Skip to Content

How to connect via SAP Cloud Platform Integration to my On-Premise mail server

You may use the SAP Cloud Connector to securely connect to On-Premise systems. SAP Cloud Platform Integration supports this configuration via the connection proxy type ‘On-Premise’ currently in the following receiver adapters:

  • AS2 (enterprise license only)
  • OData
  • HTTP
  • IDOC
  • LDAP
  • SOAP | SAP RM
  • SOAP | SOAP 1.x

This includes support for connections to multiple SAP Cloud Connectors. For this use case you specify in your SAP Cloud Connector configuration a Location ID which you refer to in your receiver adapter configuration. Please check our documentation for details.

With the July 2017 release of SAP Cloud Integration we release an RFC receiver adapter which refers to a SAP Cloud Platform destination and mandates SAP Cloud Connector usage, too. Details will be discussed in a dedicated blog and are documented in our product documentation.

What I want to emphasize here is the SAP Cloud Connector support added for the mail receiver adapter in our July 2017 release. This configuration utilizes the SOCKS5 proxy supported in SAP Cloud Connector version 2.10 and higher.

You may use it in your mail receiver adapters to connect via TCP to your On-Premise mail server. This scenario required so far dedicated ports to be opened in your fire-wall which was often not supported by your security policy. Opening of ports is now obsolete.

I assume you have already installed the SAP Cloud Connector and connected it to your SAP Cloud Platform account in which your subscription to SAP Cloud Platform Integration resides. If not download a SAP Cloud Connector from our tools page and follow it’s installation documentation.

All you need to do now is to

  1. configure a new Cloud to On-Premise system mapping in your Cloud Connector and
  2. configure your mail receiver adapter accordingly

Let’s go step by step. Logon to your Cloud Connector and add a Cloud to On-Premise system mapping. Maintain the parameter in the wizzard as follows.

Set the backend system type to ‘non SAP System’.

Select the ‘TCP’ protocol. The configuration options for TCP are not as specific as for e.g. HTTP, i.e. the SAP Cloud Connector may not restrict potential misuse from your SAP Cloud Platform account. This is referred as security risk.

Maintain your On-Premise mail server & port you want to connect to.

Define the virtual mail server & port you want to expose to your SAP Cloud Platform Account (it will be re-used later in the mail receiver adapter configuration).

Maintain an optional description, tick the ‘Check Internal Host’ checkbox (to have enable the ping test from SAP Cloud Connector to your On-Premise mail server) and finish.

You may check and maintain you system mapping in the Cloud To On-Premise overview.

Logon to your Cloud Platform account and check the corresponding Cloud Connector status.

If all is fine you may consume your just established TCP connection in the mail receiver adapter. Log on to the Cloud Integration WebUI and maintain the connection parameter in the mail receiver adapter properties as follows.

Maintain the virtual mail server name & port for the proxy type ‘On-Premise’. Maintain the protection & authentication configuration as required by your On-Premise mail server.

Done. Start sending mails from SAP Cloud Platform Integration via your own OnPremise mail server.

 

12 Comments
You must be Logged on to comment or reply to a post.
  • Hi Andreas, thank you very much for your stuff!!!

    I need to make a non-sap connection on my cloud connector and I would like to ask a question with you. My scenario is very simple: I need to extract data from my oracle database and send it to my hana database within my ecc.

    I understand that on the side of my Cloud Connector I want to create a TCP connection

     

    But I had some doubts regarding the implementation of this configuration, can you help me?

    *** Cloud Connector ***
    1) In the onpremise to cloud connection, will only my hana database (cloud) be mapped?
    2) In the cloud to onpremise connection, does sap recommend using TCP or using TCP SSL? Why?
    3) In the cloud to onpremise connection, on the hostname should I put the path of my oracle database?

    *** SAP Cloud Platform ***
    1) I need a destination in hcp, right? But how would that be? I saw there that the creation options are: HTTP, LDAP, MAIL and RFC only.

    Sorry for that lot of questions Andreas, you have very little documentation on this and I wanted to understand in detail how to proceed …

    Anyway, thank you very much for your support.
    Cardinal, T.

  • Hi Andreas Quenstedt ,

    Thank you for great information !!!

    Would SAP recommends SAP HCI (mail Adapter)–> HCC (via TCP) –> On Premise mail Exchange server.

    We have to address the Security risk for the above mentioned approach. Whats the SAP Approach -Mail Exchange (Cloud to On-premise Exchange Server) which is security compliant.

    Select the ‘TCP’ protocol. The configuration options for TCP are not as specific as for e.g. HTTP, i.e. the SAP Cloud Connector may not restrict potential misuse from your SAP Cloud Platform account. This is referred as security risk.

    Best Regards,
    Suresh S

    •  

      Hi Suresh,

      the risk is limited to potential misuse from your own SAP Cloud Platform account. If this is not acceptable in your context you should not use the described option.

      I describe an alternative here.

      Thanks & regards,

      Andreas

  • Dear Andreas,

    Considering above mentioned approach, Could you kindly clarify following queries ?

     

    1. From HCI level can we maintain SMTPS or STARTTLS for Transport level security?

     

    1. Do we need to maintain mail server User credentials in HCI Key store (since dummy user has been used in HCI for ECC web service connectivity) ?

     

    1. How Transport level security been established/achieved between HCI and HCC ? Protocol adopted.

     

    1. What are the security risks foresee via this approach?

    Best Regards,
    Suresh S

  • Hello Andreas,

    Thanks for your valuable post. I did follow the above config steps. In the Cloud Connector the virtual host is reachable, however when I try to do smtp test connectivity, it fails. I got the error:

    com.sun.mail.util.MailConnectException: Couldn’t connect to host, port: smtp.xxxx.com, 587; timeout 15000 Cause: java.net.UnknownHostException: smtp.xxxx.com

    FYI, I am able to use the smtp server in our local network and also we have some back end systems that work using the cloud connector.

    Thanks

    Abdel

    • Hi Bekkaoui,

      The above issue should be fixed by the following 2 steps

      1. In Cloud Connector, open Connector view, edit Subaccount, configure Location ID  with any value.
      2. Use the above Location ID into Receiver adapter of CPI (In CPI, Receiver channel –> Connection tab –> Location ID)
  • Hello,

    I try to get the alerts from the HANA 1.0 from the Neo Environment over the Cloud Connector to our internal Mail server over port 25, no authentication needed.

    I setup the cloud connector like described above, but the HANA doesnt connect to it.

    What are the parameters in need to specify in the HANA in the smtp settings or the alert settings?

    https://…….hana.ondemand.com/sap/hana/xs/admin/index.html#smtp

    Best regards

    Martin

  • Hi Andreas,

    Can we use same connection for the sender email(on-premise) scenario. Do we have any limitation or anything to consider. Correct my understanding here if i am wrong, I have a scenario like on-premise email server to cloud where sender scheduled  email channel polls the message from email on every run so does it make the scenario as cloud to on-premise. when i tried the scenario after configuring the TCP  connection in cloud connector as mentioned in blog, we deployed the iflow and getting below error. What could be the reason?

    Thanks in advance.

    “Error = com.sun.mail.util.MailConnectException: Couldn’t connect to host, port: smtp-xx.xxxx.com, xx; timeout 30000;
    nested exception is:
    java.io.IOException: Proxy error opening tunnel: Network unreachable. Check that a mapping to the target system is configured in Cloud Connector., cause: java.io.IOException: Proxy error opening tunnel: Network unreachable. Check that a mapping to the target system is configured in Cloud Connector.”

  • Hello,

    I am trying to connect mail server via cloud connector from CPI. CC status is reachable for mail server. But i get error while deploying iflow:

     

    [CAMEL][IFLOW][ERROR] : Integration flow failed.   [CAMEL][IFLOW][EXCEPTION] : org.osgi.service.blueprint.container.ComponentDefinitionException: Error when instantiating bean Receiver_Mail of class org.apache.camel.Endpoint     [CAMEL][IFLOW][CAUSE] : Cause: org.apache.camel.ResolveEndpointFailedException: Failed to resolve endpoint: smtp://virtual_mail:99?connectionTimeout=30000&mail.smtp.auth.digest-md5.disable=true&mail.smtp.auth.login.disable=true&mail.smtp.auth.ntlm.disable=true&mail.smtp.auth.plain.disable=true&mail.smtp.auth.xoauth2.disable=true due to: host must be specified and not empty       [CAMEL][IFLOW][CAUSE] : Cause: java.lang.IllegalArgumentException: host must be specified and not empty

     

    What could be a reason?

    Nurhan