btp-connectivity

name	btp-connectivity
description	SAP BTP Connectivity — Cloud Connector setup, Destination Service, principal propagation, on-premise tunneling.
trigger	["cloud connector","btp connectivity","on-premise connection","principal propagation","scc","destination service","btp to sap tunnel","connect btp to on-premise"]
prerequisites	["Java 17+ installed on DMZ host","BTP subaccount admin access","VM (Linux/Windows) in DMZ network with outbound HTTPS to BTP","SAP system (S/4HANA, ECC, etc.) reachable from DMZ host"]

BTP Connectivity — Cloud Connector + Principal Propagation

1. Download and Install Cloud Connector

# Download (Linux x64)
wget https://tools.hana.ondemand.com/additional/sapcc-2.17.0-linux-x64.zip
unzip sapcc-2.17.0-linux-x64.zip -d /opt/sapcc
/opt/sapcc/go.sh

2. Access Admin UI and Change Password

# Admin UI — default credentials: Administrator / manage
open https://localhost:8443

In the SCC UI:

1. Login as Administrator / manage → change password immediately
2. Navigate to Connector → Add Subaccount

3. Configure Subaccount Connection

In SCC UI → Connector → Add Subaccount:

1. Copy Region and Subaccount ID from BTP Cockpit
2. Enter Display Name (e.g. s4hana-prod)
3. Click Save — verify status shows Connected (green)

4. Map Cloud To On-Premise

In SCC UI → Cloud To On-Premise → Add:

Field	Value
Virtual Host	s4hana-virtual:443
Internal Host	s4hana.internal.corp:443
Protocol	HTTPS
Backend Type	ABAP System

Add resource paths:

• /sap/bc/adt
• /sap/opu/odata
• /sap/opu/odata/sap/

5. Create Destination in BTP Cockpit

BTP Cockpit → Connectivity → Destinations → New Destination:

{
  "Name": "s4hana-onprem",
  "Type": "HTTP",
  "URL": "https://s4hana-virtual:443",
  "ProxyType": "OnPremise",
  "Authentication": "PrincipalPropagation",
  "Description": "S/4HANA on-premise via Cloud Connector"
}

For BasicAuth instead of PrincipalPropagation:

{
  "Name": "s4hana-onprem-basic",
  "Type": "HTTP",
  "URL": "https://s4hana-virtual:443",
  "ProxyType": "OnPremise",
  "Authentication": "BasicAuthentication",
  "User": "SAP_USER",
  "Password": "***"
}

6. Principal Propagation (Optional)

On the ABAP system (transaction STRUST):

1. Import the Cloud Connector root certificate into PSE
2. Configure SAML2: map email from BTP → SAP user ID
3. Ensure icm/HTTPS/trust_client_with_subject profile parameter is set

Verification

# Check SCC tunnel status from Admin UI → Connector → Status = Connected

# Test destination from BTP Cockpit (Destinations → "Test Connection" button)

# Test via curl through destination service (OAuth flow):
curl -s -X POST \
  https://<subaccount>.authentication.us10.hana.ondemand.com/oauth/token \
  -d "grant_type=client_credentials" \
  -u "<clientid>:<clientsecret>"

# Use the access token to call the destination service:
curl -s \
  "https://<destination-api>/destination-configuration/v1/destinations/s4hana-onprem" \
  -H "Authorization: Bearer <token>"
# Expected: JSON with destination details + auth tokens

Pitfalls

1. SCC version too old

   • Cause: ABAP Cloud requires SCC 2.15+; older versions lack principal propagation support.
   • Solution: Upgrade SCC before configuring subaccount. Check version at Admin UI → About.

2. Resources path case mismatch

   • Cause: Cloud Connector resources are case-sensitive. /sap/bc/adt ≠ /sap/bc/ADT.
   • Solution: Copy exact path casing from the SAP system's SICF transaction.

3. Principal propagation fails silently

   • Cause: STRUST certificate not imported on ABAP side, or SAML2 name mapping missing.
   • Solution: Verify STRUST PSE has SCC root cert. Check SAML2 → Trusted Provider → Name ID format = email.

4. SCC shows "Disconnected"

   • Cause: Outbound HTTPS (port 443) blocked by firewall, or wrong subaccount region.
   • Solution: Open outbound 443 to *.hana.ondemand.com. Verify region matches BTP Cockpit.

5. One SCC per subaccount limitation

   • Cause: Each subaccount expects one primary SCC. Multiple SCCs need HA/shared master config.
   • Solution: For HA, configure 2+ SCC instances with --shared mode pointing to same subaccount.

6. Destination "Test Connection" fails with 502

   • Cause: Virtual host in destination URL does not match SCC mapping, or internal host unreachable.
   • Solution: Verify virtual host name in destination matches SCC Cloud To On-Premise mapping exactly.