AppAppAn application you deploy and use, installed into a system or loaded into an application as a component, rather than a library whose functions you call.See every one →What this type is →by SAPby SAPPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →
Cloud Connector
SAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.
A cloud application on SAP BTP cannot reach an ABAP system or a database inside a company network, and opening the firewall to it is what nobody wants to do. The Cloud Connector is installed inside that network as an agent and connects outwards to a BTP subaccount, so no inbound firewall rule is needed; each system it lets cloud applications reach is an access control entry, per protocol, for HTTP, RFC, LDAP or TCP. Cloud applications reach it through the SAP Connectivity serviceSAP Connectivity serviceThe proxy through which a cloud application reaches an on-premise system behind a Cloud Connector — HTTP, RFC and raw sockets — without that system being exposed.sap official, btp on Cloud Foundry, or the connectivity proxy on Kubernetes and Kyma, and it can forward the identity of the cloud user to the on-premises system. It runs on a full JDK, as a portable version meant for non-productive use or an installer version that runs as a Windows service or Linux daemon; it keeps a digitally signed audit log of access and configuration changes and can be run in a high-availability setup. It cannot be set up in SAP SaaS solutions, SAP S/4HANA Cloud public editionSAP S/4HANA Cloud Public EditionSAP's cloud ERP, run by SAP as software as a service. For the things here it is the business system a side-by-side application on BTP reads from and writes to over its published OData APIs. or third-party PaaS offerings; it belongs in a network operated like an on-premises one, including IaaS hosting.
Where it sits
Lives in
Provides
RFC connectivityABAPBTPRFC connectivityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.AuthenticationABAPBTPAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.
Serves
Requires
Java Development Kit (JDK)Java Development Kit (JDK)The Cloud Connector runs on a full JDK installed on its host; a lightweight JRE is not enough, and the supported JDKs are SAP JVM 8, Oracle JDK 8 and SapMachine versions matched to Cloud Connector versions.
Designs
Agentic AI & AI AgentsAgentic AI & AI Agentsreach into on-premise systemsIntegrating and Extending JouleIntegrating and Extending Joulesecure tunnel from the BTP subaccount to the S/4HANA Cloud Private Edition systemSAP Document AISAP Document AIreach into on-premise systems
Who is behind it
SAPSAPMaintains this
In the atlas: maintains 137, wrote 14@SAPmaintainer
In the atlas: maintains 137, wrote 14@SAPmaintainer
What it declares
Every artifact
- Type
- App
- Origin
- By SAP
As an app
- Where it runs
- does not say
- Distributed through
- does not say
Connections
Group by17 of 17 connections
NodeRelationBasis
Functional
AuthenticationAuthenticationEstablishing who is calling and making that identity availableSAP and community, narrow by design
provides
stated
provides Authentication
Forwards the identity of the cloud user to the on-premises system, so the user reaches it without a password of its own; principal propagation from cloud to on-premise runs through it. It is one of three authentication types it offers towards an internal system, beside basic authentication and technical user propagation, and the calling application's destination configuration decides which of them is used.
“The Cloud Connector lets you propagate the identity of cloud users to on-premises systems in a secure way.”“This scenario requires the Cloud Connector to connect to your on-premise system.”“The destination configuration of the used cloud application defines which of these types is used for the actual communication to an on-premises system through the Cloud Connector”“To use **principal propagation** or **technical user propagation**, you must explicitly configure trust to those cloud entities from which user tokens are accepted as valid.”
Establishing who is calling and making that identity available
RFC connectivityRFC connectivityCalling ABAP function modules from outside the system over RFCSAP and community, narrow by design
provides
stated
provides RFC connectivity
Exposes an on-premises ABAP system to BTP applications over RFC, among its other protocols, through an access control entry for that system.
“The Cloud Connector supports HTTP as well as additional protocols. For example, the RFC protocol supports native access to ABAP systems by invoking function modules.”“To allow your cloud applications to access a certain backend system on the intranet, you must specify this system in the Cloud Connector .”
Calling ABAP function modules from outside the system over RFC
Technical
btp-cloud-connector-setup-automationbtp-cloud-connector-setup-automationYeoman generator for Cloud Connector mappings and BTP destinationssap official, btp
connected from
derived
connected from btp-cloud-connector-setup-automation
signs in with the login URL, user and password it prompts for, and adds the system mappings and resources for the XS Advanced system
“This Yeoman generator helps you connect to a SAP BTP Subaccount in Cloud connector, add necessary System Mappings and resources to work access XS Advanced Systems in SAP Business Application Studio (BAS), and generate files for import in SAP BTP Destinations.”“1. Cloud Connector Login Url
2. Cloud Connector Username
3. Cloud Connector Password
4. Cloud Connector Location ID”
Yeoman generator for Cloud Connector mappings and BTP destinations
SAP Connectivity serviceSAP Connectivity serviceProxy from cloud apps to on-premise systems via Cloud Connectorsap official, btp
connects to
stated
connects to SAP Connectivity service
Registering with the Connectivity service of a subaccount and, with it, providing the tunnel through which applications on SAP BTP reach systems in the on-premise network. The connector works as a reverse invoke proxy, and no port is exposed on the on-premise side.
“The Cloud Connector is connected to \(registered in\) the SAP Connectivity service and ready to serve.”“Provides, together with the Cloud Connector, a secure tunnel from your on-premise network to applications on SAP BTP, while you keep full control and auditability of what is exposed to the cloud. This way, no network ports need to be exposed on the on-premise side.”“Acts as a reverse invoke proxy between the on-premises network and SAP BTP.”
Proxy from cloud apps to on-premise systems via Cloud Connector
SAP HANASAP HANASAP's relational database platform, on-premise and in HANA Cloudsap official, btp
connects to
stated
connects to SAP HANA
Connecting on-premises database or BI tools to [SAP HANA](artifact:sap-hana) databases running on SAP BTP.
“You can use the Cloud Connector to connect on-premises databases or BI tools to SAP HANA databases in the cloud.”
SAP's relational database platform, on-premise and in HANA Cloud
btp-cloud-connector-setup-automationbtp-cloud-connector-setup-automationYeoman generator for Cloud Connector mappings and BTP destinationssap official, btp
needed by
derived
needed by btp-cloud-connector-setup-automation
the installation the generator signs in to and adds the system mappings and resources in
“4. Cloud Connector is installed”
Yeoman generator for Cloud Connector mappings and BTP destinations
SAP-samples/cloud-sample-webhooksSAP-samples/cloud-sample-webhooksJava servlets relaying Neo alerts on premise via Cloud Connectorsap official, btp
needed by
derived
needed by SAP-samples/cloud-sample-webhooks
the connection that carries the forwarded alert from the Neo environment to the on-premise backend system
“For the connection between SAP BTP, Neo environment and the on-premise backend system, you need to configure a cloud connector and a destination.”“You have downloaded and initially configured the Cloud Connector. For this tutorial, you can use the portable version.”
Java servlets relaying Neo alerts on premise via Cloud Connector
needs
stated
needs Java Development Kit (JDK)
The Cloud Connector runs on a full JDK installed on its host; a lightweight JRE is not enough, and the supported JDKs are SAP JVM 8, Oracle JDK 8 and SapMachine versions matched to Cloud Connector versions.
“A full JDK must be installed. Lightweight JRE installations are not sufficient.”
The Java runtime and tools a Java program is run with. For the things here, the full JDK an on-premises agent such as the Cloud Connector needs on its host.
@arc-mcp/xsuaa-auth@arc-mcp/xsuaa-authXSUAA authentication stack for an MCP server on SAP BTPindependent, btp
optionally used by
derived
optionally used by @arc-mcp/xsuaa-auth
the propagated user reaches an on-premise system, for which the `./btp` entrypoint returns a connectivity proxy descriptor the caller applies
the route from Cloud Foundry into the customer network that the returned `BTPProxyConfig` points at
“`createConnectivityProxy(cfg, locationId?, logger?)` | A `BTPProxyConfig` descriptor for the Cloud Connector connectivity proxy.”
XSUAA authentication stack for an MCP server on SAP BTP
Clean Core MeasurementClean Core MeasurementReports Clean Core ATC results per system as Level A to D KPIsindependent, abap
optionally used by
derived
optionally used by Clean Core Measurement
the Level A and Key User object numbers are extracted from an on-premise system
Reaching the function module in a connected on-premise system that returns the Level A and Key User object counts.
“Add the function modules to the Cloud Connector configuration, so the system can have access to you On-Prem system and the function module.”
Reports Clean Core ATC results per system as Level A to D KPIs
scecscecDocker Compose IoT edge stack that connects to SAP BTPindependent, btp
optionally used by
derived
optionally used by scec
the Cloud Connector template is built
The template builds its image from SAP's own Cloud Connector download, with the version chosen as a build argument.
“This is a template to build a SAP Cloud Connector Docker image from the original SAP sources: https://tools.eu1.hana.ondemand.com/#cloud.”
Docker Compose IoT edge stack that connects to SAP BTP
cap-postgres-btp-connectivitycap-postgres-btp-connectivityTunnels CAP Node.js to a private PostgreSQL via Cloud Connectorindependent, cap
used by
derived
used by cap-postgres-btp-connectivity
The private [PostgreSQL](external:postgresql) database is reached through a Cloud Connector TCP system mapping, whose Location ID and virtual host and port the package is configured with.
“Do not continue with the package configuration until the BTP subaccount is connected to Cloud Connector, the TCP mapping is reachable, and the virtual host, virtual port, and Location ID are known.”
Tunnels CAP Node.js to a private PostgreSQL via Cloud Connector
SAP Connectivity serviceSAP Connectivity serviceProxy from cloud apps to on-premise systems via Cloud Connectorsap official, btp
used by
derived
used by SAP Connectivity service
Only for targets inside an on-premises or comparable network: the Cloud Connector installed there is what the service reaches them through, and principal propagation from cloud to on-premise needs it too.
“This scenario requires the Cloud Connector to connect to your on-premise system.”
Proxy from cloud apps to on-premise systems via Cloud Connector
xsa-cap-migration-using-basextnxsa-cap-migration-using-basextnGuide to migrating XS Advanced database artefacts to CAPsap official, cap
used by
derived
used by xsa-cap-migration-using-basextn
reaching the on-premise XS Advanced source database from the BTP subaccount, with a TCP mapping to the HANA system behind a virtual host.
“Install the [SAP Cloud Connector](https://tools.hana.ondemand.com/#cloud) on your local system.”
Guide to migrating XS Advanced database artefacts to CAP
xsc-cap-migrationxsc-cap-migrationGuide to migrating XS Classic database artefacts to CAPsap official, cap
used by
derived
used by xsc-cap-migration
reaching the on-premise XS Classic source database and the target SAP HANA Cloud subaccount, with one connection set up per side.
“Install the [SAP Cloud Connector](https://tools.hana.ondemand.com/#cloud) on your local system.”
Guide to migrating XS Classic database artefacts to CAP
xsc-to-native-hana-cloudxsc-to-native-hana-cloudGuide converting XS Classic content to native SAP HANA Cloud artefactssap official, btp
used by
derived
used by xsc-to-native-hana-cloud
reaching the on-premise XS Classic source database and the target SAP HANA Cloud subaccount, with one connection set up per side.
“Install the [SAP Cloud Connector](https://tools.hana.ondemand.com/#cloud) on your local system.”
Guide converting XS Classic content to native SAP HANA Cloud artefacts
xsc-xsa-migrationxsc-xsa-migrationGuide to migrating XS Classic content to XS Advancedsap official, btp
used by
derived
used by xsc-xsa-migration
reaching both the source XS Classic database and the target XS Advanced database from the SAP BTP account, one connection per system.
“SAP Cloud Connector must be installed and configured to the SAP BTP Account with both the source XS Classic and target XS Advanced database systems”
Guide to migrating XS Classic content to XS Advanced
Download
Learn more
Readings
- Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Package Integration 1.4.0 for the Advanced Event Mesh Adapter adds official support for routing through SAP Cloud Connector, so an on-premise SAP S/4HANA system can produce events that SAP Advanced Event Mesh distributes without exposing a public endpoint. The same release changes the adapter's default acknowledgment mode from Automatic Immediate to Automatic On Exchange Complete, altering delivery semantics and error handling. The release notes warn against mixing proxy configurations within one tenant, since that causes unpredictable routing in complex hybrid tenants.sissyhae, published 2026-01-23sissyhae, SAP Community
- Set up the SAP Cloud Connector: Integrating On‑Premise Systems with Cloud ServicesSet up the SAP Cloud Connector: Integrating On‑Premise Systems with Cloud ServicesA step-by-step walkthrough of installing Cloud Connector, adding a subaccount, managing identity and trust certificates in STRUST, and mapping cloud-to-on-premise paths for an SAP HANA backend. It ends by creating a Destinations entry in SAP BTP with proxy type OnPremise and basic authentication, then testing it from SAP Business Application Studio.Thijn_Grilis, published 2025-06-12Thijn_Grilis, SAP Community
- Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25ivelinakiryakov, SAP Community
2 more
- How to use SAP Data Intelligence with SAP Cloud ConnectorHow to use SAP Data Intelligence with SAP Cloud ConnectorWalks through reaching an on-premise network from SAP Data Intelligence Cloud with Cloud Connector: installing the client, assigning the Cloud_Connector_Administrator role, registering the subaccount, and mapping on-premise systems as ABAP, HANA or HTTP back-ends in Data Intelligence's Connection Manager. For an ABAP back-end it names the function-module whitelist and the gateway port format RFC access needs, per SAP Note 2835207.Former Member, published 2021-03-16Former Member, SAP Community
- Edge Integration Cell - what's new?Edge Integration Cell - what's new?A Devtoberfest 2026 integration-track session (INT-41) on Edge Integration Cell, the runtime of SAP Integration Suite a customer runs on their own Kubernetes cluster while design, configuration and monitoring stay in the cloud tenant. It names what the customer has to provide — a supported Kubernetes platform, SAP HANA or PostgreSQL, Redis or Valkey as data store, a load balancer — then the Edge Lifecycle Management cockpit with its monthly rolling updates, the inbuilt and the external Cloud Connector options and why a DMZ placement calls for the second, and the adapters available only on Edge: RFC sender, NFS, OFTP2 and UNF. The demo deploys an OFTP-to-file flow to the Edge runtime and shows the same flow rejected when its runtime profile is switched to cloud, which is where the Integration flows edge holds.SAP DevelopersSAP Developers, YouTube — SAP Developers playlists
Others providing
RFC connectivityRFC connectivityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.SAP and community, narrow by design
- rfc-connectorrfc-connectorCalls abap2UI5 apps of another system over RFC: an ICF handler on the system the browser talks to forwards each roundtrip through an SM59 destination to the system the apps run on.community org, abapForwards abap2UI5 roundtrips to another system over RFC
- abap_fm_jsonabap_fm_jsonA JSON adapter that exposes ABAP function modules over HTTP: a handler class in an ICF service calls the module named in the URL and serialises its parameters to and from JSON.independent, abapJSON adapter exposing ABAP function modules over HTTP
- erpl-node-rfcerpl-node-rfcAn SAP RFC client for Node.js and TypeScript that implements the protocol in Rust and ships prebuilt for seven platforms behind node-rfc's API, so there is no SAP NW RFC SDK to download.independent, abapRFC client for Node.js and TypeScript without the NW RFC SDK
- ERPLERPLA DuckDB extension that reads SAP ERP tables, CDS views and BW queries from SQL over RFC, BICS and ODP, and can mount an SAP system as a DuckDB catalog to join against other data.independent, abapDuckDB extension reading SAP ERP tables, CDS views and BW queries
- ADELE RFC APIADELE RFC APIAn RFC-callable ABAP API for extracting SAP data, implemented for the Java-based ADELE tool, with an OLAP mode for group by and count.independent, abapRFC-callable ABAP API for SAP data extraction for ADELE
- srijan9864/zrfcreadsrijan9864/zrfcreadAn RFC-enabled ABAP function module that counts the entries of any table against dynamic where and join criteria.independent, abapAn RFC-enabled ABAP function module that counts the entries of any table against dynamic where and join criteria.
AuthenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design
- abap_jwt_generatorabap_jwt_generatorGenerates a signed JSON Web Token in ABAP from an explicit header and claim, a stored profile in table ZJWT_PROFILE, or a shared secret, signing through a PSE profile or with the secret.independent, abapGenerates signed JSON Web Tokens in ABAP
- abap-pwnedpasswordsabap-pwnedpasswordsChecks from ABAP whether a password appears in the Have I Been Pwned breached-password list, wrapping the Pwned Passwords API V3 in one call that answers with a boolean.independent, abapChecks passwords against Have I Been Pwned from ABAP
- abapOAuthAzureabapOAuthAzureAn Enhancement Spot OA2C_SPECIFICS implementation for Microsoft Azure, written against ABAP's OAuth 2.0 Client API, with a one-sentence README that leaves configuration to SAP's help page.independent, abapOA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAP
- abap2oauth2abap2oauth2An ABAP API for OAuth 2.0 authentication that registers a provider's client ID and secret as a named consumer and implements signature method 3, the one Google uses.independent, abapABAP API for OAuth 2.0 authentication
- abapNTLMabapNTLMAn HTTP NTLM client for ABAP, with the RC4, MD4 and DES algorithms the protocol needs implemented in ABAP, which its maintainer says seems to work only some of the time.independent, abapHTTP NTLM client for ABAP
- abap_cloud_platformabap_cloud_platformA TypeScript library of the Cloud Foundry calls that walk down to an ABAP service instance, read its SAP_ADT service key and log a user in, so a tool outside the system can reach it.independent, btpTypeScript library reaching ABAP service instances on Cloud Foundry
- decodesapsso2decodesapsso2A TypeScript library that decodes a MYSAPSSO2 logon ticket into its user, client, system and validity fields, and returns the signature without validating it, so it never shows a ticket is genuine.independent, abapTypeScript decoder for MYSAPSSO2 logon tickets
- abap-aws-sigv4abap-aws-sigv4Signs outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.independent, abapSigns outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
discovered viaAdded by hand
first seen in the atlas
ecosystem and domainbtp, integration-and-messaging
History in the atlas
- propagation among three types, and what selects it
- The Connectivity service required the Cloud Connector, and nothing said which of the two opens the connection. SAP's documentation does: the connector registers with the service.
- First seen.
For your agent
- Ref
artifact:sap-cloud-connector- JSON
- /artifacts/sap-cloud-connector.json
- MCP
- Connecting an agent