Lesson 4 of 5
Planning security and connectivity
10 min
Listen to this lesson
A side-by-side extension crosses a boundary every time it calls SAP S/4HANA. Planning that crossing is part of the design, not an afterthought for go-live week. For the fleet app, four questions had to be answered: who are the users and where do they sign in, which identity does the app use when it calls SAP S/4HANA, how does the request reach a system that is not on the internet, and what exactly is that identity allowed to do there.
Users and roles in the app
Contoso's subaccounts trust its SAP Cloud Identity Services tenant, which delegates to the corporate directory for employees. Fleet desk staff are grouped in the identity provider, and the groups are mapped to role collections in each subaccount. The app declares its own roles (for the fleet app: a fleet agent role and a fleet supervisor role). Course sap-btp-204 covers this in depth; at design time you need the list of roles, who gets them, and whether access must also be restricted by data, such as by customer.
Which identity calls SAP S/4HANA?
There are two broad choices. With a technical user, the app calls SAP S/4HANA as one communication user with tightly limited authorizations; the app itself decides what each of its users may see. With principal propagation, the signed-in user's identity is forwarded so that SAP S/4HANA checks that person's own authorizations and records them in change documents. Read-only lookups for external users usually use a technical user. Writes on behalf of internal users, where SAP S/4HANA must know who made the change, are good candidates for principal propagation.
- Does SAP S/4HANA need to know which person made the change (audit, change documents, user-level authorization)?Yes → principal propagation · No → continue
- Are the app's users unknown to SAP S/4HANA, such as external customers?Yes → technical communication user with narrow roles · No → continue
- Is the call a background or system-to-system job?Yes → technical user (for example OAuth client credentials or basic) · No → review with security
Reaching a private system
CMD, CMQ and CMP run in SAP's private cloud under RISE and are not exposed to the internet. The usual path from SAP BTP is a destination with proxy type OnPremise, routed through the Cloud Connector, which opens an outbound tunnel to the subaccount and only lets through the hosts and URL paths it has been told to expose. Under RISE, how the Cloud Connector is installed and who operates it is agreed with SAP; check your contract and the RISE connectivity options. The destination lives in each subaccount, so cmc-ext-test points to CMQ client 100 and cmc-ext-prod to CMP. Course sap-btp-203 covers destinations and the Cloud Connector in detail.
| Design decision | Contoso fleet app choice | Where it is configured |
|---|---|---|
| User sign-in | SAP Cloud Identity Services, corporate IdP for employees; separate user store for Great Lakes Fleet Services contacts | Subaccount trust configuration |
| App authorization | Fleet agent and fleet supervisor roles; customer-level restriction | App security descriptor, role collections |
| Identity toward SAP S/4HANA | Technical communication user for reads | Destination and SAP S/4HANA user and roles |
| Network path | Destination with OnPremise proxy through the Cloud Connector | Destination; Cloud Connector access control |
| What the API user may do | Read sales orders and business partners for sales area 1710 / 10 / 00 only | SAP S/4HANA roles (PFCG) |
The fleet app's security and connectivity plan.
What would you do?
To save time, a developer suggests that the fleet app call SAP S/4HANA with a dialog user that has the SAP_ALL profile, "just for test", and that the same destination be copied to production later. What should Priya and the security lead insist on?
- Plan four things: user sign-in, app roles, the identity used toward SAP S/4HANA, and the network path.
- Technical users suit external-user reads and system jobs; principal propagation suits writes that SAP S/4HANA must attribute to a person.
- Destinations are per subaccount; private systems are reached through the Cloud Connector with proxy type OnPremise.
- Under RISE, agree the connectivity setup and its operation with SAP.
- Apply least privilege in SAP S/4HANA roles and Cloud Connector path allowlists, in test as well as production.
Check your understanding · not graded
Lesson check
1. When is principal propagation the better choice for calls to SAP S/4HANA?
2. Which destination proxy type is used to reach a private SAP S/4HANA system through the Cloud Connector?
3. Why should the test subaccount's communication user have the same narrow roles as production?
4. Where are app users' role collections usually tied to people at Contoso?