58 · SAP Cloud Connector

Configure Cloud Connector, expose an on-premise system as a virtual host, and call it from CAP via the Destination Service.

Episode 58 — Connectivity Service & Cloud Connector

What you'll learn

• What SAP Cloud Connector does
• Installing and configuring Cloud Connector
• Exposing on-premise systems to BTP
• Connectivity Service binding and proxy settings
• Testing the on-premise connection from CAP

Why this matters

Most enterprises have critical data in on-premise ERP systems. Cloud Connector is the secure tunnel that lets CAP call those systems without opening firewall ports or installing a DMZ proxy.

Architecture

BTP (Cloud Foundry)
│
│  CAP app → Connectivity Service → SAP Cloud Connector tunnel
│
Firewall ────────────────────────────────────────────────────
│
On-Premise Network
│
├── SAP Cloud Connector (reverse proxy, installed on-prem)
│      │
│      └── S/4HANA, ECC, SAP Gateway, any HTTP/RFC system

The connection is initiated from on-premise to BTP — no inbound firewall rule needed.

Installing Cloud Connector

1. Download from SAP Tool Center (Java-based, runs on any OS)
2. ./go.sh (Linux) or cloudconnector.exe (Windows)
3. Access admin UI: https://localhost:8443
4. Initial login: Administrator / manage (change immediately!)
5. Connect to BTP:
6. Region: your BTP region (e.g., cf.eu10.hana.ondemand.com)
7. Subaccount ID: from BTP Cockpit Overview
8. Logon email + password (or certificate)

Exposing an on-prem system

In Cloud Connector admin UI → Access Control → Cloud to On-Premise → Add:

Back-end Type:    SAP ABAP System (or non-SAP)
Protocol:         HTTPS
Internal Host:    s4hana.corp.internal   (real hostname)
Internal Port:    443
Virtual Host:     s4hana-virtual          (alias BTP sees)
Virtual Port:     443
Check Internal Host: ✓  (tests connectivity)

Resources within the system to allow:

URL Path: /sap/opu/odata/          ← allow OData calls
Access Policy: Path And All Sub-Paths

Binding Connectivity Service

# mta.yaml
resources:
  - name: connectivity
    type: org.cloudfoundry.managed-service
    parameters:
      service:      connectivity
      service-plan: lite

modules:
  - name: bookshop-srv
    requires:
      - name: connectivity
      - name: destination-service

Destination for on-premise

In BTP Cockpit → Destinations:
Name:             S4HANA_ONPREM
Type:             HTTP
URL:              http://s4hana-virtual:443   ← virtual host from SCC
ProxyType:        OnPremise                   ← tells CAP to use Cloud Connector
Authentication:   BasicAuthentication (or OAuth2SAMLBearerAssertion)

CAP configuration

// .cdsrc.json
{
  "requires": {
    "S4HANA": {
      "[production]": {
        "kind":        "odata-v2",
        "destination": "S4HANA_ONPREM"   // BTP Destination with ProxyType: OnPremise
      }
    }
  }
}

CAP + Destination Service automatically route through Cloud Connector when ProxyType: OnPremise.

RFC connections

For BAPI/RFC calls (not OData):

Cloud Connector → Access Control → Cloud to On-Premise → Add RFC
Internal Host:   sapgw00.corp.internal
Internal Port:   3300
Virtual Host:    sapgw00-virtual
Virtual Port:    3300
Protocol:        RFC

// Destination for RFC
{
  "Name":        "S4HANA_RFC",
  "Type":        "RFC",
  "jco.client.r3name": "S4H",
  "jco.client.client": "100",
  "jco.destination.pool_capacity": "5"
}

Troubleshooting Cloud Connector

# Verify SCC is connected to BTP
# BTP Cockpit → Connectivity → Cloud Connectors → Should show your SCC as Connected

# Check SCC audit log
# SCC admin UI → Logs → Audit Log

# Test from BTP directly
cf ssh bookshop-srv
# Inside the container:
curl -v http://s4hana-virtual/sap/opu/odata/sap/...

Hands-on exercise

1. Install Cloud Connector locally (or in a VM)
2. Connect it to your BTP trial subaccount
3. Expose localhost:4004 (your other CAP app) as a virtual host
4. Create an OnPremise destination pointing to the virtual host
5. Call the virtual host from another CAP service

Checkpoint ✓

• [ ] SCC is installed on-premise; the tunnel is outbound from on-prem to BTP (no inbound firewall rule)
• [ ] Virtual host in SCC = the name BTP uses to refer to the on-prem system
• [ ] ProxyType: OnPremise in the BTP Destination routes the call through SCC
• [ ] RFC connections use a separate Destination Type: RFC

Sign in for progress tracking & Q&A →