Introduction

Purpose

Scope & Objectives

This document will describe the high-level architecture of the SAP Cloud Integration application.

Out of Scope:

• Since SAP Cloud Integration is a SaaS application, network and infrastructure architecture will NOT be covered.
• Product documentation and information that can be found online will not be documented here, but referenced using hyperlinks. 
• Implementation details such as Integration Design or API Management Design may have different architectures. 

Requirements

Application Architecture

Overview

Application Architecture Design

Application Architecture Components

Application Security

User Access

 User Access to Integration Suite is via Web, and limited to technical user (developers, system administrators, support teams etc). 

Authentication

•  User Authentication to Cloud Integration is via Single Sign-on (SSO) using Syensqo EntraID federated to IdP. Username and Password logon are not permitted.
• System Authentication options include
  • OAuth 2.0 - access tokens issued via XSUAA
  • Basic Authentication
• Cloud Connector - for outbound traffic from Cloud Integration to On-Premise system - provides a TLS connection and authenticates via Principle Propagation

Authentication Flow

1. User accesses CPI tenant URL

2. The request gets redirected to SAP IdP configured in SAP BTP subaccount for Cloud Integration

3. User is re-directed to Corporate Identity Provider (IdP) logon page - Microsoft 

4. User authenticates to Microsoft using EntraID, if not already authenticated. 

5. IdP validates and issues SAML 2.0 assertion  back to BTP

6. SAP BTP maps the Role Collections assigned to the User

7. User accesses Cloud Integration

Authorisation

Standard Roles and Role Collections are assigned for User Access to Cloud Integration Components. Roles are assigned via SAP BTP Cockpit

Communication Security

For System-to-system communication, all data transfers are encrypted via a suitable mechanism - for example:

• HTTP Adapter which uses TLS 1.2 as the standard (HTTPS)
• FTP Adapter which uses SSH-2 (SFTP)

Data Security

Other Controls

System Landscape

Development Environment

Project Test Environment

Quality Environment

Production Environment

Operation Architecture

Change and Configuration Management

Transport Management

Transporting code using the Figaf Tool for SAP Integration Suite involves a structured process that leverages its DevOps and change tracking capabilities.

1. Landscape Setup:

• Configure Landscapes: 
  Define your system landscapes (e.g., Development, QA, Production) within Figaf's Configuration -> Landscapes page. Specify details like platform, automatic transport lookup, and landscape items.

• Synchronize Systems: 

  Synchronize your source system (e.g., your development environment) with Figaf to capture the current state of your integration objects.

• Generate Ticket: Navigate to DevOps -> Tickets and create a new development ticket, associating it with the relevant landscape. This ticket will track your changes.

3. Attach and Track Objects:

• Attach Tracked Objects: 
  Within the ticket, go to the "Tracked Objects" tab. Attach the specific transport(s) or integration objects (e.g., iFlows, mappings) that contain the code you want to transport.

• Include Dependencies: 

  Use the "Attach all dependent objects" feature to ensure all necessary related objects are included in the transport.

4. Initiate Transport:

• Start Transport: Click the "Start transport" button. Figaf will then prepare the transport package for deployment.

5. Import and Verification:

• Synchronize Target System: 
  Synchronize your target system (e.g., your QA or production environment) with Figaf.

• Automated Import Check: 

  Figaf automatically checks the import status of the transports after synchronization. The transport status will update to "IMPORTED" once successfully processed.

6. Resolve Ticket

• Resolve Ticket: Once the transport is complete and verified, you can resolve the development ticket in Figaf.

Key Features Facilitating Transport:

• Version Control: 
  Figaf tracks changes to integration objects, allowing you to compare versions and understand modifications.

• Approval Workflows: 
  Implement approval processes within Figaf before transports are moved to higher environments.

• Testing Integration: 
  Leverage Figaf's testing capabilities to create and execute tests on your transported code, ensuring functionality after deployment.

• Virtual Tenants (for CPI): 
  Utilize virtual tenants for environments like QA, allowing reuse of development systems while maintaining governance through prefixes/postfixes and avoiding unnecessary deployments of certain objects like value mappings.

Release Management

Monitoring

Standard Monitoring  

FIGAF 

Application Monitoring

System Monitoring

Sizing

High Availability

deployed across multiple availability zones with the following SLA:

• RPO - 4h
• RTO - 24h

Disaster Recovery

Backup/Restore

SAP performs full backups with the following schedule to meet SAP's recovery point objective.

Maintenance Plan

Weekly Maintenance Windows for SAP Cloud Services – Standard Windows SAP weekly standard maintenance windows are scheduled as listed below for the Cloud Services in this section: Start Time in UTC per region MENA FRI 7 pm UTC APJ SAT 3 pm UTC Europe: SAT 10 pm UTC Americas SUN 4 am UTC The above-mentioned maintenance windows define the maximum scheduled downtime from which certain cloud services consume only partially

SAP Cloud Platform API Management SAP Cloud Platform Integration 2 Hours

Major Maintenance

Up to 4 times per year: APJ: FRI 2 pm – FRI 6 pm UTC Europe: FRI 10 pm – SAT 2 am UTC Americas: SAT 4 am – SAT 8 am UTC

Service Introduction

Application Category

Support Team

Skill required

Checklist

Exceptions

See also

Change log

Workflow history