SAP Community - SAP Integration Strategy

Edge Integration Cell – look and feel

2023-11-06T11:03:13+01:00

In my previous blog, I introduced the Edge Integration Cell, EIC in short, explaining what it is about and what the typical use cases are. It was written from a deploy & monitor perspective. This blog is to give you an idea how it looks like and what you can expect to see. It was written from an EIC management perspective.

It all starts, after installation and configuration (more of that in an additional blog), with an additional runtime, next to the native one.

Now, you entered the Edge Lifecycle Management part. It consists of mainly 3 parts

General – it gives you a brief high level overview of how the edge node is performing. It also provides quick links to the monitoring and logging part.

Diagnostics data – collect diagnostics to perform root cause analysis or to send to SAP for further analysis.
Deployments – make sure the EIC is deployed properly, check the configuration and perform necessary upgrades.

Within the general part, detailed monitoring and logging is available (see links in the screenshot above). When you click on the monitoring link, an additional screen will pop up, showing al lot of runtime data. The screenshots below just indicate a part of it, to give you an idea how it looks like and what you can expect.

Besides the monitoring part, there is also logging available. If you, e.g., need to understand if a specific interface reaches the EIC, you can find it here. The logging part provides a very very detailed view on the in and outs of your edge node.

SAP Integration Solution Advisory Methodology at a glance

2023-11-06T16:27:05+01:00

In dynamic and constant changing times enterprises need to become more agile and resilient. But for many, fragmented process landscapes prevent them from reacting quickly to change.

According to the results of an ESG study from 2022, 83% of organizations say improving enterprise integration is a top-5 business priority for the next 12-24 months and 96% say that the need for enterprise integration was identified by the office of the CIO. However, only 27% report that they have a mature enterprise integration practice in place. Apparently, most organizations struggle with defining and executing an enterprise integration strategy. This is where the SAP Integration Solution Advisory Methodology can help: T ake this quiz learn how to evolve your integration approach and turn it into integration excellence.

A holistic approach on enterprise integration

The SAP Integration Solution Advisory Methodology allows you to increase the integration maturity level in your organization. It offers an adaptable framework that includes integration use case patterns, reference architectures, and additional best practices for cloud and hybrid IT landscapes (see figure below).

SAP Integration Solution Advisory Methodology

Its scope isn’t limited to technical aspects, but also covers the organizational dimension of enterprise integration like setting up an Integration Center. A well-defined adoption path allows you to apply the methodology step by step. Furthermore, it is an open framework whose concepts you can apply to integration technologies from SAP or to the ones from other vendors.

The phases of the methodology

The SAP Integration Solution Advisory Methodology is structured into four phases which can be further be subdivided into steps. In the following we will take a quick look at the scope of each phase.

1. Assess your integration strategy

As a starting point an enterprise architect uses the SAP Integration Solution Advisory Methodology to identify the future building blocks for an organization’s integration architecture. For this purpose, the methodology offers a technology-agnostic scoping approach along integration domains, integration styles and integration use case patterns (see figure below).

Integration styles and integration use case patterns

As a result, you will have defined the functional scope of an organization’s future hybrid integration platform.

2. Design your hybrid integration platform

In this phase, an enterprise architect maps the results of the integration strategy assessment to the matching integration technologies based on customer context factors. In this context SAP Integration Suite plays a crucial role as it supports a broad scope of integration use case patterns and is open to integrate with both, solutions from SAP and third-parties (see figure below).

SAP Integration Suite

For each integration technology an integration architect specifies integration policies that describe when to use which technology. Whenever integration developers plan to implement an integration scenario, they can perform an interface assessment to determine the best fitting integration technology with the help of the concepts of this methodology.

3. Define integration best practices

Next, an integration architect defines architecture blueprints for the integration use case patterns that are relevant for their organization. For this purpose, you can use the SAP BTP reference architectures of SAP Discovery Center. These also include architectures for the integration use case patterns of the SAP Integration Solution Advisory Methodology (see screenshot below).

Reference architectures at SAP Discovery Center

Furthermore, the integration architect can define integration dos and don’ts, which integration developers can use as guardrails to implement integration scenarios in a consistent fashion. The integration architect also prepares development guidelines for applicable integration technologies, for instance by enriching vendor-specific best practices with customer-specific aspects such as naming conventions for integration artifacts.

4. Enable a practice of empowerment

The last phase focuses on non-technical but organizational aspects of enterprise integration. These include concepts for institutionalizing an Integration Center of Excellence, which allows decentralized project teams to develop integration scenarios in an agile way based on the defined integration strategy. This phase also covers best practices for integration governance and integration quality assurance across an organization.

Thereof the Integration Assessment capability within SAP Integration Suite is the best means for introducing integration governance (see screenshot below).

Technology proposal from Integration Assessment

Integration Assessment automates key parts of the SAP Integration Solution Advisory Methodology and can help you to modernize your integration approach by leveraging the latest integration technology recommendations from SAP.

How is your enterprise integration strategy doing?

If your answer is "I don't know" then we have something for you: Check out the integration maturity assessment which allows you to identify at which level of your organization stands with regards to enterprise integration.

Integration Maturity Assessment

Once you will have completed the assessment you will get useful tips which will guide you to get to the next level on jour journey toward integration excellence. You will also get access to exclusive resources such as an whitepaper about integration modernization and more. Check it out today 🙂

Part of the new SAP BTP Guidance Framework

The SAP Integration Solution Advisory Methodology is an integral part of the SAP BTP Guidance Framework (see figure below) which has been released at SAP TechEd 2023.

SAP BTP Guidance Framework

The SAP BTP Guidance Framework provides a central access point for architects, developers and administrators to build and run enterprise-grade solutions on BTP. It acts as a compass toward architecting, developing, and operating BTP based solutions. With regards to integration the framework offers for instance an integration architecture guide, SAP Integration Solution Advisory Methodology, and reference architectures.

Your next steps

If you are looking for more details about the SAP Integration Solution Advisory Methodology you may check out the following resources:

Start with an overview

Assessment: Identify Your Enterprise Integration Maturity Level

Whitepaper: SAP Integration Strategy

Web page: SAP Integration Solution Advisory Methodology

Video: Integration Assessment capability within SAP Integration Suite

Explore the details

Blog post: Integration Assessment capability within SAP Integration Suite is general available now

Video: Enterprise Integration Strategy with SAP Integration Solution Advisory Methodology

Guide: Integration Architecture Guide for Cloud and Hybrid Environments based on SAP Integration Solution Advisory Methodology

Learn more and get started

SAP Discovery Center Mission: Get started with the Integration Assessment capability within SAP Integration Suite

Documentation: SAP Integration Solution Advisory Methodology, including free templates for download

Documentation: Integration Assessment capability within SAP Integration Suite

Webinar: Integration Cockpit by WHINT solutions

2023-11-07T09:40:13+01:00

Dear SAP-community,

We are hosting a webinar this Friday (in English) to feature our new solution which will be the next level of interface management.

Integration Cockpit

Please register here!

LinkedIn event page

Edge Integration Cell – setup highlights

2023-11-09T15:24:16+01:00

In previous blogs, I talked about the context, use cases and how the Edge Integration Cell, EIC in short, looks and feels. This blog will bring insights in the setup. It is not a manual, obviously. But it provides tips and tricks to give you a better understanding of what should be done to set up and configure the EIC. Please refer to the official SAP documentation about this topic. It provides all the necessary steps.

Prepare

Before you start installing, you need to decide where the EIC must run. SAP Note 3247839 provides the necessary information. Also, please check region availability via OSS Note 3379690.
During the beta phase of the EIC, I chose the AWS setup (Amazon Elastic Kubernetes Service (EKS) with Kubernetes 1.23.x on Amazon Web Services). The continuation of this blog is therefore based on that.

Deploy

Once SAP provisioned the capability for you (a new runtime will be added, see screenshot below), you can activate it. Make sure to grant roles integration_provisioner and EdgeLMAccess to the user performing this action. The screenshot below is the result of all actions mentioned in the documentation.

During the installation and configuration, an important part is enabling central system monitoring. Here, you need to set up your SAP Identity Authentication Service (IAS) accordingly. Setup is out-of-the-box, except for the default assertion attributes.

Standard configuration:

Configuration as we have it now:

Another part of the setup is getting the kubeconfig file. This is a file that is used to configure access to clusters. This is a generic way of referring to configuration files. You need to upload this file as one step in the configuration wizard.

Further down the installation, you need to run the Edge Lifecycle Management Bridge to establish the connection between the Edge Lifecycle Management and the Edge Node using the Cloud Connector. Edge Lifecycle Management Bridge deploys Kubernetes resources under namespace edgelm.
The result of this action is that you see the new Edge Node displayed in Edge Lifecycle Management UI, and additional Kubernetes resources are deployed automatically before the status of the Edge Node shows Available.

Important to mention here is that you need to Install AWS CLI (command line interface) first. Afterwards, you can execute command aws configure.
During this step, you also need to download software from the SAP support portal. Make sure you always download the latest version. Execute command <executable name> run init -c context.cfg
When that one finishes, you will get a nice and clear summary of all actions performed. Save that XML file for documentation purposes.

You now go back to your Integration Suite tenant, open the Edge Lifecycle Management user interface, go to the Edge Nodes tab and deploy the solution. In case of success, the result should look similar to the screenshot below.

Upgrade

To make sure the EIC remains in a healthy status, upgrades can be performed. The same applies to your Kubernetes Cluster.

Use a Kubernetes version supported by both the old and the new versions of Edge Integration Cell. SAP Note 3247839 provides insights. If the Kubernetes version isn't supported by the new Edge Integration Cell version, you have to upgrade Kubernetes. The Kubernetes upgrade process depends on your Kubernetes provider. See the respective documentation about how to upgrade.

Upgrading the EIC is really easy. If an upgrade is available, it's visible in the Edge Lifecycle Management UI. Just click on upgrade, next to the component.

SAP Learning Journey about SAP Integration Solution Advisory Methodology available now

2023-11-21T15:04:05+01:00

I am happy to share the news that a free SAP Learning Journey about SAP Integration Solution Advisory Methodology has been released!

SAP Learning Journey about SAP Integration Solution Advisory Methodology

This learning journey is designed for beginners and helps you to understand the scope of the SAP Integration Solution Advisory Methodology and related offerings. Furthermore, you can also gain practical experience using this methodology, including its tool-based approach enabled by the Integration Assessment capability within SAP Integration Suite.

Integration Assessment capability within SAP Integration Suite

If you are completely new to this methodology you may check out my blog post SAP Integration Solution Advisory Methodology at a glance for an introduction to the topic. As prerequisite for this learning journey you should have completed ones about Discovering SAP Business Technology Platform and Developing with SAP Integration Suite before.

The SAP Learning Journey "Get started with SAP Integration Solution Advisory Methodology" covers all important concepts and offerings for enterprise integration, such as SAP’s integration strategy in context of the Intelligent Enterprise, SAP Integration Solution Advisory Methodology as such and SAP Business Technology Platform with SAP Integration Suite as leading integration technology. It is structured into the following five units:

Introducing SAP’s integration strategy and the integration assessment

This unit gives you an overview of SAP’s integration strategy, including the role of SAP BTP. It also includes an introduction into the SAP Integration Solution Advisory Methodology and the Integration Assessment capability within SAP Integration Suite.

Presenting the SAP Integration Solution Advisory Methodology

As part of this unit the four phases of the methodology are described. You start with an assessment of your integration strategy, followed by the design of your hybrid integration platform, continue with defining Integration Best Practices and finally you will look at concepts for enabling a practice of empowerment for enterprise integration in your organization.

Describing the Integration Assessment capability

In this unit you will explore the tool-based approach of the SAP Integration Solution Advisory Methodology. You will discover key parts of the Integration Assessment capability and will get to know different roles and their tasks.

Designing your hybrid integration platform and defining integration best practices

You will look at the different steps which are needed to define your hybrid integration platform, including selected integration best practices.

Enable a practice of empowerment

In the last unit you will look at the organizational dimension of enterprise integration. You will also learn how to introduce integration governance in an organization with the help of Integration Assessment.

While you are learning you also have the opportunity to join the SAP Learning Group which is moderated by an SAP Learning expert. This allows you to ask your questions about your digital learning journeys, prepare successfully for your SAP Certification exams, and collaborate with other learners to reach your learning goals. Each unit closes with a short quiz. Once you will have passed all the quizzes you can receive the digital badge “Getting Started with SAP Integration Solution Advisory Methodology” as record of achievement.

Now it is your turn: Get started with SAP Integration Solution Advisory Methodology with the help of this learning journey!

Happy learning and integrating,

Yours Katrin

Decoding the Ariba ITK Shift: Cloudy with a Chance of BTP Brilliance

2023-11-29T12:57:43+01:00

To many of you familiar with Ariba Integration Tool Kit (ITK) - it's likely gonna feel like the end of an era. With Ariba ITK reaching end of support, it's decision time: To be pro-cloud or not to be, and moreover if you are willing to learn from experience and wage a path towards being an Intelligent Enterprise.

In this blog post I'm going to talk about:

ITK on BTP

How this offering aligns with SAP's holistic Integration Strategy

Making ITK on BTP smart-er

1. ITK on BTP: New cool kid in SAP town

With BTP gaining more traction by the day and becoming the client favourite when it comes to anything SAP Extensibility, it's probably a no-brainer what's a worthy alternative for the legacy Ariba ITK. The new cloud-cousin of ITK built on Integration Suite, mimics most if not all the capabilities of the legacy ITK. Here's an amazing blog post by my colleague gabrielmendes where he explains how the ITK on BTP works, with references to the community content available for you to accelerate the deployment of this solution.

Off late I've been helping my clients adopt this community content - basically the standard integration flows on integration suite. Some aspects that I love about this solution:

Modularity - The modular nature of Cloud Integration coupled with the straightforward way these IFlows have been built rules out any language specific considerations, making it easy for the clients to get up to speed with how these work.

Not a black box (anymore) - There's no denying the fact that the legacy ITK was immensely useful, but at the end of the day being deep rooted in technicalities, it was a black box.

While I'm at it, some personal rant: I've spent a lot of time understanding how couple of functionalities worked in the legacy ITK, and it was always overwhelming to say the least. The lack of documentation on the legacy ITK - documentation which is actually correct - further adds to the brain drain.

Community Support - The ITK on BTP with its open/community built nature intends to put an end to the black box nature and shine some light on the ease with which this cloud offering can be adopted. Being hosted on Integration Suite opens it up to the wider community of citizen developers, garnering much wider support when it comes to enhancing functionalities or even squelching bugs.

2. How this offering aligns with SAP's holistic Integration Strategy

Intelligent Enterprises are Integrated Enterprises

Throughout 2023, I've had various conversations - with clients, partners, colleagues - and it is apparent that SAP is truly moving towards transforming businesses into Intelligent Enterprises.

The Suite Qualities such as Aligned Domain Model are taking the integration capabilities one step closer to the vision of Intelligent Enterprises. The ITK on BTP is piggy-backing on this vision and utilising customer's existing Integration Suite landscapes to become a one-stop shop for supporting yet another integration scenario. This is eventually not only helping the customers directly but also driving adoption - Cloud Adoption, and we can't be any more excited about that.

How, you ask?

One less place to worry about Integration MonitoringLeverage Cloud Integration's out-of-the-box monitoring capabilities, that's it - you won't have to depend on the Log files stored on your file system. Customer's utilising Integration Suite stand to gain a lot in this area because now they no longer have multiple places where their integrations are scattered. The 'Monitoring' tab has got you covered.Or even if you like having multiple integration platforms, SAP has yet again got you covered. Unleash the power of Cloud Integration’s OData APIs and find out how. Performing Cross Product Analysis couldn't have been any more easier.

Safeguard Cloud Transformation

Customer using Cloud ALM (CALM) can start utilising the integration between SAP Cloud Integration and CALM for safeguarding their Cloud Transformation, accelerating time to value and ensuring business continuity, in yet another attempt to harmonise UX.

3. Making ITK on BTP Smart-er

Being hosted on SAP Cloud Integration, as you can imagine you have all the ingredients ready to take the standard community content up many notches 😉. While standard content doesn't offer these enhancements, we can certainly pivot it into a more nuanced and sophisticated integration using the plethora of features in Cloud Integration and extensibility opportunities of SAP Ariba.

1. Support Advanced Scheduler configuration for Data Upload Iflows

The support for Advance Scheduler in the Timer event has been a blessing ever since it got rolled out this year. You are no longer constrained with rigid schedules that the timer previously offered. Instead you can schedule your integration flows in a much more flexible, yet accurate manner right down to the second.

Unfortunately, the standard Data Upload Integration flows makes use of the inbuilt scheduler that the SFTP adapter provides. This inbuilt scheduler is not smart enough ie. it lacks the advanced configuration.

To get past this limitation, you can instead update the Integration Flow to use Poll Enrich step to poll SFTP server to fetch files. The scheduling in such case can now be controlled by the Timer Start Event 👌.

Poll Enrich + Timer Start 🙌

This approach has a 🍒 on top. You can now have much more control on how polling to SFTP server is done since you are now using a Poll Enrich Step. This step provides you control over cases when there is no file available in the SFTP directory to import. So in case you want to throw an exception - maybe in a scenario where you want granular monitoring - you can do that as well.

File Availability Check

2. Prevent Data Import Failures if Import Batch Data is already running

If you've used the legacy ITK, you would already know that in case you perform 2 subsequent imports using the Import Batch Data event or for that matter any other event, the 2nd import fails since the Import Batch Data task is already in Process/running in Ariba. The standard ITK on BTP has similar shortcomings. You are prone to facing this problem in case you have multiple imports which are utilising similar task eg. Import Batch Data task, or if the integration flow is scheduled to run very frequently - causing the new Import Batch Data task to overlap with an already running Batch Import in Ariba. Since there is no request queuing support for the integration events in Ariba, we land up in this hot mess.

The good:

The standard iflow on such a failure will fail if the task is still running. However, it will try to re-process the old file again on the next run.

The bad:

You need to wait till the next run which might cause operational inconsistency in the solutions.

Let's make the Integration Flow smarter

There is a way to gracefully handle such a situation. SAP Ariba provided Integration Monitoring API for Procurement as well as for Strategic Sourcing. These APIs provide the status of the Import Batch Data integration event or any other ITK event, so you can in-real time get the information if the task is currently running or not. Since you are already in the Cloud Integration landscape, positioning an additional call to this API is VERY EASY.

Utilising the status of the Import task in Ariba, your Integration flow can now decide if it needs to pause the execution (if the Import task in Ariba is still In Process) for a while and retry again after a specific time period, or is it good to go ahead send the files to SAP Ariba.

There can be several ways to make your Integration flows for master data import conflict averse, this is just one way I implemented this conflict resolution mechanism.

Subprocess for graceful handling of conflicts

3. Using an On-Premise scheduler

There might be other customers who have invested in building their own On-Premise schedulers, which they don't want to let go of. Making these On-Prem schedulers might be tricky to complement with the standard ITK on BTP IFlows, since these IFlows are using the inbuilt schedulers.

The solution to this problem is fairly straightforward - convert all these IFlows such that they can be triggered via HTTPS calls from the outside world. Now you can add the logic to trigger these iFlows from your On-Prem schedulers - the best of both worlds, isn't it.

4. SMARTER - But just these limited enhancements?

Of-course not. These are just the scenarios that I came across recently and thought were worth sharing. The most interesting part of working as a consultant is the uniqueness with which disparate customers utilise our solutions. There can be 'n' number of enhancements that customers might require or deem necessary on top of what the standard ITK on BTP provides, to seamlessly adapt to their business processes or enhance those processes to tread the path to becoming an Intelligent Enterprise. There's certainly no 'One size fit all' in Enterprise Software world. However, building solutions using technology stacks that can support technological evolution is what will be advantageous in the disruptive tech landscape. Embracing the ITK on BTP is a step in that direction (PERIOD)

5. Parting Notes

With the end-of-support date for legacy ITK soon approaching, there has been a lot of traction on this topic. I would love to hear how you and your customers have been adopting the ITK on BTP and what are the pitfalls that you have come across in this solution. You can share about your journey about this solution or ask questions about what I've shared in this blog-post in the comments down below. As always, you can reach out to the wider SAP Community to leverage their expertise.

2023 / 2024 Webcast series around the SAP integration strategy and our E2E business process solution portfolio (Design-to-Operate)

2023-12-06T12:58:43+01:00

Dear colleagues,

these 2 sessions close out our E2E business process deep dive series – this time taking a closer look into the Design-to-Operate business process.

With this we have another 2 sessions in the pipeline for you, for which we got hold of the following subject matter experts, that you could also ask your questions to in advance here in the community

ekta.arora

Peter Voelker

peder.helle

Ekta and Peter will be starting with the first session called:

End-to-End Processes – Deep Dives: Plan to Fulfill - How SAP helps to manage your digital supply chain (January 23rd 4:00PM CET)

Together with you our experts will dive into the Design to Operate E2E business process portfolio offered by SAP, specifically talking about the aspects around "Plan to Fulfill" to build integrated business processes and solutions for discrete industries.

Plan to Fulfill is a set of business processes that enables companies to manage a resilient, sustainable digital supply chain. It helps create a responsive Design to Operate process and a customer-centric supply chain that is the backbone of a resilient business.

Plan to Fulfill for Discrete Industries encompasses all activities related to the planning, manufacturing and delivery of tangible products, as well as aspects such as tracking and tracing, analytics and sustainability.

Ekta and Peter will show how SAP's interoperable S/4HANA and Digital Supply Chain solutions support the integrated Plan to Fulfill business processes within Design to Operate, and how the D2O Reference Architecture provides assets that enrich end-to-end process, solution architecture, and roadmap discussions.

After that we have again Ekta, this time together with Peder introducing:

End-to-End Processes – Deep Dives: Acquire to Decommission - Managing assets along their entire lifecycle (January 30th, 4:00PM CET)

The two will be then covering the "Acquire to Decommission" aspects needed to build an integrated business process for discrete industries and how SAP S/4HANA and SAP's Digital Supply Chain solutions will support you in that.

Here you will learn how SAP helps you to technically onboard an asset using SAP Intelligent Asset Management solutions, and then monitor and maintain it using intelligent technologies such as IoT and machine learning.

Our experts will be showing how this can be achieved for any type of asset maintenance with integrations to other domains such as finance, sourcing and procurement, etc., to collaborate with business partners and to optimize asset performance or suggest product improvements by sharing feedback directly with the manufacturer.

And as my colleagues have already done during the recruit-to-retire, source-to-pay and lead-to-cash sessions, we will of course show here as well how the D2O business process software portfolio offered by SAP benefits from implementing and embedding our suite qualities that ultimately ensure that we offer integrated business process solutions to our customers.

For those of you, who missed the the other E2E business process deep dives, please refer to our webinar event calendar, where you can find the past and recorded sessions!

See you!
Carsten

Bookmark:

Session1

Session 2

Enhancing Cloud Security: How SAP Business Technology Platform (SAP BTP) Security Capabilities Tackle OWASP Vulnerabilities

2023-12-11T07:09:14+01:00

(Jana Subramanian serves as Head of Cybersecurity, APJ Strategic Customer Engagements and is a Fellow of Information Privacy (FIP), awarded by the International Association of Privacy Professionals (IAPP). In this role, Jana supports strategic customer engagements on cybersecurity, data privacy, multi-cloud security integration architecture, contractual assurance, audit, and compliance.)

Introduction

Enterprise companies utilize the SAP Business Technology Platform (SAP BTP) for building cloud-native applications, facilitating business automation, integration and extension, data management and enhancing analytics, among many other capabilities. As we all know in this age of digitalization, cybersecurity becomes paramount as businesses increasingly depend on platforms like SAP BTP to fuel innovation, modernize applications, and drive business growth. However, this dependence also brings significant cybersecurity challenges, especially in light of the prevalent vulnerabilities identified by the Open Web Application Security Project (OWASP). The OWASP Top Ten list is a critical awareness document for developers and web application security professionals, outlining the most significant security risks to web applications and offering essential guidance in the realm of cybersecurity.

This blog aims to explore how SAP BTP's comprehensive array of security controls and services aligns with OWASP's best practice approach to safeguard against critical cyber threats. We'll delve into the specific features of SAP BTP that effectively mitigate OWASP vulnerabilities, offering insights into the platform's multi-layered security approach to securing enterprise applications and operations.

Top 10 OWASP Vulnerabilities

SAP BTP is a crucial element in SAP’s cloud architecture. Central to a multitude of SaaS applications utilized by our customers and within SAP itself, SAP BTP maintains platform capabilities for enhanced security, performance and reliability. In securing SAP BTP’s cloud infrastructure, SAP employs security of cloud foundry environment with HA Proxy, Load Balancers, DNS Security, Proxy services, Network Address Translation, DDoS protection, network-level segregation, security groups, and stringent access controls among many others including security natively available with Hyperscale providers. Beyond these fundamental protections, SAP BTP offers comprehensive security features specifically designed to mitigate OWASP-type vulnerabilities, equipping customers with powerful tools to safeguard their digital landscapes.

Figure 1: High Level SAP BTP Integration Landscape

Before delving into SAP BTP's security controls, let us summarize the OWASP vulnerabilities last identified as the Top 10.

Rank	Category	Description
A1	Broken Access Control	Inadequate restrictions on what authenticated users are allowed to do.
A2	Cryptographic Failures	Security vulnerabilities where applications fail to properly protect sensitive data through adequate encryption leading to sensitive data exposure. This can be weak cryptographic standards or misconfigured TLS settings.
A3	Injection	Broad class of security vulnerabilities where an attacker can inject malicious data into a program or system, which then gets executed or processed by that system. This can result in unauthorized access to data, data loss, or even complete takeover of the system. Examples include SQL Injection, Cross-Site Scripting, Command Injection, LDAP and XML injection.
A4	Insecure Design	A new category focusing on design flaws and missing security controls.
A5	Security Misconfiguration	Common issues due to insecure default configurations, incomplete setups, etc.
A6	Vulnerable and Outdated Components	Use of unsupported or out-of-date software components.
A7	Identification and Authentication Failures	Expanded from 'Broken Authentication', focusing on flaws in user identity management.
A8	Software and Data Integrity Failures	New category about assumptions in software updates, critical data, and CI/CD pipelines.
A9	Security Logging and Monitoring Failures	Inadequate logging and insufficient monitoring of security events.
A10	Server-Side Request Forgery (SSRF)	New addition focusing on server-side software making unvalidated HTTP requests.

SAP BTP Security Control to address OWASP Vulnerabilities

In the following section, we will focus on the details of how SAP BTP provides capabilities that can be configured to address OWASP vulnerabilities. For clarity, only high-level capabilities are discussed without going into the nitty-gritty of the configuration.

Rank	Category	SAP BTP Security Capability to address OWASP Vulnerability
A1	Broken Access Control	Within the SAP Business Technology Platform (SAP BTP), several components and protocols play a crucial role. These include the App Router, API Management service, Identity Authentication Service (IAS), Identity Provisioning Service (IPS), OAuth 2.0 protocol, and OpenID Connect protocol. 1. App Router Role-Based Access Control (RBAC): Enforces RBAC at the application level, ensuring users access only authorized parts. Route to Services Based on User Roles and Privileges: Routes requests to backend services based on each user's specific roles and privileges. 2. API Management API-Level Security: Defines security policies for APIs, controlling access and conditions. OAuth 2.0 Integration: Secures API access with OAuth 2.0, ensuring only authenticated users access endpoints. 3. Identity Authentication Service (IAS) Centralized Authentication: Provides a central mechanism for application and service access, restricting access to authenticated users only. The service can support delegated and federated authentication to customer specific IDP Identity Provider Integration: Enhances security by supporting integration with external providers using SAML and OpenID Connect protocols. 4. Identity Provisioning Service (IPS) and Identity Access Governance Automated User Management: Automates user provisioning and de-provisioning across cloud and on-premises applications within SAP BTP. Role and Access Synchronization: Synchronizes roles and access rights across systems, ensuring consistent control. 5. OAuth 2.0 Delegated Authorization: Enables applications to access services on behalf of users without needing credentials (delegated authorization). Access Tokens: Provides applications with access tokens for controlled access to APIs and services, based on granted scopes. 6. OpenID Connect Authentication Layer on Top of OAuth 2.0: Adds an identity layer over OAuth 2.0, providing additional user authentication information. ID Tokens: Issues ID tokens alongside OAuth 2.0 access tokens, containing authenticated user information, enhancing access control further.

Rank

Category

SAP BTP Security Capability to address OWASP Vulnerability

Broken Access Control

Within the SAP Business Technology Platform (SAP BTP), several components and protocols play a crucial role. These include the App Router, API Management service, Identity Authentication Service (IAS), Identity Provisioning Service (IPS), OAuth 2.0 protocol, and OpenID Connect protocol.

1. App Router

Role-Based Access Control (RBAC): Enforces RBAC at the application level, ensuring users access only authorized parts.

Route to Services Based on User Roles and Privileges: Routes requests to backend services based on each user's specific roles and privileges.

2. API Management

API-Level Security: Defines security policies for APIs, controlling access and conditions.

OAuth 2.0 Integration: Secures API access with OAuth 2.0, ensuring only authenticated users access endpoints.

3. Identity Authentication Service (IAS)

Centralized Authentication: Provides a central mechanism for application and service access, restricting access to authenticated users only. The service can support delegated and federated authentication to customer specific IDP

Identity Provider Integration: Enhances security by supporting integration with external providers using SAML and OpenID Connect protocols.

4. Identity Provisioning Service (IPS) and Identity Access Governance

Automated User Management: Automates user provisioning and de-provisioning across cloud and on-premises applications within SAP BTP.

Role and Access Synchronization: Synchronizes roles and access rights across systems, ensuring consistent control.

5. OAuth 2.0

Delegated Authorization: Enables applications to access services on behalf of users without needing credentials (delegated authorization).

Access Tokens: Provides applications with access tokens for controlled access to APIs and services, based on granted scopes.

6. OpenID Connect

Authentication Layer on Top of OAuth 2.0: Adds an identity layer over OAuth 2.0, providing additional user authentication information.

ID Tokens: Issues ID tokens alongside OAuth 2.0 access tokens, containing authenticated user information, enhancing access control further.

The Application Router in SAP BTP, serving as the singular point of entry for applications in the Cloud Foundry environment, performs a multitude of functions. It is responsible for serving static content, authenticating users, rewriting URLs, and forwarding or proxying requests to other microservices with user information propagation. This versatile router is accessible as a library on npmjs.com under @sap/approuter and as a container image on Docker Hub at https://hub.docker.com/r/sapse/approuter.

Figure 2: Secure Flow with AppRouter

Rank

Category

SAP BTP Security Capability to address OWASP Vulnerability

Cryptographic Failures

1. Encryption of Data in Transit and at Rest

TLS for Data in Transit: SAP BTP utilizes Transport Layer Security (TLS) to encrypt data transmitted over the network, preventing eavesdropping and tampering. (Image of Data in transit encryption process.). SAP BTP supports TLS1.2 and above encryption protocol.

Encryption of Data at Rest: Sensitive data stored within SAP BTP services, such as databases and file storage, is encrypted using industry-standard algorithms to safeguard it against unauthorized access. (Image of Data at rest encryption process.)

2. Secure Key Management

Centralized Key Management Service: SAP BTP provides a dedicated service for managing cryptographic keys, ensuring secure storage, regular rotation, and strict access control of encryption keys. This is facilitated by SAP Data Custodian Key Management Service available for SAP HANA Cloud, SAP Analytics Cloud (Private Edition). This is a additional service that can be integrated with SAP BTP services in scope. SAP also maintains credential store for storing cryptographic materials.

3. Secure Cryptographic Algorithms

Use of Strong Algorithms: SAP BTP employs robust, industry-standard cryptographic algorithms for encryption, hashing, and digital signatures. These algorithms offer strong protection against known and emerging cryptographic attacks.

4. Compliance with Security Standards

Adherence to Security Best Practices and Standards: SAP BTP complies with recognized international security standards such as FIPS-140 for the cryptographic modules and libraries. This compliance assures high levels of data protection and promotes trust among users.

5. Secure Communication Protocols

Enforced Secure Protocols: The platform enforces the use of secure communication protocols, such as HTTPS, for all data exchanges. This reduces the risk of data being intercepted or manipulated during transmission.

6. Access Control

Fine-Grained Access Control: SAP BTP implements strict access control measures, ensuring that only authorized personnel have access to sensitive data and encryption keys. This granular approach minimizes the risk of unauthorized access and data breaches.

Rank	Category	SAP BTP Security Capability to address OWASP Vulnerability
A3	Injection	1. API Management Input Validation: SAP API Management includes features for validating input data. It can enforce checks on the inputs sent to APIs, ensuring they meet the expected format and type, thus preventing injection attacks. Policy-Based Access Control: It allows defining and enforcing policies that can restrict what types of calls and operations can be performed through the API, reducing the attack surface for injection. Rate Limiting and Quota Management: By controlling the rate and volume of API calls, SAP API Management can prevent or mitigate the impact of certain injection attacks, such as those trying to flood the system with malicious requests. 2. AppRouter URL Rewriting and Redirection Safeguards: AppRouter can rewrite and redirect URLs in a secure manner, ensuring that untrusted input doesn’t lead to malicious destinations or actions. Authentication and Authorization: It handles user authentication and authorization, ensuring that only properly authenticated and authorized users can access certain functionalities, thereby limiting the potential for malicious injection. 3. Secure Software Development Lifecycle Approach Prepared Statements and Parameterized Queries: For services interacting with databases, using prepared statements and parameterized queries is a key defense against SQL injection. This ensures that user input is treated strictly as data, not executable code. Content Security Policy (CSP): Implementing CSP in web applications can help prevent certain types of injection attacks, like XSS (Cross-Site Scripting). Regular Security Scanning and Auditing: Continuous monitoring and regular security audits can help in early detection of vulnerabilities, including potential injection flaws. Secure Coding Practices: SAP encourages and facilitates secure coding practices, which include proper input validation, sanitization, and the use of frameworks that inherently reduce the risk of injection. Educational Resources and Training: SAP provides resources and training for developers to understand and prevent security vulnerabilities, including injection attacks.

Rank

Category

SAP BTP Security Capability to address OWASP Vulnerability

Injection

1. API Management

Input Validation: SAP API Management includes features for validating input data. It can enforce checks on the inputs sent to APIs, ensuring they meet the expected format and type, thus preventing injection attacks.

Policy-Based Access Control: It allows defining and enforcing policies that can restrict what types of calls and operations can be performed through the API, reducing the attack surface for injection.

Rate Limiting and Quota Management: By controlling the rate and volume of API calls, SAP API Management can prevent or mitigate the impact of certain injection attacks, such as those trying to flood the system with malicious requests.

2. AppRouter

URL Rewriting and Redirection Safeguards: AppRouter can rewrite and redirect URLs in a secure manner, ensuring that untrusted input doesn’t lead to malicious destinations or actions.

Authentication and Authorization: It handles user authentication and authorization, ensuring that only properly authenticated and authorized users can access certain functionalities, thereby limiting the potential for malicious injection.

3. Secure Software Development Lifecycle Approach

Prepared Statements and Parameterized Queries: For services interacting with databases, using prepared statements and parameterized queries is a key defense against SQL injection. This ensures that user input is treated strictly as data, not executable code.

Content Security Policy (CSP): Implementing CSP in web applications can help prevent certain types of injection attacks, like XSS (Cross-Site Scripting).

Regular Security Scanning and Auditing: Continuous monitoring and regular security audits can help in early detection of vulnerabilities, including potential injection flaws.

Secure Coding Practices: SAP encourages and facilitates secure coding practices, which include proper input validation, sanitization, and the use of frameworks that inherently reduce the risk of injection.

Educational Resources and Training: SAP provides resources and training for developers to understand and prevent security vulnerabilities, including injection attacks.

SAP API Management empowers developers to build secure APIs by providing features and policies specifically designed to address common vulnerabilities. This significantly enhances the security of API interactions and offers robust protection against a wide range of cyber threats. Additionally, the platform's ability to enforce stringent security policies, coupled with its seamless integration with other SAP security tools, makes it an indispensable component in strengthening API ecosystems.

Figure 3: API Management Policies

The following diagram offers a high-level view of the secure flow involving AppRouter and API Management.

Figure 4: Secure Flow with API Management

A4	Insecure Design	SAP BTP Security Capability to address OWASP Vulnerability
A5	Security Misconfiguration	Secure Defaults: SAP BTP is designed with security-focused default configurations, reducing the risk of misconfigurations that can lead to security vulnerabilities. Guided Configuration: The Integration Advisor provides guided configuration steps, helping users to accurately configure integration scenarios. This reduces the risk of security misconfigurations which can occur due to manual errors or misinterpretation of settings. Secure Credential Store: SAP provides secure store that allows developers to store signing keys and certificates securely within the platform. Best Practice Templates: It offers pre-defined configuration templates that are aligned with security best practices. This ensures that integrations are set up securely right from the start, minimizing the likelihood of introducing vulnerabilities. Custom Mapping Recommendations: By analysing business context and requirements, the Integration Advisor can suggest custom mappings and configurations that adhere to security standards, further reducing the risk of insecure setups. Secure Software Supply Chain, Regular Scanning and Updates, Compliance with Security Standards, Regular Security Audits Multi-Factor Authentication (MFA): Provides robust authentication mechanisms, including MFA, to strengthen user authentication processes. Single Sign-On (SSO): Supports SSO capabilities, reducing the risk of authentication failures due to multiple credential management. Support for SAML 2.0, Open ID, OAuth 2.0 Secure Software Development Lifecycle (SSDLC) at SAP SSDLC Integration: SAP incorporates SSDLC practices throughout the development process of its products, including SAP BTP. This means security is a priority at every stage, from design and development to deployment and maintenance. SAST and DAST Provides black box security testing. Scans a running application. Finds vulnerabilities in the final solution (prior to delivery) Ensures high-quality security validation before delivery. Can discover runtime and environment-related issues. Typically scans Web applications and Web services. Provides white box security testing. Scans source code Prevents vulnerabilities early in the security development lifecycle (SDLC) Fully integrated into development process, hence highly effective vulnerability preventions Continuous Security Assessment: As part of the SSDLC, SAP conducts continuous security assessments to identify and mitigate potential vulnerabilities early in the development process. Security Training for Developers: SAP ensures that its development teams are trained in secure coding practices, staying updated with the latest security trends and threats. Security by Design: By adhering to the principles of 'security by design', SAP integrates security considerations into the software architecture from the ground up, reducing the likelihood of vulnerabilities. Contractual Assurances Data Protection and Compliance: SAP provides contractual assurances to its customers regarding data protection, privacy, and compliance with relevant regulations (like GDPR, HIPAA). Transparent Security Practices: SAP maintains transparency in its security practices, providing customers with detailed information on how their data is protected. Regular Audits and Certifications: SAP undergoes regular external audits and obtains certifications to validate its adherence to high security and data protection standards. Technical and Organizational Security Measures: These measures include a comprehensive set of policies, processes, and technologies that SAP implements to ensure the security of its software and protect customer data. SAP Cloud Identity Services - A suite of services for user authentication and lifecycle management SAP Authorization and Trust Management Service - Manage application authorizations and trust for SAP BTP Platform Authorizations Management API - Functionality for subaccount members managing. SAP Connectivity Service - Manage destinations and securely connect to on-premises systems. SAP Credential Store Service - Managing passwords and keys. Audit Log Retrieval API - Functionality for retrieving audit logs. SAP Malware Scanning Service - Scan business documents uploaded by your custom-developed applications for malware.

Figure 5: Secure Authentication and Authorization Flow

The authentication and authorization flow explained well with a diagram in the book “Architecting Solutions with SAP Business Technology Platform” by Serdar Simsekler , Eric Du

Rank

Category

SAP BTP Security Capability to address OWASP Vulnerability

Security Logging and Monitoring Failures

1. Comprehensive Logging

Detailed Activity Logs: SAP BTP maintains detailed logs of all activities, including user actions, system events, and errors. This helps in identifying suspicious activities and potential security incidents.

Audit Trails: Audit trails are kept for critical operations, providing a clear record of who did what and when, which is crucial for security audits and investigations.

Audit Log Retrieval API - Functionality for retrieving audit logs.

2. Real-time Monitoring and Alerting

Continuous Monitoring: The platform continuously monitors for unusual activities and potential security threats. This includes monitoring of network traffic, user activities, and system performance. This is being performed by SAP Security Operations.

Automated Alerts: In case of suspicious activities or identified threats, the system generates automated alerts, enabling rapid response to potential security incidents. This is internally managed as a part of SAP BT Security Operations.

3. Security Information and Event Management (SIEM) Integration

Integration with SIEM Tools: SAP BTP can integrate with Security Information and Event Management (SIEM) tools, allowing for advanced analysis of log data, correlation of events, and more effective detection of potential security issues.

Figure 6: Audit API Retrieval Log

Rank	Category	Description
A10	Server-Side Request Forgery (SSRF)	Input Validation and Sanitization: SAP BTP employs stringent input validation and sanitization to ensure that URLs and other input data are valid and do not contain malicious content. This is crucial in preventing attackers from injecting malicious URLs that could lead to SSRF. Network Segmentation and Access Controls: By segmenting networks and enforcing strict access controls, SAP BTP limits the ability of a server-side application to make requests to unauthorized or sensitive internal resources, reducing the risk of successful SSRF attacks. URL Allowlisting: SAP BTP supports URL allowlisting, where applications can only communicate with a predefined list of safe and approved external services or domains, preventing requests to potentially harmful URLs. Many of the controls explained for App Router and API Management will apply to mitigate this vulnerability.

Additional References:

S.No	Description
1	SAP Cloud Platform API Management – API Security Best Practices Blog Series
2	SAP API Management Documentation
3	SAP BTP Application Router
4	Architecting Solutions with SAP Business Technology Platform: An architectural guide to integrating, extending, and innovating enterprise solutions using SAP BTP

Conclusion

SAP Business Technology Platform (SAP BTP) delivers robust security for developers looking to modernize applications, integrate systems, or build extensions. With its comprehensive security measures, SAP BTP offers exceptional protection against a range of OWASP vulnerabilities, a crucial consideration in today’s digital landscape. This level of security is especially vital for developers who need to ensure the safety and integrity of their applications against various web threats.

At the infrastructure layer, SAP has designed and deployed a multi-layered security architecture, utilizing both hyperscale cloud capabilities and a suite of validated third-party and open-source tools and services. For developers, SAP BTP provides a solid security framework encompassing an array of features such as the App Router, API Management, robust authentication, and authorization processes, built in security services for credential store, Secure KMS, thorough audit logging, and efficient malware scanning for documents. These integrated security features effectively mitigate risks and minimize the potential for web application attacks, offering each SAP BTP customer a secure and reliable cloud environment for their business needs.

Disclaimer:

© 2023 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to SAP Materials for general audiences.

SAP Ariba Category management Technical Architecture and BTP Integration setup Guidelines

2023-12-11T12:59:47+01:00

In this blog post, we will delve into the world of SAP Ariba Category Management. As one of the pioneering solutions in the procurement and supply chain space, SAP Ariba has successfully revolutionized the way businesses manage their procurement processes. This article will take you through an in-depth technical understanding of how SAP Ariba category management can be integrate using various BTP tools and Ariba spend visibility integration.

About SAP Ariba Category management:

SAP Ariba Category Management is a cloud-based solution that enables organizations to define and manage purchasing categories and provides actionable market intelligence, category insights, and various tools and templates for developing and operationalizing category strategies that drive business value and performance. This business solution is built on SAP Business Technology Platform (BTP).

Technical Architecture:

Below High-level Architecture diagram shows the integration between various BTS services and SAP Ariba including spend data integration for both Ariba spend data Market intelligence provider.

Pre-requisites:

SAP Ariba Category management use SAP Business Technology Platform with this cloud solution to gain visibility, extend applications, and integrate your source-to-pay processes.

Customers must have the SAP Ariba Category management license, Once obtained the license this needs to be access via Global Account with BTP Technology platform.

In the BTP Global account, customer need to setup 2 sub-account, one for test and another one for production use. For each of your SAP BTP subaccounts, you need to configure a separate Identity Authentication service (IAS) tenant.

For each of your SAP BTP subaccounts, you need an identity management system supporting SCIM, like Identity Provisioning service (IPS). Then Enable Cloud Foundry on your SAP BTP subaccounts.

In the BTP cockpit, you need to subscribe to relevant Category management entitlement, once you successfully enabled, you can see below entitlement in the BTP cockpit.

You also need to assign all the required administrator roles to yourself or to the administrator. Also, assign the roles to the end-users.

You can explore your subaccount to view the destinations which have been created by default. You will see many destinations created for different Cloud Solutions which require configuration.

Once enabled the above BTP subscriptions, then you can see the relevant SAP Ariba Category Management admin apps which including Manage Taxonomy, Manage Configurations and workflow administrations.

Integrations Required for SAP Ariba Category Management Setup in BTP:

1.Identity Authentication Service(IAS) and Identity Provisioning Service (IPS):

IAS and IPS is mandatory and basic setup for any products built in BTP. Identity Authentication provides authentication and single sign-on for users in the cloud. The Identity Authentication service is an identity provider that can be used to store users or connect with existing corporate identity providers. The service is the source for user information.

The Identity Provisioning service helps you to provision user identities and their authorizations to various cloud and on-premise business applications. The service allows you to read users and groups from Identity Authentication user store, and provision them to the other business applications.

SAP Ariba Category Management integrates with SAP Cloud Identity Services to consume user information that resides in the Identity Authentication user store via Identity Provisioning Service.

See Setting Up User Replication for SAP Ariba Category Management and Setting Up Connection with the Authorization and Trust Management Service

2.SAP Master Data Integration service:

SAP Master Data Integration service is a multi-tenant kernel service for master data integration. It harmonizes master data across a hybrid landscape. The SAP Master Data Integration service is a central hub to which applications can integrate to synchronize their master data.

SAP Ariba Category Management integrates with the SAP Master Data Integration service that allows administrators to publish purchasing categories from SAP Ariba Category Management to the SAP Master Data Integration service.

Users from other applications can utilize the centrally located purchasing category master data from their platform by establishing a connection with the SAP Master Data Integration service.

To set up master data integration, you must have a subaccount for the SAP Master Data Integration Kernel Service on SAP BTP. This service cannot be access via the same sub-account used for category management subscription.

In the above MDI service subscription, you need to configure a Distribution Model in SAP Master Data Orchestration for Purchasing Categories and Setting up SAP BTP Destination for SAP Master Data Integration after Establish a connection with the master data integration API.For more detail you can refer help documentation SAP Master Data Integration Setup | SAP Help Portal

MDI API:

3.Procurement data warehouse:

The procurement data warehouse supports ingestion of spend data from SAP Ariba applications such as SAP Ariba Sourcing including guided sourcing capability, SAP Ariba Buying and Invoicing, and SAP Ariba Spend Analysis to the embedded SAP Analytics Cloud. It provides data transfer, storage, loading, and reporting, and it drives visualization through advanced analytics dashboards.

SAP Ariba Category Management integrates with the procurement data warehouse system to consume spend analytics information for purchasing categories. The integration enables users to view and analyze spend analytics information for categories in the SAP Ariba Category Management user interface.

You can refer the SAP help document link Procurement Data Warehouse Setup | SAP Help Portal to complete the procurement data warehouse set up

4. Intelligent opportunity analyzer:

SAP Ariba Category Management integrates with intelligent opportunity analyzer, which allows users to identify, create, manage, and monitor sourcing opportunities for categories. The solution leverages spend analytics information from the procurement data warehouse system. The intelligent opportunity analyzer solution also allows users to review and analyze category spend data from the advanced analytics user interface.

5. Setting Up Connection with SAP Ariba Sourcing

Establish a connection with the SAP Ariba Sourcing with guided sourcing capability that allows users to seamlessly create guided sourcing projects for initiatives or opportunities from SAP Ariba Category Management.

Sourcing Project management API needs to be called to create the Guided sourcing event in SAP Ariba. You must have access to the SAP Ariba Developer Portal to this application.

Also Create a HTTP destination for SAP Ariba Sourcing in the Destinations editor (SAP BTP cockpit).

You also need to establish a connection with SAP Ariba Open APIs to display contracts and sourcing projects information associated with a category in SAP Ariba Category Management.

6.Setting Up Connection with Market Intelligence Providers

Establish a connection with a market intelligence data provider to receive either news feed or market dynamics data, or both, for the purchasing categories mapped to the custom domain product classification of the data provider. You must configure the destinations separately for news feed and market dynamics. For this one also , you need to create a HTTP destination in the Destinations editor (SAP BTP cockpit).

For more detail on setting up the market intelligence, you can refer at Setting Up Connection with Market Intelligence Providers | SAP Help Portal

Publishing Spend Data to Procurement Data Warehouse

SAP Ariba Category Management consumes spend data from SAP Ariba Spend Analysis or spend data loader through procurement data warehouse for spend analytics.

Once completed the configuration activities in BTP cockpit, you need to publish the spend data from SAP Ariba spend analysis.

To load the spend data from SAP Ariba Spend Analysis to procurement data warehouse, the spend analysis deployment lead must add the data (facts and dimensions) to a load operation in SAP Ariba Spend Analysis and schedule a load operation to load the data into the data load schema. After loading the enriched data, the spend analysis deployment lead must switch database schemas, to upload the data to procurement data warehouse.You can also refer spend loaded guide Data Load Process | SAP Help Portal for more detail

Now the system is ready after publishing the Ariba spend data. Next activity is Ariba category management administration which required for manage the taxonomy, creating the purchasing categories, etc. You can refer help documentation link at SAP Ariba Category Management Administration Guide | SAP Help Portal for more detail

Also make sure to assign below role for the Admin and business users for managing the admin and other category manager activities.

Roles for Business Users

To allow administrators and users to access the various applications in SAP Ariba Category Management, you have to manage roles and role collections in SAP BTP cockpit.

Assigning Administrator and User Roles

When you subscribe to SAP Ariba Category Management, the system automatically creates the below mentioned roles and role collections. Each role is based on a role template that enables specific rights.

Category Management Administrator – CategoryManagementAdministrator

A new role collection to be created for workflow administration – WorkflowAdmin & WorkflowContextAdmin

Opportunity Analysis Administrator - CategoryManagementOpportunityAdministrator

Category Manager – CategoryManagementManager & CategoryManagementViewer

Category Management Viewer – CategoryManagementViewer

Category Strategy Approver – CategoryPlanApprover , WorkflowParticipant & CategoryManagementViewer

Opportunity Manager – OpportunityManager OpportunityViewer, CategoryManagementOpportunityManager & CategoryManagementOpportunityViewer

Opportunity Viewer – OpportunityViewer & CategoryManagementOpportunityViewer

A Year in Review: My 12 Cybersecurity and Data Privacy Blogs in 2023

2023-12-14T09:00:37+01:00

(Jana Subramanian serves as Head of Cybersecurity, APJ Strategic Customer Engagements and is a Fellow of Information Privacy (FIP), awarded by the International Association of Privacy Professionals (IAPP). In this role, Jana supports strategic customer engagements on cybersecurity, data privacy, multi-cloud security integration architecture, contractual assurance, audit, and compliance.)

Introduction

As 2023 folds into our memory and 2024 stands on the horizon, it's a time for reflection, gratitude, and looking ahead. This year, I embarked on a personal challenge to write one blog post every month on the crucial topics of SAP security and data privacy - I can say I almost successfully achieved this goal!

Throughout this year, I was fortunate to have the unique opportunity to support strategic customer program accounts, where we tackled complex security and regulatory requirements for highly regulated clients. The level of due diligence required was immense, leading to significant learning and exploration. This journey of discovery is reflected in each of the 12 blog posts I published in 2023 on SAP security and data privacy. I sincerely believe each blog post was a step towards sharing security of SAP environment, adding to the collective knowledge of our SAP community.

As the year 2023 is coming close, I extend my heartfelt gratitude to the APJ Cybersecurity Advisory team. Our team cohesion and collaborative working model, built upon shared learning and support, has been invaluable. Additionally, I want to thank my colleagues and SAP Community for their consistent support, engagement, and insightful feedback.

My 12 Cybersecurity and Data Privacy Blogs: A 2023 Recap

Here is the list of 12 blogs authored by me in 2023.

S.No	Title of the Blog	Published	Description
1	Enhancing Cloud Security: How SAP Business Technology Platform (SAP BTP) Security Capabilities Tackle OWASP Vulnerabilities	December 11, 2023	This blog delves into how SAP BTP's security features and services effectively address OWASP vulnerabilities.
2	Decoding Data Types and Security in SAP Cloud Services	October 22, 2023	This blog explores the diverse data types supported by SAP cloud services.
3	Secure Data Flow and Connectivity with SAP Cloud Services	September 20, 2023	This blog delves into the security of the data flow and connectivity of SAP cloud ecosystem.
4	Security Safeguards for SAP Cloud Services: Addressing the Threats to Cloud Computing	August 31, 2023	This blog reviews enhanced security controls available with SAP Cloud Services in addressing “Top Threats to Cloud Computing Pandemic Eleven” report released by Cloud Security Alliance in June 2022.
5	Decoding Cybersecurity and Data Privacy Controls with SAP Cloud Services	July 30, 2023	This blog provides an overview of the data privacy controls and tools available to customers as Data Controllers through SAP Cloud Services
6	Securing the Future: Role of Artificial Intelligence in Cybersecurity and Data Privacy	June 25, 2023	This blog explores the complex relationship between AI, cybersecurity, data privacy, and international regulations.
7	SAP S/4HANA Cloud, Public Edition: Cybersecurity FAQs Unraveled	May 16, 2023	This blog addresses frequently asked questions (FAQ) about the cybersecurity aspects of the SAP S/4HANA Cloud, Public Edition
8	RISE with SAP S/4HANA Cloud, Private Edition: Cybersecurity FAQ Explained	April 26, 2023	This blog delves into some common cybersecurity questions frequently asked by our customers and partners with respect to SAP S/4HANA cloud, private edition.
9	Securing GROW with SAP Landscape	April 20, 2023	This blog delves into the security features of the cloud-based ERP solution provided by GROW with SAP
10	Securing RISE with SAP S/4HANA cloud, private edition, Customer Data Center option	March 20, 2023	This blog discusses the high-level security measures in place for RISE with SAP S/4HANA Cloud, Private Edition deployed in a Customer Data Center (CDC).
11	RISE with SAP: Comparing the Security of SAP S/4HANA Cloud, private edition Vs SAP S/4HANA Cloud, public edition	February 2023	This blog explores the nuances in their differences between SAP S/4HANA Cloud Private Edition and SAP S/4HANA Cloud Public Edition.
12	RISE with SAP S/4HANA Cloud, Private Edition : Secure Cloud Connectivity	January 31, 2023	This blog focuses on the different connectivity options available for secure network connections between a customer’s environment and RISE with SAP S/4HANA Cloud private edition.

Additional Reference for Reading:

Cybersecurity encompasses many facets. Don't forget to explore jay.thodenvanvelzen#content insightful blogs on how SAP secures multi-cloud hyperscale environments

Conclusion

As we conclude 2023 and look forward to 2024 and beyond, we can expect SAP to continue innovating, integrating, and expanding Artificial Intelligence solutions across its products and services. The intersection of AI and cybersecurity is poised to remain a key focus in our discussions, reflecting the rapid evolution of the technological landscape. The convergence of AI and cybersecurity brings both opportunities and significant challenges. I am excited to further my learning and contribution to the SAP Community.

Wishing everyone in the SAP Community a prosperous, successful, and rewarding 2024.

Disclaimer:

© 2023 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to SAP Materials for general audiences.

Building Integration Architecture for the Omni-channel Commerce

2023-12-17T15:05:39+01:00

We live in the global village… Looks like we are so much connected, and yet we are always seeking for more and better ways to integrate…

At the core of the Omni-channel (and Channel-less as well) Commerce is, integration, integration and more integration…

In this article, I am covering:

From Multi-channel to Omni-channel Commerce

Building integrations in phases

Using SAP ISA-M and API Business Accelerator Hub

Why building in phases?

Conclusions

Acknowledgment

References

From Multi-channel to Omni-channel Commerce

What is Multi-channel Commerce?

While Customer has multiple options to learn about the Brand and Products – Customer uses its preferred Channel to (re)search and make purchases. Each Channel essentially works on its own – pretty much independent from other Channel(s). We may also say, each Channel works in its best interests trying to “increase” its sales, but not necessarily in the best interest of the Customer experience – this may lead to the “competition” of different Channels working against each other, even at the cost of the overall sales to the Customer.

What is then Omni-channel Commerce[1]?

This is Customer centric approach. Here, all Channels work together to increase Customer awareness of the Brand and Products; increase overall engagement with the Customer, and thus increase overall sales. Channels do not compete, but “complement” each other – leaving to the Customer to chose most suitable Channel at any point of time.

Figure 1. Multi-channel and Omni-channel Commerce

To unlock the potential of the Omni-channel Commerce, we need to build the seamless integration between backend Core (Master) Systems and Client Systems – working and Commerce Channels.

How to do that?

The starting point would be – setting the Integration Strategy and the Integration Architecture for the Intelligent Enterprise – this is the foundation layer (Integration Architecture Part 1 and Part 2). After we have built the foundation, we can start building our network of integration “roads” (Integration Architecture Part 3) – meeting the specific business demands – in this case, Omni-channel Commerce.

Building integrations in phases

Let’s go through practical example of building a solution for the Omni-channel (or Channel-less) Commerce, with S/4HANA as a backed core for the Order Fulfilment process.

Integrating your first System(s)

Popular joke says: When Alexander Graham Bell built his first telephone, this was really something – but the real revolution started when he built the second one…

If we want to implement our Order Fulfillment in S/4HANA and connect first Order Taking Channel(s) – it is not enough to enable (or build) APIs on S/4HANA side – we also need to enable (or build) APIs on the “other” side. Of course, at latter stage, for adding (or subscribing) other Channels, we will leverage those APIs by publishing them to the other System(s) – this is the “order of the day”. Pls note, while some APIs will behave like PubSub Event messaging (i.e. DRF will publish “full” payload on change pointer Event), this “lite” PubSub approach is still far away from the “real” Event-Driven Architecture. At the end-state, our Integration Architecture should move more-and-more to the ”real” Event-Driven Architecture – of course, for those services where Even messaging and Event topics are possible.

But first we must build, test and prove the initial concept.

Let’s say, we are connecting “Sales App” which will be used as a primary Channel for the Customer Engagement (Lead-2-Cash) and Customer 360 in general.

Figure 2. Setting the first integrations

In the example, we have enabled standard Integration Services in S/4HANA:

DRF SOAP Business Partner Replication and Business Partner Relationship Replication – using PUSH for the bi-directional synchronization of the Account/Customer and Contact data;

IDoc MATMAS Material Replication – using PUSH for sending Product data;

DRF SOAP Sales Organization Replication – using PUSH for sending Sales Organization data;

OData API_SALES_QUOTATION_SRV Sales Quotation (A2X) for inbound Offer requests – using POST, PATCH and GET methods for creating, updating and reading Offers;

OData API_SALES_ORDER_SIMULATION_SRV Sales Order Simulation (A2X) for inbound ATP Check (incl. checking only ATP for one or more items), Price Check (incl. checking only unit/total price for one or more items) and Order Checkout (full Order Simulation) – using POST method only;

OData API_SALES_ORDER_SRV Sales Order (A2X) for inbound Order Taking requests– using only POST and PATCH methods for creating and updating Orders;

DRF SOAP Sales Order Replication (A2A)– using PUSH for sending Sales Order data;

OData API_BILLING_DOCUMENT_SRV Billing Document request – using only GET method for reading Invoices.

For this example, we use Replication Integration Function for Customer data and Sales Order data.

Why replicating data, why not sending Data Events?

We could, but we would have to create multiple Event topics, basically for each entity within Customer data and Sales Order data. Also, for the Customer data, all Data Events would have to be bi-directional (outbound, but also inbound to S/4HANA). We could also use SAP Master Data Integration and/or SAP Master Data Governance solutions in our landscape – but is this scenario we will stay with the basic approach (let’s start with the “small steps”).

In this scenario, “Sales App” is our main Customer 360 Channel – producing various Customer Attributes, include Marketing Attributes, Segmentation etc. For that, we sync “full” Customer data model between S/4HANA and “Sales App”, as well as “all” Sales Orders from S/4HANA to “Sales App” (i.e. Sales Order could be created/updated in S/4HANA directly). Of course, this is just an example with closely coupled Customer 360 capability in one app, but it could be detached, processed, and integrated within set of apps.

Also, please note, in this example I have used IDoc MATMAS for enabling Material Replication – however other approaches for integrating Material/Product data could be also used depending of the S/4HANA version e.g. DRF SOAP Product Replication to PUSH or OData API_PRODUCT_SRV Product Master (A2X) to PULL data.

Reuse of integrations for the next System(s)

Now that we have enabled key Integration Services in our backend System – let’s start reusing it by subscribing additional Systems(s) …

Let’s imagine, we are extending our commercial activities to the new “Web Shop” Channel.

Figure 3. Reusing the integrations

In the example, we are re-using already published Integration Services from S/4HANA:

DRF SOAP Business Partner Replication and Business Partner Relationship Replication – using PUSH for the bi-directional synchronization of the Account/Customer and Contact data; enabling self-service registration from the “Web Shop”; replicating only relevant subset of Customers and Customer Attributes from S/4HANA

IDoc MATMAS Material Replication – using PUSH for sending Product data;

DRF SOAP Sales Organization Replication – using PUSH for sending Sales Organization data; this would be option – depending if Customers assigned to multiple Sales Organizations could use this Channel;

OData API_SALES_ORDER_SIMULATION_SRV Sales Order Simulation (A2X) for inbound ATP Check (incl. checking only ATP for one or more items), Price Check (incl. checking only unit/total price for one or more items) and Order Checkout (full Order Simulation) – using POST method only;

OData API_SALES_ORDER_SRV Sales Order (A2X) for inbound Order Taking requests– using POST, PATCH and GET methods for creating, updating and reading Orders;

OData API_BILLING_DOCUMENT_SRV Billing Document request – using only GET method for reading Invoices.

Here things become a bit more interesting:

There is always one flow between S/4HANA and SAP Integration Suite; we use SAP Integration Suite as a “focal” point for all inbound and outbound Integration Services – of course new Channel(s) do not need to subscribe to all Integration Services;

For inbound Integration Services, we are re-using already developed and deployed APIs, by exposing endpoints to the subscribed Channel(s);

For outbound Integration Services, we are also reusing already developed and deployed APIs, by multicasting payloads to the subscribed Channel(s);

Within IFlow in SAP Integration Suite we may filter-out some data (e.g. not all Customers are being replicated to all Channels), we may filter out data sets (e.g. not all Customer Attributes are being replicated to all Channels)

Adding “new” methods – e.g. in OData API_SALES_ORDER_SRV Sales Order (A2X) we have used GET method as well for reading Order History.

So, reuse is the key “word” here…

Example with SAP Commerce Cloud

In the previous example for the “Web Shop” I have evaluate rather general Architecture. Now, let me present an integration concept which could be used for SAP Commerce Cloud – of course, just as a high-level Architecture.

Figure 4.a. Integrating SAP Commerce Cloud

In the example, we are also re-using already published Integration Services from S/4HANA:

DRF SOAP Business Partner Replication and Business Partner Relationship Replication – using PUSH for the bi-directional synchronization of the Account/Customer and Contact data; enabling self-service registration from SAP Commerce Cloud; replicating only relevant subset of Customers and Customer Attributes from S/4HANA;

IDoc MATMAS Material Replication – using PUSH for sending Product data;

DRF SOAP Sales Organization Replication – using PUSH for sending Sales Organization data; this would be option – depending if Customers assigned to multiple Sales Organizations, could use this Channel;

OData API_SALES_ORDER_SIMULATION_SRV Sales Order Simulation (A2X) for inbound ATP Check (incl. checking only ATP for one or more items), Price Check (incl. checking only unit/total price for one or more items) and Order Checkout (full Order Simulation) – using POST method only;

OData API_SALES_ORDER_SRV Sales Order (A2X) for inbound Order Taking requests– using POST, PATCH and GET methods for creating, updating and reading Orders;

OData API_BILLING_DOCUMENT_SRV Billing Document request – using only GET method for reading Invoices.

In general, no major differences as per S/4HANA enabled APIs, but there are some specifics…

What are those specifics?

Using SAP Customer Data Cloud to ensure Customer Consent is captured, and Customer Identity is being verified with connected Enterprise identification and SSO services, either using Replicate Business Partner from SAP S4HANA to SAP Customer Data Cloud as Approved Organization standard Integration Package and IFlow[2] or using existing Customer/Account Integration Servies with necessary adjustments in the Integration Suite;

Based on the current version of SAP Commerce Cloud, Integration Extension Pack[3] order process is based on standard Sync OData APIs. There are no more “prescribed” integration packages for IDocs etc. In fact, for Order APIs, it is foreseen to use direct integration between SAP Commerce Cloud and S/4HANA, without any use of SAP Integration Suite.

Figure 4.b. Integrating SAP Commerce Cloud using CSRF token

Let me evaluate further this Architecture…

SAP Customer Data Cloud can be used as an Enterprise tool even if we are using SAP Commerce Cloud as a Web Shop (or Web Portal) app. Also, it can be used for other Channels as well – e.g. even Customer is created/registered in CRM, we may still need to ask the Customer to provide its Consent… So, SAP Customer Data Cloud can be part of our Omni-channel Integration Architecture, disregarding which apps we use overall.

Standard integration scenario for SAP Commerce Cloud foresees direct integration with S/4HANA OData APIs, using CSRF token, after Customer login. However, I do not see this as an obligatory approach. We may still decide to use SAP Integration Suite as a “focal” point for all Integration Services, for all subscribed Channels. Of course, in this case SAP Commerce Could Order APIs would have to be adjusted to use (e.g.) OAuth authentication when connecting with SAP Integration Suite endpoint.

SAP Integration Suite, when properly designed and configured, does provide only minimum latency, but provides unified orchestration and clear observability, for all included Integration Services, and all in one place.

Each Enterprise will make its own decision and adjust Reference Integration Architecture into its own Enterprise Integration Architecture

Extend further by subscribing new Channels

When building Omni-channel Commerce, we would probably not go “big-bang” all apps (for all Channels) at once. With introduction of every new app (or System in general terms), we are leveraging the knowledge and experience of the previous integration(s). The choice of apps, an order in which they will be integrated in the environment etc. this would always be specific for each Enterprise or Organization – based on its own business needs.

I have started with the “Sales App” (or main CRM system) and “Web Shop”. Now, let’s go further with few more “usual” examples…

Example with the Field sales

In some cases, we will have to extend the scope of the initially built Integration Services. For the Field sales, beside the mobility component, we might also need partial off-line capability. What does this mean?

We cannot rely fully on online APIs to “prepare” for Order Taking – i.e. we cannot use Sales Order Simulation (A2X) to perform ATP Check (check Product availability) and Price Check (acquire Product price);

Relevant data for Order Taking will be preloaded on the device while it is online;

Online Order Checkout (full Order Simulation) may still be an option if device is online;

Order Taking can be done in offline mode (new Orders created) and synchronized when device is online.

To enable this kind of service, we need to provide replication, not only of Master Data (Customers, Products etc.), but also:

Inventory – to enable checking Product availability offline;

Price and Promotion – to enable calculate Order price offline;

Figure 5. Extending integrations for the Field sales

In this example, we have enables additional Integration Services:

IDoc LOISTD for Material Master requirements/stock list – using PUSH for sending Stock data; alternatively other approaches for Stock data could be also used e.g. OData API_MATERIAL_STOCK_SRV Material Stock - Read to PULL data.

For Price and Promotion we can use at minimum OData API_SLSPRICINGCONDITIONTYPE_SRV Condition Type for Pricing in Sales, OData API_SLSPRICINGCONDITIONRECORD_SRV Condition Record for Pricing in Sales, and OData API_SLSPRICINGPROCEDURE_SRV Pricing Procedure in Sales – using GET method for reading Price and Promotion data; depending of the S/4HANA version e.g. other APIs[4] as well as IDoc COND_A approach could be used;

However, offline use, does come with some limitations:

LOISTD for Material Master requirements/stock list is based on MRP (Material Requirement Planning), which is not (or may not be) the same as ATP (Available-To-Promise). MRP is actually based on the Availability Check – e.g. if the desire quantity can be met on the requested delivery date or not. In the Customizing we can set if the Availability Check is based on ATP or against planning, where ATP itself represents = Total Warehouse Stock + Planned receipts (Incoming Stock) - Planned Issues (Outgoing stock).

Complex pricing, especially promotions, might be difficult to recreate in the Client System. It is necessary that Client System understand relevant Condition Types as a “Master Data” for pricing, then to use relevant Condition Records as per Pricing Procedure.

How to overcome those limitations?

In fact, for offline use, LOISTD can do just fine. Just to be on the safe side, we still have to keep Order Checkout (full Order Simulation) as a “security” mechanism to be executed prior Order Taking – assuming device is online. The other “security” mechanism is the Order Taking itself – Order is confirmed on the device only once it is being successfully synchronized with the backend and order confirmed by S/4HANA.

Indirect sales

In the Indirect sales, our Business is serving Customers through 3^rd Parties. The overall Order Fulfillment process is split between our Enterprise and 3^rd Parties – let’s not confuse this with B2B Trading Partner scenario, as this is not exactly the same.

As far as Order Taking process, we can have multiple scenarios:

We receive Orders through our Commerce Channels (e.g. Sales App), Orders are processed and sent to the 3^rd Party to finalize Order Fulfillment. In this scenario Customer is (usually) invoiced through our Channels

Orders are taken by the 3^rd Party, based on our Customer and Product Master data, and based on our Price and Promotion Order Fulfillment is executed by the 3^rd Party. Usually, the actual 3^rd Party will be Bill-to Party (party which is invoiced) and/or Payer (party which is actually paying invoiced amount), not Customer itself – however, this all depends on the specific Business Processes we are implementing.

Combined case of the first two scenarios, where 3^rd Party can both, receive and take Orders as well.

As per 3^rd Party relationship, we can have multiple scenarios as well:

“Exclusive” – e.g. Wholesaler selling and distributing only our own Product portfolio. An example would be a dealer or franchiser authorized to cover specific region or subset of Product portfolio in the specific region.

“Non-exclusive” – e.g. 3^rd Party marketplace connecting existing marketplaces from various Businesses (Companies or Brands) into single “look-and-feel” marketplace. The Order Taking experience is managed by the 3^rd Party marketplace, fully transparent for the Customer, where in the background 3^rd Party marketplace is aggregating marketplaces from the various Businesses (Companies or Brands) – communicating with each marketplace based on predefined integration protocol. An example would be e.g. Wholesale who is dealing different Product portfolios, from various Businesses (Companies or Brands), mixing them into “one” End Customer Order, while taking individual Orders from each Business (Company or Brand).

Depending on the particular scenario, to enable this kind of service, we need to provide bi-directional replication:

Inventory – we might need to have an information of 3^rd Party Stock data (of our Product portfolio), just as 3^rd Party might needs to have an information of our Stock data (to be able to take Orders) – depending on the particular scenario;

Price and Promotion – in the specific cases we might need to have an information on 3^rd Party Price and Promotion data (specific for this 3^rd Party, but for our Product portfolio), as well 3^rd Party might needs to have an information of our Price and Promotion data (to be able to take Orders) – again depending on the particular scenario.

Figure 6. Extending integrations for the Indirect sales

For the Indirect sales,

Integration might require some additional re-mapping of our Customer and Product Master data. If we operate with multiple Sales Organization (or Sales Areas in general), re-mapping with our Organizational data would be needed as well.

When we receive Orders and “forward” it to the 3^rd Party, beside setting clear Business Rules; we might need to record relevant Stock data from the 3^rd Party – PUSH data from the 3^rd Party into our ERP special Warehouse or Storage Location. Also, there could be some specific Price and Promotion applicable when Order Fulfilment is executed by the (selected) 3^rd Party – again PUSH data from the 3^rd Party into our ERP special Conditions.

When Orders are taken by the 3^rd Party, beside setting clear Business Rules; 3^rd Party needs to have an information of our Stock , Price and Promotion data, so Order Taking can be performed via 3^rd Party Commercial Channels.

While all (re-)mapping can be performer also in SAP Integration Suite within Value Mapping, or in some cases we might go for B2B Trading Partner scenarios – but for large scale operations (working with multiple 3^rd Parties, in multiple regions/countries), engaging “Unified Translation” Middleware Services could be more prudent choice.

Some 3^rd Party marketplaces also provide natural integration with Web Shops – e.g. Mirakle marketplace connecting with, or managing, SAP Commerce Cloud[5][6]. Obviously, in this scenario, there is no need for any additional “Unified Translation” Middleware Services.

EDI

When we talk about EDI (Electronic Data Interchange), we are talking about B2B (Business to Business) communication. Both parties exchanging messages can be providing or purchasing Products or Services – i.e. from one side an Order is a Purchase Order, while for the other side it is a Sales Order.

SAP Business Accelerator Hub provides EDI Integration Templates for SAP Integration Advisor[7]. This package provides the template for both, inbound and outbound integration flows for the processing of UN/EDIFACT (incl. UN/EDIFACT subsets-like GS1 EANCOM or Odette EDIFACT), ODETTE, ASC X12 or cXML interchange to SAP IDoc, SAP SOAP or vice versa.

Figure 7. B2B Trading Partner integration scenario

More details on B2B Trading Partner integration approach can be found in blogs[8], TechEd on-demand videos[9], as well as in few openSAP free learning courses[10][11]. I suggest visiting these references – which cover all relevant details about the Integrations Advisor (IA), Message Implementation Guidelines (MIG), Mapping Guidelines (MAG), as well as key entities of the Trading Partner Management – like Company Profiles, Trading Partner Profiles, Agreement Templates and Agreements itself.

Buster agility beyond initial Architecture

Standard S/4HANA OData APIs provide many out-of-the-box features – fostering flexibility and agility in the ways of integrating Client System(s). Let’s cover few of them…

Promotion calculated in the Client System(s)

In the above examples, Promotion is calculated in S/4HANA. However, standard OData APIs for Sales Order Simulation (A2X) and Sales Order (A2X) support sending (POST) calculated Condition Records. Those Condition Records can hold Promotion calculated in the Client System(s). Condition Records must be based on the Manual Condition Types previously created in S/4HANA System.

Figure 8. Promotion calculated in the Client System

In this scenario, Client System is sending one or more PricingElement on the Item level:

PricingElement JSON sub-structure contains calculated Condition Record value – linked with the appropriate Manual Condition Type – where “Manual” means S/4HANA will allow Condition Record value to be appended into Pricing Procedure (value itself is not calculated within Pricing Procedure).

Delivery in the Client System(s)

We have already covered scenarios with the Indirect sales, where 3^rd Party can manage Delivery of the Goods. Using the same principle, we can also design our own Enterprise Business Process and allow Delivery part of the Order Fulfillment is manages by the Client System(s).

Figure 9. Delivery in the Client System

In this scenario we will not use bi-directional Stock replication, but we could use Material Movement Document:

OData API_MATERIAL_DOCUMENT Material Movement Document for inbound requests– using POST and GET methods for creating and retrieving Material Documents;

In this approach, S/4HANA is ”issuing” Goods to the Client System(s), where all further logistic will be happening. Such Material Documents, could be created either by the Client System(s) in S/4HANA, or could be created in S/4HANA and retrieved by the Client System(s).

Using SAP ISA-M and API Business Accelerator Hub

The power of SAP ISA-M[12] and API Business Accelerator Hub[13] is, among other things, in a vast number of well documented and easy deployable integration artifacts – from standard and easy configurable APIs (OData, SOAPs) – to huge number of predefined integration packages for the SAP Integration Suite (available for both, SAP and non-SAP integration scenarios). This makes things fast, really fast, in bringing “new” Integration Services to the integration domain…

But, it becomes even more interesting with Events and Event-Driven Architecture…

In this scenario I have used standard DRF SOAP Sales Order Replication (A2A) for sending status notifications to the subscribed Systems about order status – but it could be done much better using some of the standard Sales Order Events[14] together with SAP Event Mesh[15] or SAP Integration Suite, Advance Event Mesh[16].

And if standard Events are not enough (e.g. only few available for Customer), we can always build custom Events – e.g. very realistic scenario of changing some Customer Marketing Attributes – why should we replicate huge Business Partner payload to all subscribed Systems? Furthermore, not all Systems are even interested in all changes of Customer data – with Events, individual Systems can be subscribed to only some (specific) Events which are business relevant to the subscribed System…

… These are only few, very simple (and very realistic) examples – how SAP ISA-M (as an umbrella), with the associated tools, can accelerate our integration journey.

Why building in phases?

Remember, scope of integration is always End-2-End, but how to deliver it – this is completely different question:

Scope of integration – this is End-2-End integration (as described in the article Part 2: How to build an Integration Architecture for the Intelligent Enterprise)

Integration delivery approach – this is how we organize delivery of the integration (briefly mentioned in the article Part 3: Next steps in building the Integration Architecture for the Intelligent Enterprise)

In the context of integration delivery approach, Publish & Subscribe does not refer (only) to specific Event style or so (i.e. usually referred as “PubSub”), but rather on the approach where we build and publish Integration Services from the Core (Master) Systems – and then we connect subscribed Client System – this is the main concept of reusability.

Figure 10. Publish and Subscribe integration delivery approach

Why do we not start immediately with only publishing APIs from the Core System(s) and connecting subscribed client System(s)?

Initially when we were building our ways into proper governance models, we needed to apply End-2-End integration delivery approach – we needed to invest high to build the network of integration “roads”. In order our Business Process to flow seamlessly (and this is the ultimate goal, right?) it was necessary to implement beyond the Middleware, sometimes it was necessary to provide delivery of the APIs on both (or all) endpoints, as we do need to “prove” the Solution Concept.

But at the end, this is not the target delivery model we want.

Now, that we have proven the Solution Concept, in the matured delivery model, we can Publish APIs to the Client System(s) who will just Subscribe to the specific Integration Service(s) and/or Event Topic(s), based on the particular integration needs.

Here, PubSub (Publish-subscribe pattern)[17] as a pattern for the EDA (Event-driven architecture)[18], is basically encapsulated in the new delivery approach – Publish & Subscribe integration delivery approach.

Conclusions

The flexibility of standard S/4HANA APIs and capabilities of SAP Integration Suite are enabling us to “promptly” integrate “any” Commerce Channels – creating unified Omni-channel experience and architecture. Under “any”, I really do mean “any” – SAP or non-SAP…

The use of "OData". "REST". "SOAP" etc. on the Client sides – this is only indicative, as it may differ from the System to System, we are connecting.

This article covers some basic concepts, and concepts only – how to build Integration Architecture – which will enable building “Customer 360” journey and “Order360” visibility in the Enterprise. Of course, through practical (architectural) examples it covers only some Integration Services – but there are much more… In the similar fashion, S/4HANA and API Business Accelerator Hub can help us integrate Customer Return, Service Ticket (part of the Case Management), Shipment (and Delivery) etc.

Finally, as said, this article is describing only a Solution Concept – not any particular Solution itself. As always, it is up to any Enterprise or Organization to choose and build its own Solution. For sure, S/4HANA and API Business Accelerator Hub can provide a lot of options how to do that…

I am inviting you to keep following relevant blogs and community resources, post and answer questions, and read other posts on the integration topic.

And of course, share your thoughts and comments on my article, in the comments section.

Acknowledgment

*) Intro photo by NASA on Unsplash

**) This article uses SAP Business Technology Platform Solution Diagrams & Icons as per SAP Terms of Use governing the use of these SAP Materials (please note, newer version of the Solution Diagrams & Icons, as well as Terms of Use, might be in place after the publication of this article).

More guidelines on Solution Diagrams & Icons can be found in this article by bertram.ganz (@bertram.ganz).

References

[1] Omnichannel - Wikipedia

[2] SAP Customer Data Cloud | SAP Help Portal

[3]SAP S/4HANA Order Management Integration Module | SAP Help Portal

[4] Condition Type for Pricing in Sales – Read | SAP Help Portal

[5] Integrating the Mirakl Marketplace Platform with SAP Commerce

[6] SAP Commerce Marketplace Management l Digital Online Marketplace

[7[ Overview | EDI Integration Templates for SAP Integration Advisor | SAP Business Accelerator Hub

[8] What’s New for SAP Integration Suite – October & November 2023 | SAP Blogs

[9] Learn about SAP Integration Suite at SAP TechEd 2023, ASUG Tech Connect 2023, and SAPinsider EMEA 2023 | SAP Blogs

[10] Modernize Integration with SAP Integration Suite | openSAP

[11] Manage B2B Scenarios Effectively with SAP Integration Suite | openSAP

[12] SAP ISA-M: Integration Methodology | Services and Support

[13] SAP Business Accelerator Hub

[14] Sales Order Events | SAP Help Portal

[15] What Is SAP Event Mesh? | SAP Help Portal

[16] SAP Integration Suite, Advanced Event Mesh (cloud.sap)

[17] PubSub: Publish–subscribe pattern - Wikipedia

[18} EDA: Event-driven architecture - Wikipedia

How to gain the knowledge to become SAP Integration Black-Belt?

2023-12-20T22:23:11+01:00

Obtaining Integration Black-Belt badge from SAP (2023)…

I cannot comment how “prestigious” this badge is – personally, I do find it as nice addition to my list of badges and certifications… Could be because it summarize so much current (and interesting) integration topics in one (short) learning path… Or could it be because I generally like karate – who knows…

Anyway, I like it!

But, let me go immediately to the topic… The topic is – how to gain (sufficient) knowledge to become SAP Integration Black-Belt.

Let's start with some general information. All the guidelines how to start this open-end learning path can be found in the following blogs:

Take the opportunity to become an Integration Black-Belt | SAP Blogs from robert.kelly2,

Here’s the value of Integration Black Belt | SAP Blogs from shilpa.vij.

Training and quiz experience in the SAP Learning Hub are not like those in openSAP (Free SAP Training | openSAP) or in SAP Learning (Free SAP Online Courses | SAP Learning). For this particular training, content is delivered in the form of video lectures – don’t’ worry, all you need to know is really there – but there are no transcripts or any supporting textual documents or learning materials. The quiz has three attempts and cut score is 80%. This is not too difficult (after all, there are three attempts), but not too easy either (as cut score is 80%).

How to learn for the quiz?

1^st I would say, (some) hands-on is definitely must – this badge is not intended for beginners. Real working (architecture or development) experience provides the best and the most consistent knowledge. Of course, very difficult one will have “real” working experience in all the topics covered by this training; i.e. not so many people (yet) will have practical experience with Advanced Event Mesh or Integration Cell etc.

So, the 2^nd recommendation is – lets be very careful while watching the video lectures. As indicated, everything has been explained in the lectures and demos. However, no mater how careful we are, there could always be some tiny-little details which are missed.

Finally, there is 3^rd recommendation – fortunately there are some openSAP and SAP Learning training courses, freely available, which can be of great help. I strongly suggest going through those courses, and review all the available training materials offered in those courses:

Modernize Integration with SAP Integration Suite | openSAP – this course provides most of the, up-to-date information around SAP Integration Suite. Let’s be honest, this course is ”must”. This is my strong recommendation for all those are, or plan to be become, professionals in SAP integration domain.

Getting Started with SAP Integration Solution Advisory Methodology | SAP Learning – covering specific topics around SAP ISA-M. As this is vivid domain, more details are also available in the Community

Discovering DevOps with SAP BTP | SAP Learning – covering specific topics around DevOps.

Introducing SAP Cloud ALM and Implementing SAP Cloud ALM – these two are covering topics around Cloud Application Lifecycle Management.

Discovering SAP Business Technology Platform | SAP Learning – I find this course more like foundational training – probably noting too much new to learn (for those who already work with SAP Integration Suite), but good for refreshing some knowledge.

In addition, Integration for the Intelligent Sustainable Enterprise | openSAP – this course is not providing “directly” answers to Integration Black-Belt quiz questions, but it does provide a foundation for better understanding the content in the other courses listed above.

And after all, being current – why not visiting some SAP TechEd 2023 (SAP TechEd 2023 | Virtual Event) content around the integration?

Is this of any help?

I hope yes...

Sorry, no cheat-sheets, I do not use it, I do not provide it… But there is a clear learning path how to prepare for the Integration Black-Belt badge.

Please note, this is just a badge, not a certification. I see this more like – I "verify" myself for my own use, primarily – something to "share" with the community, probably – but not something that will flesh out on the top of one’s CV (still does not mean one should not mention it – why not).

Happy learning!

My 2023 blogs – and moving forward to 2024…

2024-01-04T00:33:37+01:00

End of the year is usually the time to recap past year and talk about plans for the forthcoming period.

So, let’s go immediately with the recap – articles/blogs I did and published in the SAP blogging platform(s)…

In 2023, most of my time and effort (in writing the articles) was well spent (I hope) in talking about integrations…

Here, by all means, my favorite article was Building Integration Architecture for the Omni-channel Commerce, not because it is the most “visited” or the most “liked” blog – actually, most of my articles are attracting more audience and visits – but in this article I was trying to go really “deep-dive” into Integration Architecture, addressing very specific, and very dynamic, Line-of-Business. And building integrations for the Omni-channel commerce – well, let me say – this is very challenging task… Now, this article is just a Solution Concept (like majoring of my articles), inspired by past experiences, but it’s not a specific “detail” Solution Design – so I do not really provide all the technical details (after all, some things I leave for the audience to “discover”), but still, I do believe this is a good one… I like it, and I am happy I found time to write it…

Figure 1. From Multi-channel to Omni-channel commerce (link)

The other topics I was “blogging” a lot in 2023 – Enterprise Architecture and the “ways of working”…

I did several “longer” articles – but my favorite is actually “2-cents” Architecture is about building the system… – because it basically “says it all”… Architecture is about building the SYSTEM which provides SOLUTION(S) – let’s be “brave” enough and step aways from the constant fixing of the issues and nursing the problem… We should be building the SYSTEM…

List of my articles in 2023…

Integration Strategy articles/blogs:

How to gain the knowledge to become SAP Integration Black-Belt? – it looks like this is the most “visited” blog I wrote – covering some guidelines how to train yourself to become SAP Integration Black-Belt (edition 2023).

Building Integration Architecture for the Omni-channel Commerce – as indicated, personally, my favorite article in 2023 – sort of, putting all the previous articles about the Integration Architecture in particle “motion”...

Part 3: Next steps in building the Integration Architecture for the Intelligent Enterprise

Part 2: How to build an Integration Architecture for the Intelligent Enterprise

How to build an Integration Architecture for the Intelligent Enterprise – 1^st part of three article series for building holistic Integration Architecture for both, SAP and non-SAP, enterprise environments, but also addressing some features of SAP ISA-M and SAP Integration Suite.

Agile EA - from SOA to Interoperability – Are we moving beyond traditional SOA?

Enterprise Architecture and the “ways of working” articles/blogs:

Do we need real engineering knowledge to be successful IT professionals? – “Be more likable” vs. “Be more knowledgeable”… my 2-cents…

Architecture is about building the system… - building the SYSTEM vs. persisting the problem – my 2-cents…

What do I (dis)like in Agile? – Sometimes I feel we generally misinterpret Agile framework – this is my view how it can/should be done.

Artwork of the Enterprise and Solution Architecture – I would like to believe IT Architecture can also has some ”personal” touch and “artistic” feeling.

Enterprise Architecture in the era of Agile…

AI article (well, I could not avoid it in 2023…):

Do we have too much AI these days? – “too much “ AI these days – I was trying to put an impartial overview of the current AI trends… At least trying…

Sustainability articles:

Sustainability is not just about reporting… It is a philosophy… – Sustainability is really much more than reporting – and even reporting is only “tip of an iceberg”…

GHG spillovers – a challenge which still needs to be addressed… – ESG should be fair – at least I think so…

Can we use ChatGPT to enhance Supplier data collection for ESG? – Possible use case of GenAI? On top of some previous articles I did regarding Ariba Business Network.

Figure 2. Sustainability is not just reporting…

Next steps in 2024…

What do I want to talk about in 2024…

Let’s say, the 1^st choice would be Integration Architecture, especially Event-Driven Architecture and Microservice Architecture; but I do not exclude few articles in some other domains... Time will tell…

Feel free to follow, comment and share my blogs…

How to trigger workflow in EC using API to the manager of a Contingent Worker to extend or not extend the WorkOrder EndDate

2024-01-12T07:50:54+01:00

Introduction:

Our Business requirement:

For the contingent employees we need a process that will automatically update their termination date to 3 months later.
This process should be under workflow to be approved by the manager:

If the manager dose not approve, the employee will be terminated as scheduled

Other wise - the termination date will update accordingly

Technically, our target is to trigger workflow in EC to the manager of a Contingent Worker to extend or not extend the WorkOrder EndDate X days prior to the termination date.

Solution:

In order to trigger workflow to the manager, we have to create a MDF in Manage Data to keep track of the records i.e., which records manager is extending end data and which records manager is not extending.

Also, we can only trigger workflow for MDF and not for standart portlet using API.

Note : The API user should not have “Admin access to MDF OData API” permission in order to trigger workflow.

So, we have created one MDF. Which looks like the below image.

I am using CPI as a middleware. And my iFlow looks like the below image.

CPI iFlow

In CPI we are fetching data from Work Order to compare the End Date is -15 Days, if the work order end date equals current date, then the workflow will trigger to the contingent worker’s Manager.

In order to trigger workflow, there is one mandatory step which you need to follow. Please see the below image.

This workflowConfirmed=true need to mentioned in your query in order to trigger workflow.

We also need to set business rules, if the the MDF get updated then the wokflow will be trigger to their manager.

Business Rule

Using all the steps mentioned above the workflow will be triggered to the manager.

Workflow

Now manager can select the status of the contingent worker weather they want to extend the Work Order End Date or they don't want ot extend the end date.

If the manager selects to extend the Contingent Worker End Date then the process in CPI mentioned above will run again and it will extend the end date of Contingent worker to three months and the Integration execute will be update so that the process won't process the same record. And in MDF it will look like the below image.

And if manager doesn't wants to extend the Contingent worker end date then the process will only update the integration status and the Contingent worker will get terminated on the previous date.

Conclusion:

Using the above mentioned steps you can trigger workflow in EC using API to the manager of a Contingent Worker. And also you can update the Work Order end date according to the selection of the manager.

Please let me know if this blog helps you or you have any question for me.

Advanced Event Mesh Adapter : BTP and Integration Suite now features tighter integration with AEM

2024-02-13T09:53:23.135000+01:00

"Recently, SAP released a new Integration Suite adapter for Advanced Event Mesh. This adapter enables Integration Suite developers to manage connectivity and integration flow scenarios more effectively, facilitating tighter integration with Advanced Event Mesh than was previously possible."

You can configure the adapter for sending and receiving messages to and from Advanced Event Mesh:

Sender Adapter for receiving messages from Advanced Event Mesh.
Receiver Adapter for sending messages to Advanced Event Mesh.

While there is already an AMQP Adapter available for Integration Suite, which you can use to employ AMQP as a protocol, the AEM Adapter is specifically tailored to the Advanced Event Mesh Broker.
This adapter utilizes the Solace Message Format (SMF) as the specific message protocol for Solace.

According to the documentation, the main features include the following:

Sender:

Consume Guaranteed (persistent) messages from an advanced event mesh queue
Consume Direct (non-persistent) messages using a Topic Subscription
Number of Parallel Consumers
Choice of Acknowledgement Mode
Adapter-level message retry properties

Receiver:

Publish Guaranteed (persistent) messages to a Topic (recommended) or Queue in advanced event mesh
Publish Direct (non-persistent) messages to a Topic in advanced event mesh
Destination can be dynamically set at runtime via header or property expression
Support for multiple message payload types: Text, Byte, Map message types
Turn publish into a request/reply “Requestor” that send a message to the Destination, sets ReplyToAddress and CorrelationID, and synchronously waits for a response
Set User Properties on outgoing message
Set SMF message properties such as Priority, DMQ Eligible, and CorrelationId on outgoing message

Connection with advanced event mesh broker:

Connect to any broker
Support for various authentication modes such as Basic, Client Certificate, OAuth2
Support for setting less common connection properties

Additional details about the Advanced Event Mesh adapter for SAP Integration Suite are available on the help pages, which can serve as a more detailed reference.

I think this information is sufficient enough to start with, therefore, we can proceed with a practical example both explaining and demonstrating some of these features.

SCENARIO

We will create an Integration Flow both receiving and sending messages from and to Advanced Event Mesh.
The Integration Flow will consume messages through a Queue (guaranteed message) from Advanced Event Mesh and it will be publishing the same message (of course you have the option to modify payload and everything) to a topic endpoint of Advanced Event Mesh again.
We will demonstrate the retry capabilities of the adapter, therefore we will simulate an error case to trigger the retry attempts.

THE INTEGRATION FLOW

Below you can see the Integration Flow in general, including only the necessary simple steps to demonstrate the behaviour and logic.

AEM Adapter Demo iFlow

SENDER ADAPTER DETAILS

For the sender adapter connection & processing details are as follows:

Sender Adapter - Connection Details

Sender adapter processing details

Except the connection details; below parameters are the ones that I found worth going into details

Authentication Type: We use the Basic Authentication for simplicity. We can make use of the secure store for password to keep as Secure Parameter. Other than Basic Authentication, you have the option to use Client certificate and OAuth2 Authentication.
Consumer Mode : Direct for non-persistent messages and Guaranteed for persistent messages
Retry Parameters:
- Maximum Message Processing Attempts determines how many times the adapter tries to process the message. In our case we set it 3 to allow iFlow to try x3 times.
- Retry Interval (in ms) : When using more than 1 maximum message processing attempts, Integration Flow will try in these intervals (depending on the Exponential Backoff Multiplier it determines the next timing of the retry)
- Exponential Backoff Multiplier The multiplier to apply to the current time interval delay after every subsequent retry of a message. 1 means fixed delay.

In our current setup, we will receive and consume persistent messages from the queue using basic authentication. The password has been stored securely in Cloud Integration secure store. For retry attempts, the first attempt will occur within 3 seconds, followed by a second attempt within 6 seconds after the first. The timing of these attempts is like below.

Timing of the failed/retried attempts

RECEIVER ADAPTER DETAILS

For the receiver adapter connection & processing details are as follows:

Receiver Adapter- Connection DetailsReceiver Adapter- Processing DetailsReceiver Adapter- Message Properties Details

There are similar parameters in the receiver adapter. Additional ones we have used are as follows:

Application Message ID: We can use this ID for tracking purposes. It's a string for an application-specific message identifier
Sender ID : For identifying the sender (tracking purposes for end-to-end messaging)
User Properties : You can also set additional parameters (User Properties), which are basicly key-value pair header values. These user properties to be carried in the message separate from the payload.

As per our current setup, I put "SENDER-CIS_AEM_ADAPTER_DEMO_FLOW" as sender ID and use Integration Suite, Cloud Integration to generate a ApplicationMessageID. This ID includes a timestamp in order to make it unique. I am expecting these values to be present while monitoring of the messages.

IFLOW PROCESSING STEPS' DETAILS

In the iFlow, in order to simulate an error situation, I send a header value (bberror) from Postman (which will eventually be attached as a property to my message from Sender Adapter / Queue)
If this value is true (meaning I will simulate error case), the iFlow retries receiving the message based on the retry parameters provided. After multiple retries; it fails again in our case and Advanced Event Mesh moves the message to a DMQ for further processing.
For the inbound message to the iFlow, I also generate a MessageID from Postman and send it to AEM in order to track the messages since the first one. The same ID will also be assigned as the correlationID for the rest of the steps.

Postman - AEM Inbound Message HeaderSetting up properties to use in the flowRouting (for Error or Success case)

After all these are done, eventually the results will be as follows:

Successful path (when bberror is set to false): iFlow will receive the message from AEM adapter and publish the same message to a topic (which leads to a queue in my case)
Successful Message To iFlow-PayloadSuccessful Message To iFlow-Properties

Successful Message from iFlow (Properties)
Error path (when bberror is set to true): iFlow tries to process the message 3x attemps in different intervals(based on the configuration), and finally the message is moved to a dead message queue for further processing.
Error Message in DMQ (Properties)Error (retry attempts)

"SAP Integration Suite adapters provide a means to connect various systems, applications, and data sources within an organization's landscape. They facilitate interoperability and seamless communication between different technologies and systems. While Advanced Event Mesh could be connected via various generic protocols/methods including AMQP, REST, etc., for which Cloud Integration already has adapters, the release of the Advanced Event Mesh adapter for SAP Integration Suite enhances the connectivity and communication capabilities between these two solutions. This enables both SAP and non-SAP ecosystem to benefit from tighter integration and improved communication in multiple Event-Driven and Hybrid Integration use cases."

I hope the information and samples provided will guide you in using the Advanced Event Mesh Adapter and exploring a variety of event-driven scenarios. Below, you can also find links to my other blogs, mentioning other useful features and capabilities of SAP Advanced Event Mesh.

SAP ICC @SAP Partner Summits for SME 2024 in Singapore, Madrid & Phoenix !!

2024-03-06T14:36:28.278000+01:00

SAP Partner Summits for SME are back again in 2024 in 3 beautiful cities !! Singapore, Madrid and Phoenix !! Check out the link for more info and do register !!
Register today at 👉 https://sap.to/6059pow1Z
🌏Singapore: March 12 - 13, 2024
🌎Phoenix (AZ): April 10 - 12, 2024
🌍Madrid: April 23 - 25, 2024

These events not only serve as a platform for our partners to directly hear from SAP experts but also serve as a great networking opportunity where our partners often connect with other partners for collaborative ideas ! What more, this year we are super excited to have our partners explore innovation and certification opportunities with “SAP Integration and Certification Center” #SAPICC.

SME events in 2024 will focus on taking SAP Business One into a Cloud future and keep addressing the lower mid-market and small businesses. We will also talk about additional capabilities of #SAPBTP to be developed side-by-side. You will also hear us focusing on SAP S/4HANA Cloud Public Edition as the Cloud ERP for every business need addressing the large enterprise as well as the upper mid-market segment (GROW with SAP).

In line with SAPs strategy, SAP Integration and Certification Center (SAP ICC) will certify the partner products which fit into the scenarios of GROW, BTP and B1.

Certify your SAP Business One Solution :

You can gain greater visibility over your Small & midsize business with SAP Business One certification. In today’s market many SAP partners who resell SAP Business One distinguish themselves from their competition by providing their own add- ons, integrations and packaged IP together with SAP Business One. SAP Channel Partners can develop SAP Business One add-on on for both SAP Business One and SAP Business One version for SAP HANA. If interested to certify with us, order through Partner Benefit Catalog.

Certify Your Industry Cloud Solution (GROW logo) :
Partner solutions that have been approved under the Industry Cloud Solution Readiness Check (ICRC) to meet all industry cloud solution criteria according to the Architecture & Development Guide for Industry Cloud Solutions can earn an additional stamp of approval from SAP by certifying their BTP-based extensions for SAP S/4HANA Cloud, public edition with SAP ICC. Promoting your app as “SAP Certified – Integration with GROW with SAP” allows you to showcase both your expertise as well as your own IP and enables you to get ready to win the market with SAP Business Technology Platform. If interested, order through PBC.

Certify your Apps and Extensions on SAP BTP :
Promote your app as “SAP Certified – Built on SAP Business Technology Platform”. The SAP ecosystem thrives through partners offering applications and IP integrated with the SAP solution portfolio and built on SAP Business Technology Platform. To strengthen the joint go-to-market opportunity for partner IP alongside SAP BTP, you are invited to certify your SAP BTP extensions, apps, integration and analytics content with the SAP Integration and Certification Center.If interested, order through PBC.

KEY BENEFITS OF SAP ICC CERTIFICATION :
1. Trust & Credibility: Achieving Certification is a powerful testament to a partner's commitment to quality and technical excellence. It instils trust in customers assuring them that the certified solution is technically integrated SAP Business one add-on.
2. Market Visibility: SAP Store is a globally recognized marketplace for SAP solutions. With a certified solution, partners gain increased visibility, attracting potential customers looking for reliable and integrated Industry Cloud applications.
3. Competitive Advantage: Certification sets partners apart in a competitive market. It demonstrates a deep understanding of SAP technologies and a dedication to delivering exceptional solutions.
4. SAP Certified logo will prove high standard of software and technical integration of your solution with SAP solutions.

Many of our partners are already enjoying the benefits of certification being their customers GOTO certified products. Have a look at the Certified Solutions Directory to find out which B1 partners are already certified with us. Certified BTP partner solutions can be accessed through this link. Also, you can check certified GROW partners here. We look forward to discuss and explore innovation and certification opportunities with you. We welcome our partners to join us in our next generation partnering journey !!

Check out for the all-day long sponsored pods (POD Name: Partner Innovation Lifecycle Services) at your respective events in Singapore, Madrid and Phoenix. Our colleagues mentioned below will be happy to assist you !
 Felipe Grandi : Pheonix event
 Rustem Rymkulov : Madrid event
 Swetha Biradar : Singapore event

Looking forward for not ONE but THREE fabulous events filled with learning, fun and networking !!

What’s New for SAP Integration Suite – February 2024

2024-03-12T09:22:05.281000+01:00

Before going into the highlights of our innovations, we are thrilled to inform you that SAP Integration Suite has been recognized as a Leader in the latest Gartner Magic Quadrant for Integration Platform-as-a-Service (iPaaS) for the fourth consecutive time. We are convinced that we have been received this recognition for our commitments to deliver a top-tier customer-centric integration solution, the ability to accelerate business outcomes through prebuilt content, ongoing innovation, the global geographic strategy, and readiness for the future. And a big thanks also goes to you in supporting us with all your great feedback. For more details checkout the blogpost and the SAP News article.

SAP Integration Suite highlights are:

JMS receiver adapter: property to identify sending integration flow
Inspect resource consumption through SAP Cloud ALM/SAP Focused Run
Call to action: Upgrade to new version of third-party connectors
Duplicate nodes on target side in a MAG
Definition of more complex code value mapping scenarios
Add metadata for OData-based API artifacts deployed on Edge Integration Cell
Enhancement of security standards in API Management
Policy templates in API Management
Distributed tracing in advanced event mesh
Direct consumption of SAP S/4HANA Cloud events in advanced event mesh

Cloud Integration

JMS receiver adapter: property to identify sending integration flow

We have extended the JMS receiver adapter by storing a new SAP_IntegrationFlowID property. It contains the ID of the integration flow that has sent the message through the JMS receiver adapter. The JMS consumer can use this property to define steps depending on the sending integration flow ID. Refer the documentation.

Inspect resource consumption through SAP Cloud ALM/SAP Focused Run

Inspection of your resource consumption has been available since the middle of last year. Now you may analyze the utilization of database and system resources through the health monitoring application of SAP Cloud ALM and SAP Focused Run. For troubleshooting bottlenecks caused by integration flows you may jump directly to the Inspect section of the Cloud Integration monitor.

Call to action: Upgrade to new version of third-party connectors

As per SAP note 3001980 the following previous adapter versions are deprecated since end of 2020: Salesforce, Amazon Web Services, Microsoft Dynamics, SugarCRM. There haven't been any new features or enhancements for these previous adapter versions. After the upcoming Apache Camel upgrade, the adapter versions will no longer run.

Action is required from the customer's side. Check all your tenants to see whether you have any kind of the above adapters still deployed. Please undeploy and delete the adapters. In case of question reach out to annemarie.kiefer@sap.com.

B2B Integration

We have extended the mapping functionality of the Integration Advisor capability to offer you more flexibility.

Duplicate nodes on target side in a MAG

When designing B2B integration scenarios you may have situations where certain information within the source structure needs to be mapped to only one node in the target structure. Now the mapping guidelines editor of the Integration Advisor capability enables you to duplicate group or leave nodes and map each source alternative to one of the reproductions. Refer to the documentation.

Definition of more complex code value mapping scenarios

You are now able to define local or global mappings of multiple code values at the source side to one code value at the target side. The value function now supports N:1 cardinality code value mapping ease e.g., situations where you have to map multiple partners or currencies.

API Management

Add metadata for OData-based API artifacts deployed on Edge Integration Cell

You can now supply an EDMX specification for API artifacts (API-led integration flows for deployment on Edge Integration Cell), that are based on OData APIs. This allows you to easily specify additional integration steps based on the resources of this API. See the detailed documentation.

Enhancement of security standards

As always, our intention is to offer the highest security standards to avoid attack vulnerabilities. Therefore, we encourage you to use strong certificates, and will no longer accept uploads to the Trust Store of weak customer-owned self-signed certificates or certificate chains used for mTLS handshakes. Consequently, the OpenSSL security level has been increased to level 2. See a comprehensive definition of security level 2 published on the OpenSLL site. For additional details please see note -3418201.

Policy templates

We have filled a small gap when applying policy templates to an API proxy. Default fault rules or post-client flows available within a policy template will now also be appended to the API proxy. Refer to the documentation.

Event-driven Integration

We have news regarding SAP Integration Suite, advanced event mesh our offering for distributed network of event brokers and sophisticated features.

Distributed tracing

We have extended SAP Integration Suite, advanced event mesh with a distributed tracing capability. Now you are able to trace the the lifecycle of events through OpenTelemetry, from the producing application across one or multiple event brokers to the receiving application.

Direct consumption of SAP S/4HANA Cloud events

We have an update regarding the event sources. We have enabled the direct consumption of SAP S/4HANA Cloud events into SAP Integration Suite, advanced event mesh without any intermediate hops. SAP S/4HANA Cloud customers may leverage SAP Integration Suite, advanced event mesh for very large projects, where performance is crucial. Read the documentation.

How to stay tuned to recent and upcoming innovations?

The SAP Road Map Explorer is your one-stop shop for all SAP Integration Suite innovations. You can easily check out the latest innovations and follow what is planned for the following quarters. All recent innovations also cover under the tab Features further links to blogposts or documentation.

We also refer to the complete list of new releases in our documentation: What’s New in SAP Integration Suite.

And if you have not heard of our monthly webinars, I suggest you sign up to get an invitation to the upcoming ones. Our team of Product Management experts host these webinars to showcase the latest and greatest updates regarding all SAP Integration Suite capabilities. The webinars are hosted on the last Tuesday of every month and the next one is already scheduled for February 27th.

In case you have missed our last monthly webinar, don’t worry. Visit 2024 Learning Sessions for SAP User Groups on SAP Integration Suite for all recordings, presentations, and Q&As.

Are you aware of the Release Navigator for SAP BTP? It consolidates release information across SAP BTP products and services easing you the way to find product release related notes, blogposts, and webpages. For your convenience use the direct link to the SAP Integration Suite section of the Release Navigator.

SAP BTP Integration Suite - New Message Metrics

2024-03-14T15:07:15.888000+01:00

SAP Integration Suite on the SAP Business Technology Platform (BTP) is licensed using 2 metrics: 1) number of tenants and 2) the number of messages per month.

As shown in the SAP Discovery Center, calculating the number of tenants is straightforward--1 each for instance of Integration Suite created, i.e. Dev, Test, Prod, etc. However, the number of messages is calculated based on usage and requires customers to analyze their current integrations to estimate the sizing. The messages themselves are priced in blocks of 10,000 and pricing can also be found in the Discovery Center.

This blog is to highlight a new capability within the Integration Suite that allows you to analyze message usage for a 31 day interval. This new feature is extremely helpful for customers who want to see how they've been using the Integration Suite as well as make projections for future use cases.

Help documentation

For a detailed explanation of how message sizes are calculated based on number of calls and payload sizes, refer to SAP Note 2942344 SAP Integration Suite Message Metric Definition. There are details regarding how messages are calculated across the capabilities in the Integration Suite.

In addition to the Note, the following two figures visually show some examples. At a high level, message metrics are really based on receiver channels and message payload sizes (not sender channels where messages are sent to the Integration Suite).

Example 1 Message Metric Calculation

Example 2 Message Metric Calculation

In order to use the new application, your user will need an assignment to the PI_Business_Expert and PI_Administrator role collections.

In the Integration Suite, under Monitor Artifacts there is now a tile for "Message Usage" under the Usage Details section.

Message Usage Tile

Within the dashboard, you can filter based on a 31 day date range to see the message usage details. The visualization graph will separate the total chargeable messages from the SAP to SAP messages which are not counted in the message metrics.

Sample Message Metrics for a Month on the Integration Suite

Detailed Monthly Message Statistics

Hover Over the Graph for Additional Details

You can view detailed integration flow (iFlow) details, including Receivers, Splitters, which artifacts were SAP to SAP and how a datastore was used. You can use the Action icon to further drill into the iFlow as well.

Message Calculations by Integration Flow Details

When switching the Visualization Category to "Integration Flow", you can see the number of messages per component within the iFlow.

Details of Individual iFlow

Another great feature is that any data from the tables can easily be exported to Excel for further analysis.

Data Export to Excel

Let me know how you are finding this new tool to use within the Integration Suite!

Thanks,
Marty

10+ ways to reshape your SAP landscape with SAP Business Technology Platform – Blog Series

2024-03-20T19:32:03.027000+01:00

Blog 2: The role of Business Technology Platform as an extension and innovation platform

This blog is part of the “10+ ways to reshape your SAP landscape with SAP Business Technology Platform Blog Series”

Summary: In this blog series we will look at the role of the SAP Business Technology Platform to reshape your SAP landscape including SAP and Non-SAP systems. In this second blog we discuss SAP Business Technology Platform capabilities around process automation, application development, enterprise integration, and AI. And how these capabilities support the most demanding businesses.

What does Mercedes AMG Petronas Formula One have in common with SAP Business Technology Platform? -- Tons of it.

Just like any other sophisticated business, Mercedes-AMG PETRONAS Formula One is in the cutthroat business of racing. And it competes in one of the most challenging environments in global sports. Combining elite teamwork, modern technologies, high-performance management, and exceptional driving skills, Formula One is a technologically innovative form of motorsport, where incremental gains yield significant results and can be the difference between winning and losing.

In this blog, I want to emphasise the Business Technology Platform, which brings cutting-edge cloud services around application development, process automation, enterprise integration, analytics, and AI, all of which should help IT deliver fully integrated rapid enhancements.

In Formula One, a team has to compete in 22-24 different race tracks during a season. Each race track presents a different set of challenges, which require a set of decisions made by engineers, drivers, and strategies like tyre selection and sub-2 second pit stop execution, to try to maximize the result in the race.

The challenges our customers face are similar, where they have to navigate changing market situations and customer demands, and analyse and swiftly respond to dynamic requirements, all while managing product quality, cost, process quality, and pressure on time to market.

With the switch to S/4HANA, business can build their competitive car on a clean new chassis. The focus is cloud-first strategy and clean core, i.e. a largely untouched SAP core. BTP should be used to develop, integrate, and scale new functionality and applications on top of the core. Customers here need guidance, as this is an area that needs design and mind-shift change.

Let us look at some specific areas.

Formula One has long had active aero on cars – for instance, the DRS which is the rear-wing-opening overtaking aid. Obviously, the extremes would be Monza/Spa for low downforce, and Monaco/Hungary for highest. With Silverstone as maybe the ultimate “compromise” setup on the less draggy side but also needs good high-speed downforce, especially for Copse/Maggotts/Becketts where the driver experiences lateral forces upto 6Gs during acceleration, braking and cornering.

Quite the same way, SAP Business Technology Platform, is the best path to rapidly build and enhance enterprise applications, processes, and experiences on top of a clean S/HANA chassis for various industry and internal business requirements. The prime idea is to build competition-beating processes and application enhancements quickly and deliver them to business.

A few examples are building intuitive applications with document information extraction for field staff that provide necessary actions to reduce paperwork. Or using AI to generate work orders with necessary steps which allows planners to execute orders faster. A clean core enables you to become future-proof by ensuring faster deployment with smooth upgrades – and innovate at market speed.

This is where we employ SAP Business Technology Platform BUILD capabilities in addition to key-user extensibility and on-stack extensibility.

BUILD allows you to:

Simplify your cloud application development to get more value and ignite innovation
Deliver agile process automation to automate and optimize processes and tasks
Connect people, data, and processes with engaging experiences

How can business rapidly build a meaningful application? An SAP shipping and logistics customer built a Mobile App within a period of 3 weeks, to allow drivers to capture damages and take necessary actions. This would have taken months using traditional development methods. This new app has greatly reduced tons of paperwork and human errors. This has been coupled with automation to help fleet managers plan required repairs and/or schedule them for a later date based on spare parts availability. I regularly see such use cases in public, manufacturing, discreet, process, and retail industries.

SAP Build brings together SAP Build Apps, SAP Build Process Automation, SAP Build Work Zone and SAP Build Code with generative AI-based code development into a unified development experience with innovations to rapidly build apps, automate processes, and create business websites. These "four carriages" work together to help users accelerate application development and process automation, empowering every employee in the organization:

Build visually: Rapidly create enterprise apps, automate processes, and design business sites.

Integrate seamlessly: Accelerate development with prebuilt connectors and lines of business-specific content for SAP and non-SAP systems.

Collaborate securely: Foster collaboration between business and development teams with built-in governance and lifecycle management.

To optimise the Build process, SAP Build Code, a generative AI-based code development with Joule copilot, will provide optimized Java and JavaScript application development abilities, providing a turn-key environment for coding, testing, integrations, and application lifecycle management.

SAP Build Code will help developers with:

Generative AI-based code development with Joule copilot - uses AI to generate app logic, data models, and test scripts.
Tailored for SAP development – helps you connect seamlessly with prebuilt integrations and APIs.
Enhanced fusion development – helps you drive collaboration between professional developers and business experts.

Each Formula One car is made up of around 14,500 individual components. Each element such as chassis, power unit, gearbox, aero package, braking systems, battery, cooling systems, telemetry, radio communications, tyres, driver, etc. have to be truly well integrated to ensure the car is ready to race, is reliable and will win.

Similarly, in business, systems in isolation will never work and provide a full picture of business. They have to be integrated with core systems, and external applications, leverage 3rd party data and provide all of these integrated insights to business race engineers, and enable them to make race-winning decisions.

Hence SAP Integration Suite is essential to integrate on-premises and cloud-based processes, SAP as well as non-SAP applications, services, events, and data and provide them securely to all stakeholders to consume and process information. This is where we offer SAP BTP Integration Suite which addresses hybrid integration and innovation strategies.

Top nine ways SAP Integration Suite drives innovation

The new world of innovation through Generative AI via the SAP perspective.

AI wanted to change the world in 2024. SAP is taking a pragmatic approach to this. SAP Business AI is aimed at making our business applications more intelligent by infusing AI technologies into our applications. Building data understanding is critical for the success of Business AI. SAP Business AI will come with business context, provide business-friendly user experience, and accelerate business outcomes.

To make business AI successful, we continue to build the best technology and leverage the best tools on the market.

This includes strategic partnerships with others in the industry, such as Open AI, AWS Bedrock, Aleph Alpha Luminous, Meta Llama 2, Falcon, etc.
Embed their tech into our products such as SuccessFactors, S4, CX and Spend Management.
Enable customers to build custom ML models on SAP data easily and securely.

To conclude, SAP Business Technology Platform (SAP BTP) is the platform of choice to modernize, upgrade, and drive innovations in your applications. It allows you to extend and personalize SAP applications, integrate and connect landscapes, and unleash business users to connect processes and experiences, make decisions with confidence, and drive business innovation.

Let’s get out there and win every race.

The Blog Series 10+ ways to reshape your SAP landscape with SAP Business Technology Platform will be published regularly and the newest blogs can be found here: Video & Blog Series - SAP BTP MEE Overview (brandcast.io)

To get more insights, please also visit one of our BTP Innovation Days:

Innovation Day Vienna: Vienna 04-Apr-24 SAP BTP Innovation Day Vienna
Innovation Day Switzerland: Bern 14-May-24 SAP | SAP BTP Innovation Day Switzerland
Innovation Day Germany Essen 16-May-24 SAP | SAP BTP Innovation Day

Advanced Event Mesh Connectors and Easy Event-Driven Example of S/4HANA with Amazon S3 Integration

2024-03-21T15:18:41.091000+01:00

What is an Advanced Event Mesh (Solace) Connector

"Advanced Event Mesh(AEM) Connectors are assets that enable integration between AEM event brokers and various external systems, applications, and cloud services."

Acting as a bridge between the broker and other systems, the connectors facilitate the integration of AEM messaging capabilities into different environments, such as cloud-native applications, IoT platforms, microservices architectures, and traditional enterprise systems while providing a standardized way to connect the messaging platform with these environments, ensuring interoperability and ease of use. The role is crucial as it enables seamless integration and communication between AEM event brokers and diverse environments, in development and building of scalable, event-driven architectures and distributed systems.

If you're familiar with SAP BTP Cloud Integration, you can consider them to have a similar mentality as SAP BTP Integration Suite Open Connectors.

There are different types of connectors in terms of where they operate, based on who developed/distributed them etc.(Solace, 3rd party).

You also have the flexibility to develop your own connectors.

Roughly there are rich set of connectors including connectors already integrated within the broker itself communicating to and from target systems via standard protocols, connectors for other event brokers, connectors to/from analytics-stream processing platform, iPaaS providers on top of SAP BTP Cloud Integration as Mulesoft Anypoint, Dell Boomi or connectors deployed to the source/target systems such as ASAPIO.

For a list of growing number of connectors and their details you can visit

https://solace.com/integration-hub/

SCENARIO

In this blog post, we are going to simulate a scenario via Advanced Event Mesh Connectors, particularly Amazon S3 Producer, to showcase how easy it is to connect the AEM event broker to an Amazon S3 Bucket and simulate S/4HANA as the source system.

For simplicity's sake and to focus on the main purpose of the blog post, we are going to refer to S/4HANA as the source system. However, we will simulate the S/4HANA event publishing part using Postman. This simulation will yield the same inbound results from an Advanced Event Mesh perspective as if they were published from S/4HANA. (Different variations of S/4HANA's event publishing to Advanced Event Mesh are described in different blog posts, which you can find in the community.)

ARCHITECTURE

Below architecture will be used end-to-end.

Architecture and Flow

Along with showcasing AEM Connectors, this architecture is practical and could potentially serve as a solution to modernize legacy architectures characterized by point-to-point or file-based integrations. For example, in use cases where S/4HANA needs to integrate with third-party applications via SFTP/File-based interfaces, which are often associated with potential problems.

With the implementation of Event-Driven Architecture via AEM and connectors like this, and by leveraging the numerous advantages offered by cloud-based object stores (e.g., AWS S3), customers can realize both immediate and strategic benefits for future use cases, both directly and indirectly.

As a result this kind of architecture with tools like connectors provides much greater flexibility and easiness.

Very high level, below architecture represents the flow where;

A source system (like S/4HANA) publishes new customers via events.
SAP BTP, Advanced Event Mesh via connectors connects to the AWS S3 Bucket and puts the content(file) in the bucket.

Then a third party system of your preference can consume this object(file) in a standardized and secure way.

CONFIGURATION STEPS

For the configuration of this scenario below steps will be applied.

Configuration of AWS S3 Bucket

Very simply you need to have an AWS S3 Service enabled and an S3 Bucket configured for this purpose.

I have created one and named it as bb-s4-store-s4hana

Amazon S3 Bucket

You also need to configure AWS IAM Service for a user to access the bucket and access key to be used.

This key will later be used in the configuration of Advanced Event Mesh S3 Bucket Connector.

Access Key for the Bucket

Configuration of Advanced Event Mesh Connector: S3 Bucket Provider

From the left side menu of the broker manager, (Connectors link) you can access connectors that Advanced Event Mesh (Solace) provides out-of-the box.

Initial Settings

Add a new one and choose Amazon AWS > AWS S3

Connectors for AWS, Azure, Google Cloud

AWS Connectors

Use the access key and bucket information that is being configured in the first step

Wizard -Authentication

Next step for client profile and Amazon S3 Host (you can use the defaults for demo)

Wizard- Connection information

Configuring the file name and subscription

File Name Mapping Function

This is the part that is the core of the configuration.

The filename mapping function determines the object name in S3 bucket (which eventually becomes your file name). The good thing here that Advanced Event Mesh Connector (eventually RDP) allows you is the functions and variables you can use, so that you make your file name dynamic and informative. You can use Substitution Expressions which is a Solace-specific expression language used to replace specific text attributes (request targets, request headers, etc.) with system generated output.

More information can be found from the below link.

https://docs.solace.com/Messaging/Substitution-Expressions-Overview.htm

As I wanted my filename to be

customer-created-XXXXXXXXXXXX.csv

with a timestamp therefore I utilize below expressions/functions in the naming of the object:

unixTime(): Returns the number of seconds since midnight, January 1, 1970 UTC for the specified timestamp, ignoring leap seconds which is known as unix time or epoch time. This will allow uniqueness of the file name and be informative about file creation time.
topic(N) :Returns part or all of the message topic. I used the first and second segments of the topic in the file name which are “customer” and “created”.

Subscriptions

These are the topics to which my queue(generated) is subscribed, triggering the creation of objects to be pushed to S3 when an event related to these topics is published. Specifically, I want the object(file) to be created when a 'customer/created' event is published.

My final result of File Name and Subscriptions would be as follows.

Wizard- File Name Mapping and Subscriptions

As a summary, AEM Connector Wizard informs that the following objects to be created.

Result – Assets (Artifacts) created

Technically behind the scenes, the connector with a very quick 2-3 step process creates an RDP Client with REST Consumer, Queue and Queue Binding and attaches related subscriptions that we should do when we configure everything manually. Within the auto-configuration of these assets it also configures the AWS Authentication, schemes, remote call details.

As mentioned, this could also be done with different manual steps. The details of how you can manually set RDP and substitution expressions for this and other purposes could be found in my other post below

https://community.sap.com/t5/technology-blogs-by-members/advanced-event-mesh-dynamically-publishing-messages-from-source/ba-p/13576391

"As a result; all this setup is done within seconds, it's up and running.."

Resulting AEM Artifacts Created

TESTING

We will be using Postman to simulate S/4HANA event creation making a direct REST call to Advanced Event Mesh.

Payload

The message payload will be a CSV where there is the customer name and a guid in each line.(with the below header line)

“Customer Name”;”GUID”

Topic

Our topic will be customer/created for simplicity.

Postman REST Call

And Voilà! When we check AWS S3 Bucket after publishing 2 events, there are two objects(files)

Result - Files(objects) in the bucket for consumer / target system

And the content of a sample file which is basically the event message payload is as follows:

File Content

Once you have this in the S3 Bucket, you can reach the file/ download this file securely from a third party application.

FINAL WORDS & TAKE AWAYS

With a very quick and simple scenario and with the help of Advanced Event Mesh Connectors, we demonstrate how to easily set up an end-to-end use case with modern event driven implementation.

At the same time with event-enabling our scenario, we seamlessly connected our broker to Amazon S3.

Imagine the need to publish the same information to Azure Functions as well. All that is required is configuring the Azure Functions Connector specific to that purpose and nothing else needs to be changed to extend overall scenario. The use case can be further extended by calling other custom REST endpoints(RDPs) or you can subscribe to the same topic with different types of consumers and receive the same event and process it.. Still without affecting either the publisher and other subscribers.

The possibilities with these kinds of setups are almost “limitless”. They are easy to maintain once properly established and straightforward to configure with the connectors and event-driven architecture.

You can find my other blogs from the below links: