Service offering

SAP Cloud Connector

SAP Cloud Connector is the reverse-proxy gateway that bridges your on-premise SAP systems with SAP BTP — without opening inbound firewall ports. We handle everything: from provisioning and hardening the virtual machine where the connector runs, through HA master/shadow configuration, system mapping, principal propagation, and ongoing certificate and lifecycle management.

Cloud Connector (SCC)VM Provisioning & ManagementHA Master / ShadowSystem MappingPrincipal PropagationAccess Control (Whitelist)RFC · HTTPS · LDAP · TCPCertificate LifecycleAudit LoggingSAP Cloud ALM Integration

SAP Cloud Connector — administration console

Architecture

Cloud Connector runs on an outbound-only tunnel architecture — no inbound firewall rules, DMZ exposure, or open server ports on your side. We reference SAP’s standard tunnel design and configure it for your landscape; the mechanism itself is documented in SAP’s official Cloud Connector documentation.

Cloud Connector — outbound tunnel, master/shadow high availability

Master (active)Tunnel live · serving traffic

→

Master failureHost down · process crash · network loss

→

Shadow detectsHeartbeat timeout exceeded

→

Shadow promotesEstablishes own BTP tunnel

→

Shadow (now master)Traffic resumes · no manual action

Architecture reference: architecture.learning.sap.com

We deploy Cloud Connector as a Master / Shadow pair on separate hosts — a single instance is a single point of failure for all BTP-to-on-premise connectivity, so production landscapes always run the pair with automatic, unattended failover.

System Mapping & Access Control

These two mechanisms are the foundation of Cloud Connector’s security model — they control precisely which on-premise systems and resources are reachable through the tunnel.

System Mapping

Virtual Host → Real Internal Host

Every on-premise system is exposed to BTP via a virtual hostname — the real internal network structure is never visible to the cloud side.

Resource Access Control

Explicit Whitelist — Deny by Default

Only explicitly whitelisted paths, function modules, and directory entries are reachable through the tunnel — everything else is blocked by default.

Multi-Subaccount

One SCC, Multiple BTP Subaccounts

A single Cloud Connector serves multiple BTP subaccounts (DEV/TEST/PROD) with isolated mappings and no cross-subaccount access leakage.

Audit Logging

Every Tunnelled Request Recorded

Caller, target, resource, and result are logged for every request — the evidence trail for compliance reviews and incident investigations.

Principal Propagation

We configure end-to-end principal propagation so on-premise ABAP systems see the real authenticated end user on every BTP-initiated call — not a shared technical account — and enforce their full PFCG authorization model accordingly. This builds on SAP’s standard principal propagation mechanism between Cloud Connector and ABAP; we don’t reproduce that mechanism here — see SAP’s official documentation for the underlying protocol.

Supported Protocols

Cloud Connector can tunnel six protocol types — each mapped at the system level with its own access control configuration.

HTTP / HTTPS

REST, OData, SOAP

Covers OData, REST, SOAP, and custom endpoints — the most common protocol, used by CPI, BTP CAP apps, and Work Zone.

RFC

SAP Remote Function Calls

Lets BTP apps and CPI call ABAP function modules (BAPIs, RFMs) directly.

LDAP

Directory Services

Tunnels queries to on-premise Active Directory for user lookups and identity resolution.

TCP

Generic TCP

Raw tunnel for protocols with no dedicated adapter — maximum flexibility, least granular access control.

JDBC

Database Connectivity

Direct connections from BTP applications to on-premise databases (HANA, Oracle, MS SQL).

Mail (SMTP / IMAP)

On-Premise Mail Servers

Tunnels mail protocols to corporate mail servers that aren’t publicly reachable.

VM Infrastructure & Managed Hosting

Cloud Connector is not a BTP-hosted service — it is software that runs on a virtual machine you must provision and maintain within your network. Most customers handle the SCC Java configuration but underestimate the operational overhead of the underlying VM: OS patching, certificate lifecycle, monitoring, and SCC version upgrades.

CNBS delivers the complete stack — from VM provisioning and OS hardening through SCC installation to ongoing lifecycle management.

CNBS Unique Offering

Full VM + SCC Stack — Provisioned, Hardened, and Managed by CNBS

We provision the virtual machine, harden the operating system, install and configure the Cloud Connector (master + shadow), and provide ongoing lifecycle management — so your team does not need to run a dedicated SCC operations function. Cloud Connector becomes a fully managed component of your BTP connectivity layer, not an unowned server someone provisioned three years ago.

VM provisioning (Azure · AWS · on-premise)

OS selection & hardening (RHEL · SLES · Ubuntu)

Network & firewall rule design

OpenJDK installation & tuning

SCC installation (master + shadow)

HA failover testing & validation

OS patch management (scheduled)

SCC version upgrade management

Certificate lifecycle & renewal

VM monitoring (Azure Monitor / CloudWatch)

SAP Cloud ALM health integration

Incident response & runbooks

What We Deliver

VM Provisioning & OS Hardening

Virtual machine provisioning on Azure, AWS, or on-premise hypervisor (VMware/Hyper-V). OS selection and hardening: SELinux / AppArmor profiles, SSH key-only access, minimal installed packages, NTP configuration, and host-based firewall rules (iptables/firewalld). OpenJDK installation, JVM heap sizing, and startup service configuration (systemd).

HA Master / Shadow Installation

Cloud Connector installation on dedicated master and shadow hosts (separate VMs or availability zones). Subaccount trust setup and BTP connector registration, master-shadow pairing via certificate exchange, heartbeat configuration, and automatic failover validation by deliberately failing the master and confirming shadow promotion and traffic resumption.

System Mapping & Access Control

Virtual-to-real host mapping for each on-premise system (HTTP, RFC, LDAP, TCP, JDBC). Resource whitelist configuration: URL path prefixes for OData/REST services, individual RFC function module names for ABAP BAPIs. BTP Destination configuration with proxy type OnPremise and authentication method per use case. Per-subaccount mapping isolation for DEV/TEST/PROD.

Principal Propagation Setup

End-to-end principal propagation configuration: BTP Destination with PrincipalPropagation authentication type, Cloud Connector CA certificate export, ABAP STRUST configuration to trust the SCC CA, and CERTRULE / ICM certificate-to-user mapping in the ABAP system. Validated with a real end-user login trace confirming the ABAP authorization check runs against the actual user.

Security Hardening & Certificate Lifecycle

TLS configuration between SCC and BTP (pinned trust anchors), SCC administration console certificate renewal, backend system client certificate management, admin user governance (no shared admin accounts), and audit log configuration. Certificate expiry tracking with alerting — every certificate managed by CNBS has a renewal action scheduled before expiry.

Monitoring, Patching & Lifecycle Management

VM health monitoring via Azure Monitor, AWS CloudWatch, or SAP Cloud ALM. SCC process monitoring (auto-restart via systemd watchdog). Scheduled OS patching with maintenance windows. SAP Cloud Connector version upgrade management (SAP releases minor and major updates regularly — each tested in non-production before production promotion). Operational runbooks for every common task.

How Customers Benefit

Zero

Inbound Firewall Rules Required

The outbound-only tunnel design means no inbound ports need to be opened, no reverse proxies need to be published, and no DMZ rules need ongoing justification to your security team — the entire connectivity model is driven by an outbound HTTPS connection your firewall already permits.

Deny-All

Access Control by Default

Every on-premise resource is blocked by default. Only explicitly whitelisted URL paths, RFC function modules, and LDAP base DNs are reachable through the tunnel. BTP cannot reach anything you haven’t consciously approved — the access control model is conservative by design.

Full

ABAP Authorization for BTP Calls

Principal propagation ensures that every BTP-initiated call to S/4HANA carries the real end user’s identity. ABAP’s full authorization framework — PFCG roles, object-level checks — runs on the actual user, not a shared service account with excessive permissions.

Managed

VM + SCC as a Fully Operated Service

CNBS provisions the VM, installs SCC, manages OS patches, upgrades the connector software, renews certificates, and monitors health — your team does not need SCC-dedicated operations expertise. The connector is just infrastructure that works.

Automatic Failover — No Manual Action

Master / Shadow HA eliminates the single point of failure for all BTP-to-on-premise connectivity. Shadow promotion is automatic — a VM reboot, process crash, or network partition on the master does not require an on-call engineer to restore connectivity.

Auditable

Every Request Logged

Cloud Connector’s audit log records every tunnelled request — caller, target, resource, and result. Combined with SIEM forwarding, this creates a complete evidence trail for compliance reviews, security incidents, and access audits without additional tooling.

How We Work

Assessment & Topology Design

We map your on-premise systems in scope, firewall rules, network topology, BTP subaccount structure, and HA requirements. We design the connector placement (DMZ vs internal segment), VM sizing, and per-subaccount system mapping strategy before any infrastructure is provisioned.

VM Provisioning & OS Hardening

We provision the master and shadow VMs (Azure, AWS, or on-premise), apply OS hardening baselines, configure host-based firewall rules, install OpenJDK with appropriate JVM heap sizing, and set up systemd service units for SCC auto-start and watchdog monitoring.

SCC Installation & BTP Trust

Cloud Connector installation, admin console certificate issuance, BTP subaccount connector registration, master-shadow pairing via certificate exchange, and initial connectivity validation. Each BTP subaccount (DEV, TEST, PROD) gets its own tunnel with isolated system mappings.

System Mapping & Whitelist Configuration

Virtual-to-real host mapping for every on-premise system, resource whitelist definition (URL paths, RFC function modules, LDAP DNs), and BTP Destination creation for each mapped system. Principal propagation configured end-to-end and validated with ABAP trace.

HA Validation & Security Hardening

Deliberate master failure test confirming shadow promotes and traffic resumes within the defined RTO. Security review: admin account governance, certificate expiry schedule, audit log configuration, SIEM forwarding, and access whitelist sign-off against your security team’s requirements.

Handover & Ongoing Operations

Operational runbooks for all common tasks (adding a new system mapping, renewing a certificate, upgrading SCC, performing a failover test). Monitoring dashboard handover, certificate renewal calendar, and patching schedule. CNBS remains available for lifecycle management under a managed services arrangement.

Ready to enable secure hybrid SAP connectivity?

Let’s build your secure bridge — and keep it running.

Tell us about your on-premise SAP systems, BTP subaccount structure, and HA requirements — we’ll design, provision, and manage a secure, stable Cloud Connector landscape from VM to tunnel.

Get in touch →