{"ref":"artifact:sap-cloud-connector","page":"/artifacts/sap-cloud-connector","json":"/artifacts/sap-cloud-connector.json","generated":"2026-10-27","drafted_with_ai":true,"entity":{"id":"sap-cloud-connector","name":"Cloud Connector","artifact_type":"app","ecosystem":"btp","serves_ecosystems":["abap"],"domain":"integration-and-messaging","secondary_domains":["security-and-compliance"],"origin_ring":"sap-official","description":{"one_line":"SAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.","short":"SAP's on-premises agent linking SAP BTP to customer-network systems","what_it_solves":"A cloud application on SAP BTP cannot reach an ABAP system or a database inside a company network, and opening the firewall to it is what nobody wants to do. The Cloud Connector is installed inside that network as an agent and connects outwards to a BTP subaccount, so no inbound firewall rule is needed; each system it lets cloud applications reach is an access control entry, per protocol, for HTTP, RFC, LDAP or TCP. Cloud applications reach it through the [SAP Connectivity service](artifact:btp-connectivity) on Cloud Foundry, or the connectivity proxy on Kubernetes and Kyma, and it can forward the identity of the cloud user to the on-premises system. It runs on a full JDK, as a portable version meant for non-productive use or an installer version that runs as a Windows service or Linux daemon; it keeps a digitally signed audit log of access and configuration changes and can be run in a high-availability setup. It cannot be set up in SAP SaaS solutions, [SAP S/4HANA Cloud public edition](external:sap-s4hana-cloud-public-edition) or third-party PaaS offerings; it belongs in a network operated like an on-premises one, including IaaS hosting."},"links":{"docs":"https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector"},"source_available":false,"requires":[{"ref":"external:jdk","for":"The Cloud Connector runs on a full JDK installed on its host; a lightweight JRE is not enough, and the supported JDKs are SAP JVM 8, Oracle JDK 8 and SapMachine versions matched to Cloud Connector versions.","sources":[{"url":"https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/prerequisites","title":"SAP Help Portal — SAP BTP Connectivity: Prerequisites","checked":"2026-09-15","quote":"A full JDK must be installed. Lightweight JRE installations are not sufficient."}]}],"connects":[{"ref":"artifact:btp-connectivity","kind":"data","direction":"outbound","for":"Registering with the Connectivity service of a subaccount and, with it, providing the tunnel through which applications on SAP BTP reach systems in the on-premise network. The connector works as a reverse invoke proxy, and no port is exposed on the on-premise side.","sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-connectivity/2701fd820fe6e09d653dde223e7aed63db79325f/docs/1-connectivity-documentation/connectivity-service-0edfc0b.md","title":"Connectivity Service — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity)","checked":"2026-09-19","quote":"The Cloud Connector is connected to \\(registered in\\) the SAP Connectivity service and ready to serve."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-connectivity/2701fd820fe6e09d653dde223e7aed63db79325f/docs/1-connectivity-documentation/connectivity-service-bd2d4f4.md","title":"Connectivity Service — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity)","checked":"2026-09-19","quote":"Provides, together with the Cloud Connector, a secure tunnel from your on-premise network to applications on SAP BTP, while you keep full control and auditability of what is exposed to the cloud. This way, no network ports need to be exposed on the on-premise side."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-connectivity/2701fd820fe6e09d653dde223e7aed63db79325f/docs/1-connectivity-documentation/cloud-connector-e6c7616.md","title":"Cloud Connector — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity)","checked":"2026-09-19","quote":"Acts as a reverse invoke proxy between the on-premises network and SAP BTP."}]},{"ref":"artifact:sap-hana","kind":"data","for":"Connecting on-premises database or BI tools to [SAP HANA](artifact:sap-hana) databases running on SAP BTP.","sources":[{"url":"https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector","title":"https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector","checked":"2026-10-18","quote":"You can use the Cloud Connector to connect on-premises databases or BI tools to SAP HANA databases in the cloud."}]}],"provides":[{"capability":"capability:rfc-connectivity","what_it_does":"Exposes an on-premises ABAP system to BTP applications over RFC, among its other protocols, through an access control entry for that system.","sources":[{"url":"https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector","title":"SAP Help Portal — SAP BTP Connectivity: Cloud Connector","checked":"2026-09-15","quote":"The Cloud Connector supports HTTP as well as additional protocols. For example, the RFC protocol supports native access to ABAP systems by invoking function modules."},{"url":"https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/configure-access-control","title":"SAP Help Portal — SAP BTP Connectivity: Configure Access Control","checked":"2026-09-15","quote":"To allow your cloud applications to access a certain backend system on the intranet, you must specify this system in the Cloud Connector ."}]},{"capability":"capability:authentication","what_it_does":"Forwards the identity of the cloud user to the on-premises system, so the user reaches it without a password of its own; principal propagation from cloud to on-premise runs through it. It is one of three authentication types it offers towards an internal system, beside basic authentication and technical user propagation, and the calling application's destination configuration decides which of them is used.","facets":[{"key":"propagates_user","value":true,"source":{"url":"https://raw.githubusercontent.com/SAP-docs/btp-connectivity/main/docs/1-connectivity-documentation/authenticating-users-against-on-premises-systems-b643fbe.md","title":"Authenticating Users against On-Premises Systems — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity)","checked":"2026-10-15","quote":"Currently, the Cloud Connector supports **basic authentication**, **principal propagation**, and **technical user propagation** as user authentication types towards internal systems."}}],"sources":[{"url":"https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector","title":"SAP Help Portal — SAP BTP Connectivity: Cloud Connector","checked":"2026-09-15","quote":"The Cloud Connector lets you propagate the identity of cloud users to on-premises systems in a secure way."},{"url":"https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/principal-propagation","title":"SAP Help Portal — SAP BTP Connectivity: Principal Propagation","checked":"2026-09-15","quote":"This scenario requires the Cloud Connector to connect to your on-premise system."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-connectivity/main/docs/1-connectivity-documentation/authenticating-users-against-on-premises-systems-b643fbe.md","title":"Authenticating Users against On-Premises Systems — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity)","checked":"2026-10-15","quote":"The destination configuration of the used cloud application defines which of these types is used for the actual communication to an on-premises system through the Cloud Connector"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-connectivity/main/docs/1-connectivity-documentation/authenticating-users-against-on-premises-systems-b643fbe.md","title":"Authenticating Users against On-Premises Systems — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity)","checked":"2026-10-15","quote":"To use **principal propagation** or **technical user propagation**, you must explicitly configure trust to those cloud entities from which user tokens are accepted as valid."}]}],"maintainers":["actor:sap"],"drafted_with_ai":true,"provenance":{"discovered_via":[{"source":"source:curator"}],"first_seen":"2026-09-15"},"history":[{"date":"2026-09-19","field":"connects","from":null,"to":"btp-connectivity","reason":"The Connectivity service required the Cloud Connector, and nothing said which of the two opens the connection. SAP's documentation does: the connector registers with the service."},{"date":"2026-10-15","field":"provides[capability:authentication]","from":"propagation alone","to":"propagation among three types, and what selects it","reason":"The edge read as though the connector propagated the user by itself. SAP's own page names three authentication types towards an internal system and says the calling application's destination configuration picks one, and that trust to the cloud entities whose tokens are accepted has to be configured explicitly. The property the BTP door compares on rests on the same sentence."}]},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"unknown","evidence":"no release data"},{"label":"Continuity","tier":"unknown","evidence":"no contributor data"},{"label":"Repository","tier":"unknown","evidence":"no repository data"}],"compatibility":[{"label":"Declared for","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Survived majors","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Maintainer's CI","tier":"unknown","evidence":"no repository data"}],"practice":[{"label":"Tests","tier":"unknown","evidence":"not crawled"},{"label":"Docs","tier":"unknown","evidence":"docs link declared, tree not read"},{"label":"Changelog","tier":"unknown","evidence":"not crawled"}],"reach":[{"value":null,"unit":"installs/week"},{"value":null,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-26","npm":"not published under this name"},"edges":{"maintainers":[{"ref":"actor:sap","name":"SAP","json":"/actors/sap.json"}],"contributors":[],"explained_by":[{"ref":"content:connecting-sap-s-4hana-on-prem-directly-to-advanced-event-mesh-using-cloud-conne","name":"Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!","json":"/content/connecting-sap-s-4hana-on-prem-directly-to-advanced-event-mesh-using-cloud-conne.json"},{"ref":"content:set-up-the-sap-cloud-connector-integrating-on-premise-systems-with-cloud-service","name":"Set up the SAP Cloud Connector: Integrating On‑Premise Systems with Cloud Services","json":"/content/set-up-the-sap-cloud-connector-integrating-on-premise-systems-with-cloud-service.json"},{"ref":"content:why-sap-cloud-identity-matters-for-sap-task-center-it-s-about-trust-and-global-u","name":"Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User ID","json":"/content/why-sap-cloud-identity-matters-for-sap-task-center-it-s-about-trust-and-global-u.json"},{"ref":"content:how-to-use-sap-data-intelligence-with-sap-cloud-connector","name":"How to use SAP Data Intelligence with SAP Cloud Connector","json":"/content/how-to-use-sap-data-intelligence-with-sap-cloud-connector.json"},{"ref":"content:devtoberfest-2026-int-41-edge-integration-cell","name":"Edge Integration Cell - what's new?","json":"/content/devtoberfest-2026-int-41-edge-integration-cell.json"}],"alternative_to_this":[],"needed_by":[{"ref":"artifact:arc-mcp-xsuaa-auth","name":"@arc-mcp/xsuaa-auth","json":"/artifacts/arc-mcp-xsuaa-auth.json","requirement":"conditional","condition":"the propagated user reaches an on-premise system, for which the `./btp` entrypoint returns a connectivity proxy descriptor the caller applies"},{"ref":"artifact:sap-samples-btp-cloud-connector-setup-automation","name":"btp-cloud-connector-setup-automation","json":"/artifacts/sap-samples-btp-cloud-connector-setup-automation.json","requirement":"required"},{"ref":"artifact:cap-postgres-btp-connectivity","name":"cap-postgres-btp-connectivity","json":"/artifacts/cap-postgres-btp-connectivity.json"},{"ref":"artifact:xexer-abap-ccm","name":"Clean Core Measurement","json":"/artifacts/xexer-abap-ccm.json","requirement":"conditional","condition":"the Level A and Key User object numbers are extracted from an on-premise system"},{"ref":"artifact:btp-connectivity","name":"SAP Connectivity service","json":"/artifacts/btp-connectivity.json"},{"ref":"artifact:sap-samples-cloud-sample-webhooks","name":"SAP-samples/cloud-sample-webhooks","json":"/artifacts/sap-samples-cloud-sample-webhooks.json","requirement":"required"},{"ref":"artifact:b-tocs-scec","name":"scec","json":"/artifacts/b-tocs-scec.json","requirement":"conditional","role":"image-contents","condition":"the Cloud Connector template is built"},{"ref":"artifact:sap-samples-xsa-cap-migration-using-basextn","name":"xsa-cap-migration-using-basextn","json":"/artifacts/sap-samples-xsa-cap-migration-using-basextn.json"},{"ref":"artifact:sap-samples-xsc-cap-migration","name":"xsc-cap-migration","json":"/artifacts/sap-samples-xsc-cap-migration.json"},{"ref":"artifact:sap-samples-xsc-to-native-hana-cloud","name":"xsc-to-native-hana-cloud","json":"/artifacts/sap-samples-xsc-to-native-hana-cloud.json"},{"ref":"artifact:sap-samples-xsc-xsa-migration","name":"xsc-xsa-migration","json":"/artifacts/sap-samples-xsc-xsa-migration.json"}],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}