SAP Cloud Connector
SAP Cloud Connector is the reverse-proxy gateway that bridges your on-premise SAP systems with SAP BTP — without opening inbound firewall ports. We handle everything: from provisioning and hardening the virtual machine where the connector runs, through HA master/shadow configuration, system mapping, principal propagation, and ongoing certificate and lifecycle management.
How Cloud Connector Works — The Outbound Tunnel
Cloud Connector’s fundamental design is outbound-only: the connector, running inside your corporate network, initiates an outbound HTTPS connection to SAP BTP. BTP then uses this established tunnel to route requests from cloud applications back to on-premise systems — without any inbound firewall rules, DMZ exposure, or open server ports.
No inbound ports are required. The corporate firewall only needs to permit outbound HTTPS (port 443) from the SCC host to SAP BTP’s published IP ranges. All request traffic from BTP to on-premise travels back through this persistent, TLS-encrypted tunnel. Cloud Connector can be connected to multiple BTP subaccounts simultaneously — each subaccount sees a separate, independently controlled tunnel.
High Availability — Master / Shadow
A single Cloud Connector instance is a single point of failure for all BTP-to-on-premise connectivity. Production landscapes must run a Master / Shadow pair to ensure automatic failover without manual intervention.
The master is the active node. It establishes and maintains the HTTPS tunnel to BTP, serves all traffic from BTP to on-premise systems, and is the source of truth for configuration. All administrative changes are made on the master and automatically synchronised to the shadow.
- Holds the active BTP subaccount connection
- Processes all tunnelled requests
- Synchronises configuration to the shadow
- Runs the administration console
- Generates audit log entries for all access
The shadow passively monitors the master via a heartbeat. If the master becomes unavailable, the shadow automatically promotes itself to master, establishes its own BTP tunnel, and resumes traffic — typically within seconds. The shadow should run on a separate physical or virtual host for meaningful redundancy.
- Receives configuration sync from the master
- Maintains its own outbound HTTPS connection to BTP
- Promotes automatically when master heartbeat is lost
- No traffic flows through shadow unless promoted
- Should run on a separate host / availability zone
System Mapping & Access Control
These two mechanisms are the foundation of Cloud Connector’s security model — they control precisely which on-premise systems and resources are reachable through the tunnel.
s4hana-prod) to the actual internal hostname (e.g. sapapp01.corp.internal:44300). BTP Destinations reference only the virtual hostname — the real internal network structure is never exposed to the cloud side. Each mapped system also specifies the allowed protocol (HTTP, RFC, LDAP, TCP)./sap/opu/odata/). For RFC systems: individual function module names. For LDAP: base DNs. Anything not on the whitelist is blocked by the Cloud Connector — even if BTP attempts to call it. This deny-by-default posture is a key security control.Principal Propagation
Principal Propagation allows a BTP application or CPI iFlow to forward the authenticated end user’s identity to an on-premise ABAP system — so that the ABAP authorization layer (PFCG roles, object-level checks) can enforce fine-grained access control based on the actual user, not a shared technical account.
Setup requirements on the ABAP side:
- The SCC CA certificate must be trusted in ABAP transaction
STRUST(SSL client identity) - A certificate-to-user mapping rule must exist in ABAP (transaction
CERTRULEor ICM configuration) — mapping the CN of the short-lived cert (which carries the user’s email or login name) to an ABAP user - The ABAP system must have the Cloud Connector’s virtual host registered and the relevant OData or RFC service activated
Without principal propagation, all BTP-to-on-premise calls use a shared technical user — meaning ABAP cannot distinguish which end user triggered the request. With it, every call carries the user’s identity and ABAP enforces its full authorization model.
Supported Protocols
Cloud Connector can tunnel six protocol types — each mapped at the system level with its own access control configuration.
VM Infrastructure & Managed Hosting
Cloud Connector is not a BTP-hosted service — it is software that runs on a virtual machine you must provision and maintain within your network. Most customers handle the SCC Java configuration but underestimate the operational overhead of the underlying VM: OS patching, certificate lifecycle, monitoring, and SCC version upgrades.
CNBS delivers the complete stack — from VM provisioning and OS hardening through SCC installation to ongoing lifecycle management.
What We Deliver
VM Provisioning & OS Hardening
Virtual machine provisioning on Azure, AWS, or on-premise hypervisor (VMware/Hyper-V). OS selection and hardening: SELinux / AppArmor profiles, SSH key-only access, minimal installed packages, NTP configuration, and host-based firewall rules (iptables/firewalld). OpenJDK installation, JVM heap sizing, and startup service configuration (systemd).
HA Master / Shadow Installation
Cloud Connector installation on dedicated master and shadow hosts (separate VMs or availability zones). Subaccount trust setup and BTP connector registration, master-shadow pairing via certificate exchange, heartbeat configuration, and automatic failover validation by deliberately failing the master and confirming shadow promotion and traffic resumption.
System Mapping & Access Control
Virtual-to-real host mapping for each on-premise system (HTTP, RFC, LDAP, TCP, JDBC). Resource whitelist configuration: URL path prefixes for OData/REST services, individual RFC function module names for ABAP BAPIs. BTP Destination configuration with proxy type OnPremise and authentication method per use case. Per-subaccount mapping isolation for DEV/TEST/PROD.
Principal Propagation Setup
End-to-end principal propagation configuration: BTP Destination with PrincipalPropagation authentication type, Cloud Connector CA certificate export, ABAP STRUST configuration to trust the SCC CA, and CERTRULE / ICM certificate-to-user mapping in the ABAP system. Validated with a real end-user login trace confirming the ABAP authorization check runs against the actual user.
Security Hardening & Certificate Lifecycle
TLS configuration between SCC and BTP (pinned trust anchors), SCC administration console certificate renewal, backend system client certificate management, admin user governance (no shared admin accounts), and audit log configuration. Certificate expiry tracking with alerting — every certificate managed by CNBS has a renewal action scheduled before expiry.
Monitoring, Patching & Lifecycle Management
VM health monitoring via Azure Monitor, AWS CloudWatch, or SAP Cloud ALM. SCC process monitoring (auto-restart via systemd watchdog). Scheduled OS patching with maintenance windows. SAP Cloud Connector version upgrade management (SAP releases minor and major updates regularly — each tested in non-production before production promotion). Operational runbooks for every common task.
How Customers Benefit
How We Work
Assessment & Topology Design
We map your on-premise systems in scope, firewall rules, network topology, BTP subaccount structure, and HA requirements. We design the connector placement (DMZ vs internal segment), VM sizing, and per-subaccount system mapping strategy before any infrastructure is provisioned.
VM Provisioning & OS Hardening
We provision the master and shadow VMs (Azure, AWS, or on-premise), apply OS hardening baselines, configure host-based firewall rules, install OpenJDK with appropriate JVM heap sizing, and set up systemd service units for SCC auto-start and watchdog monitoring.
SCC Installation & BTP Trust
Cloud Connector installation, admin console certificate issuance, BTP subaccount connector registration, master-shadow pairing via certificate exchange, and initial connectivity validation. Each BTP subaccount (DEV, TEST, PROD) gets its own tunnel with isolated system mappings.
System Mapping & Whitelist Configuration
Virtual-to-real host mapping for every on-premise system, resource whitelist definition (URL paths, RFC function modules, LDAP DNs), and BTP Destination creation for each mapped system. Principal propagation configured end-to-end and validated with ABAP trace.
HA Validation & Security Hardening
Deliberate master failure test confirming shadow promotes and traffic resumes within the defined RTO. Security review: admin account governance, certificate expiry schedule, audit log configuration, SIEM forwarding, and access whitelist sign-off against your security team’s requirements.
Handover & Ongoing Operations
Operational runbooks for all common tasks (adding a new system mapping, renewing a certificate, upgrading SCC, performing a failover test). Monitoring dashboard handover, certificate renewal calendar, and patching schedule. CNBS remains available for lifecycle management under a managed services arrangement.
Ready to enable secure hybrid SAP connectivity?
Let’s build your secure bridge — and keep it running.
Tell us about your on-premise SAP systems, BTP subaccount structure, and HA requirements — we’ll design, provision, and manage a secure, stable Cloud Connector landscape from VM to tunnel.
Get in touch →