Versions Compared

Old Version 1

changes.mady.by.user SNP

Saved on

compared with

New Version Current

changes.mady.by.user Robert Adamec

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

This article describes a process required to establish a connection from SAP to Azure Data Lake Storage Gen2.

Table of Contents

Prerequisites

  • SAP NetWeaver 7.01 SP-level 015

  • HTTPS service enabled

  • SSFLIB Version 1.850.40 ; CommonCryptoLib (SAPCRYPTOLIB) Version 8.5.20 (+MT)

Azure storage configuration

This section describes the steps needed for the preparation of the landing area on the Azure side.

Storage Account and ADLS container

To create the MS Azure storage account, follow the official documentation Create a storage account to use with Azure Data Lake Storage Gen2.


Landing area (container/directory)

Create a container or a directory within the container where all files extracted from the SAP system will be stored.
In Microsoft Azure Storage Explorer, select the container/directory that will be used and set appropriate permissions depending on the authentication method chosen.
Image Modified

Authentication

Authentication to ADLS can be delivered by two methods:

...

The SAS token should grant permission to Create, Read, Write, Delete and List.
Click Generate SAS token and URL.
Copy Blob SAS token string and store it for configuration on the SAP side.

OAuth 2.0 Authentication

OAuth 2.0 required application registration. To create a new registration, follow these steps:

  1. Go to Azure Active Directory > App registrations > New application registration.

Image Modified

2. Fill in the required fields and click Create.

3. Write down Application ID and Directory ID, as it will be required later during the Storage management configuration.

Image Modified

4. Click Certificates & secrets and generate a New client secret. Write down the secret, which will be used later during the configuration.

Image Modified

5. Allow access to the registered application (Client ID) to the landing area.

...

6. The registered application also needs to execute permission on ALL parent directories and filesystem (enabling directory structure traversal).

SAP system configuration

After preparation is complete on the Azure side, fill in the required information on the SAP side to establish a connection.

STRUST

To enable verification of server authenticity and encrypted communication (HTTPS), SSL certificates need to be added to the SAP system's STRUST.
To download relevant certificates, open a web browser in private mode and navigate to storage account FQDN in the format: https://<container>.dfs.core.windows.net
The browser will return an InvalidUri error, but will offer an interface to download the certificates:

Image Modified

Image Modified

Image Modified

Image Modified

Image Modified

Please make sure to download all three certificates to have a full certificate chain:

Image Modified

Image Modified


In STRUST, import these certificates into SSL Client (Anonymous) PSE. After the import, click Save.
Image Modified

If OAuth authentication is to be used, repeat the same steps for certificate management with the address https://login.microsoftonline.com.
The address uses the following certificate chain:
Image Modified

When the PSE is updated, run the transaction SMICM and restart the ICM services.

Image Modified

Storage RFC

Create RFC type G for Azure Data Lake Gen2 primary endpoint.

  • Set Target Host to your ADLS address (e.g. dvdadls2.dfs.core.windows.net).

    Note

    Target host must contain <host>.dfs.core.windows.net in FQDN.
    That guarantees ADLS Gen2 API will be addressed.


  • Set Path Prefix to ADLS container.

  • Set SSL to Active and Certificate list to ANONYM SSL Client (Anonymous).
  • Set HTTP Version to 1.1 and Compression to Active.
    Note

    Active compression can cause communication problems in combination with ICM kernel version 753 patch number 1100 and higher.

    In this case, we recommend switching the compression off (Inactive).

...

  •  to Inactive.


Image Added

OAuth 2.0 Authentication RFC destination

This step is required only if OAuth authentication is chosen.

Create RFC of the type G for the Microsoft Active directory. This RFC represents a connection to the authority server that grants an authentication token for ADLS. 



Note

On some new SAP Kernel releases (Kernel 753, Patch 1210 and higher) Compression setting causes problems and should always be set to Inactive. 

Storage Management

In this step, the actual connection to the landing area is created.

  1. Execute transaction /DVD/SM_SETUP.
  2. Switch to Edit Mode and click New Storage.
  3. Choose storage type ADLS_GEN2 and specify Storage ID.

  4. Specify the following parameters:

      • HTTP RFC Destination: Storage RFC destination created previously.
      • Path Prefix: /<path to landing area> within ADLS container.
      • HTTP Call Repeat: Specify the number of times the HTTP request will be retried in case of failure (0 = no repetition).
      • Repeat Delay (seconds): Seconds between repetitions - if not filled, the default value will be set to 3 seconds (instead of 0).


The bottom part of the storage connection configuration depends on the authentication method chosen.

...

b) If the OAuth authentication method is chosen, fill in the OAuth profile with information recorded during application registration:

OAuth 2.0 profile: The ID of the profile.
Client ID: Application ID created in the section Creating Application Registration.
Client secret: Key created in the section Creating Application Registration.
Resource: Static address https://storage.azure.com/.
Tenant: Part of the URL identifier is described in the section Tenant.

Confirm storage creation by saving the information (Ctrl+S).

...

Failover (Read-only) storage enables the utilization of Azure Storage Redundancy, e.g. read-access geo-redundant storage (RA-GRS) or read-access geo-zone-redundant storage (RA-GZRS), to improve high availability/disaster recovery. For more information about Azure replication strategies, refer to official Microsoft documentation Azure Storage redundancy.

When the primary storage is unavailable, i.e. connection check fails, the application will automatically switch to Failover storage for data read from another data center in a secondary region. Follow the procedure below to enable it on the SAP side.

...

After that, additional parameters appear in Storage Management settings (transaction /DVD/SM_SETUP), where you can specify HTTP Destination to your Failover storage and SAS token.

Failover storage RFC

Create RFC type G for Azure Data Lake Gen2 secondary endpoint.

  • Set Target Host to your secondary ADLS address - it is the same as for primary storage, but appends the suffix –secondary (e.g. dvdadls2-secondary.dfs.core.windows.net) and Path Prefix to /<filesystem>/<Path to landing folder>.

  • Set SSL to Active and Certificate list to ANONYM.
  • Set HTTP Version to 1.1 and Compression to Active

...