SAP Cloud Connector

Beschreibung

Der SAP Cloud Connector ist eine on-premise Komponente, die eine sichere Verbindung zwischen SAP Business Technology Platform (BTP) Cloud-Anwendungen und on-premise SAP-Systemen herstellt. Er fungiert als sicherer Tunnel und Reverse-Proxy für die Kommunikation zwischen Cloud und On-Premise Umgebungen.

Hauptfunktionen:

Sichere Verbindung zwischen SAP BTP und On-Premise Systemen
SSL/TLS verschlüsselte Kommunikation
Access Control für Backend-Systeme
High Availability Unterstützung (Master/Shadow)
Audit Logging und Monitoring
Support für HTTP, HTTPS und RFC Protokolle

Download

SAP Tools Portal:

URL: SAP Development Tools
Navigation: SAP BTP → Cloud Connector
Aktuelle Version: 2.17.x oder höher
Unterstützte Plattformen: Windows, Linux (SLES, RHEL), macOS

Systemvoraussetzungen:

JVM 17 oder höher (ab Version 2.15.0)
Mindestens 2 GB RAM
2 GB freier Festplattenspeicherplatz
Netzwerkzugriff auf SAP BTP (Port 443 ausgehend)
Betriebssystem: SUSE SLES 15+, RHEL 8+, Windows Server 2019+

Installation

Linux (SUSE/RHEL)

# Download und Installation
chmod +x sapcc-*.sh
sudo ./sapcc-*.sh

# Standard Installation Path: /opt/sap/scc
# Service wird automatisch als sccservice registriert

# Service aktivieren und starten
sudo systemctl enable sccservice
sudo systemctl start sccservice

# Status prüfen
sudo systemctl status sccservice

# Version verifizieren
sudo cat /opt/sap/scc/version.properties

Windows

REM MSI Installer als Administrator ausführen
sapcc-*.msi

REM Service wird automatisch installiert und gestartet
REM Standardpfad: C:\SAP\scc

REM Service Status prüfen
sc query "SAP Cloud Connector"

REM Service manuell starten falls nötig
net start "SAP Cloud Connector"

Konfiguration

Initial Setup

# Admin UI aufrufen
# URL: https://localhost:8443

# Initial Credentials:
# User: Administrator
# Password: manage

# WICHTIG: Password sofort über "Change Password" ändern!

Subaccount konfigurieren

# Via Admin UI Navigation:
# 1. Connector → Add Subaccount
# 2. Subaccount Details eingeben:
#    - Region: cf.eu10.hana.ondemand.com (beispielsweise)
#    - Subaccount Name: <your-subaccount-id>
#    - Login User: <technical-user-email>
#    - Password: <technical-user-password>
#    - Display Name: <description>
#    - Location ID: (optional für Multi-Cloud Connector Setup)

# 3. "Save" klicken und Connection Status prüfen

Backend System konfigurieren

# Cloud To On-Premise → Add System:
# - Backend Type: ABAP System / Java System / Other
# - Protocol: HTTP / HTTPS / RFC
# - Internal Host: <real-sap-system-hostname>
# - Internal Port: <port> (z.B. 8000 für HTTP, 50000 für Java)
# - Virtual Host: <virtual-hostname> (z.B. mysap.virtual)
# - Virtual Port: <virtual-port> (z.B. 8001)
# - Principal Propagation: None / X.509 Certificate / Kerberos
# - Host in Header: Use Virtual Host
# - Description: <system-description>

Access Control konfigurieren

# Resources für Backend System definieren:
# 1. Cloud To On-Premise → Access Control → Add Resource
# 2. Resource Details:
#    - URL Path: /sap/bc/rest/*
#    - Access Policy: Path and all sub-paths
#    - Description: SAP REST Services
#    - Authentication: None / Basic / Certificate

# 3. Additional Paths:
#    - /sap/opu/odata/* (für OData Services)
#    - /sap/bc/webdynpro/* (für Web Dynpro Apps)
#    - /sap/public/* (für öffentliche Services)

# 4. Status auf "Enabled" setzen

Update

Standard Update (Single Instance)

# 1. Konfiguration sichern
sudo cp -r /opt/sap/scc/scc_config /backup/scc_config_$(date +%Y%m%d)

# 2. Configuration Export via Admin UI
# Administrator → Configuration → Export → scc_config.zip

# 3. Service stoppen
sudo systemctl stop sccservice

# 4. Neuen Installer ausführen
sudo ./sapcc-<neue-version>.sh

# 5. Installation im selben Pfad bestätigen (/opt/sap/scc)
# Konfiguration wird automatisch übernommen

# 6. Service starten
sudo systemctl start sccservice

# 7. Version und Funktionalität prüfen
sudo cat /opt/sap/scc/version.properties
curl -k https://localhost:8443/sap/public/ping

High Availability Update (Zero Downtime)

# Phase 1: Shadow Instance updaten
# Auf Shadow Server:
sudo systemctl stop sccservice
sudo ./sapcc-<neue-version>.sh
sudo systemctl start sccservice

# Phase 2: Role Switch via Master Admin UI
# https://<master-host>:8443
# Navigation: High Availability → Switch Role
# Shadow wird zu Master, Master wird zu Shadow

# Phase 3: Original Master updaten (jetzt Shadow)
# Auf Original Master Server:
sudo systemctl stop sccservice
sudo ./sapcc-<neue-version>.sh
sudo systemctl start sccservice

# Phase 4: Validation
# Beide Instanzen auf gleiche Version prüfen
# HA Status: Master = Active, Shadow = Synchronized

Test

Connectivity Tests

# 1. Cloud Connector Admin UI Zugriff
curl -k https://localhost:8443/sap/public/ping
# Expected: HTTP 200 OK

# 2. Service Status
sudo systemctl status sccservice
# Expected: active (running)

# 3. Port Listening Check
sudo netstat -tulpn | grep :8443
# Expected: java process listening on 8443

# 4. Log File Check
tail -20 /opt/sap/scc/log/ljs_trace.log
# Expected: Keine ERROR messages

End-to-End Funktionstest

# Via Admin UI Tests:
# 1. Connector → Check Connection (für Subaccount)
# 2. Cloud To On-Premise → Check Availability (für Backend System)
# 3. Access Control → Test Resource Access

# BTP Destination Test:
# 1. BTP Cockpit → Connectivity → Destinations
# 2. Create New Destination:
#    - Name: MY_ONPREM_SYSTEM
#    - Type: HTTP
#    - URL: http://mysap.virtual:8001
#    - Proxy Type: OnPremise
#    - Authentication: BasicAuthentication / PrincipalPropagation
# 3. Check Connection

Monitoring

# Real-time Log Monitoring
tail -f /opt/sap/scc/log/ljs_trace.log

# Access Logs (HTTP Requests)
tail -f /opt/sap/scc/log/http_access_$(date +%Y%m%d).log

# Audit Logs (Admin Actions)
tail -f /opt/sap/scc/log/audit_$(date +%Y%m%d).log

# Connection Statistics via Admin UI:
# Monitor → Connection Statistics
# - Active Connections
# - Data Transfer Volume
# - Response Times

Fehlerbehebung

Starten/Stoppen funktioniert nicht

Lösung 1: Service Status Analysis

# Detaillierte Service Informationen
sudo systemctl status sccservice -l --no-pager

# Service Logs der letzten 50 Zeilen
sudo journalctl -u sccservice -n 50 --no-pager

# Falls Service failed:
sudo systemctl reset-failed sccservice
sudo systemctl daemon-reload
sudo systemctl start sccservice

# Falls immer noch Probleme:
sudo systemctl stop sccservice
sudo systemctl disable sccservice
sudo systemctl enable sccservice
sudo systemctl start sccservice

Lösung 2: Port Konflikte beheben

# Port Belegung prüfen
sudo ss -tulpn | grep :8443
sudo ss -tulpn | grep :8080

# Prozess identifizieren der Port blockiert
sudo lsof -i :8443

# Falls anderer Prozess Port belegt:
# Option 1: Anderen Prozess stoppen
sudo kill -9 <PID>

# Option 2: Cloud Connector Port ändern
sudo vi /opt/sap/scc/scc_config/com.sap.scc.web.xml
# <port>8443</port> zu <port>8444</port> ändern

# Service neu starten
sudo systemctl restart sccservice

# Neuen Port testen
curl -k https://localhost:8444/sap/public/ping

Lösung 3: JVM/Memory Issues

# Java Version und Installation prüfen
java -version
which java
echo $JAVA_HOME

# Für Cloud Connector 2.15+ wird JVM 17 benötigt:
# SUSE:
sudo zypper install java-17-openjdk java-17-openjdk-devel

# RHEL/CentOS:
sudo yum install java-17-openjdk java-17-openjdk-devel

# JAVA_HOME setzen (falls nötig)
export JAVA_HOME=/usr/lib64/jvm/java-17-openjdk
echo 'export JAVA_HOME=/usr/lib64/jvm/java-17-openjdk' >> ~/.bashrc

# Memory Settings überprüfen/anpassen
sudo vi /opt/sap/scc/go.sh
# Suchen nach -Xmx Parameter und erhöhen falls nötig
# z.B. -Xmx2g für 2GB Heap

sudo systemctl restart sccservice

Connection zu BTP nicht möglich

Lösung 1: Firewall/Proxy Configuration

# Internet Connectivity Tests
curl -I https://api.cf.eu10.hana.ondemand.com
ping api.cf.eu10.hana.ondemand.com

# DNS Resolution Test
nslookup api.cf.eu10.hana.ondemand.com

# Corporate Firewall Ports prüfen:
# - Ausgehend Port 443 (HTTPS) zu SAP BTP
# - Ausgehend Port 8443 (für manche Services)

# Proxy Configuration via Admin UI:
# Configuration → On Premise → Proxy Settings
# - Use Proxy: Yes
# - Host: proxy.company.com
# - Port: 8080
# - Authentication: Basic/NTLM
# - Username: domain\username
# - Password: <proxy-password>
# - Non Proxy Hosts: localhost,127.0.0.1,*.company.internal

Lösung 2: Certificate Issues

# SSL Certificate Chain prüfen
openssl s_client -connect api.cf.eu10.hana.ondemand.com:443 -showcerts

# Corporate Root CA importieren via Admin UI:
# Administrator → Certificate → Trusted Root CAs
# - Import Certificate: company-root-ca.pem
# - Restart Service nach Import

# System Certificate Status prüfen
# Administrator → Certificate → System Certificate
# - Valid From/Until prüfen
# - Subject DN verifizieren

Backend System nicht erreichbar

Lösung 1: System Configuration Validation

# Network Connectivity vom Cloud Connector Server
ping <backend-sap-system>
telnet <backend-sap-system> <port>

# Beispiel für SAP System Tests:
telnet sapserver01 8000  # HTTP
telnet sapserver01 50000 # Java HTTP
telnet sapserver01 3300  # Gateway/RFC

# DNS Resolution
nslookup <backend-sap-system>

# Routing Check
traceroute <backend-sap-system>

Lösung 2: Access Control Validation

# Via Admin UI prüfen:
# Cloud To On-Premise → Access Control
# 
# Verify für jede Resource:
# 1. URL Path: Exakt wie von BTP-App verwendet
#    - Häufige Patterns:
#      * /sap/bc/rest/*
#      * /sap/opu/odata/*
#      * /sap/bc/webdynpro/*
#      * /
# 
# 2. Access Policy: "Path and all sub-paths"
# 3. Authentication: Passend zu BTP Destination
# 4. Status: Enabled (grüner Haken)
# 5. System Status: Available (grüner Punkt)
#
# Test via "Check Availability" Button

High Availability Issues

Lösung 1: HA Synchronization Problems

# HA Status prüfen via Admin UI
# High Availability → Overview
# - Master Status: Active
# - Shadow Status: Synchronized
# - Last Sync: Recent timestamp

# Bei Sync-Problemen:
# 1. Network Connectivity zwischen Master/Shadow
ping <shadow-host>
telnet <shadow-host> 8443

# 2. Certificate Sync prüfen
# Beide Instanzen müssen identische Certificates haben

# 3. Manual Sync triggern
# High Availability → Force Synchronization

# 4. Log Files analysieren
tail -f /opt/sap/scc/log/ljs_trace.log | grep -i "sync\|shadow\|master"

Codeschnipsel

Version und Status Informationen

# Cloud Connector Version anzeigen
sudo cat /opt/sap/scc/version.properties

# Alternative via JAR Manifest
sudo unzip -p /opt/sap/scc/configurator.jar META-INF/MANIFEST.MF | grep -i version

# Service Status detailliert
sudo systemctl status sccservice --no-pager -l

# Aktive Connections anzeigen
sudo ss -tulpn | grep java

Backup und Recovery

# Vollständiges Backup erstellen
sudo tar -czf /backup/scc_backup_$(date +%Y%m%d_%H%M).tar.gz \
  /opt/sap/scc/scc_config \
  /opt/sap/scc/version.properties \
  /opt/sap/scc/props.ini

# Configuration Export via Admin UI (automatisiert)
curl -k -u Administrator:<password> \
  -X GET "https://localhost:8443/admin/export" \
  -o scc_config_$(date +%Y%m%d).zip

# Backup wiederherstellen
sudo systemctl stop sccservice
sudo tar -xzf /backup/scc_backup_YYYYMMDD_HHMM.tar.gz -C /
sudo systemctl start sccservice

Monitoring und Alerting

# Health Check Script
#!/bin/bash
# SCC Health Monitor

# Service Status
if ! systemctl is-active --quiet sccservice; then
    echo "CRITICAL: SCC Service not running"
    exit 2
fi

# Admin UI Accessibility
if ! curl -k -s --max-time 10 https://localhost:8443/sap/public/ping >/dev/null; then
    echo "WARNING: Admin UI not accessible"
    exit 1
fi

# Log Error Check (last 100 lines)
ERROR_COUNT=$(tail -100 /opt/sap/scc/log/ljs_trace.log | grep -c "ERROR\|FATAL")
if [ $ERROR_COUNT -gt 5 ]; then
    echo "WARNING: $ERROR_COUNT errors in recent logs"
    exit 1
fi

echo "OK: SCC running normally"
exit 0

Certificate Management

# System Certificate Details anzeigen
sudo openssl x509 -in /opt/sap/scc/scc_config/keystore -text -noout

# Certificate Expiration Check
sudo openssl x509 -in /opt/sap/scc/scc_config/certificate.crt \
  -checkend 2592000 -noout
# Prüft ob Certificate in 30 Tagen abläuft

# Root CA Certificate importieren (Command Line)
sudo cp company-root-ca.crt /opt/sap/scc/scc_config/trusted_cas/
sudo systemctl restart sccservice

Log Analysis

# Connection Errors analysieren
grep -i "connection.*failed\|timeout" /opt/sap/scc/log/ljs_trace.log | tail -10

# HTTP Access Logs auswerten
awk '{print $7}' /opt/sap/scc/log/http_access_$(date +%Y%m%d).log | sort | uniq -c | sort -nr

# Top 10 häufigste Fehler
grep "ERROR" /opt/sap/scc/log/ljs_trace.log | cut -d' ' -f4- | sort | uniq -c | sort -nr | head -10

# Performance Analysis
grep "response time" /opt/sap/scc/log/ljs_trace.log | awk '{print $NF}' | sort -n | tail -20

Nützliche Links

SAP Dokumentation

SAP Notes (Support Portal)

Community und Support

Security und Best Practices

Troubleshooting Ressourcen

Tools und Utilities