SAP INTEGRATION AND

CERTIFICATION CENTER

SAP E-WAY BILL FOR INDIA - INTEGRATION

WITH GSP (GST SUVIDHA PROVIDER)
VIA SAP CLOUD PLATFORM INTEGRATION

EWB-IND-GSP SET UP
GUIDE
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

Introduction:

The e-way bill solution requires the integration between SAP Business Application (ERP/S4HANA)
and GSPs. The following documentation describes the steps to adapt and deploy the SAP Cloud
Platform Integration content flow to establish the communication between SAP Business
Application and GSPs.

Before you start with the activities mentioned in this document, please ensure to read
through this complete document.
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

Section I: Pre-requisites for SAP customers from SAP

Ensure that the following prerequisites are met:

- SAP E-way bill (EWB) for India solution should be available in your landscape. For detailed
information on installation and implementation, refer SAP note: 2631687*

- Provisioned live SAP Cloud Platform Integration (SCPI) pre-production and/or production
tenants.
o Remember your Account URL, Web UI URL, Runtime URL
Sample:
Account URL: https://account.hana.ondemand.com
Web UI URL: https://xxx-tmn.avt.eu1.hana.ondemand.com/itspaces
Runtime URL: https://xxx-iflmap.avtsbhf.eu1.hana.ondemand.com

▪ Use your P-user or s-user to login. If you get HTTP status 403 error, kindly
contact your Tenant Administrator

o Role:
▪ SCPI service user should have ESBMessaging.Send role
▪ user should have AuthGroup.Administrator role to perform steps related to
KeyStore, client certificate mapping and User credentials

- Completed registration with GST Suvidha Provider(GSP) system and have received the
following:
o GST Suvidha Provider(GSP) integration/set up manual.
o Trusted certificates from GSP for SSL handshake.
o GSTIN (NIC) public key certificate
o GSTIN (NIC) user credentials
o other required technical details from GSP
o Two Integration Flows (.zip files) from GSP and save to any local location in your
desktop
▪ GSP integration flow [Integration Flow specific to GSP]
▪ Router integration flow [Routes e-Way Bill request from SAP business
application to specific GSP Integration Flow]
o Please ensure to read through the assessment report shared along with this set up
documentation
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

Section II: Establish the connection between SAP Cloud Platform Integration (SCPI) and
GSP

Step 1 – Create new keystore and import trusted certificate into the keystore
Note: You can use tools like Keystore Explorer to create a new Keystore.

Step 2 – Deploy keystore

In SCPI Web UI URL, To deploy keystore, go to Monitor  manage security  keystore 
add keystore (fill parameters here)  click deploy  click ok.
Note: To perform above operation, you need to be a tenant administrator with role
AuthGroup.Administrator
You can refer help document here

Step 3 – connection test (recommended)

In SCPI Web UI URL, To check the connectivity with GSP, go to Monitor  manage
security  connectivity tests  enter GSP base url without https and port  click send = Reponse
should be ok.

Step 4 – Deploy NIC public key certificate

In SCPI Web UI URL, To add NIC public key certificate, go to Monitor  manage security
 keystore  add keystore  browse to NIC public certificate and maintain passphrase (sample
name: niccert)  click deploy  click ok.

Step 5 – Add user credentials per GSTIN from NIC provided by your GSP
In SCPI Web UI URL, To add user credentials, go to Monitor  manage security 
security material  add  click user credentials (fill parameters here)  click deploy
You can refer help document here

Name GSTIN of the business place to which this user belongs

Description any relevant text (optional)
User User id provided by NIC/GSP
Password/Repeat password password

Step 6 – Deploy client certificate to SCPI (optional but highly recommended)

- Download client certificate from source system.
- In SCPI Web UI URL, Go to to Monitor  Manage Security  Manage Certificate-to-User
Mappings  click add  add user name as SCPI user name (this user must have
ESBMessaging.Send role assigned) and certificate as client certificate from source system

Step 7 – create content package

In the Web UI URL of the tenant, go to Design  create 
- In Header, give meaningful name (technical name), short description. Then click save.
Package will be successfully created.

Step 8 – Deploy GSP iflow

SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

- Now within the content package, in artifacts tab, click add  integration flow  choose
upload  browse to the gsp iflow zip file, give any name, description, sender, receiver 
click ok. Now, integration flow is successfully added.
- Select the gsp integration flow. System displays the iflow screen.

Double click the ‘processdirect’  adapter specific  connection details – address  make
note of this value (sample: /gsp)

Note: You should enter the service provider name as same as address value (without
slash) in the business application  sm30  in view “EDOINEWBGSPV”.

- After that to configure and deploy:

In artifacts screen, against the gsp iflow, click on actions icon  configure  Define the
externalized parameters as provided by GSP to SAP customer.  Once parameters are
updated, click save then deploy. (you can refer parameter description in assessment report
and take exact values from GSP)
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

Note: NIC public key alias value is alias you have entered as same as the alias of the NIC
public key certificate you deployed (niccert).

Step 9 – Deploy Router iflow

- Now within the same content package, in artifacts tab, click add  integration flow  choose
upload  browse to the router iflow zip file, give any name, description, sender, receiver 
click ok. Now, integration flow is successfully added.
- Select the Router integration flow. System displays the iflow screen
- Double click the ‘processdirect’  adapter specific  connection details – address 
maintain as /<gsp name>
- After that to configure and deploy:
In artifacts screen, against the router iflow, click on actions icon  configure  verify the
value as below

click save then deploy.

Note: The endpoint URL of the router iflow is https://<Tenant Runtime

URL>/cxf/indiaewaybilledoc
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

Remember:

1) After successful deployment, check the integration flows are in started state by choosing
monitor  manage integration content.

2) Any issues with SCPI tenant, please report under SAP component: LOD-HCI-PI-OPS

3) Any issues with EWB, please report under SAP component: XX-CSC-IN-EWB

4) Any issues with GSP system access, please report through GSP defined support
mechanism

Important links:

SAP Cloud Platform Integration:

https://help.sap.com/viewer/product/CLOUD_INTEGRATION/Cloud/en-US

SAP CPI – overview of authorization groups:

https://help.sap.com/viewer/368c481cd6954bdfa5d0435479fd4eaf/Cloud/en-
US/2937e5ca6ef448cfb21451a2461cc2a6.html

SAP CPI – user credentials:

https://help.sap.com/viewer/368c481cd6954bdfa5d0435479fd4eaf/Cloud/en-
US/6912d63bbbc64aee8bbd4ff10314c60c.html

SAP CPI – Importing a keystore:

https://help.sap.com/viewer/368c481cd6954bdfa5d0435479fd4eaf/Cloud/en-
US/0db193a325a94675928e717c9310734a.html
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

Appendix:
Appendix A:
Know information about your SAP Cloud Platform Integration tenant

With SAP eWay bill solution, you get two Cloud Platform Integration tenants. For each tenant, you get a welcome email
outing the details about the tenant.
We recommend that you use one tenant for development/testing, and another for production.

Appendix B:
Know to add Members to SAP Cloud Platform Integration (SCPI) Account

To add members to the SAP Cloud platform integration account, follow the below steps:
1. Logon to the Account URL with the SAP ID user provided in the mail.
2. Add members and assign roles on this account by navigating to Members  Add Members.
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

3. Assign the following Roles.

• Administrator - Assign role Administrator to the user who is supposed to have the full permissions of an administrator
• Application User Admin - Assign role Application User Admin to the user who is supposed to have restricted
administrator permissions

Appendix C:
Know to Provide Authorizations to SAP Cloud Platform Integration (SCPI) Users

To add Authorizations to the existing users:

1. Logon to the Account URL with the SAP ID user provided in the mail.
2. In the Navigation Pane, choose Security  Authorizations
3. Create a Group and Assign the Roles and Assign users for this Group.
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

The authorization group AuthGroup.Administrator is designed for the administrator at customer side who administers a
(customer-specific) tenant management node.
For more details refer here.

Appendix D:
Know to Create a Service User in SCPI

1. Register a new user at https://account.hana.ondemand.com/#/home/welcome

2. Assign the ESBMessaging.Send role to the user

Appendix E:
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

Know to Add New Certificates or Private Keys to the SCP Integration Tenants Keystore

You can add the security artifacts like keystore entries following the process mentioned here

You should have Tenant Admin authorizations (AuthGroup.Administrator role) for the tenant to perform this operation.
1. Navigate to Monitor->Manage Security->Keystore

2. Enter the new Keystore Entry

3. Click on Add button

System displays the Add Keystore screen

4. Browse the relevant Keystore. Click on Deploy.

System displays the following message.
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

5. Click on OK.

Appendix F:
Know to Deploy Client Certificate to SCPI

For inbound HTTP connections to SCPI, you define Authorization options for the communication user associated with the
sender system to define how it accesses the Cloud Integration components. We recommend that you use Client-
Certificate with certificate-to-user mapping. Using this option, authentication of a sender is performed based on a client
certificate. With a certificate-to-user mapping, the certificate is mapped to a user, whose authorizations are checked on
the tenant.

1. Navigate to Monitor->Manage Security-> Manage Certificate-to-User Mappings

2. Click on Add button

3. Enter the service user and deploy the client certificate obtained from SAP ERP
Note that the service user should have the ESBMessaging.Send role assigned to it.
For more information on how to obtain client certificate obtained from SAP ERP, refer the Master guide attached to SAP
Note 2631687.
SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

Appendix G:
Know to Add User Credentials (per GSTIN credentials provided by GSP/NIC) to SCPI?

You register user per business place in NIC. Use the following steps to add these NIC users in SCPI:
1. Go to Security material. Navigate to Monitor->Manage Security->Security Material

2. Add a new user credential

3. Click on User Credentials

4. Add and Deploy the user credentials

SAP Integration and Certification Center EWB-IND-GSP Set Up Documentation

Note that in the Name field, enter the GSTIN of the business place to which this user belongs.

Copyright/Trademark