SAP Cloud Connector: Unterschied zwischen den Versionen

Aus XccesS Wiki
Zur Navigation springen Zur Suche springen
Zum nächsten Versionsunterschied →
VisuellWikitext
Die Seite wurde neu angelegt: „== Beschreibung == Der '''SAP Cloud Connector''' ist eine on-premise Komponente, die eine sichere Verbindung zwischen SAP Business Technology Platform (BTP) Cloud-Anwendungen und on-premise SAP-Systemen herstellt. Er fungiert als sicherer Tunnel und Reverse-Proxy für die Kommunikation zwischen Cloud und On-Premise Umgebungen. '''Hauptfunktionen:''' * Sichere Verbindung zwischen SAP BTP und On-Premise Systemen * SSL/TLS verschlüsselte Kommunikation * Ac…“
 
KKeine Bearbeitungszusammenfassung
Zeile 7: Zeile 7:
* Access Control für Backend-Systeme
* Access Control für Backend-Systeme
* High Availability Unterstützung (Master/Shadow)
* High Availability Unterstützung (Master/Shadow)
* Audit Logging und Monitoring
* Support für HTTP, HTTPS und RFC Protokolle
== Download ==
'''SAP Tools Portal:'''
* URL: [https://tools.hana.ondemand.com/ SAP Development Tools]
* Navigation: SAP BTP → Cloud Connector
* Aktuelle Version: 2.17.x oder höher
* Unterstützte Plattformen: Windows, Linux (SLES, RHEL), macOS


'''Systemvoraussetzungen:'''
'''Systemvoraussetzungen:'''
Zeile 22: Zeile 13:
* 2 GB freier Festplattenspeicherplatz
* 2 GB freier Festplattenspeicherplatz
* Netzwerkzugriff auf SAP BTP (Port 443 ausgehend)
* Netzwerkzugriff auf SAP BTP (Port 443 ausgehend)
* Betriebssystem: SUSE SLES 15+, RHEL 8+, Windows Server 2019+


== Installation ==
== Installation ==
=== Download ===
* URL: [https://tools.hana.ondemand.com/ SAP Development Tools]
* Navigation: SAP BTP → Cloud Connector
* Aktuelle Version: 2.17.x oder höher


=== Linux (SUSE/RHEL) ===
=== Linux (SUSE/RHEL) ===
Zeile 56: Zeile 51:
REM Service Status prüfen
REM Service Status prüfen
sc query "SAP Cloud Connector"
sc query "SAP Cloud Connector"
REM Service manuell starten falls nötig
net start "SAP Cloud Connector"
</syntaxhighlight>
</syntaxhighlight>
== Konfiguration ==


=== Initial Setup ===
=== Initial Setup ===
Zeile 73: Zeile 63:


# WICHTIG: Password sofort über "Change Password" ändern!
# WICHTIG: Password sofort über "Change Password" ändern!
</syntaxhighlight>
=== Subaccount konfigurieren ===
<syntaxhighlight lang="text">
# Via Admin UI Navigation:
# 1. Connector → Add Subaccount
# 2. Subaccount Details eingeben:
#    - Region: cf.eu10.hana.ondemand.com (beispielsweise)
#    - Subaccount Name: <your-subaccount-id>
#    - Login User: <technical-user-email>
#    - Password: <technical-user-password>
#    - Display Name: <description>
#    - Location ID: (optional für Multi-Cloud Connector Setup)
# 3. "Save" klicken und Connection Status prüfen
</syntaxhighlight>
=== Backend System konfigurieren ===
<syntaxhighlight lang="text">
# Cloud To On-Premise → Add System:
# - Backend Type: ABAP System / Java System / Other
# - Protocol: HTTP / HTTPS / RFC
# - Internal Host: <real-sap-system-hostname>
# - Internal Port: <port> (z.B. 8000 für HTTP, 50000 für Java)
# - Virtual Host: <virtual-hostname> (z.B. mysap.virtual)
# - Virtual Port: <virtual-port> (z.B. 8001)
# - Principal Propagation: None / X.509 Certificate / Kerberos
# - Host in Header: Use Virtual Host
# - Description: <system-description>
</syntaxhighlight>
=== Access Control konfigurieren ===
<syntaxhighlight lang="text">
# Resources für Backend System definieren:
# 1. Cloud To On-Premise → Access Control → Add Resource
# 2. Resource Details:
#    - URL Path: /sap/bc/rest/*
#    - Access Policy: Path and all sub-paths
#    - Description: SAP REST Services
#    - Authentication: None / Basic / Certificate
# 3. Additional Paths:
#    - /sap/opu/odata/* (für OData Services)
#    - /sap/bc/webdynpro/* (für Web Dynpro Apps)
#    - /sap/public/* (für öffentliche Services)
# 4. Status auf "Enabled" setzen
</syntaxhighlight>
</syntaxhighlight>


Zeile 144: Zeile 87:
sudo systemctl start sccservice
sudo systemctl start sccservice


# 7. Version und Funktionalität prüfen
# 7. Version prüfen
sudo cat /opt/sap/scc/version.properties
sudo cat /opt/sap/scc/version.properties
curl -k https://localhost:8443/sap/public/ping
</syntaxhighlight>
</syntaxhighlight>


Zeile 160: Zeile 102:
# https://<master-host>:8443
# https://<master-host>:8443
# Navigation: High Availability → Switch Role
# Navigation: High Availability → Switch Role
# Shadow wird zu Master, Master wird zu Shadow


# Phase 3: Original Master updaten (jetzt Shadow)
# Phase 3: Original Master updaten (jetzt Shadow)
Zeile 170: Zeile 111:
# Phase 4: Validation
# Phase 4: Validation
# Beide Instanzen auf gleiche Version prüfen
# Beide Instanzen auf gleiche Version prüfen
# HA Status: Master = Active, Shadow = Synchronized
</syntaxhighlight>
== Test ==
=== Connectivity Tests ===
<syntaxhighlight lang="bash">
# 1. Cloud Connector Admin UI Zugriff
curl -k https://localhost:8443/sap/public/ping
# Expected: HTTP 200 OK
# 2. Service Status
sudo systemctl status sccservice
# Expected: active (running)
# 3. Port Listening Check
sudo netstat -tulpn | grep :8443
# Expected: java process listening on 8443
# 4. Log File Check
tail -20 /opt/sap/scc/log/ljs_trace.log
# Expected: Keine ERROR messages
</syntaxhighlight>
=== End-to-End Funktionstest ===
<syntaxhighlight lang="bash">
# Via Admin UI Tests:
# 1. Connector → Check Connection (für Subaccount)
# 2. Cloud To On-Premise → Check Availability (für Backend System)
# 3. Access Control → Test Resource Access
# BTP Destination Test:
# 1. BTP Cockpit → Connectivity → Destinations
# 2. Create New Destination:
#    - Name: MY_ONPREM_SYSTEM
#    - Type: HTTP
#    - URL: http://mysap.virtual:8001
#    - Proxy Type: OnPremise
#    - Authentication: BasicAuthentication / PrincipalPropagation
# 3. Check Connection
</syntaxhighlight>
=== Monitoring ===
<syntaxhighlight lang="bash">
# Real-time Log Monitoring
tail -f /opt/sap/scc/log/ljs_trace.log
# Access Logs (HTTP Requests)
tail -f /opt/sap/scc/log/http_access_$(date +%Y%m%d).log
# Audit Logs (Admin Actions)
tail -f /opt/sap/scc/log/audit_$(date +%Y%m%d).log
# Connection Statistics via Admin UI:
# Monitor → Connection Statistics
# - Active Connections
# - Data Transfer Volume
# - Response Times
</syntaxhighlight>
== Fehlerbehebung ==
=== Starten/Stoppen funktioniert nicht ===
==== Lösung 1: Service Status Analysis ====
<syntaxhighlight lang="bash">
# Detaillierte Service Informationen
sudo systemctl status sccservice -l --no-pager
# Service Logs der letzten 50 Zeilen
sudo journalctl -u sccservice -n 50 --no-pager
# Falls Service failed:
sudo systemctl reset-failed sccservice
sudo systemctl daemon-reload
sudo systemctl start sccservice
# Falls immer noch Probleme:
sudo systemctl stop sccservice
sudo systemctl disable sccservice
sudo systemctl enable sccservice
sudo systemctl start sccservice
</syntaxhighlight>
==== Lösung 2: Port Konflikte beheben ====
<syntaxhighlight lang="bash">
# Port Belegung prüfen
sudo ss -tulpn | grep :8443
sudo ss -tulpn | grep :8080
# Prozess identifizieren der Port blockiert
sudo lsof -i :8443
# Falls anderer Prozess Port belegt:
# Option 1: Anderen Prozess stoppen
sudo kill -9 <PID>
# Option 2: Cloud Connector Port ändern
sudo vi /opt/sap/scc/scc_config/com.sap.scc.web.xml
# <port>8443</port> zu <port>8444</port> ändern
# Service neu starten
sudo systemctl restart sccservice
# Neuen Port testen
curl -k https://localhost:8444/sap/public/ping
</syntaxhighlight>
==== Lösung 3: JVM/Memory Issues ====
<syntaxhighlight lang="bash">
# Java Version und Installation prüfen
java -version
which java
echo $JAVA_HOME
# Für Cloud Connector 2.15+ wird JVM 17 benötigt:
# SUSE:
sudo zypper install java-17-openjdk java-17-openjdk-devel
# RHEL/CentOS:
sudo yum install java-17-openjdk java-17-openjdk-devel
# JAVA_HOME setzen (falls nötig)
export JAVA_HOME=/usr/lib64/jvm/java-17-openjdk
echo 'export JAVA_HOME=/usr/lib64/jvm/java-17-openjdk' >> ~/.bashrc
# Memory Settings überprüfen/anpassen
sudo vi /opt/sap/scc/go.sh
# Suchen nach -Xmx Parameter und erhöhen falls nötig
# z.B. -Xmx2g für 2GB Heap
sudo systemctl restart sccservice
</syntaxhighlight>
=== Connection zu BTP nicht möglich ===
==== Lösung 1: Firewall/Proxy Configuration ====
<syntaxhighlight lang="bash">
# Internet Connectivity Tests
curl -I https://api.cf.eu10.hana.ondemand.com
ping api.cf.eu10.hana.ondemand.com
# DNS Resolution Test
nslookup api.cf.eu10.hana.ondemand.com
# Corporate Firewall Ports prüfen:
# - Ausgehend Port 443 (HTTPS) zu SAP BTP
# - Ausgehend Port 8443 (für manche Services)
# Proxy Configuration via Admin UI:
# Configuration → On Premise → Proxy Settings
# - Use Proxy: Yes
# - Host: proxy.company.com
# - Port: 8080
# - Authentication: Basic/NTLM
# - Username: domain\username
# - Password: <proxy-password>
# - Non Proxy Hosts: localhost,127.0.0.1,*.company.internal
</syntaxhighlight>
==== Lösung 2: Certificate Issues ====
<syntaxhighlight lang="bash">
# SSL Certificate Chain prüfen
openssl s_client -connect api.cf.eu10.hana.ondemand.com:443 -showcerts
# Corporate Root CA importieren via Admin UI:
# Administrator → Certificate → Trusted Root CAs
# - Import Certificate: company-root-ca.pem
# - Restart Service nach Import
# System Certificate Status prüfen
# Administrator → Certificate → System Certificate
# - Valid From/Until prüfen
# - Subject DN verifizieren
</syntaxhighlight>
=== Backend System nicht erreichbar ===
==== Lösung 1: System Configuration Validation ====
<syntaxhighlight lang="bash">
# Network Connectivity vom Cloud Connector Server
ping <backend-sap-system>
telnet <backend-sap-system> <port>
# Beispiel für SAP System Tests:
telnet sapserver01 8000  # HTTP
telnet sapserver01 50000 # Java HTTP
telnet sapserver01 3300  # Gateway/RFC
# DNS Resolution
nslookup <backend-sap-system>
# Routing Check
traceroute <backend-sap-system>
</syntaxhighlight>
==== Lösung 2: Access Control Validation ====
<syntaxhighlight lang="text">
# Via Admin UI prüfen:
# Cloud To On-Premise → Access Control
#
# Verify für jede Resource:
# 1. URL Path: Exakt wie von BTP-App verwendet
#    - Häufige Patterns:
#      * /sap/bc/rest/*
#      * /sap/opu/odata/*
#      * /sap/bc/webdynpro/*
#      * /
#
# 2. Access Policy: "Path and all sub-paths"
# 3. Authentication: Passend zu BTP Destination
# 4. Status: Enabled (grüner Haken)
# 5. System Status: Available (grüner Punkt)
#
# Test via "Check Availability" Button
</syntaxhighlight>
=== High Availability Issues ===
==== Lösung 1: HA Synchronization Problems ====
<syntaxhighlight lang="bash">
# HA Status prüfen via Admin UI
# High Availability → Overview
# - Master Status: Active
# - Shadow Status: Synchronized
# - Last Sync: Recent timestamp
# Bei Sync-Problemen:
# 1. Network Connectivity zwischen Master/Shadow
ping <shadow-host>
telnet <shadow-host> 8443
# 2. Certificate Sync prüfen
# Beide Instanzen müssen identische Certificates haben
# 3. Manual Sync triggern
# High Availability → Force Synchronization
# 4. Log Files analysieren
tail -f /opt/sap/scc/log/ljs_trace.log | grep -i "sync\|shadow\|master"
</syntaxhighlight>
== Codeschnipsel ==
=== Version und Status Informationen ===
<syntaxhighlight lang="bash">
# Cloud Connector Version anzeigen
sudo cat /opt/sap/scc/version.properties
# Alternative via JAR Manifest
sudo unzip -p /opt/sap/scc/configurator.jar META-INF/MANIFEST.MF | grep -i version
# Service Status detailliert
sudo systemctl status sccservice --no-pager -l
# Aktive Connections anzeigen
sudo ss -tulpn | grep java
</syntaxhighlight>
=== Backup und Recovery ===
<syntaxhighlight lang="bash">
# Vollständiges Backup erstellen
sudo tar -czf /backup/scc_backup_$(date +%Y%m%d_%H%M).tar.gz \
  /opt/sap/scc/scc_config \
  /opt/sap/scc/version.properties \
  /opt/sap/scc/props.ini
# Configuration Export via Admin UI (automatisiert)
curl -k -u Administrator:<password> \
  -X GET "https://localhost:8443/admin/export" \
  -o scc_config_$(date +%Y%m%d).zip
# Backup wiederherstellen
sudo systemctl stop sccservice
sudo tar -xzf /backup/scc_backup_YYYYMMDD_HHMM.tar.gz -C /
sudo systemctl start sccservice
</syntaxhighlight>
=== Monitoring und Alerting ===
<syntaxhighlight lang="bash">
# Health Check Script
#!/bin/bash
# SCC Health Monitor
# Service Status
if ! systemctl is-active --quiet sccservice; then
    echo "CRITICAL: SCC Service not running"
    exit 2
fi
# Admin UI Accessibility
if ! curl -k -s --max-time 10 https://localhost:8443/sap/public/ping >/dev/null; then
    echo "WARNING: Admin UI not accessible"
    exit 1
fi
# Log Error Check (last 100 lines)
ERROR_COUNT=$(tail -100 /opt/sap/scc/log/ljs_trace.log | grep -c "ERROR\|FATAL")
if [ $ERROR_COUNT -gt 5 ]; then
    echo "WARNING: $ERROR_COUNT errors in recent logs"
    exit 1
fi
echo "OK: SCC running normally"
exit 0
</syntaxhighlight>
=== Certificate Management ===
<syntaxhighlight lang="bash">
# System Certificate Details anzeigen
sudo openssl x509 -in /opt/sap/scc/scc_config/keystore -text -noout
# Certificate Expiration Check
sudo openssl x509 -in /opt/sap/scc/scc_config/certificate.crt \
  -checkend 2592000 -noout
# Prüft ob Certificate in 30 Tagen abläuft
# Root CA Certificate importieren (Command Line)
sudo cp company-root-ca.crt /opt/sap/scc/scc_config/trusted_cas/
sudo systemctl restart sccservice
</syntaxhighlight>
=== Log Analysis ===
<syntaxhighlight lang="bash">
# Connection Errors analysieren
grep -i "connection.*failed\|timeout" /opt/sap/scc/log/ljs_trace.log | tail -10
# HTTP Access Logs auswerten
awk '{print $7}' /opt/sap/scc/log/http_access_$(date +%Y%m%d).log | sort | uniq -c | sort -nr
# Top 10 häufigste Fehler
grep "ERROR" /opt/sap/scc/log/ljs_trace.log | cut -d' ' -f4- | sort | uniq -c | sort -nr | head -10
# Performance Analysis
grep "response time" /opt/sap/scc/log/ljs_trace.log | awk '{print $NF}' | sort -n | tail -20
</syntaxhighlight>
</syntaxhighlight>


== Nützliche Links ==
== Nützliche Links ==
=== SAP Dokumentation ===
* [https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector Cloud Connector Administration Guide]
* [https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector Cloud Connector Administration Guide]
* [https://tools.hana.ondemand.com/ SAP Development Tools Portal]
* [https://tools.hana.ondemand.com/ SAP Development Tools Portal]
* [https://help.sap.com/docs/btp/sap-business-technology-platform/connectivity SAP BTP Connectivity Service]
* [https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/destination-service Destination Service Documentation]
=== SAP Notes (Support Portal) ===
* [https://userapps.support.sap.com/sap/support/knowledge/en/2539713 SAP Note 2539713 - Cloud Connector Upgrade]
* [https://userapps.support.sap.com/sap/support/knowledge/en/2539713 SAP Note 2539713 - Cloud Connector Upgrade]
* [https://userapps.support.sap.com/sap/support/knowledge/en/3043130 SAP Note 3043130 - HA Upgrade Scenarios]
* [https://userapps.support.sap.com/sap/support/knowledge/en/3302250 SAP Note 3302250 - Support Strategy Cloud Connector]
=== Community und Support ===
* [https://community.sap.com/topics/cloud-connector SAP Community - Cloud Connector]
* [https://community.sap.com/topics/cloud-connector SAP Community - Cloud Connector]
* [https://blogs.sap.com/tags/73554900100800002881/ SAP Blogs - Connectivity]
* [https://answers.sap.com/tags/73554900100800002881 SAP Answers - Cloud Connector]
=== Security und Best Practices ===
* [https://help.sap.com/docs/btp/sap-business-technology-platform/security SAP BTP Security Guide]
* [https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/recommendations-for-secure-setup SAP Cloud Connector Security Recommendations]
* [https://blogs.sap.com/2019/07/22/sap-cloud-connector-security-recommendations/ Security Best Practices Blog]
=== Troubleshooting Ressourcen ===
* [https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/troubleshooting Cloud Connector Troubleshooting Guide]
* [https://wiki.scn.sap.com/wiki/display/SBO/SAP+Cloud+Connector+Troubleshooting Community Troubleshooting Wiki]
* [https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html SAP Security Notes & Patches]
=== Tools und Utilities ===
* [https://tools.hana.ondemand.com/#cloud SAP BTP CLI Tools]
* [https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector-rest-api Cloud Connector REST API]
* [https://github.com/SAP-samples/cloud-connector-samples SAP Cloud Connector Code Samples]

Version vom 8. August 2025, 15:40 Uhr

Beschreibung

Der SAP Cloud Connector ist eine on-premise Komponente, die eine sichere Verbindung zwischen SAP Business Technology Platform (BTP) Cloud-Anwendungen und on-premise SAP-Systemen herstellt. Er fungiert als sicherer Tunnel und Reverse-Proxy für die Kommunikation zwischen Cloud und On-Premise Umgebungen.

Hauptfunktionen:

  • Sichere Verbindung zwischen SAP BTP und On-Premise Systemen
  • SSL/TLS verschlüsselte Kommunikation
  • Access Control für Backend-Systeme
  • High Availability Unterstützung (Master/Shadow)

Systemvoraussetzungen:

  • JVM 17 oder höher (ab Version 2.15.0)
  • Mindestens 2 GB RAM
  • 2 GB freier Festplattenspeicherplatz
  • Netzwerkzugriff auf SAP BTP (Port 443 ausgehend)

Installation

Download

Linux (SUSE/RHEL)

# Download und Installation
chmod +x sapcc-*.sh
sudo ./sapcc-*.sh

# Standard Installation Path: /opt/sap/scc
# Service wird automatisch als sccservice registriert

# Service aktivieren und starten
sudo systemctl enable sccservice
sudo systemctl start sccservice

# Status prüfen
sudo systemctl status sccservice

# Version verifizieren
sudo cat /opt/sap/scc/version.properties

Windows

REM MSI Installer als Administrator ausführen
sapcc-*.msi

REM Service wird automatisch installiert und gestartet
REM Standardpfad: C:\SAP\scc

REM Service Status prüfen
sc query "SAP Cloud Connector"

Initial Setup

# Admin UI aufrufen
# URL: https://localhost:8443

# Initial Credentials:
# User: Administrator
# Password: manage

# WICHTIG: Password sofort über "Change Password" ändern!

Update

Standard Update (Single Instance)

# 1. Konfiguration sichern
sudo cp -r /opt/sap/scc/scc_config /backup/scc_config_$(date +%Y%m%d)

# 2. Configuration Export via Admin UI
# Administrator → Configuration → Export → scc_config.zip

# 3. Service stoppen
sudo systemctl stop sccservice

# 4. Neuen Installer ausführen
sudo ./sapcc-<neue-version>.sh

# 5. Installation im selben Pfad bestätigen (/opt/sap/scc)
# Konfiguration wird automatisch übernommen

# 6. Service starten
sudo systemctl start sccservice

# 7. Version prüfen
sudo cat /opt/sap/scc/version.properties

High Availability Update (Zero Downtime)

# Phase 1: Shadow Instance updaten
# Auf Shadow Server:
sudo systemctl stop sccservice
sudo ./sapcc-<neue-version>.sh
sudo systemctl start sccservice

# Phase 2: Role Switch via Master Admin UI
# https://<master-host>:8443
# Navigation: High Availability → Switch Role

# Phase 3: Original Master updaten (jetzt Shadow)
# Auf Original Master Server:
sudo systemctl stop sccservice
sudo ./sapcc-<neue-version>.sh
sudo systemctl start sccservice

# Phase 4: Validation
# Beide Instanzen auf gleiche Version prüfen

Nützliche Links

Abgerufen von „https://wiki.fam-puls.de/index.php?title=SAP_Cloud_Connector&oldid=391“