The Cloud Connector is a tool that facilitates secure communication between cloud applications and on-premise systems. It acts as a bridge, enabling cloud-based services to access data and services from on-premise environments without exposing them directly to the internet. This setup ensures enhanced security and simplified configuration.
Operating Cloud Connector
Objectives
After completing this lesson, you will be able to:
- Highlight Cloud Connector
- Install and Configure Cloud Connector
- Operate Cloud Connector
Defining the Cloud Connector
The Purpose of the Cloud Connector
How does the Cloud Connector work? Watch the video to learn more.
The Cloud Connector also supports service channels. In the video you will find out more about it.
Features of the Cloud Connector
The Cloud Connector is a lightweight but robust component of the SAP Connectivity Service.
The Cloud Connector Main Features are:
- Recovers broken connections automatically.
- Supports principal propagation for added security.
- Contains integrated monitoring and alerting tools.
- Provides audit logging of inbound traffic and configuration changes.
- Supports a high availability failover environment, by setting up a shadow Cloud Connector.
- Is updated with 1 to 4 new releases each year, with frequent patches.
- Is fully documented in the SAP BTP Connectivity Help Portal.
The Cloud Connector Software:
- Is downloaded from the SAP Development Tools web site.
- Is installed in your on-premise environment, in its own network zone.
- Is a lightweight application that requires minimal resources.
- Runs on Linux, Windows, or macOS.
- Features an easy installation and configuration process.
Summary
The Cloud Connector provides a secure means of connecting cloud applications to on-premise applications. Service channels can allow on-premise database tools to access specific SAP BTP services.
Further Reading
Installation Prerequisites
Fundamental Requirements for Cloud Connector Setup
Before installing the SAP Cloud Connector, ensure your system meets the necessary prerequisites, such as supported operating systems and the appropriate version of the Java Development Kit (JDK). Allocate between 1 and 20 GB of disk space for configuration, audit logs, and trace files. The Cloud Connector Administration UI, built with SAPUI5, can be accessed via any supported web browser. It’s crucial to understand the typical network topology and determine the optimal placement of the Cloud Connector within various network zones. Lastly, adhere to the hardware sizing recommendations for small, medium, and large installations, taking into account CPU, RAM, and disk space requirements.
Hint
All available cloud connector versions can be downloaded here for all supported operating systems: https://tools.hana.ondemand.com/#cloud
Further Reading
Cloud Connector Installation
In this lesson, you will learn about various variants to install the Cloud Connector. The Cloud Connector is available for the following operating systems:
- Linux
- Windows
- macOS
The Cloud Connector can be installed using one of the following installation modes:
- Portable version
- Installer version
| Version | Linux | Windows | macOS |
|---|---|---|---|
| Portable version | x | x | x |
| Installer version | x | x | - |
The portable version can be installed easily by extracting a compressed archive into an empty directory. It does not require administrator or root privileges for the installation, and you can run multiple instances on the same host.
Note
On macOS, only the portable version is available.The installer version requires root respective administrator permissions for the installation and can be set up to run as a Linux daemon in the background or a Windows service. You can upgrade it easily, retaining all the configuration and customizings.
Note
SAP strongly recommends that you use the installer version for a productive setup.1. Installation on Linux
As a prerequisite for the installation of Cloud Connector on Linux, first make sure that you:
- Use the supported 64-bit operating systems,
- Prepared a supported JDK,
- Downloaded the portable version (as tar.gz archive) or the installer version (as compressed RPM installer).
Portable Version
- Extract the tar.gz file to an arbitrary directory on your local file system using the command:
tar -xzof sapcc-<version>-linux-<platform>.tar.gz.
- Go to this directory and start the Cloud Connector using the go.sh script.
Installer Version
- Extract the sapcc-<version>-linux-<platform>.zip archive to an arbitrary directory by using the command unzip sapcc-<version>-linux-<platform>.zip
- Go to this directory and install the extracted RPM using the following command as the root user:
rpm -i com.sap.scc-ui-<version>.<arch>.rpm
After installation via the RPM manager, the Cloud Connector process is started automatically and registered as a daemon process, which ensures the automatic restart of the Cloud Connector after a system reboot.
To start, stop, or restart the process explicitly, open a command shell and use the following commands, which require root permissions:
- service scc_daemon start|stop|restart (on System V distributions)
- systemctl start|stop|restart scc_daemon (on systemd distributions)
2. Installation on Windows
As a prerequisite for the installation of Cloud Connector on Windows, first make sure that you:
- Use the supported 64-bit operating systems.
- Installed Microsoft Visual Studio C++ 2013 and Microsoft Visual Studio C++ 2019 runtime libraries (required for SAP JVM).
- Prepared a supported JDK.
- Downloaded the portable version (as ZIP archive) or the installer version (as MSI package).
Portable Version
- Extract the <sapcc-<version>-windows-x64.zip> ZIP file to an arbitrary directory on your local file system.
- Set the environment variable JAVA_HOME to the installation directory of the JDK that you want to use to run the Cloud Connector. Alternatively, you can add the bin subdirectory of the JDK installation directory to the PATH environment variable.
- Go to the Cloud Connector installation directory and start it using the go.bat batch file.
Installer Version
- Start the installer by double-clicking it.
- The installer guides you through the installation. Some of the dialogs are:
- The desired installation directory
- The port of the Administration UI (default value is 8443)
- The JDK
The Cloud Connector is started as a Windows service in the productive use case. Therefore, installation requires administration permissions. After installation, manage this service under Control Panel → Administrative Tools → Services. The service name is Cloud Connector. Make sure that the service is executed with a user that has limited privileges. Typically, the privileges allowed for service users are defined by your company policy. Adjust the folder and file permissions to be manageable by only this user and system administrators.
3. Installation on macOS
As a prerequisite for the installation of Cloud Connector on macOS, first ensure that you:
- Use the supported 64-bit operating systems.
- Have prepared a supported JDK.
- You've downloaded the tar.gz archive for the developer use case on macOS.
Portable Version
- Extract the tar.gz file to an arbitrary directory on your local file system using the command tar -xzof sapcc-<version>-macosx-x64.tar.gz
- Go to this directory and start Cloud Connector using the go.sh script.
Summary
Now, you're able to install the Cloud Connector.
Cloud Connector Logon
Initial Logon
The Cloud Connector is primarily configured and administered using a web interface. To access the Cloud Connector user interface, enter the following URL in a supported web browser:
https://<hostname>:<port>
- <hostname> refers to the machine on which the Cloud Connector is installed. If installed on your machine, you can simply enter localhost.
- <port> is the Cloud Connector port (the default port is 8443).
On the logon screen, enter the following credentials:
- User Name: Administrator
- Password: manage
When you first log in, you must change the password before you continue. The Cloud Connector does not check the strength of your new password. Select a strong password that can’t be guessed easily.
Exchanging the UI Certificate
By default, the Cloud Connector uses a self-signed UI certificate. It’s used to encrypt the communication between the Administration UI in the browser and the Cloud Connector. For security reasons, you should replace this certificate with your own one to let the browser accept the certificate without security warnings.
The figure describes how to exchange the UI certificate.
To exchange the UI certificate of a master instance, perform the following steps:
- Within the Administration UI, navigate to Configuration, and then to USER INTERFACE.
- In the UI Certificate section, start a procedure to request certificate signing by choosing the icon Generate a certificate signing request.
- In the Generate CSR window, specify a key size and a Common Name fitting to the Cloud Connector host name. In the Subject Alternative Names section, you can add other values by pressing the Add button. You can, for example, use the DNS option to specify a virtual hostname or a wildcard name (such as *.sap.com).
- Choose Generate.
- You’re prompted to save the certificate signing request (CSR) in a file. The content of the file is the signing request in PEM format.
- The certificate signing request must be provided to a Certificate Authority (CA) - either one within your company or another one you trust. The CA signs the request and the returned response should be stored in a file using the PEM format.
- Select Browse to locate that file and then choose the Import button.
- Restart the Cloud Connector to activate the new certificate.
In the exercise below you will replace the UI certificate of the Cloud Connector.
Summary
Now, you’re able to exchange UI certificates.
Connecting the First Subaccount
To be able to use Cloud Connector, you have to configure at least one SAP BTP subaccount. The following data is required to establish the first connection:
- Email Address used for SAP BTP registration
- Password used for SAP BTP registration
- Subaccount ID
- Region
Within your SAP BTP Cockpit, navigate to the Account Explorer and note the fields Provider and Region of your respective subaccount. To determine the Subaccount ID, select the tile representing your respective subaccount.
Within the Administration UI for your Cloud Connector, navigate to Define Subaccount and enter this data. After you saved your input, the secure tunnel between your Cloud Connector and your SAP BTP subaccount has been established.
Within your SAP BTP Cockpit, you can check the status of Cloud Connectors connected to a subaccount at Connectivity → Cloud Connectors.
The demonstration below shows you how to configure the first subaccount.
Connecting Additional Subaccounts
You can connect to several subaccounts within a single Cloud Connector installation. Those subaccounts can use the Cloud Connector concurrently with different configurations. By selecting a subaccount from the dropdown box, all tab entries show the configuration, audit, and state, specific to this subaccount. In the case of audit and traces, the cross-subaccount info is merged with the subaccount-specific parts of the UI.
If you want to connect an additional subaccount with your on-premise landscape, simply press the Add Subaccount button, which opens a dialog that is similar to the initial configuration operation when establishing the first connection.
Summary
Now, you’re able to configure subaccounts in your Cloud Connector.
Further Reading
Supported Protocols
To allow your cloud applications to access a certain on-premise system on the intranet, you must specify this system in the Cloud Connector. The procedure is specific to the protocol that you're using for communication. The following protocols are supported:
- HTTP
- RFC
- LDAP
- TCP
Configuring Access Control (HTTP)
In the following, the widely used HTTP protocol is covered as an example in more details. The figure shows the overall workflow to securely use the HTTP protocol.
Initial Configuration: Import or Generate a System Certificate
To set up a mutual authentication between the Cloud Connector and any back-end system it connects to, you can import an X.509 client certificate into the Cloud Connector. The Cloud Connector then uses the so-called system certificate for all HTTPS requests to back ends that request or require a client certificate. The CA that signed the Cloud Connector’s client certificate must be trusted by all back-end systems to which the Cloud Connector is supposed to connect.
There are three options on how to provide the system certificate:
- Upload an existing X.509 certificate
- Upload the signed UI certificate
- Generate a self-signed system certificate (for example: for a demo scenario)
All options are offered in the Cloud Connector Administration UI at Configuration → ON PREMISE → System Certificate.
Initial Configuration: Maintain the Trust Store Using an Allowlist
By default, the Cloud Connector does not trust any on-premise system when connecting to it via HTTPS. To enable secured communication, you must add trusted certificate authorities (CAs) to the allowlist. Any server certificate that has been issued by one of those CAs will be considered trusted.
To maintain the trust store, in the Cloud Connector Administration UI navigate to Configuration → ON PREMISE → Trust Store.
Caution
If you do not want to specify explicit CAs you’re going to trust, but rather trust all back ends, you can switch off the handle. In this case, the allowlist is ignored. This option is considered less secure, since all back ends are trusted now.Exposing an AS ABAP-Based On-Premise SAP System
To allow your cloud applications to access a certain back end system on the intranet via HTTP, you must specify this system in the Cloud Connector.
To do so, start the wizard offered in the Cloud Connector Administration UI at Cloud To On-Premise → ACCESS CONTROL.
To expose an AS ABAP-Based on-premise SAP system, provide the following:
- Back-end Type: ABAP System.
- Protocol: HTTP or HTTPS.
- Internal Host and Internal Port: the actual host and port under which the on-premise SAP system can be reached within your intranet.
- Virtual Host and Virtual Port: enter the host name exactly as specified in the <URL> property of the HTTP destination configuration in SAP BTP. The virtual host can be a fake name and does not need to exist. The Virtual Port allows you to distinguish between different entry points of your back end system, for example, HTTP/80 and HTTPS/443, and to have different sets of access control settings for them.
- Allow Principal Propagation: defines if any kind of principal propagation should be allowed over this mapping. If selected, also define what kind of Principal Type is sent to the on-premise SAP system within the HTTP request.
- System Certificate for Logon: select if the Cloud Connector's system certificate should be used for authentication at the back end.
- Host In Request Header lets you define which host is used in the host header that is sent to the target server. By choosing Use Internal Host, the actual host name is used. When choosing Use Virtual Host, the virtual host is used.
- Description: optional description text
- Check Internal Host: this allows you to make sure the Cloud Connector can indeed access the on-premise SAP system.
Limit the Accessible ICF Services
In addition to allowing access to a particular host and port, you also must specify which Resources (URL paths, also known as Internet Communication (ICF) Services) are allowed to be invoked on that host. The Cloud Connector uses strict allowlists for its access control. Only those ICF services for which you explicitly granted access are allowed. All other HTTP(S) requests are denied by the Cloud Connector.
Summary
Now, you’re able to expose an AS ABAP-based SAP system for HTTP(S) access.
Further Reading
Connect On-Premise to SAP BTP Applications
In this lesson, you will see a simple demonstration of connecting the "cloud to on-premise" scenario. We have an extension module, which was written in SAP Fiori. It was developed in the SAP BTP, using the development tool SAP Business Application Studio. But, we don’t want to run it in the SAP BTP. We want to run it in the on-premise ABAP environment.
The Cloud Connector can be used to connect applications running in the SAP BTP to applications running on-premise, and allowing on-premise tools to access SAP HANA Cloud running in the SAP BTP.
How do we deploy it there? We can use the Cloud Connector.
- The first step is to define the on-premise system to Cloud Connector. We hide the actual host name and port number behind a virtual host name and port number.
- Then we define on-premise resources to be exposed.
- Finally, we deploy the SAP Fiori application to the on-premise system.
Watch the demonstration below on how to use the Cloud Connector to connect an SAP BTP application to an On-Premise system.
Our SAP Fiori application was deployed from the SAP Business Application Studio in the SAP BTP to the on-premise ABAP environment. Now, it can be used by on-premise users.
Summary
Now you’re able to outline how to connect an On-Premise application to SAP BTP.
Further Referencing
Note
For a more in-depth explanation of how to manage the Cloud Connector, refer to the Learning Journey: Connecting SAP BTP and On-Premise Systems using the Cloud Connector
Log in to track your progress & complete quizzes