sap-btp-connectivity

---
name: sap-btp-connectivity
description: "SAP BTP Connectivity skill covering Destination Service, Connectivity Service, Cloud Connector, Connectivity Proxy, and Transparent Proxy for Kubernetes. Use when configuring destinations (HTTP, RFC, LDAP, MAIL, TCP), setting up cloud-to-on-premise connectivity, implementing OAuth and principal propagation, deploying connectivity proxies in Kubernetes/Kyma, troubleshooting connectivity errors (405, 407, 503), or configuring multitenancy."
license: GPL-3.0
metadata:
  maintainer: "Eduard Jiglau"
  maintainer_email: "hello@sap-ai-skills.com"
  website: "https://sap-ai-skills.com"
  version: "2.4.1"
  last_verified: "2025-11-27"
  keywords: [SAP BTP, Connectivity, Destination Service, Cloud Connector, Connectivity Proxy, Transparent Proxy, Kyma, Kubernetes, OAuth, Principal Propagation, RFC, LDAP, on-premise, hybrid connectivity, service channels, SOCKS5, reverse proxy, tunnel]
---

# SAP BTP Connectivity Skill

## Related Skills

- **sap-btp-cloud-platform**: Use for platform fundamentals, BTP account setup, and integration patterns
- **sap-btp-best-practices**: Use for implementation guidance, security best practices, and production deployment
- **sap-cap-capire**: Use for CAP service connectivity, destination consumption, and secure API access
- **sap-fiori-tools**: Use for configuring Fiori app destinations and frontend connectivity
- **sap-abap**: Use when connecting to ABAP systems via RFC or implementing principal propagation

## When to Use This Skill

Use this skill when configuring BTP destinations, Cloud Connector, OAuth flows, principal propagation, RFC/LDAP/MAIL/TCP connectivity, Kubernetes/Kyma connectivity proxies, multitenant destination access, or troubleshooting connectivity errors such as 405, 407, 503, and proxy failures.

## Table of Contents

1. [Overview](#overview)
2. [Quick Start](#quick-start)
3. [Connectivity Scenarios](#connectivity-scenarios)
4. [Destination Types](#destination-types)
5. [Authentication Configuration](#authentication-configuration)
6. [Cloud Connector Setup](#cloud-connector-setup)
7. [Kubernetes/Kyma Connectivity](#kuberneteskyma-connectivity)
8. [Common Issues & Troubleshooting](#common-issues--troubleshooting)
9. [Security Best Practices](#security-best-practices)
10. [Critical Rules](#critical-rules)
11. [Bundled Resources](#bundled-resources)

---

## Overview

SAP BTP Connectivity provides secure access from SAP BTP applications to remote services across cloud, on-premise, and VPC environments.

### Core Components

| Component | Purpose |
|-----------|---------|
| **Destination Service** | Manages connection metadata, authentication, routing |
| **Connectivity Service** | Enables Kubernetes workloads via Cloud Connector |
| **Cloud Connector** | Reverse proxy for secure on-premise tunneling |
| **Connectivity Proxy** | Kubernetes component for on-premise access |
| **Transparent Proxy** | Kubernetes component for unified destination access |

**Supported Environments**: Cloud Foundry, ABAP Environment, Kyma  
**Supported Protocols**: HTTP/HTTPS, RFC, TCP (SOCKS5), LDAP/LDAPS, Mail

---

## Quick Start

### Create HTTP Destination (Cloud Foundry)

1. Navigate: **Connectivity > Destinations** in BTP Cockpit
2. Select: **Create > From Scratch**
3. Configure:
   ```
   Name: my-destination
   Type: HTTP
   URL: https://api.example.com
   ProxyType: Internet
   Authentication: OAuth2ClientCredentials
   clientId: <your-client-id>
   clientSecret: <your-client-secret>
   tokenServiceURL: https://auth.example.com/oauth/token
   ```

### Set Up Cloud Connector

1. Download from [SAP Tools](https://tools.hana.ondemand.com/#cloud)
2. Access: `https://localhost:8443`
3. Login: `Administrator` / `manage` (change immediately)
4. Add subaccount connection

### Access Destination in Application (Node.js)

```javascript
const { getDestination } = require('@sap-cloud-sdk/connectivity');
const destination = await getDestination({ destinationName: 'my-destination' });
```

---

## Connectivity Scenarios

### Cloud-to-Cloud
```
ProxyType: Internet
Authentication: OAuth2ClientCredentials | OAuth2SAMLBearerAssertion
```

### Cloud-to-On-Premise
```
ProxyType: OnPremise
Authentication: BasicAuthentication | PrincipalPropagation
```
Requires Cloud Connector installation in on-premise network.

### On-Premise-to-Cloud (Service Channels)
For on-premise systems accessing SAP BTP services via Cloud Connector.

---

## Destination Types

| Type | Use Case | ProxyType | Common Authentication |
|------|----------|-----------|----------------------|
| **HTTP** | REST/OData APIs | Internet/OnPremise | OAuth2, Basic, Certificates |
| **RFC** | SAP systems | OnPremise | Basic, PrincipalPropagation |
| **LDAP** | Directory services | Internet | Basic, NoAuth |
| **MAIL** | Email protocols | Internet | Basic, NoAuth |
| **TCP** | Generic TCP | OnPremise | Basic |

**Detailed configuration**: See `references/http-destinations.md`, `references/rfc-destinations.md`, `references/mail-tcp-ldap-destinations.md`

---

## Authentication Configuration

### OAuth2ClientCredentials (Service-to-Service)
```
Authentication: OAuth2ClientCredentials
clientId: <client-id>
clientSecret: <client-secret>
tokenServiceURL: https://auth.example.com/oauth/token
```

### OAuth2SAMLBearerAssertion (User Propagation)
```
Authentication: OAuth2SAMLBearerAssertion
audience: <target-audience>
clientKey: <client-key>
tokenServiceURL: https://auth.example.com/oauth2/token
KeyStoreLocation: <certificate-location>
```

### PrincipalPropagation (On-Premise SSO)
```
Authentication: PrincipalPropagation
ProxyType: OnPremise
```
Requires Cloud Connector X.509 certificate generation.

**Complete reference**: `references/authentication-types.md` (all 17+ types)

---

## Cloud Connector Setup

### Installation
- **Production**: Windows MSI/Linux RPM packages (service registration)
- **Development**: Portable archive (manual execution)

### Initial Configuration
1. Access UI: `https://<hostname>:8443`
2. Login: `Administrator` / `manage`
3. **Change password immediately**
4. Select mode: Master or Shadow
5. Add subaccount connection

### Access Control
Configure on-premise resource access:
- **Backend Types**: ABAP System, SAP Gateway, Non-SAP System, SAP HANA
- **HTTP Access Control**: System mapping + resource paths + policies

### High Availability
- **Master-Shadow**: Primary + backup with synchronized config
- **Requirements**: Stable network, separate machines, identical versions

**Complete guide**: `references/cloud-connector.md`

---

## Kubernetes/Kyma Connectivity

### Connectivity Proxy
Enables Kubernetes workloads to access on-premise systems.

**Installation**:
```bash
helm install connectivity-proxy \
  oci://registry-1.docker.io/sapse/connectivity-proxy \
  --version <version> --namespace <namespace> -f values.yaml
```

### Transparent Proxy
Exposes BTP destinations as Kubernetes Services.

**Installation**:
```bash
helm install transparent-proxy \
  oci://registry-1.docker.io/sapse/transparent-proxy \
  --version <version> --namespace <namespace> -f values.yaml
```

**Usage**: Create Destination Custom Resource, access as Kubernetes Service.

**Complete configuration**: `references/kubernetes-connectivity.md`

---

## Common Issues & Troubleshooting

### HTTP Error Codes

| Code | Cause | Solution |
|------|-------|----------|
| **400** | Malformed request | Check request syntax |
| **401** | Authentication failure | Verify credentials/tokens |
| **405** | HTTPS instead of HTTP | Use `http://` with port 20003 |
| **407** | Missing authorization | Add `Proxy-Authorization: Bearer <token>` |
| **503** | Cloud Connector offline | Check CC connection and Location ID |

### Cloud Connector Issues

**Cannot connect to subaccount**:
- Verify region host URL
- Check firewall allows outbound HTTPS
- Verify subaccount credentials

**Access denied to resource**:
- Check access control configuration
- Verify virtual host mapping
- Check resource path policy

**Complete troubleshooting**: `references/troubleshooting.md`

---

## Security Best Practices

### Cloud Connector
- Deploy in DMZ under IT control
- Change default password immediately
- Configure LDAP for user management
- Enable audit logging (All level for production)
- Deploy high availability (master + shadow)

### Destinations
- Use OAuth over basic authentication
- Store credentials in Destination Service, not code
- Enable TLS for all connections
- Use mTLS for enhanced security

---

## Critical Rules

### Always Do
- Change Cloud Connector default password immediately
- Use HTTPS for all external connections
- Configure access control before exposing resources
- Enable audit logging in production
- Cache tokens and destinations appropriately

### Never Do
- Expose Cloud Connector UI to internet
- Store credentials in application code
- Skip access control configuration
- Modify Cloud Connector Tomcat config files
- Run multiple master instances (split-brain)

---

## Bundled Resources

### Configuration References
- `references/http-destinations.md` - Complete HTTP destination properties
- `references/rfc-destinations.md` - RFC destination properties and pooling
- `references/mail-tcp-ldap-destinations.md` - Mail, TCP, LDAP configuration
- `references/authentication-types.md` - All 17+ authentication configurations

### Setup & Configuration
- `references/cloud-connector.md` - Cloud Connector setup and configuration
- `references/kubernetes-connectivity.md` - Connectivity Proxy and Transparent Proxy
- `references/destination-service-api.md` - REST API reference

### Advanced Topics
- `references/advanced-configuration.md` - MTA, config.json, chaining, ZTIS
- `references/identity-propagation-scenarios.md` - ABAP, NetWeaver Java, custom IDP
- `references/operational-guides.md` - Network zones, solution management
- `references/connectivity-alternatives-and-config.md` - Reverse proxy, user roles, RFC config

### Development & SDK
- `references/java-sdk-development.md` - Java APIs, JCo, SAP Cloud SDK
- `references/mail-protocols.md` - SMTP, IMAP, POP3 configuration

### Templates
- `templates/destination-http-oauth.json` - HTTP destination with OAuth template
- `templates/destination-onpremise.json` - On-premise destination template
- `templates/connectivity-proxy-values.yaml` - Helm values for Connectivity Proxy
- `templates/transparent-proxy-values.yaml` - Helm values for Transparent Proxy

---

## Documentation Links

- **Official SAP Documentation**: [https://help.sap.com/docs/connectivity](https://help.sap.com/docs/connectivity)
- **GitHub Repository**: [https://github.com/SAP-docs/btp-connectivity](https://github.com/SAP-docs/btp-connectivity)
- **Destination API**: [https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination](https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination)
- **Release Notes**: [https://help.sap.com/whats-new/cf0cb2cb149647329b5d02aa96303f56](https://help.sap.com/whats-new/cf0cb2cb149647329b5d02aa96303f56)

---

**Last Updated**: 2025-11-27  
**Next Review**: 2026-02-27  
**Source**: [https://github.com/SAP-docs/btp-connectivity](https://github.com/SAP-docs/btp-connectivity) (383 files, 352+ analyzed)

From secondsky/sap-skills at 652a861, shown as plain text under its license: GPL-3.0 (copyleft). The license text is in plugins/sap-btp-connectivity/skills/sap-btp-connectivity/SKILL.md.

• SKILL.md11 KB · 6abcf8f4f2a6
• README.md8.3 KB · 3d19ebcda21b
• agents/
• openai.yaml261 B · 279c66d0b760
• references/
• advanced-configuration.md9.0 KB · 783977a90a88
• authentication-types.md12 KB · f592e8874b0d
• cloud-connector.md11 KB · ef40a1efcb59
• connectivity-alternatives-and-config.md11 KB · 9dbc7cb7b50e
• destination-service-api.md11 KB · 9bd89b3c6fe6
• http-destinations.md7.1 KB · 586f1b1c38f8
• identity-propagation-scenarios.md11 KB · 2fe1090a6c04
• java-sdk-development.md11 KB · 8a8713e58bb4
• kubernetes-connectivity.md14 KB · f70284299c9d
• mail-protocols.md7.9 KB · 1c8ef058f5ed
• mail-tcp-ldap-destinations.md9.3 KB · ae854baad17a
• operational-guides.md11 KB · 68ebf687ba59
• rfc-destinations.md6.6 KB · fbc842843c1f
• troubleshooting.md10 KB · 71400063713b
• templates/
• connectivity-proxy-values.yaml6.0 KB · e5b4a2095b92
• destination-http-oauth.json5.0 KB · 4b9abc3b8dbc
• destination-onpremise.json5.3 KB · 25b828acf962
• transparent-proxy-values.yaml6.0 KB · ae79fdfed9ff

21 files, 183 KB in total. Each file has a sha256 in the pin's manifest; the first 12 characters are shown.