Sunteți pe pagina 1din 32

7/31/2019

Process Orchestration
Generated on: 2019-07-31

SAP NetWeaver 7.5 | 7.5.15

PUBLIC

Warning

This document has been generated from the SAP Help Portal and is an incomplete version of the official SAP product
documentation. The information included in custom documentation may not re ect the arrangement of topics in the SAP Help
Portal, and may be missing important aspects and/or correlations to other topics. For this reason, it is not for productive use.

For more information, please visit the SAP Help Portal.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde372… 1/32
7/31/2019

Process Orchestration
Use
Process Orchestration provides a tool infrastructure to model and design business processes - from the overall process ow and
the sequence of activities up to the interfaces and data types that are needed to integrate SAP systems and external systems.

It combines the integration capabilities of SAP Process Integration Advanced Adapter Engine Extended (AEX) with the process
modeling, operation, and monitoring capabilities of SAP Business Process Management (BPM). Like AEX, Process Orchestration
is based on AS Java only.

The package is based on the following components:

Advanced Adapter Engine Extended

AEX provides the connectivity capabilities of the Advanced Adapter Engine (AAE) as well as design and con guration tools
(ES Repository and the Integration Directory) to set up integration scenarios.

More information: Advanced Adapter Engine Extended

Business Process Management and Business Rules Management

BPM and Business Rules Management allow you to design, execute, and monitor business processes.

More information: Business Process Management

Deployment

You can obtain Process Orchestration by installation or by adding the corresponding usage types to an existing SAP NetWeaver
system. For latter, both are supported, deployment of BPM on an existing AEX system and deployment of an AEX on an existing
BPM system.

Process Orchestration runs on one system. Deployment on more than one system is not supported.

For more information about features and constraints for the AEX and BPM runtime integration, see AEX and BPM Runtime
Integration

Concepts
Use
Process Orchestration provides an integrated tool infrastructure to model and design business processes - from the overall
process ow and the sequence of activities through to the interfaces and data types that are needed to integrate SAP systems and
external systems. In addition, it provides the tools to con gure business processes for speci c system landscapes.

The package is based on the following components:

Components of the Advanced Adapter Engine Extended (AEX), in particular:

Enterprise Services Repository

Enables you to design integration content like service interfaces and mappings, for example.

Integration Directory

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde372… 2/32
7/31/2019
Con guration tool that allows an integration expert to con gure integration content, in particular: One the one
hand, to specify the business communication between business systems and the Process Integration &
Orchestration Package and, on the other, to specify the connectivity between the BPM process and the Process
Integration runtime.

Advanced Adapter Engine

Process Integration runtime component that allows you to process XML messages.

More information on this installation option: Advanced Adapter Engine Extended

Business Process Management and Business Rules Management engines

Allows an integration expert to model business processes and to execute and monitor the business processes (BPM-based
applications) at runtime.

More information: Business Process Management , Business Rules Management

The involved components are illustrated in the gure below.

Interaction of the Components

As shown in the gure above, the components interact in the following way:

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde372… 3/32
7/31/2019
During installation time, the components of the AEX and of Business Process Management (BPM) (usage types PI-AEX
and BPM) are installed on the same technical system (same system ID).

Note
That means, that, technically, only the Java stack is involved.

At design time, an integration expert uses the Process Composer of SAP BPM to model the business process (BPM
process). The Process Composer is part of SAP NetWeaver Developer Studio.

More information: Concepts (Process Composer)

Using the Enterprise Services Repository (ES Repository), an integration expert de nes the relevant integration content,
for example, data types, service interfaces and mappings.

More information:

Interface Objects

Mapping Objects

To make these ES Repository content available also for a BPM process, service interfaces and mappings de ned in the ES
Repository can be imported into the process composer. This option enables a loose integration between the ES Repository
and the Process Composer.

In order to con gure the BPM process and the integration content for usage in a speci c system landscape, an integration
expert uses the Integration Directory as central tool.

In the Integration Directory, the relevant communication channels are de ned in order to specify the connectivity with the
(external) business systems.

The business systems themselves are represented as communication components. Business systems that are de ned in
the System Landscape Directory (SLD) are represented as business system components, whereas external partners
(typically used in business-to-business communication) are represented by business components (and optionally
communication parties).

Applications that are implemented as BPM process are represented as business components. The interfaces that are used
by the BPM process are assigned to the business component manually in Integration Directory.

The technical communication between the BPM process and the AAE is speci ed by communication channel with adapter
type SOAP. As with regard to Process Integration capabilities the AEX is used, integrated con gurations are used to specify
routing, mapping, and sender and receiver channels.

More information: Con guration Time

At runtime, the Advanced Adapter Engine (AAE) is used as runtime engine (message hub) to enable the communication
between business systems and Process Orchestration. Therefore, all adapters that are part of the AAE can be used.

More information: Advanced Adapter Engine

The “internal” communication between the AAE and the BPM runtime is based on the XI 3.0 protocol (using a SOAP
communication channel).

More information: AEX and BPM Runtime Integration

At runtime, a business process is monitored using the monitoring capabilities of SAP BPM and AEX (not shown in the
gure).

Note

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde372… 4/32
7/31/2019
As shown in the gure, a non-central AAE can also be connected to the Process Orchestration hub. However, a separate BPM
usage type cannot be installed on the system of the non-central AAE.

More Information
For more information on the security-relevant aspects of Process Orchestration, see Security Aspects of Process Orchestration

Note
This documentation also provides more details regarding the interaction of the components at runtime.

PI and BPM Runtime Integration


Use
The integration of Advanced Adapter Engine Extended (AEX) and Business Process Management (BPM) processes is based on the
XI 3.0 message protocol.

The following gures show the AEX and BPM runtime integration.

To explain in more detail how the components interact at runtime, the following gures describe the sequence of message
processing.

Message Processing from AEX to BPM

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde372… 5/32
7/31/2019
An external business system sends a message to the Process Orchestration system. According to the settings of an integrated
con guration (with a key that matches the message header address elds), a business component representing a BPM process is
determined as a receiver and a communication channel is used that is based on the SOAP adapter with XI protocol. Messages
from AEX are processed by the Java Proxy Runtime (JPR) as shown in the gure above. The Java Proxy Runtime ensures reliable
messaging and duplicate check and hands over messages to the Web service runtime. From there, messages are processed to the
BPM runtime. The system executes the BPM process after a process is started or a message is delivered to an intermediate event
step.

Message Processing from BPM to AEX

At runtime, a con gured automated activity in a process instance sends messages to the Web service runtime as depicted in the
gure above. The Web service runtime hands over messages to the Java Proxy Runtime. The Java Proxy Runtime sends XI 3.0
messages to AEX. An Integrated Con guration object with a communication component representing the BPM process and a
sender SOAP channel with message protocol XI 3.0 and the assigned outbound sender service interface are con gured to further
process messages coming from the BPM process.

Features and Constraints

For message exchange between AEX and BPM, you can use XI 3.0 compatible service interfaces. Other interface patterns
are not supported.

Service interfaces must be de ned in the ES Repository. Do not use service interfaces from other sources.

For asynchronous (reliable) messaging from AEX to the BPM process, use the SOAP Adapter with message protocol XI 3.0.
For synchronous messaging, use the SOAP Adapter with message protocol XI 3.0 or SOAP 1.1.

SAP BPM supports quality of service Best Effort and Exactly Once, Exactly Once in Order is not supported.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde372… 6/32
7/31/2019
BPM does not support acknowledgment handling.

BPM does not support message attachments.

Con guring Message Processing from PI to


BPM
Use
You use a message start event or an intermediate message event in your BPM process to process messages from the Advanced
Adapter Engine Extended (AEX) to a BPM process.

In AEX, you con gure a communication component representing the BPM process and a communication channel using a receiver
SOAP adapter with message protocol XI 3.0. Con gure an Integrated Con guration object using the communication component
and the communication channel. An inbound service interface de ned in the ES Repository determines the structure of messages
that are exchanged.

The following procedure only describes steps in the BPM process and objects in AEX that are necessary for message exchange.
You have to add other steps of your process. In AEX, add information about the message sender and for example mapping and
routing de nitions.

Prerequisites

Caution
Use a service interface to trigger exactly one BPM process. If you deploy another BPM process using the same service
interface, you will get an error message.

You have designed an inbound service interface in ES Repository that you want to use for message processing.

The service interface must have interface pattern XI 3.0 compatible.

You have created the objects for the business system in Integration Directory of AEX.

Procedure
1. Con gure a Process in BPM Process Composer

1. Create a project in the Process Composer perspective of SAP NetWeaver Developer Studio.

More information: Creating a Project

2. Create your process and create a new pool representing the BPM process.

More information: Creating a Process

3. Import the inbound service interface from ES Repository.

More information: Importing Service Interface De nitions

4. For better overview, create a second passive pool representing the business system the process exchanges messages with
via AEX. This step is optional.

More information: De ning Process Participants Using Pools

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde372… 7/32
7/31/2019
5. To receive messages from AEX in a BPM process, add a message start event or an intermediate message event to your
BPM process in Process Composer.

To trigger a process instance by an inbound message coming from AEX, use a message start event.

If a running process instance should wait for an inbound message coming from AEX, use an intermediate message
event.

De ne data mappings.

More information: De ning Data Mappings

More information: Events , Modeling Events

6. Build and deploy your process.

For XI 3.0 compatible service interfaces, the BPM system automatically creates an XI endpoint.

More information: Building and Deploying a Process

2. Con gure Message Processing in Integration Directory of AEX

1. In the Integration Directory of AEX create a communication component representing the BPM process.

You do not need to create a party.

2. On the Receiver tab assign the inbound service interface you want to use for message exchange.

More information: De ning Communication Components

3. Create a communication channel with the following attributes:

Direction: Receiver

Adapter type: SOAP

Message protocol: XI 3.0

Addressing type: URL Address

Target URL: http(s)://<hostname>:<port>/MessagingSystem/receive/JPR/XI

Enter the host name and port of the local system.

More information: De ning Communication Channels , Con guring the Receiver SOAP Adapter

4. Create an Integrated Con guration with the following settings:

Add information about the business system that is the sender.

On the Outbound Processing tab, select the receiver SOAP adapter you de ned.

On the Receiver tab, select the business component representing the BPM system.

On the Receiver Interfaces tab, select the inbound service interface the BPM process uses.

More information: Con guration Objects (Advanced Adapter Engine) , De ning the Integrated Con guration

Note
Instead of con guring objects in the Integration Directory, you can also con gure message processing in SAP NetWeaver
Developer Studio using integration ows.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde372… 8/32
7/31/2019

Con guring Message Processing from BPM


to PI
Use
You use an automated activity to process messages from a BPM process to the Advanced Adapter Engine Extended (AEX).

In AEX, you con gure a communication component representing the BPM process and a communication channel with a SOAP
sender adapter using the XI 3.0 message protocol. Con gure an Integrated Con guration object assigning the communication
component and the communication channel. An outbound service interface de ned in the ES Repository determines the structure
of messages that are exchanged.

The following procedure only describes the steps and objects necessary for message exchange between the BPM process and the
AEX. You have to add the other steps of your process. In AEX, add the receiver and for example mapping and routing de nitions.

Prerequisites
You have designed an outbound service interface in ES Repository that you want to use in your message processing.

The service interface must have interface pattern XI 3.0 compatible. Other interface patterns are not supported.

You have created the objects for the business system in Integration Directory of AEX.

Procedure
1. Con gure a Process in BPM Process Composer

1. Create a project in Process Composer perspective of SAP NetWeaver Developer Studio .

More information: Creating a Project

2. Create your process and create a new pool representing the BPM process.

More information: Creating a Process

3. Import an outbound service interface from ES Repository.

More information: Importing Service Interface De nitions

4. When modeling your process, create a second, passive pool for the business system that you exchange messages with
using AEX. This is an optional step.

More information: De ning Process Participants Using Pools

5. To send messages from a BPM process to AEX, de ne an automated activity in the BPM process.

a. Assign the imported outbound service interface to the automated activity.

b. The service reference type is automatically set to WS. In the Type eld select XI.

Note
Service reference type XI cannot be combined with WS and RFC types in one Service Group.

c. Under Custom properties enter the sender component name.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde372… 9/32
7/31/2019

Note
You can change the sender component name in SAP NetWeaver Administrator.

i. Choose SOA Application and Scenario Communication Application Communication and select your
application.

ii. Select the service group and service reference and select Edit .

iii. Select the Con guration tab and change the entry in the Sender Component eld.

d. De ne data mappings.

More information: De ning Data Mappings

More information: Modeling Automated Activities

6. Build and deploy your process.

More information: Building and Deploying a Process

2. Con gure Message Processing in Integration Directory of AEX

1. In the Integration Directory of AEX create a communication component representing your BPM process. Reuse the name
you de ned for the sender component in your BPM process.

You do not need to create a party.

2. On the Sender tab, assign the outbound service interface you want to use for message processing.

More information: De ning Communication Components

3. Create a communication channel with the following attributes:

Direction: Sender

Adapter type: SOAP

Message protocol: XI 3.0

More information: De ning Communication Channels , Con guring the Sender SOAP Adapter

4. Create an Integrated Con guration and provide the following information for the sender:

Select the communication component representing the BPM process.

Select the outbound interface the BPM process uses.

5. After creating the Integrated Con guration, select on the Inbound Processing tab the sender SOAP adapter you de ned.

Add information about the business system that is the receiver.

More information: Con guration Objects (Advanced Adapter Engine) , De ning the Integrated Con guration

Note
Instead of con guring objects in the Integration Directory, you can also con gure message processing in SAP NetWeaver
Developer Studio using integration ows.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 10/32
7/31/2019

Handling Large Messages Using Claim


Check Pattern
Prerequisites
You must ensure that you have a Process Orchestration installation including a BPM and an AEX system.

Context
Messaging is a reliable and fast way to transmit information, but if messages contain a large amount of data, this can reduce the
efficiency of a system. The Claim Check pattern reduces data volume by ltering the message content. It stores complete
message information in a persistent store, from where it can be retrieved later using a unique key. The Claim Check pattern solves
the problem of moving large amounts of data across systems.

When a message with a large volume of data arrives, the Claim Check component, generates a unique Claim Check key for the
information. The data required for processing in BPM is extracted from the original large message to create a smaller message.
The Claim Check key is added to the smaller message. The Claim Check component then stores the large message in a persistent
store and assigns it a unique key. BPM processing runs more efficiently using the smaller message and when the complete
message is required, the Claim Check key is used to retrieve the data from the store.

In Process Orchestration systems, the unused data of large messages in the memory reduces efficiency. Efficiency improves if the
process contains smaller messages as most of the BPM processes require only a limited part of the content of the individual PI
messages. Using the Claim Check pattern, you can replace the message content with a Claim Check key, which is used to retrieve
the entire message content later. The original message is stored temporarily while the intermediate steps are provided with a
smaller message along with a key, which is used to retrieve the original message later for processing.

You use the SAP PI Message Store, which gives you control on the life cycle of the messages stored in a Claim Check scenario. You
retrieve messages and change the status of the message. The PI standard delete job automatically deletes the messages that are
scheduled for deletion.

Procedure
1. De ne the Interfaces

The original large message has all elds, however, you have to de ne a lean and an aggregated message to implement the
Claim Check pattern. The smaller lean message has the basic elds from the large message that are required for
processing and one additional eld to establish the link between the large and lean message during retrieval. The
aggregated message has the collection of related smaller messages with the same correlation key. You use the SAP PI
Enterprise Services Repository to model the interface.

For more information on how to create a new smaller interface with the elds required by BPM from your existing large
interface, see also Working with Process Component Architecture Models .

Note
The new smaller interface should have the minimum required elds from the large message. You must also keep a eld
in the new interface that can be used as a link between the smaller interface and the original large message, for
example, PI Message ID.

2. Create the PI Operations Mapping

You create two mappings to execute the Claim Check pattern. The rst mapping extracts a few elds from the large PI
message to the small message. The second mapping merges several individual messages into one large aggregated

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 11/32
7/31/2019
message.

For more information, see also Mapping Messages to Each Other Using Mapping Objects .

3. Con gure the Integration Flows and an Adapter Module

You must con gure the integration ows to use the smaller message as the receiver channel for integration ows. The
integration ows must be enhanced using the SCPMappingBean adapter module at the receiver channel. Adapter modules
are stateless EJBs, which are used to enhance adapters for special data handling. You can de ne the generic modules in
the module processor with each adapter. The module forwards the message to the adapter, which transfers the message to
the connected system. The adapter addresses the module processor in the form of a bean for transferring the message
object as a PI message or its own format. The SCPMappingBean adapter module has the following module parameters:

mappingID: This is the object ID of the PI operation mapping in the ESR that is used for the transformation of larger
messages to smaller messages.

persistuntil: This is the estimated time period in days for which the large message is to be stored in the message
store.

Note
The persist until value does not guarantee that the message will be deleted immediately after the speci ed time
has elapsed.

xpath: This is the eld of the lean interface in which the message ID will be placed by the bean. It contains the link
(an ID), identi ed to connect the large and small message for retrieval of the original message later, for example,
xpath of PI Message ID.

For more information, see also Con guring the Integration Flows and an Adapter Module .

4. Con gure the BPM Processes Using Web Services

The SAP BPM process uses the smaller message for processing, however at the end you will need the original large
message for further processing. You retrieve the payload by using two Web services.

The rst Web service calls the OriginalMessageAccessorBean at the end of the BPM process to retrieve those messages
from the message store, for which the messageID has been handed over as a parameter. You can con gure it by using the
input and output mapping:

a. Input mapping:

MESSAGE_ID_LIST: List of message IDs to be read from the message store.

PROCESS_INSTANCE_ID: The This process instance ID of the process calling the bean. This is used for
tracing and logging for supportability.

OPERATION_MAPPING_GUID and SWCV_GUID: GUIDs of the associated operation mapping in the ESR,
created from the list of large messages to the aggregated message.

b. Output mapping:

Cast the result XML-string to the target data object.

The second Web service calls the MessageStatusUpdaterBean after the step for the retrieval of all messages. You can
con gure it by using the input mapping.

a. Input mapping:

MESSAGE_ID_LIST: List of message IDs to be read from the message store

PROCESS_INSTANCE_ID: The process Instance ID of the process calling the bean. This is used for tracing
and logging for supportability.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 12/32
7/31/2019
For more information, see also Con guring the BPM Processes Using Web Services .

Con guring the Integration Flows and an


Adapter Module
Prerequisites
You must ensure that you have a Process Orchestration installation including a BPM and an AEX system.

Context
You use this procedure to con gure the integration ow and the SCPMappingBean adapter module.

Procedure
1. Con gure the integration ows:

a. Choose Window Open Perspective Other .

b. Choose Process Integration Designer .

c. Choose OK .

d. Expand Integration Flows .

e. Choose the integration ow con gured to send messages from AEX to BPM.

2. Con gure the adapter module:

a. In < integration ow name >, choose Receiver Channel .

b. In the Channel view, choose Modules .

c. In the Processing Sequence section, choose Add .

d. In the Module Name column, select SCPMappingBean .

e. Choose OK .

f. Choose Move Up to execute the module rst.

g. In the Module Con guration section, enter the details as given below:

mappingid: Object ID of the operation mapping in the ESR.

persistuntil: Time period in days for which the message is stored in the message store. Details will be
explained later.

xpath: xpath expression to the eld of the lean interface in which the message ID will be placed by the bean.

3. Save, activate, and deploy the integration ow.

Con guring the BPM Processes Using Web


Services
https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 13/32
7/31/2019

Prerequisites
You must ensure that you have a Process Orchestration installation including a BPM and an AEX system.

Context
You use this procedure to con gure BPM processes and to retrieve the original messages to the BPM process by using two Web
services.

Procedure
1. Con gure the BPM Processes:

a. In the Process Development perspective, open the process used for communicating with AEX.

b. Import the newly created service interface from ESR.

c. Assign this service interface to the Start and the Intermediate Event of the process.

d. To retrieve the original data and update the message status in AEX, perform the following sub steps :

i. Create an automated activity in the process model with the Web service OriginalMessageAccessor
(namespace: http://sap.com/aii/scp/functions/ejb/ ) to retrieve the original data.

ii. In the Input Mapping view, map the following attributes:

MESSAGE_ID_LIST

OPERATION_MAPPING_GUID

SWCV_GUID

iii. Create an automated activity in the process model with the Web service MessageStatusUpdater
(namespace: http://sap.com/aii/scp/functions/ejb/ ) to update the message status in AEX.

iv. In the Input Mapping view, map the following attributes:

MESSAGE_ID_LIST

2. Save and deploy the process.

Using Operation Mappings (PI) in a BPM


Process
Prerequisites
You have de ned operation mappings in ES Repository.

More information: Overview , Mapping Messages to Each Other Using Mapping Objects

You cannot use value mappings and parameterized mappings in your BPM process.

Do not use synchronous interfaces to be mapped. The mapping is not be executed for the response or the fault message.

You cannot use service interfaces containing the same data type and namespace for operation mappings, even if the
software component versions for data types differ. The WSDL import does not differentiate data types by software
component versions.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 14/32
7/31/2019

Context
In Process Orchestration, you can assign operation mappings that are de ned in the ES Repository to an automated activity in
your BPM process.

Procedure
1. Create a project in the Process Composer perspective of SAP NetWeaver Developer Studio.

More information: Creating a Project

2. Create your process.

More information: Creating a Process

3. Import a service interface from ES Repository.

More information: Importing Service Interface De nitions

4. Create an automated activity, a message start event or an intermediate message event in your process and assign the
service interface.

More information: Modeling Automated Activities , Events , Modeling Events

5. Import the operation mapping that matches an operation of the imported service interface and that you want to use for
changing the message.

More information: Importing Operation Mappings (PI)

6. Create an automated activity in your process and assign the operation mapping.

More information: Modeling Automated Activities

7. Build and deploy your process.

More information: Building and Deploying a Process

Process Orchestration Monitoring


Use
Access

You access monitors from the Process Orchestration start page. To access the monitoring tools, select the Con guration and
Monitoring link. For the PI monitoring tools, you can also open a browser and go to http(s)://<host>:<port>/pimon , or
open the SAP NetWeaver Administrator http(s)://<host>:<port>/nwa . The BPM monitoring applications are integrated
in the SAP NetWeaver Administrator, too.

More information about necessary monitoring roles: Monitoring Roles (PI) , Authorizations and Roles (BPM)

Monitoring Message Processing Between AEX and BPM

For monitoring the message processing between Advanced Adapter Engine Extended (AEX) and Business Process Management
(BPM), use the following monitors:

Message monitor

You can monitor the message processing on the AEX.

More information: Monitoring Messages

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 15/32
7/31/2019
Communication channel monitor

You can obtain information about communication channels and perform some administrative tasks.

More information: Monitoring Communication Channels

Java Proxy Runtime monitor

Monitor the overall status of the Java Proxy Runtime.

More information: Monitoring the Java Proxy Runtime

You can nd the monitors for BPM, in the SAP NetWeaver Adminsitrator, on the Operations tab, then on the Processes and Tasks
tab page.

Manage Processes

Monitor and manage BPM processes. Administrators can view the process details, process instance ow, process
de nition ow, history, process context, and so on; navigate to related tasks; and perform an appropriate action on a
process.

More information: Monitoring and Managing the Processes

Manage Tasks

Monitor and manage BPM tasks. Administrators can view the task details, deadline details, history, task owners, and so on;
nominate users (that is, actual owners) for the tasks; and navigate to the related process instance.

More information: Monitoring and Managing the Tasks

To monitor messages across BPM and PI, open the BPM Log Viewer. In the SAP NetWeaver Administrator, choose
Troubleshooting Processes and Tasks Business Logs . For more information, see Monitoring Messages Across PI and
BPM via Message ID in the BPM Log Viewer

Additional Monitors

For AEX, the following additional monitors are available:

Adapter Engine Status

Retrieve information about the messaging system of an Advanced Adapter Engine including data about message status,
database locks, queues, backlogs, event handlers.

More information: Displaying Technical Data for the Adapter Engine

IDoc Monitor

Monitor IDoc message traffic and processed metadata.

More information: Monitoring the IDoc Adapter

Performance Monitoring

Monitor the performance of message processing by inspecting the amount of processed data over various periods of time
and the message processing time at individual adapter modules.

More information: Monitoring Performance

Background Job Monitor

Get an overview of background jobs and manage them.

More information: Performing Background Processing

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 16/32
7/31/2019
Channel-Independent Logs

This monitor displays the processing steps of adapters that cannot be assigned to a particular communication channel.

Monitoring the Cache

Monitor cache objects in the runtime caches of AEX.

More information: Monitoring the Cache

CPA Cache History

This monitor gives you the history of various types of cache updated to the database. View the cache response to the
Integration Directory for detailed error analysis.

To monitor the AEX components, select the Common tab and select the component monitor. You get insight into the health status
of the individual components of AEX.

More information: Monitoring Process Integration Components

For mapping runtime, you can use the cache monitor on the Mapping Runtime tab.

More information: Mapping Runtime Cache

Monitoring Messages Across PI and BPM in


the BPM Log Viewer
Use
To provide monitoring capability for Process Orchestration scenarios across PI and BPM, message-related business log entries
contain the message ID that is delivered by PI to SAP BPM using the XI 3.0 message protocol. You can view this information in the
BPM Log Viewer to track what happened to a PI message in BPM. You can navigate from this PI message ID in the Business Log
Viewer to PI message monitoring.

Note
The PI message ID is only provided for Process Orchestration scenarios. For scenarios that do not involve PI, and which
speci cally do not use the XI 3.0 protocol for sending messages, no message ID is displayed with the corresponding business
log entries.

Note
Message-related business log entries are only written if the business log level is set to at least Standard.

In addition, you can search for business log entries by using the PI message ID.

You can also use this procedure to search the PI messages using the process instance ID.

Prerequisites
You must have at least one of the following roles assigned to you:

Role Activities

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 17/32
7/31/2019

NWA_SUPERADMIN View logs

NWA_READONLY View logs

SAP_BPM_SuperDisplay View logs and context data

SAP_BPM_Navigation View logs and context data

SAP_BPM_SuperAdmin View logs and context data

The business log entries belong to a Process Orchestration scenario. This means that the business log entries are triggered
by a PI message.

Procedure
Looking Up PI Message IDs and Navigating to PI Monitoring

1. Log on to the SAP NetWeaver Administrator.

2. Choose Troubleshooting Processes and Tasks Business Logs .

3. Display the logs you are interested in. You can view the logs based on categories, events, containers, or date ranges.

For more information about business logs, see Con guring Business Log Levels or Monitoring the Business Lifecycle Logs.

4. On the Details tab, look at the Details of the log entry . If the business log entry was triggered by a PI message, the
message ID is displayed.

5. To navigate to the PI Message Monitor, click the message ID. In the PI Message Monitor, the messages are already ltered
to messages using this ID.

Note
If there is no PI system implemented or available in the same technical system, you get an error message while loading
PI message monitoring.

Searching for a Process Instance Based on PI Message ID

1. Log on to the SAP NetWeaver Administrator.

2. Choose Troubleshooting Processes and Tasks Business Logs .

3. Switch to the Advanced search, if necessary.

4. In the Message ID eld, enter the PI message ID, and choose Go.

5. The business log entry that was triggered by this message is displayed.

6. Choose the Container ID from the Details of the log entry to navigate to the NWA Manage Process application.

7. In the Manage Process application, the process instance associated with the PI message ID is displayed.

Searching for a PI Message Based on the Process Instance ID

1. Log on to the SAP NetWeaver Administrator.

2. Choose Operations Processes and Tasks Business Logs .

3. Switch to the Advanced search in the Business Log Viewer.

4. Enter the process instance ID in the Container ID eld and choose Go.
https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 18/32
7/31/2019
5. If the process is initiated by a PI message, the message ID is displayed in the Details of the Log Entry.

6. Choose this message ID to navigate to the PI Message Monitor.

7. In the PI Message Monitor, the message associated with the process instance ID is displayed.

Searching for Multiple PI Messages Initiated by a BPM Process

1. Log on to the SAP NetWeaver Administrator.

2. Choose Operations Processes and Tasks Manage Processes .

3. Select a process and go to the Details tab.

4. Choose Show Related Messages to navigate to the PI Message Monitor.

5. In the PI Message Monitor, all messages associated with the corresponding BPM process are displayed.

Correlating Process Instances with PI


Messages
Prerequisites
In your process you have designed a message start event, intermediate message event, or an automated activity for message
exchange with AEX.

Context
Separate monitors are available on AEX and for BPM. With the following settings, you can correlate messages coming from or
going to AEX with a process instance.

Procedure
1. When designing a process in Process Composer perspective of SAP NetWeaver Developer Studio, enter an ID which can be
uniquely identi ed and is part of the message payload of the message coming from AEX in the process Subject eld.

This ID can for example be an order ID or a customer number.

a. Open the process in Process Composer and select the User Texts tab.

b. Enter Variable Name , Type , and Expression for the ID you want to use.

c. In the Subject eld, reference the variable entered above.

More information: Working with Tasks , section (Optional) De ning User Texts

2. On AEX, de ne a lter for the user-de ned message search using this ID.

More information: Con guring User-De ned Message Search

3. On AEX start page, choose the Monitoring and Administration link.

4. If requested, enter user name and password.

5. Choose the Processes and Tasks tab page and select Manage Processes .

The process subject eld is part of the result list.

6. To monitor message processing on AEX, select Message Monitor .

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 19/32
7/31/2019
7. Find the search option for user-de ned message search under Advanced Search options.

More information: Advanced Message Search

Using IDoc Interfaces in BPM


You can send an Intermediate Document (IDoc) from an SAP R/3 system to SAP BPM. This topic describes the needed steps for
using IDoc interfaces in BPM.

An IDoc cannot be directly imported into SAP BPM. The WSDL generated from an imported IDoc in the Enterprise Services
Repository (ES Repository) is not WS-I compliant. Therefore, runtime issues can occur when BPM tries to consume the service
interface.

To use IDoc interfaces in BPM, you need to perform the following steps:

1. Modifying the WSDLModifying the WSDL

2. Creating Service InterfacesCreating Service Interfaces

3. Creating MappingsCreating Mappings

4. Creating an Integration FlowCreating an Integration Flow

5. Modeling a BPM processModeling a BPM process

6. Sending the IDoc from the R/3 System Sending the IDoc from the R/3 System

Modifying the WSDL


When an IDoc is imported from an R/3 system into the ES Repository not all attributes that are needed on the receiver side (BPM)
are generated. Therefore, you need to modify certain tags of the imported WSDL to enable the consumption of the imported IDoc
by BPM:

1. After you have successfully imported the IDoc, open the IDoc, go to the WSDL tab, and export the WSDL into a le.

2. Make a copy of the WSDL le and in this copy, do the changes that are described in the following steps.

3. For the xsd:schema, set the targetNamespace attribute to "urn:sap-com:document:sap:idoc:messages"


and the xmlns attribute to "urn:sap-com:document:sap:idoc:messages".

4. For the <WSDL:definitions> element, set the xmlns attribute to "urn:sap-


com:document:sap:idoc:messages".

5. Import the modi ed WSDL le as an external service de nition (SI_R).

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 20/32
7/31/2019

Note
This external service de nition is used in the receiver interface.

6. Save and activate your changes.

For more information, see 1414292

Creating Service Interfaces


Create service interfaces with the attributes as shown in the following table:

Field Sender Interface Receiver Interface

Category Abstract Abstract

Interface Pattern Stateless XI 3.0 Compatible Stateless XI 3.0 Compatible

Mode Asynchronous Asynchronous

Request Type IDoc External De nition

For more information, see Creating Service Interfaces or Services.

Creating Mappings
1. In the ES Repository, you need to create a message mapping between the source (as IDoc) and the target (as external
de nition) because the sender and receiver do not use the same schema. For more information, see Message Mappings.

2. Create an operation mapping between source (the imported and not modi ed interface SI_S, that means the sender
interface) and target (the modi ed interface SI_R, that means the receiver interface). For more information, see Operation
Mapping and Using Operation Mappings (PI) in a BPM Process.

3. Assign the message mapping to this operation mapping.

4. Save and activate your changes.

Creating an Integration Flow


In the Developer Studio, with the SAP Process Integration Designer, create an integration ow. For more information about
creating integration ows, see Creating an Integration Flow.

1. Create an integration ow with the following attributes:

Field Sender Receiver

Interface SI_S SI_R

Adapter Idoc_AAE SOAP, XI 3.0, JPR URL

2. Assign the operation mapping you created before to this integration ow.

3. Save, activate and deploy your changes.

Modeling a BPM process

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 21/32
7/31/2019
In the Developer Studio, with the Process Composer, model a BPM process. For more information about modeling BPM processes,
see Modeling Processes with Process Composer

1. Create a new Process Composer Development Component.

For more information, see Creating a Project

2. Import the service interface SI_R from the ES Repository.

The data types are created in the namespace "urn:sap-com:document:sap:idoc:messages" as we changed


before.

For more information about the import of service interfaces, see Importing Service Interface De nitions

3. Assign this service interface to the start event of your BPM process.

For more information, see Modeling Events.

4. Crate a data object and map it in the Output Mapping of the event.

For more information, see Creating Data Objects and Working with Data Mappings.

Note
In the WSDL le, errors can occur such as the following: "s4s-att-invalid-value: Invalid attribute value
for 'maxOccurs' in element 'element'. Recorded reason: cvc-datatype-valid.1.2.1:
'9999999999' is not a valid value for 'nonNegativeInteger'." You can ignore such errors.

Sending the IDoc from the R/3 System


1. Trigger the IDoc from the R/3 system.

2. Check whether the messages have been delivered.

You can monitor the messages using the Message Monitor. To open the Message Monitor, log on to the SAP NetWeaver
Administrator (URL: http://<host>:<port>/nwa), and go to Availablility and Performance Process
Monitoring Message Monitor .

3. Check whether the BPM process started and the context data has been updated according to the sentvalues.

In the SAP NetWeaver Administrator (URL: http://<host>:<port>/nwa), go to Operations Processes and


Tasks Manage Processes

Related Information
Modeling Processes with Process Composer
Working with Integration Flows
http://scn.sap.com/community/process-orchestration/blog/2014/09/24/idoc-to-nw-bpm-scenario

Exposing Back-End Data as OData Services


You can use the Java implementation of the Gateway Hub (part of the Integration Gateway and in the following named as Gateway
Java) to expose SAP back-end data as OData services.

The Gateway Java provides SAP back-end content as OData services using the OData Channel (ODC). ODC allows you to expose
OData services by de ning object models and registering a corresponding runtime data provider class.

As OData services the data from SAP back-end systems can be consumed by applications, for example, by apps or user interfaces
for completing tasks.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 22/32
7/31/2019

Note
Fiori Apps and the Uni ed Inbox are not yet supported by the Gateway Java. If you want to consume the back-end data as
OData services in Fiori Apps or the Uni ed Inbox, please use the Gateway.

Before you can expose SAP back-end content as OData services with Gateway Java, the following preperation steps are needed:

Enable SSO authentication between SAP NetWeaver Application Server for Java (AS Java) and SAP back-end system.

If you have deployed the component IW_BEP 200 SP06 or lower in the SAP backend, you need to implement the SAP note
1816779 . The component IW_BEP 200 is required to enable SAP services as OData services.

Related Information
Enabling Single Sign-on Authentication
Creating Destinations on SAP NetWeaver Application Server for Java
Managing Service Registrations

Authorizations in Gateway to Access


Applications
https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 23/32
7/31/2019
Authorizations in Gateway determines access to applications. This is based on an authorization concept that enables an
administrator to assign authorizations to users.

The assigned authorizations determine the actions that users can perform after they have been authenticated. For Gateway,
assign the following prede ned application roles:

Role Description

GW_Admin Use this role to manually assign a user with administration


permissions.

GW_User Use this role to manually or automatically assign a user or a group


of users with application permissions.

To assign the roles you use the Identity Management that is integrated in the SAP NetWeaver Administrator.

1. Log on to the SAP NetWeaver Administrator with http://<host>:<port>/nwa.

2. Choose Con guration Identity Management .

Note
You can also directly open the Identity Management application using the quick link, http://<host>:
<port>/nwa/identity.

3. On the Overview tab, you can search for the GW_Admin and GW_User roles using Roles as Search Criteria.

4. You can create a user or modify an exisitng user and assign the appropriate role. For more information, see UME Roles and
Actions (AS Java).

Related Information
Security Aspects of Process Orchestration

Enabling Single Sign-on Authentication


Enabling single sign-on (SSO) authentication is a prerequisite for using Gateway.

Context
You must encrypt the communication channel between SAP Application Server and SAP back-end system for security reasons.
This is achieved by uploading the SSO certi cate of the SAP back-end system to the SAP Application Server and vice versa.

Procedure
1. Download the certi cate from the SAP Application Server:

a. Use the link http://<host>:<port>/nwa to go to the SAP Application Server and log on.

b. Choose the Con guration tab, and Certi cates and Keys Ticketkeystore SAPLogonTicketKeypair-cert. .

c. Choose Export Entry.

d. In the Export Entry to File window, choose Binary X.509 as the export format.

e. Choose Download and save the certi cate on your system.

This SAP Application Serve certi cate has to be uploaded to SAP back-end system.

2. Upload the certi cate to the SAP back-end system:

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 24/32
7/31/2019
a. Log on to SAP back-end system in which you want to upload the certi cate.

b. Go to transaction strustsso2.

c. Expand System PSE and choose the child node to get the details of the system.

d. Click the assigned owner, for example, CN=AP2.

e. Choose Import Certi cate.

f. Enter the path where the downloaded SAPLogonTicketKeypair-cert.crt is saved.

g. Under File Format, choose Binary.

The certi cate is saved in the location you speci ed. This ABAP system certi cate has to be uploaded to SAP Application
Server.

3. Download the certi cate from the SAP back-end system:

a. Log on to the SAP back-end system from which you want to download the certi cate.

b. Go to transaction strustsso2.

c. Expand System PSE and choose the child node to get the details of the system.

d. Click the assigned owner, for example, CN=AP2.

e. Choose Export Certi cate.

f. Choose the path where the SAP back-end certi cate should be saved.

g. Under File Format, choose Binary.

4. Upload the certi cate to the SAP Application Server:

a. Use the link http://<host>:<port>/nwa to go to the SAP Application Server and log on.

b. On the Con guration tab, choose Trusted Systems.

c. Under Add Trusted System, choose By Uploading Certi cate Manually.

d. Enter the system ID and client details of the SAP back-end system.

e. Choose the certi cate downloaded from the SAP back-end system.

f. Choose Next.

g. Choose Finish.

Creating Destinations on SAP NetWeaver


Application Server for Java
Create destinations for the services to point to the SAP back-end system from which the data is fetched.

Context
You create the destinations in the SAP NetWeaver Administrator on the SAP NetWeaver Application Server Java.

Procedure
1. To go to the SAP NetWeaver Application Server for Java, use the following URI http://<host>:<port>/nwa and log
on.

2. On the Con gurations tab, choose Destinations Create… .

3. Select a system as Hosting System.

4. Enter a destination name.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 25/32
7/31/2019
5. As the Destination Type, select HTTP and choose Next.

6. Enter the details of the SAP back-end system:

Option Description

URL Enter the URL of the SAP back-end system.

Here is the generic URL: <https://<hostname>:


<port>/sap/iwbep?sap-client=<client number>

Hostname, port and client number depend on the system you


are using.

To get the destination URL:

In transaction SICF, choose Execute to display the


service tree hierarchy.

Expand the default host and navigate to the node


IWBEP (default_host sap iwbep ).

In the context menu of the node iwbep, choose Test


Service and in the pop up window, choose Allow.

The URL you get in the address bar of the browser is the
destination URL.

System ID Enter the system ID of the SAP back-end system.

Client Enter the client number of the SAP back-end system.

Make sure that the service information you enter is the same as on the SAP Business Suite system. To get the list of the
SAP Business Suite services, perform the following steps:

a. Log on to the SAP Business Suite system and go to the transaction SPRO.

b. Open the SAP Reference IMG and navigate to SAP NetWeaver Gateway Service Enablement Backend OData
Channel Service Deployment for Backend OData Channel Display Models and Service .

7. Choose Next.

8. Select the Authentication type. You can choose from the following types:

No Authentication: When the back-end system has no authentication mechanism.

Basic (User ID and Password): When the back-end system is authenticated using credentials.

Logon Ticket: SSO authentication; for this type of authentication you have to establish mutual handshake.

Assertion Ticket: Similar to SSO authentication, but the session timeout is shorter than the one of the logon ticket.

User Mapping: Using this option, the user can map the destination to a particular application server.

X509 Client Certi cate with SSL: If the user has a certi cate authorized by a CA.

Results
A destination is created for the SAP back-end system. You can now register a service using 'OData Provisioning Administration' of
Gateway Java.

Related Information
Managing Service Registrations

Managing Service Registrations


https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 26/32
7/31/2019
To manage service registrations you use the OData Provisioning Administration tool.

Prerequisites
You have created a destination for the SAP services to point to the SAP back-end system from which the data is fetched.
For more information, see Creating Destinations on SAP NetWeaver Application Server for Java.

Context
The OData Provisioning Administration is the central user interface for all Gateway administration tasks. You also use the OData
Provisioning Administration tool to register SAP services.

Procedure
1. To start the OData Provisioning Administration, enter the URL http://<hostname>:<port>/igwj/Admin and log
on using the administrator user name and the corresponding password.

2. On the SERVICES tab, choose Register a New Service....

3. Choose a destination from the Select a Destination list.

4. To search for SAP services, enter the service name or a key word in the Search eld.

5. Select the service you want to register and choose Register.

Results
The registered service is activated by default. A service document URL to access the OData service is generated. You can see this
URL in the Service Document column.

Security Aspects of Process Orchestration


This section provides an overview of security aspects of Process Orchestration.

Business Communication
When Process Orchestration is installed on a system, the installation acts in two roles:

As “integration broker” using the Process Integration runtime

Process Orchestration uses the functions of the Advanced Adapter Engine Extended (AEX) and therefore the Advanced
Adapter Engine as runtime component.

More information on the security aspects of the integration broker: Business Communication

As host for business components implementing applications based on SAP Business Process Management (BPM)

To explain in more detail how the components interact at runtime, the following section describes the sequence of message
processing.

1. An external business system sends a message to the Process Orchestration system.

2. According to the settings of an integrated con guration (with a key that matches the message header address elds), a
business component representing a BPM-based application is determined as a receiver. A communication channel based
on the SOAP adapter with XI protocol is used for this.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 27/32
7/31/2019
The user speci ed in the communication channel requires authorization to log on to the URL of the Java Proxy Runtime, as
well as application-speci c authorizations.

In the case of an application based on BPM, it requires respective BPM security roles.

In particular, the user speci ed in the communication channel requires the SAP_XI_APPL_SERV_USER security role to
logon to the URL of the Java Proxy Runtime and for message processing, as well as the SAP_BPM_TRIGGER_EVENT role
for raising start events or intermediate events of a business process.

3. The BPM-based application is executed after a process is started or a message is delivered to an intermediate event step.

For more details, for example, the process role concept: Business Process Management Security Guide

4. When the process reaches an automated activity that uses XI as Service Reference Type , a message is handed over to
the Process Integration runtime (AAE) again.

In this communication step, the BPM-based application is represented as a sender business component, according to its
con guration.

This hand-over is accomplished typically by the service user like the following: SAP_BPM_Service or, in case,
Principal Propagation is used, the propagated user.

More information: Principal Propagation

If you have con gured Access Control List (ACL)-based authorizations for service users in the Integration Directory
for the communication, you have to adapt them accordingly.

More information: User Management and Authorization Concepts (AEX) under ACL-Based Authorizations

User Management and Authorization Concept


As a Process Orchestration system is based on Application Server (AS) Java, the general User Management concepts of the AS
Java apply to both the Process Integration-speci c concepts and the concepts of the installed components of the Composition
Environment, mainly the BPM component.

More information: User Management of the Application Server Java

For the Process Integration-speci c user management and authorization concepts, see: User Management and Authorization
Concepts (AEX)

In particular, see the sections related to the AEX:

User Management for the AEX (PI-AEX)

Standard User (Java Single-Stack)

UME Roles and Actions (AS Java)

For the BPM-speci c concepts, see the corresponding sections of the Business Process Management Security Guide. In the
Authorizations and Roles section, you can nd a list with all roles and their corresponding authorizations needed for BPM.

Important con guration tasks in SAP NetWeaver Administrator require authorizations for the corresponding workspace (SAP
NetWeaver Administrator under SOA Application and Scenario Communication ).

More information: Authorizations

Default User

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 28/32
7/31/2019
During initial technical con guration of Process Orchestration, a default technical user is created that can be entered in
communication channels addressing the local Java Proxy Runtime URL to connect to BPM processes. Its default name is
PIBPMMSG<SID> , where <SID> is the System ID of the installation. The name can be changed during the initial setup. Roles
SAP_XI_APPL_SERV_USER and SAP_BPM_TRIGGER_EVENT are assigned to the user.

Additional Roles
To expose SAP back-end data as OData services using the Gateway Java, you need additional roles with authorizations that
determine access to applications. For more information, see Authorizations in Gateway to Access Applications.

Authorizations in Gateway to Access


Applications
Authorizations in Gateway determines access to applications. This is based on an authorization concept that enables an
administrator to assign authorizations to users.

The assigned authorizations determine the actions that users can perform after they have been authenticated. For Gateway,
assign the following prede ned application roles:

Role Description

GW_Admin Use this role to manually assign a user with administration


permissions.

GW_User Use this role to manually or automatically assign a user or a group


of users with application permissions.

To assign the roles you use the Identity Management that is integrated in the SAP NetWeaver Administrator.

1. Log on to the SAP NetWeaver Administrator with http://<host>:<port>/nwa.

2. Choose Con guration Identity Management .

Note
You can also directly open the Identity Management application using the quick link, http://<host>:
<port>/nwa/identity.

3. On the Overview tab, you can search for the GW_Admin and GW_User roles using Roles as Search Criteria.

4. You can create a user or modify an exisitng user and assign the appropriate role. For more information, see UME Roles and
Actions (AS Java).

Related Information
Security Aspects of Process Orchestration

Enabling Single Sign-on Authentication


Enabling single sign-on (SSO) authentication is a prerequisite for using Gateway.

Context

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 29/32
7/31/2019
You must encrypt the communication channel between SAP Application Server and SAP back-end system for security reasons.
This is achieved by uploading the SSO certi cate of the SAP back-end system to the SAP Application Server and vice versa.

Procedure
1. Download the certi cate from the SAP Application Server:

a. Use the link http://<host>:<port>/nwa to go to the SAP Application Server and log on.

b. Choose the Con guration tab, and Certi cates and Keys Ticketkeystore SAPLogonTicketKeypair-cert. .

c. Choose Export Entry.

d. In the Export Entry to File window, choose Binary X.509 as the export format.

e. Choose Download and save the certi cate on your system.

This SAP Application Serve certi cate has to be uploaded to SAP back-end system.

2. Upload the certi cate to the SAP back-end system:

a. Log on to SAP back-end system in which you want to upload the certi cate.

b. Go to transaction strustsso2.

c. Expand System PSE and choose the child node to get the details of the system.

d. Click the assigned owner, for example, CN=AP2.

e. Choose Import Certi cate.

f. Enter the path where the downloaded SAPLogonTicketKeypair-cert.crt is saved.

g. Under File Format, choose Binary.

The certi cate is saved in the location you speci ed. This ABAP system certi cate has to be uploaded to SAP Application
Server.

3. Download the certi cate from the SAP back-end system:

a. Log on to the SAP back-end system from which you want to download the certi cate.

b. Go to transaction strustsso2.

c. Expand System PSE and choose the child node to get the details of the system.

d. Click the assigned owner, for example, CN=AP2.

e. Choose Export Certi cate.

f. Choose the path where the SAP back-end certi cate should be saved.

g. Under File Format, choose Binary.

4. Upload the certi cate to the SAP Application Server:

a. Use the link http://<host>:<port>/nwa to go to the SAP Application Server and log on.

b. On the Con guration tab, choose Trusted Systems.

c. Under Add Trusted System, choose By Uploading Certi cate Manually.

d. Enter the system ID and client details of the SAP back-end system.

e. Choose the certi cate downloaded from the SAP back-end system.

f. Choose Next.

g. Choose Finish.

Creating Destinations on SAP NetWeaver


Application Server for Java
https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 30/32
7/31/2019
Create destinations for the services to point to the SAP back-end system from which the data is fetched.

Context
You create the destinations in the SAP NetWeaver Administrator on the SAP NetWeaver Application Server Java.

Procedure
1. To go to the SAP NetWeaver Application Server for Java, use the following URI http://<host>:<port>/nwa and log
on.

2. On the Con gurations tab, choose Destinations Create… .

3. Select a system as Hosting System.

4. Enter a destination name.

5. As the Destination Type, select HTTP and choose Next.

6. Enter the details of the SAP back-end system:

Option Description

URL Enter the URL of the SAP back-end system.

Here is the generic URL: <https://<hostname>:


<port>/sap/iwbep?sap-client=<client number>

Hostname, port and client number depend on the system you


are using.

To get the destination URL:

In transaction SICF, choose Execute to display the


service tree hierarchy.

Expand the default host and navigate to the node


IWBEP (default_host sap iwbep ).

In the context menu of the node iwbep, choose Test


Service and in the pop up window, choose Allow.

The URL you get in the address bar of the browser is the
destination URL.

System ID Enter the system ID of the SAP back-end system.

Client Enter the client number of the SAP back-end system.

Make sure that the service information you enter is the same as on the SAP Business Suite system. To get the list of the
SAP Business Suite services, perform the following steps:

a. Log on to the SAP Business Suite system and go to the transaction SPRO.

b. Open the SAP Reference IMG and navigate to SAP NetWeaver Gateway Service Enablement Backend OData
Channel Service Deployment for Backend OData Channel Display Models and Service .

7. Choose Next.

8. Select the Authentication type. You can choose from the following types:

No Authentication: When the back-end system has no authentication mechanism.

Basic (User ID and Password): When the back-end system is authenticated using credentials.

Logon Ticket: SSO authentication; for this type of authentication you have to establish mutual handshake.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 31/32
7/31/2019
Assertion Ticket: Similar to SSO authentication, but the session timeout is shorter than the one of the logon ticket.

User Mapping: Using this option, the user can map the destination to a particular application server.

X509 Client Certi cate with SSL: If the user has a certi cate authorized by a CA.

Results
A destination is created for the SAP back-end system. You can now register a service using 'OData Provisioning Administration' of
Gateway Java.

Related Information
Managing Service Registrations

Managing Service Registrations


To manage service registrations you use the OData Provisioning Administration tool.

Prerequisites
You have created a destination for the SAP services to point to the SAP back-end system from which the data is fetched.
For more information, see Creating Destinations on SAP NetWeaver Application Server for Java.

Context
The OData Provisioning Administration is the central user interface for all Gateway administration tasks. You also use the OData
Provisioning Administration tool to register SAP services.

Procedure
1. To start the OData Provisioning Administration, enter the URL http://<hostname>:<port>/igwj/Admin and log
on using the administrator user name and the corresponding password.

2. On the SERVICES tab, choose Register a New Service....

3. Choose a destination from the Select a Destination list.

4. To search for SAP services, enter the service name or a key word in the Search eld.

5. Select the service you want to register and choose Register.

Results
The registered service is activated by default. A service document URL to access the OData service is generated. You can see this
URL in the Service Document column.

https://help.sap.com/http.svc/dynamicpdfcontentpreview?deliverable_id=21802081&topics=f124e6e6f548480b85197bde37… 32/32

S-ar putea să vă placă și