Introduction

Purpose

The purpose of the document is to outline the application architecture of S/4HANA instance deployed in Europe region. 

Scope & Objectives

This document describes the high-level architecture design for S/4HANA and the supporting systems that are deployed together in the RISE environment. It will cover the following topics:

• Landscape overview
• Application and components
• Application security and access
• Operational architecture

Out of scope:

• Detailed architecture designs that are managed by SAP RISE.
• RISE operating model.

Key Decisions and Requirement

Application Architecture

Overview

SAP RISE application architecture is represented in the diagram below. 

SAP RISE Details

The table below summaries SAP RISE details. 

Application Components

S/4HANA

S/4HANA is an Enterprise resource planning solution based on SAP HANA database and SAP ABAP platform. It is a core component in SyWay landscape. SAP Fiori and GTS components will be co-deployed with S/4HANA. A two tier deployment approach will be adopted for S/4HANA systems: Application and DB. 

• For Sandbox, Development, Integration testing and Training S/4HANA systems, 1 application and 1 DB server will be deployed.

• For UAT and Parallel Testing S/4HANA systems, multiple application servers will be deployed with 1 DB server.

• For Production, high availability is in scope and S/4HANA components (like message server, app and DB) are deployed across 2 availability zones with pacemaker clusters to ensure no single point of failure. 

CI - Central Instance, SCS - SAP Central Services, PAS - Primary Application Server, AAS - Additional Application Server

SAP Web Dispatcher

SAP Web dispatcher acts as a web proxy for S/4HANA systems. It facilitates and load balances incoming HTTP traffic. 

• For all non-PRD landscape, one web dispatcher will be deployed 
• For PRD, two web dispatchers will be deployed for HA purposes and Azure load balancer will used to load balance HTTP traffic to the 2 PRD web dispatchers.

SAP Cloud Connector

The SAP Cloud connector acts as a reverse invocation proxy to establish network connection between SAP RISE systems and SAP BTP services (Integration suite, API management, SAP Analytics Cloud etc.) and Ariba Cloud Integration Gateway (CIG). Due to its reverse invoke capabilities, the network traffic originates from SAP Cloud connector to SAP BTP and once the link as been established, data can be exchanged between SAP RISE systems and BTP. HTTPS or RFC protocols are used between SAP Cloud Connector and S/4HANA, and HTTPS protocol is used between Cloud Connector and S/4HANA.

To enable outbound internet traffic from SAP RISE, SAP has provisioned a customer gateway server (CGS) with a forward internet proxy installed on it.

A 2 tier landscape will be adopted for SAP cloud connector: non-PRD and PRD. The non-PRD cloud connector will be shared across all non-PRD landscape. 

Data Provisioning Agent

Data Provisioning Agent (DPA) is used to integrate S/4HANA and SAP Datasphere. The network connection to SAP Datasphere is initiated by DPA and CGS is used to facilitate the internet connection to SAP Datasphere. 

DPA uses the HTTPS or RFC protocols to communicate with S/4HANA and uses the HTTPS protocol to communicate with SAP Datasphere.   

A 2 tier landscape will be adopted for DPA: non-PRD and PRD. The non-PRD instance will be shared across all non-PRD landscape. 

SAP Analytic Cloud (SAC) Agent

SAC Agent facilitates secure data connectivity and data transfer from S/4HANA to the SAP Analytics Cloud. It leverages SAP Cloud connector connection to BTP to transmit data from S/4HANA to SAC. The HTTPS protocol is used for communication S/4HANA, SAC agent and SAC. 

A 2 tier landscape will be adopted for SAC agent: non-PRD and PRD. The non-PRD SAC agent will be shared across all non-PRD landscape. 

OpenText Connector

OpenText connector facilitates the connection between S/4HANA and the OpenText cloud. The connection is initiated from S/4HANA to the OpenText connector and to OpenText cloud via CGS. The HTTPS protocol is used for communication between all components. 

A 2 tier landscape will be adopted for OpenText Connector: non-PRD and PRD. The non-PRD instance will be shared across all non-PRD landscape. 

Supporting Components (SAP Router and DNS)

These are components deployed to SAP RISE landscape and are managed by SAP. Syensqo users will not have access to these applications and can raise requests to SAP to manage any changes. 

• SAP Router: Single instance deployed in SAP RISE to manage SAP support's connection to Syensqo RISE systems.
• DNS: Two instances deployed in SAP RISE to manage SAP RISE domain and will be integrated with Syensqo DNS using Conditional DNS Forwarding.

System Landscape

The table below describes the environment and the corresponding application & SID deployed. 

The following sections describes the system details for each tier. 

Sandbox

Development 

Integration Testing

UAT

Training

Parallel Run

Production

S/4HANA Client and Transport Strategy

Please see S/4HANA Client Strategy for client details in S/4HANA.

Application Security

User Access

SAP Fiori (web access) will be the primary mode of access for S/4HANA for business users. 

Support users will access S/4HANA via web and SAPGUI.

Authentication

SAML SSO - Fiori 

Identity Authentication Services within SAP Cloud Identity Services will be configured to act as a Identity provider proxy as shown below.

Authorization

Communication Security

Data Security

Other Controls

Operation Architecture

Change and Configuration Management

Transport Management

Release Management

Monitoring

Application Monitoring

System Monitoring

Sizing

High Availability

Disaster Recovery

Backup/Restore

Maintenance Plan

Exceptions

See also

Change log

Workflow history