SAP® Plug-in

In the SAP® plug-in configuration, you specify which SAP® system the OPC Router connects to and how the login is performed. The settings are spread across several tabs: General, Security, Language and Code Pages, and Advanced.

note

If you want to use load balancing, you need an Enterprise license.

General

On the “General” tab, you specify the name of the connection, the client protocol, and the login method.

Property	Description
Name	Any name under which this SAP® system appears in Flow project planning. Choose a name that clearly describes the connection.
Client Log	SAP® driver used by the OPC Router for communication. You can choose between the “RFC protocol” and the “NetWeaver RFC protocol”.
Client Libraries	Add the required libraries here: on Windows, the *.dll files; in Docker, the *.so files.
Connection Type	Select the desired login method: “Direct log-in” or Load Balancing.

note

The classic “RFC protocol” (librfc32 library) has been deprecated by SAP and has not been supported since March 31, 2016. For new connections, select the “NetWeaver RFC protocol”; the classic RFC protocol is now available only for compatibility reasons.

Direct Login

With direct login, the OPC Router explicitly connects to a single SAP® application system.

Property	Description
Host/IP	Name or IP address of the server hosting the SAP® application system. An explicit login to a single system takes place (no load balancing).
System Number	Number of the SAP® system.
Client	Client (company code) for the SAP® user.

Load Balancing

With load balancing, the login is performed via a message server that distributes the load across multiple application servers.

Property	Description
Message Server	Name or IP address of the SAP® message server.
Log-on Group	Log-on group of the SAP® system.
System Number	Number of the SAP® system.
Client	Client (company code) for the SAP® user.

Security

On the “Security” tab, select the login method and configure the corresponding credentials.

Property	Description
Login Method	Choose between Basic Authentication and Secure Network Communications (SNC).

Basic Authentication

Property	Description
Username	Username for logging in to the SAP® system.
Password	Password for logging in to the SAP® system.

Secure Network Communications (SNC)

With SNC (Secure Network Communications), communication with the SAP® system is encrypted. Encryption is handled by an external SAP® cryptography library.

Prerequisites for SNC

The following prerequisites must be met for an SNC-secured connection:

• Cryptographic Library: An SAP® cryptographic library (sapcrypto.dll) must be installed. It is not provided by inray—contact Support if you wish to use it.
• PSE file: A PSE (Personal Security Environment) file provides the keys and certificates used for SNC. All users must have access to the PSE file.
• SECUDIR Environment Variable: The SECUDIR environment variable must point to the directory containing the SAP® crypto files, for example, C:\sapcrypto\nt-x86_64\sec.

Property	Description	Example (without Single Sign-On)
Username	Username of the SAP® user with which the OPC Router logs in.	RFCUSER
Password	Password of the SAP® user. It is stored as a secret via Secret Management and selected here.	Secret SAP-PROD-RFCUSER
Login	“Use Windows User” option: Login with the currently logged-in Windows user (for Single Sign-On).	disabled
Custom SNC Name	SNC name of the OPC router in the format p:CN=..., as specified in the issued certificate.	p:CN=OPCROUTER, O=INRAY, C=DE
SNC Partner Name	SNC name of the SAP® system (partner) in the format p:CN=....	p:CN=SAPPROD, O=INRAY, C=DE
SNC Library Path	Path to the SNC/crypto library (sapcrypto.dll). Can be selected using the “…” button.	C:\sapcryptolib\sapcrypto.dll
Use Single Sign-On	Logs in to the SAP® system via Windows login without explicitly entering credentials. Without Single Sign-On, the username and password are used instead.	Disabled
Security Level	Security level of the SNC connection, for example “Maximum” or “Default”.	“Maximum”
Authentication Method	Windows authentication method; relevant only when Single Sign-On is enabled: NTLM or Kerberos5.	—
Security Certificate	Certificate for the SNC identity. Add via +, view via the eye icon, remove via the trash can icon.	“Without”

Configuration on the SAP Side

For an SNC connection to be established, the SAP® system must also be configured for SNC. These tasks are usually performed by SAP Basis Administration—in collaboration with the team responsible for certificates and PKI, if necessary—and not in the OPC Router. Typically, this includes:

• Enable SNC on the SAP® system: Setting the SNC profile parameters (for example, snc/enable, snc/identity/as, snc/gssapi_lib) and providing an SNC identity for the server.
• Exchange certificates: Establish mutual trust between the OPC Router and the SAP® system by importing the certificates into the respective certificate lists or PSEs (on the SAP side via transaction STRUST).
• Enable and assign SNC names: Register the OPC Router’s SNC name in the SAP® system and grant it authorization, for example, via the access control list in transaction SNC0. For SNC-based single sign-on, the SNC name is also assigned to the SAP® user (transaction SU01, “SNC” tab).

The exact procedure depends on the SAP® system landscape and the security products used. Please refer to the SAP® documentation and consult your SAP Basis administration team for guidance.

Language and Code Pages

On the “Language and codepage” tab, you specify the login language and character encoding used by the RFC triggers.

Property	Description
Language	The language you want to use, for example, de for German or en for English. The selected language must be available on the SAP® system.
IDoc Culture	Selection of the IDoc culture (German or English). Selecting the appropriate culture prevents errors, such as those caused by differing date formats (February 1, 2018: 01.02.2018 in German, 02.01.2018 in English).

Register RFC Trigger as

Property	Description
Unicode	Registers RFC triggers as Unicode.
Non-Unicode	Registers RFC triggers as non-Unicode.

When using SAP® NetWeaver, Unicode must always be enabled. For the classic RFC protocol, the encoding depends on the library used: librfc32 (without Unicode) or librfc32u (with Unicode). The target in the SAP® transaction SM59 must be set to Unicode or Non-Unicode accordingly—depending on the setting in the OPC Router and the library used.

Advanced

On the “Advanced” tab, you can control IDoc handling and the behavior for incoming RFC calls and IDocs.

Property	Description
IDoc Handling	Determines how IDocs are formatted: Selecting “Use template from the SAP® system” imports the default values from the segments stored in the SAP® system. If “Create empty IDoc” is selected, only the empty segments are adopted.
IDOC Redundancy	When enabled, received IDocs are temporarily stored in a Redis cache. This enables redundant operation of the OPC router, allowing received IDocs to continue being processed even after a failure.
Redis Connection String	Connection data for the Redis cache, which is used when IDoc redundancy is enabled. This data is stored via Secret Management. You can test the connection using the “Test Redis” button.
Use an additional process for receiving RFC calls and IDocs	If this option is enabled, the OPC Router will not stop and will continue to run even if an error occurs in the SAP trigger (RFC or IDoc).

Use the “Test” button to check whether the connection can be established successfully.

note

To use the preferred settings of the SAP® user, the OPC Router requires read access to the SAP® table USR01.

Configure the Port

By default, the OPC Router uses port 33<system-nummer> to communicate with the SAP® system—for example, 3301 for system number 01. If the SAP® system uses a different port and the SAP® GUI is not installed, the port must be adjusted:

1. Create a backup copy of the file C:\Windows\System32\drivers\etc\services.

2. Open the file C:\Windows\System32\drivers\etc\services with a text editor (not the backup copy).

3. Modify or add to the entry sapgw00. The port number is specified in the format XX00, for example, 3600.

   sapgw00 <port>/tcp

4. Save the file.

The OPC Router will then use the specified port number.