Skip to Content
Author's profile photo Former Member

SAP API Management – Connecting on-prem made simple

Up until now connecting to your on-premise system from SAP HANA Cloud Platform, API management was a little complicated. Either you were using a “classic” Reverse Proxy / DMZ setup (with all it pros and cons) or you had to do a somewhat complicated workaround (https://blogs.sap.com/2016/03/15/sap-api-management-using-cloud-connector/).

Over the last few months we have already been testing another option in several customer projects. Since it was quite successful we also decided to release it as part of the product — and that’s what you can see now! When you log on to your API management portal (be it your productive instance or the one on HCP trial) you will see  — in addition to some great UI enhancements — a new checkbox when creating an API Provider. This will now allow you to connect to your on-premise system.

But lets take a step back.

Obviously the first thing that you need to do is install and configure your cloud connector on-prem. This is explained already in several blogs (https://blogs.sap.com/2015/02/11/set-up-your-sap-web-ide-on-hana-cloud-part-2/ ) so I will only show the result in my configuration:


You can see that I have configured a Virtual Host MyOnPremSystem with port 500 which points to my on-prem system (which happens to run on the same machine, so): localhost:50001

With this configuration I can switch to my SAP HANA Cloud Platform Cockpit from where I can see under Connectivity – Cloud Connectors the successful connection to the on-prem system:

That’s all that you need (just remember [copy] the host name displayed here). Let’s go to the SAP API Management Portal and from the “Develop” (Pencil) icon on the left select “API Provider”. Next click on “Create” to create a new provider:

Now you enter the information (as you would have done previously), but make sure to check the box next to On-Premise.

In my case (since I am connecting to a SAP Gateway system), before you click on Save, click on the “Catalog Service Settings” and enter the information to the CatalogService, e.g. /sap/opu/odata/IWFND/CATALOGSERVICE/ServiceCollection. Under the Authentication Tab you might also want to fill in authentication details to connect to the Catalog service.

Now that’s it and you can click on Save.

To test the new connectivity, just create a new API Proxy:

From the drop-down select the API Provider you just created and click on Discover:

You should see a list of all the OData service from your on-premise SAP Gateway system. Just continue as you have before:

After saving the new API Proxy you are ready to test it!

And with these few steps you have now exposed your on-prem OData service via SAP HCP, API management to the internet!

Assigned Tags

      18 Comments
      You must be Logged on to comment or reply to a post.
      Author's profile photo Jan Almkvist
      Jan Almkvist

      Thanks Holger!

      It works very well with an Odata service. However I have struggled to do the same thing with an existing SOAP Enterprise Service. However when I am adding a resource(operation) I can’t save the API without getting an error:

      “Unable to register API” and [Request ID: 0ef2d71f-cf76-4818-a1bb-c543d1235f0e]
      String index out of range: 0

      It seems it’s related to the adding of the resource since I have no problem saving it without a resource but then I get the service unavailable respone when testing of course.

      What could possibly be wrong?

      Janne

      Author's profile photo Kinnera Christina Tenali
      Kinnera Christina Tenali

      Hello Holger,

      Very useful Blog !!

      I was able to create the API provider in API portal and also the catalog link works fine.

      However, when i try to create an API using the API provider, I get the below message

      Request ID: a21f59e2-c0e0-439f-9f75-3ea1a5bb51c8] Unable to fetch data from the catalog due to incorrect credential of selected API Provider. Check the credential and try again.

      I have checked the credentials maintained in the destination created for the API provided in API management. It looks fine.

      Is it that the oDATA service catalogue link points to some default client ? how do we know which client it is pointing to? I'm unable to maintain the property 'sap-client' in the destination of API management. Is this a bug ?

      Appreciate your inputs.

      Regards,

      Christina.

       

       

       

      Author's profile photo Former Member
      Former Member

      Hi Christina,

       

      what happens if you open the full Catalog URL in a new browser window (so that you have to enter your credentials again?) Is the authentication working then? You should be able to change the default SAP client, by adding

      ?sap-client=xxx

      to the URL.

      Hope this helps,

       

      Holger.

       

       

      Author's profile photo Kinnera Christina Tenali
      Kinnera Christina Tenali

      Hello Holger,

      Thank you for the hint on the 'sap-client' addition. The issue is resolved now!!

      I made two changes

      1. In the cloud connector configuration, I deleted and recreated the access control settings of my on-prem system. This time the virual host name was different to the actual host name
      2. In the API provider, I checked the 'Trust All'  checkbox in the service catalogue settings

      Thank you again for the blog and your response :).

      Regards,

      Christina.

       

       

      Author's profile photo Shivam Bedwal
      Shivam Bedwal

      Hi Christina,

      I am also same error when creating an API. How did your issue was resolved?

       

      Thanks,

      Shivam

      Author's profile photo Marcus Schiffer
      Marcus Schiffer

      Tried that with my own systems and it worked pretty well until today.

      Without any changes in the settings I get the following error:

       

       

      {
          "fault":{
              "faultstring":"Unable to identify proxy for host: sxxxtrial-trial.apim1.hanatrial.ondemand.com:9005 and url: \/sxxxtrial\/ZVBAK_SRV\/vbakSet",
              "detail":{
                  "errorcode":"messaging.adaptors.http.configuration.ApplicationNotFound"
              }
          }
      }
      

       

      What might be wrong here ?

      Any help is appreciated !

      Author's profile photo Bobu Putheeckal
      Bobu Putheeckal

      I think we need to mention the URL and API Provider in the TARGET ENDPOINT section in the API

      Author's profile photo Himanshu Mundra
      Himanshu Mundra

      Hi  Former Member ,

      I am trying to add my On Premise system in API Provider but getting this error.

       

      Appreciate your inputs.

      Regards,

      Himanshu

       

      Author's profile photo Damien Wieser
      Damien Wieser

      Hi Holger,

      I followed your Steps to add my on-premise Gateway as an API Provider in API Management but the discovering of services ends with an Error while opening catalog URL in a Browser works fine.

      The Catalog also works well in the WebIde when selecting a Service for a Projekt.

       

      What could be wrong?

       

      Regards

      Damien

      Author's profile photo Abi G
      Abi G

      Damien… Please let me know if you were able to resolve this issue. Thx

       

      Author's profile photo Damien Wieser
      Damien Wieser

      Hi Abi,

      Yesssss ! I could resolve the issue. A little thing after a long investigation 😉

      The reason is the order of the logon methods SAP runs through to check the credentials. After you

      configure your SAP Cloud Connector with System Certificat in order to allow pricipale propagation, it changes the way SAP trys to connect the user even for basic authentication.

      Basicaly SAP walks sequentially through the list of Methods stored in the "logon data" tab and stop at first faile.

      Solution:

      You can change this sequence or simply set the Checkbox "Use All Logon Procedures" in "logon data" tab of SICF Transaction (See screenshot below).
      The new configuration can be done individually on a path or an entire Tree.

      Kind Regards

      Damien

       

       

      Author's profile photo Krishna Kammaje
      Krishna Kammaje

      Thanks, Damien. Looks like everyone is facing this issue even after three years of your post and yours is the only documented solution. 🙂

      Author's profile photo Damien Wieser
      Damien Wieser

      Author's profile photo Christoffer Fuss
      Christoffer Fuss

      Hi Damien,

       

      I have the same issue. Is there no other way to solve this?  I cannot change the "opu" node, how have you done it?

      Best Regards,

      Chris

      Author's profile photo Gregor Wolf
      Gregor Wolf

      Dear Chris,

      you can use Aliases in SICF to override the setting.

      Best regards
      Gregor

      Author's profile photo Abi G
      Abi G

      Damien... Please let me know if you were able to resolve this issue. Thx

      Author's profile photo Gopi Sagi
      Gopi Sagi

      Hi Damien,

      We had same issues and after changing the service as you described, the issue resolved.

      Author's profile photo enio ferreira
      enio ferreira

      Hi Guys,

       

      Did anyone get the error below while trying to create the API?

       

      The server encountered a temporary error and could not complete your request. [Request ID: fc097aff-f178-4af5-b612-9208ce5670fa]