SAP Cloud Connector Setup

Setting up the SAP Cloud Connector (SCC) requires access to a server inside your corporate network, a SAP BTP account, and administrative access to both. Complete this setup once per environment (development, QA, production). Each environment should have its own SCC connecting its own BTP subaccount to its own on-premise SAP system.

System Requirements

The server running Cloud Connector must meet these requirements:

Operating system: Windows Server 2016+ or Linux (RHEL, SUSE, Ubuntu)
Java: SAP JVM (bundled with the installer) or a compatible JDK
RAM: Minimum 2 GB; 4 GB recommended for production
Disk: Minimum 5 GB for installation and logs
Network: Outbound internet access on port 443 to *.hana.ondemand.com
No inbound port changes required on your corporate firewall

Step 1: Download the Installer

Download the Cloud Connector installer from the SAP Software Downloads Center (support.sap.com). Search for "Cloud Connector". Download the version matching your operating system. The current major version at the time of this writing is 2.x. Always use the latest patch level for security fixes.

Step 2: Install Cloud Connector

On Windows: Run the .exe installer as Administrator. Accept the default installation directory or choose your own. The installer registers SCC as a Windows service that starts automatically on server restart.

On Linux: Unpack the .tar.gz file, navigate to the extracted directory, and run the install.sh script as root. SCC registers as a systemd service.

After installation, SCC starts automatically and listens on port 8443 for its administration UI.

Step 3: Access the Administration UI

Open a browser on the SCC server (or from a machine that can reach the server on port 8443):

URL: https://<scc-server-hostname>:8443/

Default credentials on first login:
  Username: Administrator
  Password: manage

Change the password immediately after first login.
This password protects your entire integration landscape.

Step 4: Connect SCC to Your BTP Subaccount

In the SCC administration UI, go to Connector → Add Subaccount. Fill in these details from your SAP BTP cockpit:

Region – The BTP region where your subaccount lives (e.g., eu10, us10)
Subaccount – Your BTP subaccount ID (found in BTP cockpit under subaccount overview)
Display Name – A friendly label (e.g., "CPI DEV Tenant")
Subaccount User – A BTP user with the Cloud Connector Administrator role
Password – The BTP user's password

Click Save. SCC immediately tries to establish the tunnel. If successful, the status shows a green "Connected" indicator. If it fails, check that port 443 outbound is allowed to SAP's cloud URLs.

Step 5: Add On-Premise Systems

Navigate to Cloud To On-Premise → Access Control. Click the plus (+) button to add a system mapping:

Back-end Type: ABAP System (for SAP ERP/S4 connections)
             : SAP HANA (for HANA database connections)
             : Other SAP System (for non-ABAP SAP systems)

Protocol:     HTTPS (for OData, REST, SOAP)
              RFC/ABAP Wizard (for RFC/BAPI calls)

Internal Host: erp-prod.internal   ← real internal hostname
Internal Port: 443                 ← real port

Virtual Host:  erp-prod-virtual    ← the name CPI will use
Virtual Port:  443                 ← port CPI will call

Principal Type: None (no user propagation)
               : X.509 Certificate (for principal propagation)

Step 6: Configure the Access Control List

After adding the system, click the system entry to open its resources list. Add the URL paths that CPI is allowed to access:

URL Path: /sap/opu/odata/    (allows all OData service calls)
Access Policy: Path And All Sub-Paths

URL Path: /sap/bc/soap/      (allows SOAP web service calls)
Access Policy: Path And All Sub-Paths

Be as specific as possible. If CPI only needs to call one specific OData service, restrict the path to that service path. Broad wildcards like "/" (allow everything) defeat the purpose of access control.

Step 7: Verify in BTP Cockpit

Log in to your BTP cockpit. Navigate to your subaccount and find the Cloud Connectors section. You should see your SCC listed as Connected with the virtual host mappings you configured. CPI iFlows can now use the virtual hostname to call your on-premise SAP system.

Step 8: Test from CPI

Build a simple test iFlow that calls the on-premise SAP OData service through the Cloud Connector. Use the virtual host in the receiver adapter URL:

Receiver Adapter: HTTP or OData
Address: https://erp-prod-virtual:443/sap/opu/odata/sap/API_SALES_ORDER_SRV/$metadata

Proxy Type: On-Premise (this setting tells CPI to route through Cloud Connector)

Set the Proxy Type to On-Premise in the receiver adapter settings. This is the critical setting that routes the CPI call through the Cloud Connector tunnel instead of the open internet.

Common Setup Errors

Connection refused / tunnel not connecting: Check that port 443 outbound is allowed to *.hana.ondemand.com from the SCC server
Virtual host not found: Verify the virtual host name in CPI matches exactly what you configured in SCC (case-sensitive)
403 Forbidden from SAP: The URL path is not on the SCC access control list — add the specific path
Authentication failure: Verify the BTP subaccount credentials used to connect SCC are still valid and the user has the Cloud Connector Administrator role

Shadow Instance for High Availability

Install a second SCC on a different server. In the second SCC's administration UI, choose Shadow Mode during initial setup and point it to the same BTP subaccount. The shadow automatically syncs configuration from the master. When the master goes down, BTP promotes the shadow to master automatically — no manual intervention, no downtime for dependent iFlows.

Previous lesson

Back to course

Next lesson