Giving an Overview of License and Subscription

• SAP BTP Global Account credentials with Administrator role
• Purchased SaaS license for the application
• Enterprise Identity Provider (IdP) with SAML 2.0 configuration and OpenID capabilities
• Document management system that supports the standardized protocol Content Management Interoperability Services (CMIS) - Required for attachments
• S/4 Life Sciences Add-on Installed - Required for S/4 integration
• IdP must support the OpenID Connect protocol (OIDC)

Create a subaccount, if not created already.

Create a space, if not created already.

Subscribe to SAP Batch Release Hub for Life Sciences.

• Choose Services → Service Marketplace from the navigation area.
• Select the application and choose Create.

Go to Application becomes available when the subscription is activated.

• Create an Instance of the Integration Service Broker
• Configure Destinations
• Configure Integration of E-Signature
• Onboard a Document Management Repository
• Set Up SAP Event Mesh
• Optional Activities
• Configure Integration of Data Model for Business Rules Service
• Configure Output Management for SAP Forms Service by Adobe
• Using SAP Cloud ALM
• Set Up Integration Hub for Life Sciences
• Configure SAP Cloud Transport Management Service

The integration service broker is used to create and retrieve credentials that can be used to communicate with SAP Batch Release Hub for Life Sciences on an API level.

Access to the APIs is managed through the integration service broker.

Steps to create the instance:

1. Select Instances and Subscriptions from the navigation bar.
2. Choose Create at the top right of the screen, the new instance wizard will appear.
3. Select the service as per below table and follow the wizard to create an instance

The creation of the service key generates the technical credentials used to connect to the integration service for SAP Batch Release Hub for Life Sciences and thus access to the APIs.

Steps to create the service key:

1. Select the instance created for the integration service broker.
2. Go to the Service Keys tab and choose Create.
3. On the dialog, enter a unique name for the service key.
4. Open the service key using the "…" and copy the client credentials: client_id and client_secret.

SAP Batch Release Hub for Life Sciences uses the OpenID Connect (OIDC) API for e-signature user reauthentication. This requires configuration of the integration between the identity provider that is designated for e-signature users and the SAP Business Technology Platform (SAP BTP).

Two possible scenarios

1. First scenario: E-signature configuration with a federated SAP IAS or third-party identity provider for release-responsible users. In this scenario, the OpenID Connect application and the SAML Connect application are created in the same identity provider (SAP IAS or your third-party identity provider).
2. Second scenario: E-signature configuration with a federated third-party identity provider and SAP IAS for release-responsible users. In this scenario, the OpenID Connect application and the SAML Connect application are created in different identity providers as follows:
   • The OpenID Connect application is created in SAP IAS.
   • The SAML Connect application is created in the third-party identity provider (such as Microsoft Azure or Okta).
   

• Create instance for SAP Identity Authentication Service.
• Under Trust →  Single Sign-On →  Protocol, choose OpenID Connect.
• Under Application APIs, choose Client Authentication.
• Choose the Add button in the Secrets section and copy your client secret and client ID.
• Save the configuration.

• Go to Connectivity → Destinations and choose New Destination.
• Enter this destination name: IDP_OIDC_URL.
• Enter the destination URL: https://<tenantID>.accounts.ondemand.com.
• Enter the client ID and client secret that were just generated in the OpenID Connect application.
• In the Token Service URL type, select Dedicated and for field, enter the URL: https://<tenantID>.accounts.ondemand.com/oauth2/token.
• Save the configuration.

• Assign role SDM_Admin on the SAP Document Management Service.
• Go to the Configuration and Responsibilities group, open the Manage Repositories app, and choose Add Repository.
• Enter the parameters as described.

• Go to the Manage Release Configurations app.
• Choose Make General Settings.
• On the Document Management tab, switch to edit mode, and select the external repository.

• Recommendation is to use Odata Apis instead of SAP Event Mesh.
• Create an instance of SAP Event Mesh with plan as "default".
• Use the JSON file from the next slide in the parameters.
• "Emname" is the instance name for SAP Event Mesh entered in the Basic Info tab.
• Save the configuration.
• Create Event Mesh Service key (Same steps as described in Slide 7 for Integration Service Broker).

• Subscribe to the SAP Forms Service
• Create a Service Instance of the Forms Service by Adobe API
• Use the following Subaccount user roles to access Forms Service by Adobe:
  • ADSAdmin
  • TemplateStoreAdmin

• Restrict access to the Template Store API by following: Restrict Access to the Template Store API, if you do not want to modify the templates.

See the following template details.

Download the templates from: Set Up the PDF Templates for SAP Batch Release Hub for Life Sciences.

Access the Template Store UI by using the URL: https://﹤your subdomain﹥-ads.formsprocessing.cfapps.﹤cf region﹥.hana.ondemand.com/adsrestapi/ui.html

In the Template Store UI, create the Forms using the mentioned names in the next screenshot.

• Go to BTP Cockpit → Connectivity → Destinations → Create Destination
• Enter the destination URL: https://adsrestapi-formsprocessing.cfapps.﹤region﹥.hana.ondemand.com
• Client ID, Client Secret, and Token Service URL from service key for SAP Forms Service instance.
• Check connection. HTTP status code below 500 is treated as successful.

• Integration Hub Core: Provides generic replication functionality.
• Batch Release Hub Adapter for Integration Hub: Provides integration between SAP Batch Release Hub for Life Sciences and Integration Hub for Life Sciences.
• Note

  As of release 2306, the original standalone version of the Batch Release Hub Adapter is deprecated, and therefore, use of the integrated adapter is mandatory.
• Data Replication Framework: Extract and replicate the data from SAP S/4HANA to the consuming service that is provided by Integration Hub for Life Sciences as a REST endpoint.
• SAP Application Interface Framework: Process the inbound batch release decision message from SAP Batch Release Hub for Life Sciences.
• SAP Gateway: To connect the SAP S/4HANA OData service and Cloud Connector.

• Go to BTP Cockpit → SubAccount → Connectivity → Destinations → Create Destination
• Note

  Use the name as IHLS_S4HANA or IHLS_S4HANA_﹤logical system identifier﹥
• URL: The virtual host and port can be seen under Cloud Connectors in the BTP Cockpit, under the Host column in the Cloud Connector list.

  http://﹤virtual host and port of S/4HANA system exposed by Cloud Connector﹥/sap/opu/odata/

  LSCH/RELEASE_DECISION_SRV

• User: SAP S/4 HANA Technical User, Assign the role /LSCH/PROCESS_RELEASE_DECISION to the technical user and generate the user profile.

Find the message client belonging to SAP Batch Release Hub for Life Sciences and navigate to it.

• Navigate to Queues on the message client.
• Go to Queue Subscription and add the topic.
• If you want to consume the message when the release decision status is changed, you must add the following exact topic names.
• For prod, add default/sap.brh.prod/-/ce/outbound/releasedecision
• For dev/validation, add default/sap.brh.validation/-/ce/outbound/releasedecision

• Navigate to Webhooks on the message client.
• Webhook URL: <Adapter API>/brhem/onEventReceived.
• Use the Adapter URL from Instance for SAP Batch Release Hub for Life Sciences Validation.
• Use the Client credentials from the same instance created in slide #3.
• Trigger the handshake from the actions.
• Subscription status becomes Active and handshake is Completed.

• Navigate to Queues on the message client.
• Go to Queue Subscription and add the topic.
• If you want to consume the message when the release decision status is changed, you must add the following exact topic names.
• For prod, add default/customer.ihls/1/replication/v1

• Navigate to Webhooks on the message client.
• WebHook URL: <Adapter API>/ihlsem/onEventReceived.
• Use the Adapter URL from Service Key for the Instance of Batch Release Hub integration service broker.
• Use the Client credentials from the same instance.
• Trigger the handshake from the actions.
• Subscription status becomes Active and handshake is Completed.

• Go to BTP Cockpit → Connectivity → Destinations → Create Destination.
• Note: URL from messaging URI field of the Event Mesh service key.
• Client ID, Client Secret, and Token Service URL from service key for messaging protocol "httprest".

• Run transaction SE80, select Package, and choose any package.
• Right-click on the displayed package to display the context menu.
• Choose Create →  Others →  OAuth 2.0 Client Profile.
• Enter a name for the client profile. Note this name.
• Choose the Type DEFAULT.
• Save your changes.

• Run transaction OA2C_CONFIG. If Internet Explorer opens, copy the displayed URL into a Google Chrome browser.
• Choose Create in the dialog and fill the following fields.
  • Client Profile: From the drop-down menu, select the client profile that you have created for Integration Hub.
  • Configuration Name: Enter IHLS_COMM. Remember this Configuration Name.
  • OAuth 2.0 Client ID: Enter the client ID of the Integration Hub Core service broker instance.
• Complete the Details section, including the General Settings, Authorization Server Settings, and Access Settings.
  • OAuth 2.0 Client Secret: Enter the client ID of the Integration Hub Core service broker instance.
  • Authorization Endpoint: Enter the URL of the Integration Hub Core service broker instance and append "/oauth/token". Remove "http://".
  • Token Endpoint: Enter the URL of the Integration Hub Core service broker instance and append "/oauth/token". Remove "http://".
  • Client Authentication: Basic.
  • Resource Access Authentication: Header Field.
  • Selected Grant Type: Client Credentials.
• Check the Scopes section. For the profile you created in the previous step, the scope should be empty.

• Go to SPRO customizing.
• Choose Quality Management → Integration Hub for Life Sciences → Current Settings → Determine the OAuth Profile.
• In the Configuration field, enter the name of the configuration that you have created for Integration Hub.
• Save your entries.

Run transaction SM59 and create a new HTTP Connection to an external server using a folder with type G.

In the technical settings, enter the host and path prefix.

On the Subscriptions tab of your SAP BTP subaccount, right-click on the Integration Hub for Life Sciences link and choose Copy Link Address. Paste the link into the Host field, removing the "https://" prefix and the "/" suffix.

In the Path Prefix field, enter "/repl/v2".

In the Logon with User section, ensure the Do not use a user  radio button is selected.

In the Logon with Ticket section, ensure the Do not send logon ticket  radio button is selected.

In the Security Options section, select the Active  radio button for the SSL field, and for the SSL Certificate field, choose DEFAULT SSL Client (Standard).

Choose OAuth Settings and add the profile that was created.

Test the destination by choosing Connection Test.

• Follow SAP Note 2853519 to download the SAP BTP Global Root Certificate.
• Run transaction STRUST in change mode.
• Select the PSE folder SSL client SSL Client (standard).
• At the bottom of the Certificate section, choose Import Certificate.
• Enter your certificate's File Path and Name and choose Add to Certificate List.
• Repeat the above steps for the PSE folder SSL client SSL Client (Anonymous).

• Run transaction DRFIMG (Customizing for Data Replication).
• Choose Define Custom Setting for Data Replication → Define Technical Settings → Define Technical Settings for Business Systems.
• Choose New Entries.
• Enter a name for the business system.
• Enter the name of the RFC destination created previously in Maintain Destination to External Server.

• Choose Define Custom Settings for Data Replication > Define Replication Models.
• Choose New Entries.
• Enter a name for the replication model and save your entries.
• For this replication model, go to Assign Outbound Implementation.
• Select and assign the outbound implementations to the replication model.
• For each outbound implementation, go to Assign Target System for Repl Model/Outbound Implementation to select and assign the business system created in Step 2.
• Repeat the steps for adding outbound implementations to the replication model.
• Repeat this task for each replication model and outbound implementation you want to use.

• LSCH_BATCH (Batch)
• LSCH_BRR (Batch Record Review)
• LSCH_CERT (Certificate)
• LSCH_CPNTB (Components of Batch)
• LSCH_CR (Change Record)
• LSCH_CT (Clinical Trial Release Check)
• LSCH_GENE (Genealogies)
• LSCH_INSPL (Inspection Lot)
• LSCH_INSTY (Inspection Types)
• LSCH_PLANT (Plant)
• LSCH_PRD (Product/Material)
• LSCH_PRDGR (Product Group/Material Group)
• LSCH_QBS (Quality Batch Statuses)
• LSCH_QD (Quality Deviations)
• LSCH_RELDT (Release Decision Trigger)
• LSCH_RLSDC (Release Decision Confirmation)
• LSCH_TEMP (Temperature Record)
• LSCH_TRANS (Transport Record)
• LSCH_UDC (Usage Decision Codes)

In your SAP S/4HANA system, open AIF Content Transport - Deploy (transaction /AIF/CONTENT_EXTRACT).

Enter /LSCH/SAP_AIF_0066 as the deployment scenario.

Save your entries.

Run transaction /AIF/PERS_CGR and select the namespace /IHLS.

Create runtime configuration for synchronous and asynchronous message queue processing.

• Subscribe to SAP Cloud Transport Management service.
• Choose Services → Service Marketplace from the navigation area.
• Select the application, and choose Create.
• Select the standard plan.
• Go to Application becomes available when the subscription is activated.

The service instance is used for calling the export functionality of SAP Cloud Transport Management.

Steps to create the service instance and key:

1. Create a new service instance in your subaccount.
2. When the instance is created, go to the Service Keys tab, and choose Create.
3. On the dialog, enter a unique name for the service key.
4. Open the service key using the "…" and copy the client credentials: client_id and client_secret.

12345678910

{ 
  "uaa": {
    "clientid": "sb-xxxxxx",
    "clientsecret": "xxxxxx",
"url": "https://<domain>.authentication.sap.hana.ondemand.com", 
     ...
  },
  "uri": "https://transport-service-app-backend.ts.cfapps.sap.hana.ondemand.com"
}

On the Subscriptions tab, in the Cloud Transport Management row, choose "…" and Manage Roles. The default role templates are displayed.

Customers can create new role collections based on their requirements by following: Setting Up Role Collections.

In the SAP Cloud Transport Management service, transport destinations are used to address the target end point of a deployment process. Transport destinations contain the address of the target end point as well as an authentication type for access control. For example, the user credentials of the platform user that you want to use for the destination.

You create a transport destination in SAP BTP Cockpit of the subaccount in which you are subscribed to for SAP Cloud Transport Management.

Create the required transport destinations by configuring all tenants for SAP Batch Release Hub for Life Sciences in SAP Cloud Transport Management. To do this, follow the steps provided in: Create Transport Destinations.

Enter the Destination Configuration settings as follows:

• Name and type: Enter a name to identify the destination and enter HTTP.
• URL: Enter the value of the transport_api field from the service key and add the suffix /gacd/.
• Proxy Type: Internet.
• Authentication: OAuth2ClientCredentials.
• Client ID: Clientid field from the service key.
• Client Secret: Clientsecret field from the service key.
• Token Service URL Type: Dedicated.
• Token Service URL: URL field from the service key and add the suffix /oauth/token?grant_type=client_credentials.
• Token Service User: Same as Client ID.
• Token Service Password: Same as Client Secret.

Configure the destination in the SAP Batch Release Hub for Life Sciences source tenant subaccount. Enter the Destination Configuration settings as follows:

• Name: Enter IRON_CTMS_EXPORT_DESTINATION. Note: Name is hard coded and is not a variable value.
• Type: HTTP.
• URL: URL field from the service key.
• Proxy Type: Internet.
• Authentication: OAuth2ClientCredentials.
• Client ID: clientid from the service key.
• Client Secret: clientsecret field from the service key.
• Token Service URL Type: Dedicated.
• Token Service URL: URL field from the service key and add the suffix/oauth/token.
• Token Service User: Same as Client ID.
• Token Service Password: Same as Client Secret.

Create the transport nodes via the SAP Cloud Transport Management application. To do this, follow the steps provided in: Create Transport Nodes.

Enter the following settings:

• Node Name: Node name that is configured in the SAP Batch Release Hub for Life Sciences application as shown in the screenshot.
• Destination: Required destination from the drop-down list, which contains all the import destinations configured in SAP Cloud Transport Management.

Create the transport routes to define the source tenant and target tenant. To do this, follow the steps provided in: Create Transport Routes.

In the SAP BTP cockpit, choose Services →  Instances and Subscriptions.

Select instance for brh-integration (for production) or brh-integration-validation (for preprod/validation).

Select the text in the Credentials column. A dialog opens with the credentials in JSON format.

Make a note of the values of the following attributes from the JSON text:

• In the SAP BTP cockpit, go to SubAccount → Connectivity → Destinations. Choose New Destination. Enter the details as in screenshot.
• Enter the destination URL. Retrieve the URL from the credentials with /v2/rule_inbound_srv added at the end.
• http://iron-<landscape>-<landscape>-iron-backend.cfapps.eu10.hana.ondemand.com/v2/rule_inbound_srv.
• Enter the client ID and client secret that you retrieved from the credentials on previous slide.
• Token Service URL: Retrieved from the credentials with /oauth/token added at the end.
• https://Subdomain>.authentication.eu10.hana.ondemand.com/oauth/token

Check Connection to verify that the URL configured for the HTTP destination can be reached and the connection to the specified system is possible.

Integration Hub for Life Sciences is automatically integrated with SAP Cloud ALM once you have enabled your SAP Cloud ALM subscription. The application uses the new data collection infrastructure to report monitoring data to SAP Cloud ALM.

No configuration is required on the SAP Batch Release Hub for Life Sciences tenant.

The following steps are required on SAP CALM to receive monitoring data:

• Activate the Monitoring Data Collection for Integration Monitoring: Integration & Exception Monitoring - Setup & Configuration
• Activate the Monitoring Data Collection for Real User Monitoring: Real User Monitoring Setup & Configuration (sap.com)