
      }
    ]
  }'

Delete Fragment

DELETE /subaccountDestinationFragments/{fragmentName}

curl -X DELETE "${destinationUri}/destination-configuration/v1/subaccountDestinationFragments/my-fragment" \
  -H "Authorization: Bearer ${access_token}"

---

Subscription-Level Destinations (Multitenancy)

For SaaS applications with tenant-specific destinations.

Create Subscription Destination

1. Get subscriber token using provider credentials 2. Call API with subscriber context

# Get subscriber token
curl -X POST "${subscriberTokenUrl}/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  --data-urlencode "client_id=${providerClientId}" \
  --data-urlencode "client_secret=${providerClientSecret}"

# Create subscription destination
curl -X POST "${destinationUri}/destination-configuration/v1/subscriptionDestinations" \
  -H "Authorization: Bearer ${subscriber_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "Name": "tenant-destination",
    "Type": "HTTP",
    "URL": "https://tenant-api.example.com",
    "Authentication": "BasicAuthentication",
    "User": "tenant-user",
    "Password": "tenant-password"
  }'

---

Pagination

For large numbers of destinations, use pagination:

GET /subaccountDestinations?$top=100&$skip=0

curl -X GET "${destinationUri}/destination-configuration/v1/subaccountDestinations?\$top=100&\$skip=0" \
  -H "Authorization: Bearer ${access_token}"

Parameters:

• $top: Maximum number of results (default: 100)
• $skip: Number of results to skip

---

Error Handling

HTTP Status Codes

Error Response Format

{
  "ErrorMessage": "Destination with name 'my-destination' already exists."
}

---

Best Practices

Caching

• Cache access tokens for their validity period
• Cache destination configurations (3-5 minutes recommended)
• Use stale cache if refresh fails

Retry Logic

const retryDelays = [2000, 4000, 8000, 16000]; // ms

async function callWithRetry(fn) {
  for (let i = 0; i < retryDelays.length; i++) {
    try {
      return await fn();
    } catch (error) {
      if (i === retryDelays.length - 1) throw error;
      await sleep(retryDelays[i]);
    }
  }
}

Timeouts

• Connect timeout: 2-5 seconds
• Read timeout: ~30 seconds

---

SDK Usage

SAP Cloud SDK (Node.js)

const { getDestination } = require('@sap-cloud-sdk/connectivity');

// Get destination with authentication
const destination = await getDestination({
  destinationName: 'my-destination',
  jwt: userJwt  // For user propagation
});

console.log(destination.url);
console.log(destination.authTokens);

SAP Cloud SDK (Java)

import com.sap.cloud.sdk.cloudplatform.connectivity.DestinationAccessor;

// Get destination
Destination destination = DestinationAccessor
    .getDestination("my-destination");

String url = destination.get(DestinationProperty.URI)
    .orElseThrow();

---

Documentation Links

• API Specification: https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination
• Calling the API: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/calling-destination-service-rest-api
• Multitenancy: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/multitenancy-in-destination-service

---

Last Updated: 2025-11-22

HTTP Destinations - Complete Reference

Source: https://github.com/SAP-docs/btp-connectivity/blob/main/docs/1-connectivity-documentation/http-destinations-42a0e6b.md

---

Overview

HTTP destinations define connection parameters for HTTP/HTTPS endpoints, supporting internet, on-premise, and PrivateLink connections.

---

Required Properties

---

Proxy Types

Internet

Direct connection to internet-accessible endpoints.

• Default proxy type
• No additional components required

OnPremise

Connection via Cloud Connector to on-premise systems.

• Requires Cloud Connector installation
• Optional CloudConnectorLocationId for multiple connectors
• Also applies to VPC environments

PrivateLink

Connection via SAP Private Link Service.

• Available for selected SAP BTP services
• Requires Private Link setup with IaaS provider

---

Authentication Types

No Authentication

Authentication: NoAuthentication

Basic Authentication

Authentication: BasicAuthentication
User: <username>
Password: <password>

Client Certificate Authentication

Authentication: ClientCertificateAuthentication
KeyStoreLocation: <certificate-location>
KeyStorePassword: <password>

OAuth2ClientCredentials

Authentication: OAuth2ClientCredentials
clientId: <client-id>
clientSecret: <client-secret>
tokenServiceURL: https://auth.example.com/oauth/token
tokenServiceURLType: Dedicated | Common

Optional Properties:

• scope: OAuth scopes
• tokenServiceUser / tokenServicePassword: For token service basic auth
• URL.headers.<name>: Custom headers for target
• URL.queries.<name>: Custom query parameters
• tokenService.body.<name>: Custom token request body

OAuth2JWTBearer

Authentication: OAuth2JWTBearer
clientId: <client-id>
clientSecret: <client-secret>
tokenServiceURL: https://auth.example.com/oauth/token

Exchanges incoming user JWT for new access token.

OAuth2SAMLBearerAssertion

Authentication: OAuth2SAMLBearerAssertion
audience: <saml-audience>
clientKey: <client-key>
tokenServiceURL: https://auth.example.com/oauth2/token
KeyStoreLocation: <certificate-for-signing>

Required for user propagation (cloud-to-cloud).

Additional Properties:

• nameIdFormat: SAML NameID format
• userIdSource: JWT field for user ID
• authnContextClassRef: Authentication context class
• assertionIssuer: SAML assertion issuer
• companyId: Company identifier
• assertionRecipient: SAML recipient

OAuth2Password

Authentication: OAuth2Password
User: <username>
Password: <password>
clientId: <client-id>
clientSecret: <client-secret>
tokenServiceURL: https://auth.example.com/oauth/token

Deprecated: Use OAuth2ClientCredentials or OAuth2SAMLBearerAssertion instead.

OAuth2AuthorizationCode

Authentication: OAuth2AuthorizationCode
clientId: <client-id>
clientSecret: <client-secret>
tokenServiceURL: https://auth.example.com/oauth/token

For interactive user authorization flows.

OAuth2UserTokenExchange

Authentication: OAuth2UserTokenExchange
clientId: <client-id>
clientSecret: <client-secret>
tokenServiceURL: https://auth.example.com/oauth/token

Exchanges user token for access token.

OAuth2RefreshToken

Authentication: OAuth2RefreshToken
clientId: <client-id>
clientSecret: <client-secret>
tokenServiceURL: https://auth.example.com/oauth/token
refreshToken: <refresh-token>

Uses refresh token to obtain access tokens.

SAMLAssertion

Authentication: SAMLAssertion
audience: <saml-audience>

For SAML assertion authentication without OAuth.

PrincipalPropagation

Authentication: PrincipalPropagation
ProxyType: OnPremise

Required for user propagation (cloud-to-on-premise).

• Requires Cloud Connector configuration
• Generates X.509 certificate from user identity

---

Optional Properties

Connection Settings

Valid ranges:

• Connection timeout: 0-60 seconds
• Socket read timeout: 0-600 seconds

Custom Headers and Parameters

URL.headers.<header-name>: <value>
URL.queries.<param-name>: <value>
tokenService.headers.<header-name>: <value>
tokenService.queries.<param-name>: <value>
tokenService.body.<param-name>: <value>

TLS Configuration

TrustStoreLocation: <truststore-location>
TrustAll: true | false

Warning: TrustAll: true disables certificate validation. Use only for testing.

Cloud Connector

CloudConnectorLocationId: <location-id>

Required when multiple Cloud Connectors connect to the same subaccount.

---

Token Service URL Types

Example with Common:

tokenServiceURL: https://{tenant}.auth.example.com/oauth/token

---

Example: Complete OAuth2ClientCredentials Destination

{
  "Name": "my-api-destination",
  "Type": "HTTP",
  "URL": "https://api.example.com/v1",
  "ProxyType": "Internet",
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "tokenServiceURLType": "Dedicated",
  "scope": "read write",
  "URL.headers.X-Custom-Header": "custom-value",
  "URL.connectionTimeoutInSeconds": "30",
  "URL.socketReadTimeoutInSeconds": "60"
}

---

Example: On-Premise with Principal Propagation

{
  "Name": "onprem-sap-system",
  "Type": "HTTP",
  "URL": "http://virtual-host:443/sap/opu/odata/sap/API_BUSINESS_PARTNER",
  "ProxyType": "OnPremise",
  "Authentication": "PrincipalPropagation",
  "CloudConnectorLocationId": "loc1"
}

---

Documentation Links

• HTTP Destinations: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/http-destinations
• Authentication Types: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/http-destinations#authentication
• Destination Service API: https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination

---

Last Updated: 2025-11-22

Identity Propagation Scenarios Reference

Advanced identity propagation configurations for ABAP systems, NetWeaver Java, and custom identity providers.

Source: https://github.com/SAP-docs/btp-connectivity/tree/main/docs/1-connectivity-documentation

---

Overview

Identity propagation enables SSO between SAP BTP and backend systems by forwarding user identity through short-lived X.509 certificates.

Propagation Types

Supported Backend Systems

• SAP ABAP systems (HTTPS, RFC)
• SAP NetWeaver AS Java
• SAP Web Dispatcher (as proxy)
• Third-party systems (with X.509 support)

---

Identity Propagation to ABAP Systems

HTTPS Configuration

Prerequisites:

• Cloud Connector installed and connected
• System certificate configured in Cloud Connector
• Access control for target ABAP system

Steps:

1. Export Cloud Connector Certificate:

• Cloud Connector UI > Configuration > On Premise > System Certificate
• Download the certificate

2. Import to ABAP Trust Store:

• Transaction STRUST
• Import certificate to SSL Server Standard

3. Configure Certificate Mapping:

• Transaction CERTRULE
• Create rule to map certificate subject to ABAP user

4. Destination Configuration:

   Authentication: PrincipalPropagation
   ProxyType: OnPremise

RFC Configuration

Prerequisites:

• Cloud Connector with SNC PSE configured
• SNC enabled on ABAP system

Steps:

1. Configure SNC PSE in Cloud Connector:

• Cloud Connector UI > Configuration > On Premise > SNC

2. Export SNC Certificate:

• Download PSE certificate from Cloud Connector

3. Import to ABAP SNC Trust:

• Transaction STRUST > SNC (SAPCryptolib)

4. Configure SNC Parameters:

   jco.client.snc_mode: 1
   jco.client.snc_partnername: p:<ABAP-SNC-Name>
   jco.client.snc_qop: 9

Rule-Based Certificate Mapping

Configure in ABAP transaction CERTRULE:

Example Rules (Transaction CERTRULE):

# Rule 1: Direct mapping from CN attribute
Certificate Attribute: CN (Common Name)
Login As: ABAP User
Mapping: CN value maps directly to SAP user ID

# Rule 2: Email-based mapping via SubjectAlternativeName
Certificate Attribute: SubjectAlternativeName (Email)
Login As: Alias
Mapping: Email address maps to user alias in table USR02

# Rule 3: OU-based filtering with CN mapping
Subject Filter: OU=Cloud Connector
Certificate Attribute: CN
Login As: ABAP User

Short-Term vs Long-Term Certificates

---

Identity Propagation to NetWeaver Java

Prerequisites

• SAP NetWeaver Administrator access
• Cloud Connector administrator access
• SSL access point configuration

Configuration Steps

1. Import Cloud Connector Certificate:

• SAP NetWeaver Administrator > Security > Certificates and Keys
• Import system certificate to "Trusted CAs" keystore

2. Configure ICM SSL Access Point:

• Create new SSL access point
• Generate Certificate Signing Request (CSR)
• Import certificate chain:
• CSR response
• Root CA certificate
• Cloud Connector certificate
• Restart ICM

3. Add ClientCertLoginModule:

• SAP NetWeaver Administrator > Configuration > Security
• Add ClientCertLoginModule to policy configuration

4. Define User Mapping Rules:

# Map from certificate subject
Rule Type: Subject Name Field
Field: CN
Target: User ID

# Map from SubjectAlternativeName
Rule Type: Certificate V3 Extension
Extension: SubjectAlternativeName
Target: User ID

# Certificate filter
Rule Type: Client Certificate Filter
Issuer: CN=Cloud Connector CA

ICM Verification

# Check ICM trusts certificate
sapcontrol -nr <instance> -function ICMGetThreadList

# Verify SSL configuration
disp+work -v

---

Custom Identity Provider Configuration

SSO Passcode Method

When using a custom IDP for Cloud Connector subaccount configuration:

Step 1: Construct SSO URL

https://<subdomain>.authentication.<region>.hana.ondemand.com/passcode

Example:

https://mycompany.authentication.eu10.hana.ondemand.com/passcode

Step 2: Obtain Passcode

• Navigate to SSO URL in browser
• Authenticate with custom IDP
• Copy generated one-time passcode

Step 3: Configure Cloud Connector

Username: $SAP-CP-SSO-PASSCODE$
Password: <one-time-passcode>

Alternative: Authentication Data File

Cloud Connector 2.17+ supports authentication data file import:

1. Generate file in BTP Cockpit 2. Download authentication data 3. Cloud Connector UI > Configuration > Import 4. Select authentication data file

---

IAS Token Propagation

IAS-Signed SAML Bearer Assertion

Flow: 1. User authenticates to SAP Identity Authentication Service (IAS) 2. IAS issues signed SAML assertion 3. Destination Service exchanges for OAuth token 4. Token used for target system access

Destination Configuration:

{
  "Name": "ias-saml-destination",
  "Type": "HTTP",
  "URL": "https://target-system.example.com",
  "Authentication": "OAuth2SAMLBearerAssertion",
  "ProxyType": "Internet",
  "audience": "https://target-system.example.com",
  "clientKey": "<service-key>",
  "tokenServiceURL": "https://target.authentication.region.hana.ondemand.com/oauth/token",
  "KeyStoreLocation": "ias-signing-cert.p12",
  "KeyStorePassword": "<password>"
}

IAS-Generated SAML to OAuth2 Chain

Predefined Chain Configuration:

Authentication: OAuth2SAMLBearerAssertion
ChainType: IAS_SAML_TO_OAUTH2

Flow: 1. BTP app requests destination with IAS token 2. Destination Service validates IAS token 3. Generates SAML assertion from IAS claims 4. Exchanges SAML for OAuth2 token 5. Returns destination with access token

---

OAuth2UserTokenExchange

Token Exchange Flow

Prerequisites:

• User token with uaa.user scope
• OAuth2UserTokenExchange destination configured

Header Configuration:

Implementation

# Provider tenant token exchange
curl -X GET "${uri}/destination-configuration/v1/destinations/${destName}" \
  -H "Authorization: Bearer ${userJwt}"

# Subscriber to provider destination
curl -X GET "${uri}/destination-configuration/v1/destinations/${destName}" \
  -H "Authorization: Bearer ${accessToken}" \
  -H "X-user-token: ${subscriberUserJwt}"

---

Sequential User Propagation Chain

Concept

Chain multiple authentication methods for complex SSO scenarios.

Example: BTP → IAS → On-Premise

1. User authenticates to BTP via IAS 2. IAS token exchanged for SAML assertion 3. SAML propagated to on-premise via Cloud Connector 4. On-premise validates and maps user

Configuration

{
  "Name": "sequential-chain-dest",
  "Type": "HTTP",
  "URL": "https://onprem.internal:443",
  "Authentication": "OAuth2SAMLBearerAssertion",
  "ProxyType": "OnPremise",
  "chainConfig": {
    "step1": "IAS_TOKEN_VALIDATION",
    "step2": "SAML_ASSERTION_GENERATION",
    "step3": "PRINCIPAL_PROPAGATION"
  }
}

---

Propagation via SAP Web Dispatcher

Architecture

BTP App → Cloud Connector → Web Dispatcher → ABAP Backend

Web Dispatcher Configuration

# icm/server_port_0
wdisp/ssl_enable = 1
wdisp/ssl_client_sni = 1

# Client certificate forwarding
icm/HTTP/client_cert_header = SSL_CLIENT_CERT

Trust Chain Setup

1. Import Cloud Connector certificate to Web Dispatcher trust store 2. Configure certificate forwarding to backend 3. Backend validates certificate from trusted Web Dispatcher

---

Communication Behavior Parameters

JCo Connection Parameters

Codepage Considerations

When passwords contain special characters:

• Default 1100 (iso-8859-1) may not support all characters
• Use appropriate codepage for your locale:
• 1160 - UTF-8
• 8000 - Japanese
• 8300 - Korean

---

Troubleshooting

Certificate Issues

Debugging

Cloud Connector:

Audit Log Level: All
Connection/Traffic Traces: Enabled (temporarily)

ABAP:

Transaction: SMICM > Services > ICM Trace
Transaction: SLDCHECK > SSL Trace

NetWeaver Java:

Log Configuration: Security > Authentication
Trace Level: DEBUG

---

Last Updated: 2025-11-22 Source Files:

• configuring-identity-propagation-to-an-abap-system-6705cc3.md
• configuring-identity-propagation-to-sap-netweaver-as-for-java-2e96287.md
• use-a-custom-idp-for-subaccount-configuration-2022612.md
• exchanging-user-jwts-via-oauth2usertokenexchange-destinations-39d4265.md
• ias-signed-saml-bearer-assertion-a1ecea9.md
• sequential-user-propagation-chain-13f633e.md
• parameters-influencing-communication-behavior-cce126a.md

Java APIs and SDK Development - Complete Reference

Source: https://github.com/SAP-docs/btp-connectivity/tree/main/docs/1-connectivity-documentation

---

Overview

SAP BTP Connectivity provides Java APIs for destination access, though SAP Cloud SDK is recommended for new developments.

---

API Status

Support-only: Bug fixes and security patches only; no new features planned.

---

Maven Dependencies

Connectivity API Extension

<dependency>
    <groupId>com.sap.cloud.connectivity.apiext</groupId>
    <artifactId>com.sap.cloud.connectivity.apiext</artifactId>
    <version>${connectivity-apiext.version}</version>
    <scope>provided</scope>
</dependency>

JCo (Java Connector for RFC)

<dependency>
    <groupId>com.sap.cloud</groupId>
    <artifactId>neo-java-web-api</artifactId>
    <version>4.108.9</version>
    <scope>provided</scope>
</dependency>

SAP Cloud SDK (Recommended)

<dependency>
    <groupId>com.sap.cloud.sdk.cloudplatform</groupId>
    <artifactId>cloudplatform-connectivity</artifactId>
</dependency>

---

ConnectivityConfiguration API

Retrieve destination configurations via JNDI lookup.

Setup

context.xml:

<Resource name="connectivityConfiguration"
    type="com.sap.core.connectivity.api.configuration.ConnectivityConfiguration"
    factory="com.sap.core.connectivity.api.jndi.ServiceObjectFactory"/>

manifest.yml:

env:
  USE_CONNECTIVITY_APIEXT: true
services:
  - my-xsuaa
  - my-destination-service
  - my-connectivity-service

Usage

import com.sap.core.connectivity.api.configuration.ConnectivityConfiguration;
import com.sap.core.connectivity.api.configuration.DestinationConfiguration;

// JNDI Lookup
Context ctx = new InitialContext();
ConnectivityConfiguration config = (ConnectivityConfiguration)
    ctx.lookup("java:comp/env/connectivityConfiguration");

// Get destination
DestinationConfiguration destConfig =
    config.getConfiguration("my-destination");

// Access properties
String authType = destConfig.getProperty("Authentication");
Map<String, String> allProps = destConfig.getAllProperties();

// Get keystore for SSL/TLS
KeyStore keyStore = destConfig.getKeyStore();
KeyStore trustStore = destConfig.getTrustStore();

Priority Order

When destinations exist at multiple levels: 1. Instance/Subscription level (highest) 2. Subaccount level (lowest)

---

AuthenticationHeaderProvider API

Retrieve prepared authentication headers for target systems.

Setup

context.xml:

<Resource name="myAuthHeaderProvider"
    type="com.sap.core.connectivity.api.authentication.AuthenticationHeaderProvider"
    factory="com.sap.core.connectivity.api.jndi.ServiceObjectFactory"/>

Usage

import com.sap.core.connectivity.api.authentication.AuthenticationHeaderProvider;
import com.sap.core.connectivity.api.authentication.AuthenticationHeader;

// JNDI Lookup
AuthenticationHeaderProvider authProvider = (AuthenticationHeaderProvider)
    ctx.lookup("java:comp/env/myAuthHeaderProvider");

// Principal Propagation (On-Premise SSO)
AuthenticationHeader ppHeader = authProvider.getPrincipalPropagationHeader();

// OAuth2 SAML Bearer Assertion
List<AuthenticationHeader> samlHeaders =
    authProvider.getOAuth2SAMLBearerAssertionHeaders(destConfig);

// OAuth2 Client Credentials
AuthenticationHeader ccHeader =
    authProvider.getOAuth2ClientCredentialsHeader(destConfig);

Token Caching

• Tokens cached automatically
• Auto-refresh before expiration
• No manual cache management needed

---

JCo (Java Connector) for RFC

Sample Servlet

import com.sap.conn.jco.*;

@WebServlet("/rfc-demo")
public class JCoServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {

        try {
            // Get destination
            JCoDestination destination =
                JCoDestinationManager.getDestination("JCoDemoSystem");

            // Get function
            JCoFunction function = destination.getRepository()
                .getFunction("STFC_CONNECTION");

            if (function == null) {
                throw new RuntimeException("Function not found");
            }

            // Set import parameters
            function.getImportParameterList()
                .setValue("REQUTEXT", "Hello from Cloud!");

            // Execute
            function.execute(destination);

            // Get export parameters
            String echoText = function.getExportParameterList()
                .getString("ECHOTEXT");
            String respText = function.getExportParameterList()
                .getString("RESPTEXT");

            // Output
            resp.getWriter().println("Echo: " + echoText);
            resp.getWriter().println("Response: " + respText);

        } catch (JCoException e) {
            throw new ServletException("RFC error: " + e.getMessage(), e);
        }
    }
}

Working with Tables

// Get table parameter
JCoTable companyCodeTable = function.getTableParameterList()
    .getTable("COMPANYCODE_LIST");

// Iterate rows
while (companyCodeTable.nextRow()) {
    String compCode = companyCodeTable.getString("COMP_CODE");
    String compName = companyCodeTable.getString("COMP_NAME");
    System.out.println(compCode + ": " + compName);
}

// Add rows to input table
JCoTable inputTable = function.getTableParameterList().getTable("INPUT_DATA");
inputTable.appendRow();
inputTable.setValue("FIELD1", "value1");
inputTable.setValue("FIELD2", "value2");

Connection Pool Access

// Check pool statistics
JCoDestination dest = JCoDestinationManager.getDestination("MyDest");
dest.getPoolStatistics(); // Returns pool usage info

---

SAP Cloud SDK (Recommended)

Get Destination

import com.sap.cloud.sdk.cloudplatform.connectivity.DestinationAccessor;
import com.sap.cloud.sdk.cloudplatform.connectivity.HttpDestination;

// Simple lookup
HttpDestination destination = DestinationAccessor
    .getDestination("my-destination")
    .asHttp();

// With user propagation
HttpDestination destWithUser = DestinationAccessor
    .getDestination("my-destination")
    .asHttp()
    .withUserToken();

Execute HTTP Request

import com.sap.cloud.sdk.cloudplatform.connectivity.HttpClientAccessor;

HttpClient client = HttpClientAccessor.getHttpClient(destination);
HttpResponse response = client.execute(new HttpGet("/api/resource"));

Node.js (SAP Cloud SDK)

const { getDestination } = require('@sap-cloud-sdk/connectivity');

// Get destination
const destination = await getDestination({
    destinationName: 'my-destination',
    jwt: userJwt  // For user propagation
});

// Use with HTTP client
const response = await axios.get(destination.url + '/api/resource', {
    headers: destination.headers
});

---

Application Router Setup

Required for multitenancy and user-specific service calls with JCo.

manifest.yml

applications:
  - name: approuter
    path: approuter
    buildpacks:
      - nodejs_buildpack
    memory: 120M
    env:
      NODE_TLS_REJECT_UNAUTHORIZED: 0
      destinations: >
        [{
          "name": "backend",
          "url": "https://backend-app.cfapps.eu10.hana.ondemand.com",
          "forwardAuthToken": true
        }]
    services:
      - my-xsuaa

xs-app.json

{
  "welcomeFile": "/index.html",
  "routes": [
    {
      "source": "^/api/(.*)$",
      "destination": "backend",
      "authenticationType": "xsuaa"
    }
  ]
}

---

WebSocket RFC (Internet)

For direct RFC connections without Cloud Connector (S/4HANA 1909+):

Configuration

jco.destination.proxy_type=Internet
jco.client.wshost=s4hana.example.com
jco.client.wsport=443
jco.client.tls=1
jco.client.tls_trust_all=0
jco.client.tls_trust_store_location=truststore.jks
jco.client.tls_trust_store_password=<password>

Supported Systems

• SAP S/4HANA Cloud
• SAP BTP ABAP Environment
• SAP S/4HANA On-Premise 1909+

---

Communication Behavior Parameters

---

Encryption Keys

Customer-Specific Encryption Keys (CSEK)

• Default encryption with SAP-managed keys
• No configuration required
• All properties encrypted except Name and FragmentName

Customer-Managed Keys (CMK)

• Dual encryption: CSEK + customer key
• Requires SAP Data Custodian Key Management
• Full control: grant, revoke, rotate, delete keys

Unencrypted Metadata

• Destination Name
• FragmentName
• Creation/modification timestamps
• Owning subaccount info

---

Connectivity via Reverse Proxy (Not Recommended)

Alternative to Cloud Connector with significant drawbacks:

Recommendation: Use Cloud Connector instead.

---

Documentation Links

• Destination Java APIs: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/destination-java-apis
• ConnectivityConfiguration: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/connectivityconfiguration-api
• AuthenticationHeaderProvider: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/authenticationheaderprovider-api
• SAP Cloud SDK: https://sap.github.io/cloud-sdk/

---

Last Updated: 2025-11-22

Kubernetes Connectivity - Complete Reference

Source: https://github.com/SAP-docs/btp-connectivity/blob/main/docs/1-connectivity-documentation/connectivity-proxy-for-kubernetes-e661713.md

---

Overview

Kubernetes connectivity in SAP BTP involves two main components:

1. Connectivity Proxy: Enables on-premise system access from Kubernetes 2. Transparent Proxy: Exposes BTP destinations as Kubernetes Services

Both work together for comprehensive connectivity in Kubernetes and Kyma environments.

---

Connectivity Proxy

Purpose

Bridges Kubernetes workloads with on-premise systems via Cloud Connector.

Architecture

┌─────────────────────────────────────────────────────────────┐
│                    Kubernetes Cluster                        │
│  ┌─────────────┐    ┌───────────────────┐                   │
│  │ Application │───►│ Connectivity Proxy │                   │
│  └─────────────┘    └─────────┬─────────┘                   │
└───────────────────────────────┼─────────────────────────────┘
                                │ Secure Tunnel
                    ┌───────────┴───────────┐
                    │  SAP Connectivity     │
                    │      Service          │
                    └───────────┬───────────┘
                                │
                    ┌───────────┴───────────┐
                    │   Cloud Connector     │
                    └───────────┬───────────┘
                                │
                    ┌───────────┴───────────┐
                    │  On-Premise Systems   │
                    └───────────────────────┘

Installation via Helm

# Add SAP registry
helm repo add sap https://sapse.github.io/helm-charts

# Install Connectivity Proxy
helm install connectivity-proxy \
  oci://registry-1.docker.io/sapse/connectivity-proxy \
  --version <version> \
  --namespace <namespace> \
  -f values.yaml

values.yaml Configuration

# Connectivity Service credentials
config:
  integration:
    connectivityService:
      serviceCredentialsKey: connectivity-service-key

# Subaccount configuration
  subaccountId: <subaccount-id>
  subaccountSubdomain: <subdomain>

# High availability
replicaCount: 2

# Resource limits
resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: 500m
    memory: 512Mi

# Logging
config:
  servers:
    proxy:
      logging:
        level: INFO

Create Connectivity Service Instance

# Cloud Foundry
cf create-service connectivity connectivity_proxy my-connectivity-service

# Create service key
cf create-service-key my-connectivity-service my-key

# Get credentials
cf service-key my-connectivity-service my-key

Kubernetes Secret

Create secret from service key:

apiVersion: v1
kind: Secret
metadata:
  name: connectivity-service-key
  namespace: <namespace>
type: Opaque
stringData:
  connectivity_key: |
    {
      "clientid": "...",
      "clientsecret": "...",
      "url": "...",
      "onpremise_proxy_host": "...",
      "onpremise_proxy_port": "..."
    }

Using the Connectivity Proxy

Applications connect via HTTP with proxy configuration:

const axios = require('axios');

// Get proxy settings from service binding
const proxy = {
  host: process.env.CONNECTIVITY_PROXY_HOST || 'connectivity-proxy.namespace',
  port: process.env.CONNECTIVITY_PROXY_PORT || 20003
};

// Make request to on-premise system
const response = await axios.get('http://virtual-host/api/resource', {
  proxy: {
    host: proxy.host,
    port: proxy.port,
    protocol: 'http'
  },
  headers: {
    'Proxy-Authorization': `Bearer ${accessToken}`,
    'SAP-Connectivity-SCC-Location_ID': 'optional-location-id'
  }
});

---

Transparent Proxy

Purpose

Provides unified access to BTP destinations as Kubernetes Services, handling authentication, principal propagation, and protocol translation automatically.

Architecture

┌─────────────────────────────────────────────────────────────┐
│                    Kubernetes Cluster                        │
│  ┌─────────────┐    ┌───────────────────┐                   │
│  │ Application │───►│ Transparent Proxy  │                   │
│  └─────────────┘    └─────────┬─────────┘                   │
│                               │                              │
│  ┌─────────────────────────────────────────────────────────┐│
│  │              Destination Custom Resources               ││
│  │  my-destination.namespace → BTP Destination             ││
│  └─────────────────────────────────────────────────────────┘│
└───────────────────────────────┼─────────────────────────────┘
                                │
              ┌─────────────────┼─────────────────┐
              │                 │                 │
     ┌────────┴────┐   ┌───────┴───────┐  ┌─────┴─────┐
     │  Internet   │   │ Connectivity  │  │   Cloud   │
     │  Services   │   │    Proxy      │  │ Connector │
     └─────────────┘   └───────────────┘  └───────────┘

Installation via Helm

helm install transparent-proxy \
  oci://registry-1.docker.io/sapse/transparent-proxy \
  --version <version> \
  --namespace <namespace> \
  -f values.yaml

values.yaml Configuration

# Destination Service credentials
config:
  integration:
    destinationService:
      serviceCredentialsKey: destination-service-key

# Connectivity Proxy integration (for on-premise)
  connectivityProxy:
    enabled: true
    serviceName: connectivity-proxy

# Tenant mode
  tenantMode: shared  # or dedicated

# Logging
  logging:
    level: info

# Resources
replicaCount:
  http: 2
  tcp: 1

resources:
  http:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 256Mi

Destination Custom Resource

Create a Custom Resource for each destination:

apiVersion: destination.connectivity.api.sap/v1
kind: Destination
metadata:
  name: my-api-destination
  namespace: default
spec:
  destinationRef:
    name: my-btp-destination  # Name in BTP Destination Service
  destinationServiceInstanceName: my-dest-service  # Optional

Accessing Destinations

After creating the Custom Resource, access the destination as a Kubernetes Service:

const axios = require('axios');

// Access destination via Transparent Proxy
// URL format: http://<destination-name>.<namespace>
const response = await axios.get('http://my-api-destination.default/api/resource', {
  headers: {
    'Authorization': 'Bearer ' + userToken  // For user propagation
  }
});

Supported Destination Types

---

Service Channels (On-Premise-to-Cloud)

Purpose

Expose Kubernetes workloads to on-premise systems via Cloud Connector.

ServiceMapping Resource

apiVersion: servicemapping.connectivityproxy.sap.com/v1
kind: ServiceMapping
metadata:
  name: my-exposed-service
spec:
  # Protocol type
  type: TCP  # or RFC

  # Subaccount for routing
  subaccountId: <subaccount-id>

  # Virtual service name (exposed to on-premise)
  serviceId: my-k8s-service

  # Internal Kubernetes address
  internalAddress: my-service.namespace:8080

  # Optional: Location IDs for specific Cloud Connectors
  locationIds:
    - loc1
    - loc2

Constraints

• type + subaccountId + serviceId must be unique
• ServiceMappings are cluster-scoped
• Requires Cloud Connector 2.15.0+ (2.14.2+ for RFC only)

---

Kyma Environment

Differences from Standalone Kubernetes

In Kyma, connectivity components are managed as Kyma modules:

1. Module Installation: Enable via Kyma dashboard 2. Operator Management: Kubernetes Operator handles lifecycle 3. Feature Set: May differ from standalone versions

Enable Connectivity Module

# Kyma module configuration
apiVersion: operator.kyma-project.io/v1alpha1
kind: ModuleTemplate
metadata:
  name: connectivity
spec:
  channel: regular

Destination Custom Resource in Kyma

apiVersion: destinations.connectivity.api.sap/v1alpha1
kind: Destination
metadata:
  name: my-destination
  namespace: default
spec:
  destinationRef:
    name: my-btp-destination

---

Multi-Region Deployment

Configuration

Deploy Connectivity Proxy across regions:

# values.yaml for multi-region
config:
  multiRegion:
    enabled: true
    regions:
      - name: eu10
        connectivity:
          serviceCredentialsKey: eu10-connectivity-key
      - name: us10
        connectivity:
          serviceCredentialsKey: us10-connectivity-key

---

Istio Service Mesh Integration

Prerequisites

• Istio installed in cluster
• PeerAuthentication configured

Configuration

# values.yaml for Istio
config:
  istio:
    enabled: true

# Disable internal mTLS (Istio handles it)
config:
  servers:
    proxy:
      http:
        enableMTLS: false

PeerAuthentication

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: connectivity-proxy
  namespace: <namespace>
spec:
  selector:
    matchLabels:
      app: connectivity-proxy
  mtls:
    mode: STRICT

---

Lifecycle Management

Upgrade

# Helm upgrade
helm upgrade connectivity-proxy \
  oci://registry-1.docker.io/sapse/connectivity-proxy \
  --version <new-version> \
  --namespace <namespace> \
  -f values.yaml

Downgrade

# Same as upgrade with older version
helm upgrade connectivity-proxy \
  oci://registry-1.docker.io/sapse/connectivity-proxy \
  --version <older-version> \
  --namespace <namespace> \
  -f values.yaml

Uninstall

helm uninstall connectivity-proxy --namespace <namespace>

# CRDs are preserved; delete manually if needed
kubectl delete crd servicemappings.servicemapping.connectivityproxy.sap.com

---

Troubleshooting

Log Retrieval

# Connectivity Proxy logs
kubectl logs statefulset/connectivity-proxy -n <namespace>

# Transparent Proxy logs
kubectl logs deployment/transparent-proxy -n <namespace>

Change Log Level

kubectl exec <pod> -n <namespace> -it -- change-log-level DEBUG

List Loggers

kubectl exec <pod> -n <namespace> -it -- list-loggers

Common Errors

Error Response Headers

• x-error-message: Error description
• x-error-origin: Component that failed
• x-request-id: Correlation ID

---

Documentation Links

• Connectivity Proxy: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/connectivity-proxy-for-kubernetes
• Transparent Proxy: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/transparent-proxy-for-kubernetes
• Kyma Connectivity: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/connectivity-in-kyma-environment
• Helm Charts: https://github.com/SAP/connectivity-proxy

---

Last Updated: 2025-11-22

Mail Protocol Configuration Reference

Detailed configuration for mail destinations (SMTP, IMAP, POP3) and their secure variants.

Source: https://github.com/SAP-docs/btp-connectivity/tree/main/docs/1-connectivity-documentation

---

Supported Protocols

---

SMTP Configuration

Required Properties

Name: <destination-name>
Type: MAIL
ProxyType: Internet | OnPremise
Authentication: BasicAuthentication | OAuth2ClientCredentials | OAuth2RefreshToken | OAuth2AuthorizationCode
mail.smtp.host: <smtp-server-address>

Standard Properties

SMTPS Properties (TLS/SSL)

Port Guidelines

• Port 25: Traditional SMTP (often blocked by ISPs)
• Port 587: Submission port with STARTTLS (recommended)
• Port 465: SMTPS with implicit TLS

---

IMAP Configuration

Required Properties

Name: <destination-name>
Type: MAIL
ProxyType: Internet | OnPremise
Authentication: BasicAuthentication | NoAuthentication
mail.imap4.host: <imap-server-address>

Standard Properties

IMAPS Properties (TLS/SSL)

---

POP3 Configuration

Required Properties

Name: <destination-name>
Type: MAIL
ProxyType: Internet | OnPremise
Authentication: BasicAuthentication | NoAuthentication
mail.pop3.host: <pop3-server-address>

Standard Properties

POP3S Properties (TLS/SSL)

---

Authentication Options

BasicAuthentication

{
  "Name": "my-mail-destination",
  "Type": "MAIL",
  "ProxyType": "Internet",
  "Authentication": "BasicAuthentication",
  "User": "user@example.com",
  "Password": "<password>",
  "mail.smtp.host": "smtp.example.com",
  "mail.smtp.port": "587",
  "mail.smtp.auth": "true"
}

OAuth2ClientCredentials

{
  "Name": "my-mail-destination",
  "Type": "MAIL",
  "ProxyType": "Internet",
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "<client-id>",
  "clientSecret": "<client-secret>",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "tokenServiceURLType": "Dedicated",
  "mail.smtp.host": "smtp.example.com",
  "mail.smtp.port": "587"
}

OAuth2RefreshToken

{
  "Name": "my-mail-destination",
  "Type": "MAIL",
  "ProxyType": "Internet",
  "Authentication": "OAuth2RefreshToken",
  "clientId": "<client-id>",
  "clientSecret": "<client-secret>",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "refreshToken": "<refresh-token>",
  "mail.imap4.host": "imap.example.com"
}

---

On-Premise Mail Destinations

For on-premise mail servers accessed via Cloud Connector:

{
  "Name": "onprem-mail",
  "Type": "MAIL",
  "ProxyType": "OnPremise",
  "Authentication": "BasicAuthentication",
  "User": "mailuser",
  "Password": "<password>",
  "mail.smtp.host": "virtual-smtp-host",
  "mail.smtp.port": "25",
  "CloudConnectorLocationId": "my-location"
}

Requirements:

• Cloud Connector with access control configured for mail server
• Virtual host mapping in Cloud Connector
• TCP protocol enabled in access control

---

Kubernetes/Transparent Proxy

Consuming SMTP via Transparent Proxy

The Transparent Proxy performs SOCKS5 handshake automatically for on-premise mail connections.

Multitenancy Support:

apiVersion: destination.connectivity.api.sap/v1
kind: Destination
metadata:
  name: smtp-destination
  annotations:
    transparent-proxy.connectivity.api.sap/tenant-subdomains: "tenant1,tenant2"
spec:
  destinationRef:
    name: my-smtp-destination

Creates separate Kubernetes services per tenant:

• smtp-destination-tenant1.<namespace>
• smtp-destination-tenant2.<namespace>

---

Protocol Comparison

---

Troubleshooting

Common Issues

Port Verification

# Test SMTP connectivity
telnet smtp.example.com 587

# Test IMAP connectivity
telnet imap.example.com 993

# Test with OpenSSL
openssl s_client -connect smtp.example.com:465

---

Cloud Connector Limitation

Important: Mail (SMTP, IMAP, POP3) communication is not supported through Cloud Connector for internet-to-on-premise scenarios. Cloud Connector only supports:

• HTTP/HTTPS
• RFC/RFC-SNC
• TCP (via SOCKS5)
• LDAP/LDAPS

For on-premise mail, use TCP destinations with SOCKS5 proxy.

---

Last Updated: 2025-11-22 Source Files:

• smtp-426527a.md, smtps-897df97.md
• imap-6037066.md, imaps-ceb84cb.md
• pop3-387e3e4.md, pop3s-76db66c.md
• mail-destinations-584bc93.md, mail-destinations-e3de817.md

RFC Destinations - Complete Reference

Source: https://github.com/SAP-docs/btp-connectivity/blob/main/docs/1-connectivity-documentation/rfc-destinations-238d027.md

---

Overview

RFC destinations enable Remote Function Call communication with SAP ABAP systems. They support both on-premise systems via Cloud Connector and cloud ABAP systems.

---

Minimal Configuration

Name=SalesSystem
Type=RFC
jco.client.client=000
jco.client.lang=EN
jco.client.user=consultant
jco.client.passwd=<password>
jco.client.ashost=sales-system.cloud
jco.client.sysnr=42
jco.destination.proxy_type=OnPremise

---

Required Properties

User Logon Properties

Target System Properties

---

Pooling Configuration

Connection pooling improves performance by reusing connections.

Example:

jco.destination.pool_capacity=5
jco.destination.peak_limit=10
jco.destination.max_get_client_time=30
jco.destination.expiration_time=60

Pool Behavior

• Pool starts empty (no pre-allocated connections)
• Connections created on demand during function module calls
• Requests wait up to max_get_client_time if peak_limit reached
• pool_check_connection validates pooled connections (performance overhead)

---

Communication Behavior Parameters

---

Repository Configuration

---

SNC (Secure Network Communications)

For encrypted RFC connections:

---

Load Balancing (Message Server)

For connection via message server:

---

SAP Router

For connections through SAP Router:

Format: /H/<router-host>/S/<router-port>/H/<target-host>

---

Principal Propagation

For user propagation to on-premise systems:

Type=RFC
jco.destination.proxy_type=OnPremise
jco.destination.auth_type=PrincipalPropagation

Requires Cloud Connector configuration for X.509 certificate generation.

---

Complete Example

# Basic Configuration
Name=ERP_System
Type=RFC
Description=Production ERP System

# User Logon
jco.client.user=RFC_USER
jco.client.passwd=<password>
jco.client.client=100
jco.client.lang=EN

# Target System
jco.client.ashost=virtual-erp-host
jco.client.sysnr=00

# Connectivity
jco.destination.proxy_type=OnPremise
CloudConnectorLocationId=loc1

# Connection Pooling
jco.destination.pool_capacity=10
jco.destination.peak_limit=50
jco.destination.max_get_client_time=30
jco.destination.expiration_time=60
jco.destination.pool_check_connection=1

---

Cloud Connector Access Control

For RFC destinations with ProxyType=OnPremise:

1. Add system mapping in Cloud Connector:

• Virtual Host: Name used in destination
• Internal Host: Actual SAP hostname
• Protocol: RFC or RFCS (with SNC)
• Port: System number × 100 + 3300

2. Optionally restrict function modules:

• Add allowed function module patterns
• Use wildcards for module groups

---

Invoking ABAP Function Modules

Java (JCo)

JCoDestination destination = JCoDestinationManager.getDestination("ERP_System");
JCoFunction function = destination.getRepository().getFunction("BAPI_COMPANYCODE_GETLIST");

function.execute(destination);

JCoTable codes = function.getTableParameterList().getTable("COMPANYCODE_LIST");
while (codes.nextRow()) {
    System.out.println(codes.getString("COMP_CODE"));
}

Node.js (node-rfc)

const { Client } = require('node-rfc');

const client = new Client({ dest: 'ERP_System' });
await client.open();

const result = await client.call('BAPI_COMPANYCODE_GETLIST', {});
console.log(result.COMPANYCODE_LIST);

await client.close();

---

Documentation Links

• RFC Destinations: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/rfc-destinations
• Pooling Configuration: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/pooling-configuration
• Invoking Function Modules: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/invoking-abap-function-modules-via-rfc

---

Last Updated: 2025-11-22