onedevatlasBeta
Browse the atlas
AllABAPBTPCAPUI5
AppApptypeAn application you deploy and use, installed into a system or loaded into an application as a component, rather than a library whose functions you call.See every one →What this type is →by SAPby SAPoriginPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →

Cloud Connector

SAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.

A cloud application on SAP BTP cannot reach an ABAP system or a database inside a company network, and opening the firewall to it is what nobody wants to do. The Cloud Connector is installed inside that network as an agent and connects outwards to a BTP subaccount, so no inbound firewall rule is needed; each system it lets cloud applications reach is an access control entry, per protocol, for HTTP, RFC, LDAP or TCP. Cloud applications reach it through the SAP Connectivity service on Cloud Foundry, or the connectivity proxy on Kubernetes and Kyma, and it can forward the identity of the cloud user to the on-premises system. It runs on a full JDK, as a portable version meant for non-productive use or an installer version that runs as a Windows service or Linux daemon; it keeps a digitally signed audit log of access and configuration changes and can be run in a high-availability setup. It cannot be set up in SAP SaaS solutions, SAP S/4HANA Cloud public edition or third-party PaaS offerings; it belongs in a network operated like an on-premises one, including IaaS hosting.

Docs

Where it sits

Lives in
BTP/BAIP
Provides
RFC connectivityBTPABAPRFC connectivitycapabilityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.AuthenticationBTPABAPAuthenticationcapabilityEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.
Serves
ABAP
Requires
Java Development Kit (JDK)Java Development Kit (JDK)outside the atlasThe Cloud Connector runs on a full JDK installed on its host; a lightweight JRE is not enough, and the supported JDKs are SAP JVM 8, Oracle JDK 8 and SapMachine versions matched to Cloud Connector versions.
Designs
Agentic AI & AI AgentsAgentic AI & AI Agentsreference architecturereach into on-premise systemsIntegrating and Extending JouleIntegrating and Extending Joulereference architecturesecure tunnel from the BTP subaccount to the S/4HANA Cloud Private Edition systemSAP Document AISAP Document AIreference architecturereach into on-premise systems

Who is behind it

SAPSAPOrganisationMaintains this
In the atlas: maintains 137, wrote 14@SAPmaintainer

What it declares

Every artifact

Type
App
Origin
By SAP

As an app

Where it runs
does not say
Distributed through
does not say

For authentication

Supports
Token with no userPasses the user onCorporate IdP behind it
property statedstated nonot said

Tasks this contributes to1Beta

Authentication1
Reach a system in the customer's own network as the signed-in userAn application on SAP BTP calls a system inside the customer's network and that system sees the person who signed in, not a shared service user.Shown workingthe tunnel, and the identity it forwards
What it does

Forwards the cloud user's identity to the internal system instead of a password of its own. Principal propagation is one of three authentication types it offers towards an internal system, beside basic authentication and technical user propagation.

Conditions

Trust has to be configured explicitly to the cloud entities whose user tokens are accepted as valid.; The calling application's destination configuration decides which of the three authentication types is used.

Remaining work

Install and register the connector, add the access control entry for the system, and set up the certificate and the subject pattern the internal system resolves a logon name from.

All options on the Authentication page →

Connections17

Download
Cloud Connector connectionsCloud ConnectorPROVIDES→ provides2provides stated Forwards the identity of the cloud user to the on-premises system, so the user reaches it without a password of its own; principal propagation from cloud to on-premise runs through it. It is one of three authentication types it offers towards an internal system, beside basic authentication and technical user propagation, and the calling application's destination configuration decides which of them is used. SAP Help Portal — SAP BTP Connectivity: Cloud Connector: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector SAP Help Portal — SAP BTP Connectivity: Principal Propagation: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/principal-propagation Authenticating Users against On-Premises Systems — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity): https://raw.githubusercontent.com/SAP-docs/btp-connectivity/main/docs/1-connectivity-documentation/authenticating-users-against-on-premises-systems-b643fbe.md Authenticating Users against On-Premises Systems — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity): https://raw.githubusercontent.com/SAP-docs/btp-connectivity/main/docs/1-connectivity-documentation/authenticating-users-against-on-premises-systems-b643fbe.mdAuthenticationprovides stated Exposes an on-premises ABAP system to BTP applications over RFC, among its other protocols, through an access control entry for that system. SAP Help Portal — SAP BTP Connectivity: Cloud Connector: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector SAP Help Portal — SAP BTP Connectivity: Configure Access Control: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/configure-access-controlRFC connectivityUSED BY← connected from1connected from derived signs in with the login URL, user and password it prompts for, and adds the system mappings and resources for the XS Advanced system Through: inverted from its connects edge SAP-samples/btp-cloud-connector-setup-automation — README, Description: https://github.com/SAP-samples/btp-cloud-connector-setup-automation SAP-samples/btp-cloud-connector-setup-automation — README, Usage: https://github.com/SAP-samples/btp-cloud-connector-setup-automationbtp-cloud-connector-setup-automation← needed by2needed by derived the installation the generator signs in to and adds the system mappings and resources in Through: inverted from its requires edge SAP-samples/btp-cloud-connector-setup-automation — README, Requirements: https://github.com/SAP-samples/btp-cloud-connector-setup-automationbtp-cloud-connector-setup-automationneeded by derived the connection that carries the forwarded alert from the Neo environment to the on-premise backend system Through: inverted from its requires edge SAP-samples/cloud-sample-webhooks — README, Description: https://github.com/SAP-samples/cloud-sample-webhooks SAP-samples/cloud-sample-webhooks — README, Requirements: https://github.com/SAP-samples/cloud-sample-webhooksSAP-samples/cloud-sample-webhooks← optionally used by3optionally used by derived If: the propagated user reaches an on-premise system, for which the `./btp` entrypoint returns a connectivity proxy descriptor the caller applies the route from Cloud Foundry into the customer network that the returned `BTPProxyConfig` points at Through: inverted from its requires edge arc-mcp/xsuaa-auth — README: https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md@arc-mcp/xsuaa-authifoptionally used by derived If: the Level A and Key User object numbers are extracted from an on-premise system Reaching the function module in a connected on-premise system that returns the Level A and Key User object counts. Through: inverted from its requires edge Xexer/abap-ccm — README, On-Prem: Cloud Connector: https://github.com/Xexer/abap-ccmClean Core Measurementifoptionally used by derived If: the Cloud Connector template is built The template builds its image from SAP's own Cloud Connector download, with the version chosen as a build argument. Through: inverted from its requires edge b-tocs/scec — SAP Cloud Connector Template: https://raw.githubusercontent.com/b-tocs/scec/main/templates/scc/README.mdscecif← used by6used by derived The private [PostgreSQL](external:postgresql) database is reached through a Cloud Connector TCP system mapping, whose Location ID and virtual host and port the package is configured with. Through: inverted from its requires edge cap-postgres-btp-connectivity — README: https://www.npmjs.com/package/cap-postgres-btp-connectivitycap-postgres-btp-connectivityused by derived Only for targets inside an on-premises or comparable network: the Cloud Connector installed there is what the service reaches them through, and principal propagation from cloud to on-premise needs it too. Through: inverted from its requires edge SAP Help Portal — SAP BTP Connectivity: Principal Propagation: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/principal-propagationSAP Connectivity serviceused by derived reaching the on-premise XS Advanced source database from the BTP subaccount, with a TCP mapping to the HANA system behind a virtual host. Through: inverted from its requires edge SAP-samples/xsa-cap-migration-using-basextn — README, Step-1: https://github.com/SAP-samples/xsa-cap-migration-using-basextnxsa-cap-migration-using-basextnused by derived reaching the on-premise XS Classic source database and the target SAP HANA Cloud subaccount, with one connection set up per side. Through: inverted from its requires edge SAP-samples/xsc-cap-migration — README, Step-1: https://github.com/SAP-samples/xsc-cap-migrationxsc-cap-migrationused by derived reaching the on-premise XS Classic source database and the target SAP HANA Cloud subaccount, with one connection set up per side. Through: inverted from its requires edge SAP-samples/xsc-to-native-hana-cloud — README, Step-1: https://github.com/SAP-samples/xsc-to-native-hana-cloudxsc-to-native-hana-cloudused by derived reaching both the source XS Classic database and the target XS Advanced database from the SAP BTP account, one connection per system. Through: inverted from its requires edge SAP-samples/xsc-xsa-migration — README, Requirements: https://github.com/SAP-samples/xsc-xsa-migrationxsc-xsa-migrationNEEDS→ connects to2connects to stated Registering with the Connectivity service of a subaccount and, with it, providing the tunnel through which applications on SAP BTP reach systems in the on-premise network. The connector works as a reverse invoke proxy, and no port is exposed on the on-premise side. Connectivity Service — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity): https://raw.githubusercontent.com/SAP-docs/btp-connectivity/2701fd820fe6e09d653dde223e7aed63db79325f/docs/1-connectivity-documentation/connectivity-service-0edfc0b.md Connectivity Service — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity): https://raw.githubusercontent.com/SAP-docs/btp-connectivity/2701fd820fe6e09d653dde223e7aed63db79325f/docs/1-connectivity-documentation/connectivity-service-bd2d4f4.md Cloud Connector — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity): https://raw.githubusercontent.com/SAP-docs/btp-connectivity/2701fd820fe6e09d653dde223e7aed63db79325f/docs/1-connectivity-documentation/cloud-connector-e6c7616.mdSAP Connectivity serviceconnects to stated Connecting on-premises database or BI tools to [SAP HANA](artifact:sap-hana) databases running on SAP BTP. https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connectorSAP HANA→ needs1needs stated The Cloud Connector runs on a full JDK installed on its host; a lightweight JRE is not enough, and the supported JDKs are SAP JVM 8, Oracle JDK 8 and SapMachine versions matched to Cloud Connector versions. SAP Help Portal — SAP BTP Connectivity: Prerequisites: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/prerequisitesJava Development Kit (JDK)

Learn more5

Readings
  1. Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!sissyhae, SAP Community
  2. Set up the SAP Cloud Connector: Integrating On‑Premise Systems with Cloud ServicesThijn_Grilis, SAP Community
  3. Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDivelinakiryakov, SAP Community
2 more
  1. How to use SAP Data Intelligence with SAP Cloud ConnectorFormer Member, SAP Community
  2. Edge Integration Cell - what's new?SAP Developers, YouTube — SAP Developers playlists

Others providing31

RFC connectivity
  1. rfc-connectorForwards abap2UI5 roundtrips to another system over RFCfrom ABAP
  2. SAP Connectivity serviceProxy from cloud apps to on-premise systems via Cloud Connectorfrom BTP/BAIP
  3. abap_fm_jsonJSON adapter exposing ABAP function modules over HTTPfrom ABAP
  4. erpl-node-rfcRFC client for Node.js and TypeScript without the NW RFC SDKfrom ABAP
  5. ERPLDuckDB extension reading SAP ERP tables, CDS views and BW queriesfrom ABAP
  6. open-rfcSDK-free TypeScript client for SAP synchronous RFC on Node.jsfrom CAP
  7. ADELE RFC APIRFC-callable ABAP API for SAP data extraction for ADELEfrom ABAP
  8. @sap/cds-rfcCalls to ABAP function modules over RFC from a CAP servicefrom CAP
  9. srijan9864/zrfcreadAn RFC-enabled ABAP function module that counts the entries of any table against dynamic where and join criteria.from ABAP
Authentication
  1. abap_jwt_generatorGenerates signed JSON Web Tokens in ABAPfrom ABAP
  2. @arc-mcp/xsuaa-authXSUAA authentication stack for an MCP server on SAP BTPfrom BTP/BAIP
  3. abap-pwnedpasswordsChecks passwords against Have I Been Pwned from ABAPfrom ABAP
  4. SAP Authorization and Trust Management serviceOAuth server issuing JWTs and holding scopes for BTP appsfrom BTP/BAIP
  5. Cloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenantfrom BTP/BAIP
  6. SAP Customer Identity and Access Management for B2CRegistration, login and consent for customer-facing sitesfrom BTP/BAIP
  7. OAuth 2.0 on SAP BTPOAuth 2.0 grant flows for applications and APIs in Neo regionsfrom BTP/BAIP
  8. com.sap.cds:cds-feature-identityOAuth2 token validation from XSUAA and SAP Cloud Identity Servicesfrom CAP
  9. com.sap.cds:cds-feature-xsuaaFormer XSUAA JWT validation for CAP Java, removed in CAP Java 3.0from CAP
  10. abapOAuthAzureOA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAPfrom ABAP
  11. abap2oauth2ABAP API for OAuth 2.0 authenticationfrom ABAP
  12. abapNTLMHTTP NTLM client for ABAPfrom ABAP
  13. abap_cloud_platformTypeScript library reaching ABAP service instances on Cloud Foundryfrom BTP/BAIP
  14. decodesapsso2TypeScript decoder for MYSAPSSO2 logon ticketsfrom ABAP
  15. @marianfoo/sap-mcp-authBrowser login and session module for SAP MCP serversfrom BTP/BAIP
  16. @sap/approuterSAP's Node.js application router in front of business applicationsfrom BTP/BAIP
  17. @sap/cdsCAP Node.js runtimefrom CAP
  18. @sap/xssecToken validation and security context for XSUAA and IASfrom CAP
  19. cds-azure-adAzure AD and Azure AD B2C authentication strategy for CAPfrom CAP
  20. @saptools/cf-xsuaaOAuth2 token fetcher for a Cloud Foundry app's XSUAA bindingfrom BTP/BAIP
  21. cds-common-jwt-supportJWT authentication for CAP without xsuaa or xssecfrom CAP
  22. abap-aws-sigv4Signs outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.from ABAP

Details

Sources1
Added by handdiscovered herechecked

Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.

Compatibility and provenance
discovered viaAdded by hand
first seen in the atlas
ecosystem and domainbtp, integration-and-messaging
History in the atlas3
  1. propagation among three types, and what selects it
  2. The Connectivity service required the Cloud Connector, and nothing said which of the two opens the connection. SAP's documentation does: the connector registers with the service.
  3. First seen.
For your agent
Ref
artifact:sap-cloud-connector
JSON
/artifacts/sap-cloud-connector.json
MCP
Connecting an agent