CLEAN CORE ARCHITECTURAL GUIDE #16

SAP BTP Cloud Connector & Hybrid Connectivity Architecture

Author: Andrea Antonio Perrelli Scope: SAP BTP (Side-by-Side Tier-3) to S/4HANA (Private Cloud / On-Premise) Security: Reverse-Invoke TLS Tunnel & Principal Propagation

Zero-Trust Architecture: In Tier-3 Side-by-Side extensions, opening inbound corporate firewall ports or creating public IP routes to on-premise ERP databases violates enterprise security standards. The SAP Cloud Connector (SCC) acts as an on-premise proxy establishing a reverse-invoke, encrypted TLS tunnel outbound to SAP BTP.

Limited Time Deal

Master SAP BTP & Hybrid Clean Core Architecture

Get the Complete SAP Enterprise Architecture Suite: 40 Retina architecture diagrams, 61 production-grade code listings, and decision frameworks. Use code FLASH80 at checkout for 80% OFF.

📦 Get Enterprise Suite (€9.80 with FLASH80) 📚 Paperback on Amazon ($19.99) 🌐 Launch Cloud Connector Architect

1. The Reverse-Invoke Tunnel Explained

Traditional cloud integrations require corporate network engineers to open port 443 inbound in the corporate DMZ. The SAP Cloud Connector eliminates this risk through Reverse-Invoke:

The Cloud Connector daemon initiates an outbound connection over HTTPS (port 443) from inside the customer DMZ to the SAP BTP Connectivity Service endpoint.
Once established, this encrypted control tunnel remains persistently open.
When a BTP microservice (e.g., CAP Node.js service) calls an on-premise OData API via Destination ProxyType = OnPremise, the BTP Connectivity Service routes the request back through the existing established tunnel.
The internal ERP system sees the request as coming from the local Cloud Connector IP inside the local network.

2. Virtual Addressing & Topology Hiding

To prevent internal network topography (server names, private IP subnets) from being exposed to the cloud layer, the Cloud Connector enforces Virtual Host Mapping:

Attribute	Virtual Host (BTP Facing)	Internal Host (On-Premise ERP)
Host Name	`s4virtual.corp` (Arbitrary logical name)	`s4prod01.internal.corp.local` (Physical FQDN)
Port	`443` (Standard TLS port)	`44300` (ICM HTTPS port)
Exposure	Configured in BTP Destination URL	Never revealed outside the on-premise DMZ

3. Principal Propagation: Zero-Trust Identity Forwarding

In production Clean Core architectures, side-by-side applications must never use a single hardcoded "technical user" (such as RFC_USER) to read or write business documents. Doing so destroys audit trails and bypasses individual PFCG role authorizations.

The Principal Propagation Flow:

End user logs into the BTP Fiori application; identity is authenticated by SAP Cloud Identity Services (IAS) producing a signed JWT.
The BTP microservice forwards the JWT to the BTP Destination Service.
The BTP Connectivity Service passes the user identity header to the Cloud Connector.
The Cloud Connector acts as a trusted local CA, issuing a short-lived X.509 client certificate signed with the user's email/login ID.
S/4HANA ICM receives the TLS client certificate, evaluates transaction CERTRULE, and maps the user to their local ABAP user (SY-UNAME).

4. Resource Whitelisting

Even after a system is mapped, the Cloud Connector blocks all traffic by default until individual URL paths are explicitly whitelisted:

Exposed URL Path	Access Mode	Typical Use Case
`/sap/opu/odata/sap/`	Path and all sub-paths	SAP Gateway OData V2/V4 service consumption for BTP CAP apps.
`/sap/bc/srt/rfc/sap/`	Path and all sub-paths	SOAP web service and Tier-2 RFC wrapper invocation.
`/sap/bc/bsp/sap/`	Exact path only	Fiori tile launchpad catalog integration.

5. Troubleshooting Common Connectivity Errors

HTTP Status / Error	Root Cause	Production Resolution
`403 Forbidden - Resource not accessible`	URL path is not whitelisted in the Cloud Connector.	Open Cloud Connector Admin > Cloud To On-Premise > Add path with Path and all sub-paths.
`502 Bad Gateway - Connection refused`	Virtual host in BTP Destination does not match Cloud Connector mapping.	Ensure Destination `URL=https://<virtual-host>:<port>` exactly matches the virtual mapping.
`401 Unauthorized - Certificate untrusted`	S/4HANA does not trust the Cloud Connector CA certificate.	Export the SCC System Certificate and import into S/4HANA transaction `STRUST` under SSL Server Standard.

Recommended Clean Core Developer Tools

Explore free client-side interactive utilities to accelerate your S/4HANA migration:

🌐 Cloud Connector Architect 🚀 BTP Destination Generator ☁️ BTP CAP Service Builder 🧭 Decision Wizard & ADR