© 2021 SAP SE or an SAP affiliate company. All rights reserved.

PUBLIC
2021-06-03

SAP BTP, Neo Environment

THE BEST RUN

Content

1 What Is SAP BTP, Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.1 Account Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Global Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Subaccounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Directories [Feature Set B]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Relationship Between Global Accounts and Subaccounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Relationship Between Global Accounts, Subaccounts, and Directories [Feature Set B]. . . . . . . . . 13
Custom Properties [Feature Set B]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
User Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.2 Regions in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Regions and Hosts Available for the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Resilience, High Availability, and Disaster Recovery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
1.3 Solutions and Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
1.4 Connectivity for the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
What Is Connectivity for the Neo Environment?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
What's New for Connectivity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Development. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Cloud Connector (Neo Environment). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Connectivity via Reverse Proxy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531
Connectivity Support. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533
1.5 What is Document Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535
Consuming the Document Service (Java). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .538
Consume Document Service (HTML5 Applications). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 586
Managing Repositories in the Cockpit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587
Managing a Repository with Console Client Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590
Terminate an Account and Export Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .591
1.6 SAP Feedback service (Beta). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591
Consuming the SAP Feedback service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593
Getting Feedback for Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
Data Protection and Privacy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608
1.7 Gamification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609
Getting Started. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610
Gamification Development Cycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .620
Gamification Workbench. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 622
Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626

SAP BTP, Neo Environment

2 PUBLIC Content
 Managing Apps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629
Configuring Game Mechanics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 634
Integrating Gamification into a Target Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 669
Analyzing Gamification Concepts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677
Case Study: Gamified Help Desk Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679
1.8 SAP Git Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 698
Managing Repositories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .700
Working with Repositories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704
Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709
Best Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711
1.9 What Is SAP Monitoring Service?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713
1.10 What's New for SAP Monitoring Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 714
2020 What's New for SAP Monitoring Service (Archive). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 715
2019 What's New for SAP Monitoring Service (Archive). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 715
2018 What's New for SAP Monitoring Service (Archive). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 716
1.11 Initial Setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .717
1.12 Monitoring Java Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717
View Monitoring Metrics of a Java Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 718
Availability Checks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 720
JMX Checks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726
Generate Heap and Thread Dumps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733
Metrics REST API for Java Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734
Checks REST API for Java Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740
1.13 Monitoring HTML5 Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 742
View Metrics of Custom Checks for an HTML5 Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . 743
Configure Custom Checks for HTML5 Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 744
Metrics REST API for HTML5 Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 747
Checks REST API for HTML5 Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748
1.14 Monitoring Database Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 749
View Monitoring Metrics of a Database System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 750
View Monitoring Metrics of an SAP HANA XS Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755
Availability Checks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756
Custom HTTP Checks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .761
Metrics REST API for Database Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 765
Metrics REST API for SAP HANA XS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .766
Checks REST API for SAP HANA XS Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767
1.15 Alert Webhooks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769
1.16 Monitoring and Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 772
Getting Support. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 772
1.17 Remote Data Sync Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 772
Get Access to the Remote Data Sync Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775

SAP BTP, Neo Environment

Content PUBLIC 3
 Provide a MobiLink Server in Your Subaccount. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776
Develop Client-Initiated Synchronization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 778
MobiLink Server Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 785
Configure Authentication for a MobiLink Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788
Connecting SQL Anywhere Tools to MobiLink Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 789
Monitor the Availability of the MobiLink Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792
Performance and Scalability of the MobiLink Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 793
1.18 Tutorials. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .795
1.19 Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 797
SAP BTP Cockpit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 798
SAP Web IDE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 801
Maven Plugin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 801
SAP BTP SDK for Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 802
SAP BTP SDK for iOS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803
Eclipse Tools for the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804
Console Client for the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .805
Working with Cloud Management Tools Feature Set B in the Neo Environment. . . . . . . . . . . . . .805

2 Get an Enterprise Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810

2.1 Purchase a Customer Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810
2.2 Join the Partner Program. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810
2.3 Commercial Models. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811
What Is the Consumption-Based Commercial Model?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812
What Is the Subscription-Based Commercial Model?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814

3 Getting Started, Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816

3.1 Getting Started with a Customer Account in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . 816
3.2 Getting Started with Business Applications Subscriptions in the Neo Environment. . . . . . . . . . . . . 820
Providing Multitenant Applications to Consumers in the Neo Environment. . . . . . . . . . . . . . . . 822
Subscribe to Java Multitenant Applications in the Neo Environment. . . . . . . . . . . . . . . . . . . . . 825
Subscribe to HTML5 Multitenant Applications in the Neo Environment. . . . . . . . . . . . . . . . . . . 827

4 Development, Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829

4.1 Deploy Business Applications in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829
4.2 Developing Java in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .830
Java: Getting Started. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 831
Runtime for Java. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 857
Development Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 870
Developing Java Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 874
Deploying and Updating Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .885
Debugging Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 912
Developing Multitenant Applications in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . 916

SAP BTP, Neo Environment

4 PUBLIC Content
 Programming with JPA and JDBC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 934
4.3 Developing SAP HANA in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1002
SAP HANA: Getting Started. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1002
Launch SAP HANA XS Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1017
Using an SAP HANA XS Database System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1018
4.4 Multitarget Applications for the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1035
Create a Hello World Multitarget Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1036
Defining MTA Development Descriptors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1040
Defining MTA Deployment Descriptors for the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . 1041
Defining Multitarget Application Archives. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1042
Defining MTA Extension Descriptors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1044
MTA Module Types, Resource Types, and Parameters for Applications in the Neo Environment
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1046
Integration with Transport Management Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074
Modeling Solutions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080
Operating Solutions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107
4.5 Developing HTML5 Applications in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1135
HTML5: Getting Started. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1137
Developer's Guide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
4.6 API Documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1165
Using Platform APIs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1167
4.7 Using Services in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1170
About Services in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1170
Enable Services in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171
Disable Services in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1172

5 Extensions, Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1173

5.1 Extending SAP S/4HANA Cloud in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1175
Configuring Single Sign-On Between SAP S/4HANA Cloud and SAP BTP, Neo Environment
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1176
Configuring the Extension Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1179
Configuring SAP Web IDE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1188
5.2 Extending SAP SuccessFactors in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1193
Configuring the Subaccount in SAP BTP for SAP SuccessFactors. . . . . . . . . . . . . . . . . . . . . . 1195
Installing and Configuring Extension Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1207
5.3 Extending SAP Cloud for Customer in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . .1237
Configuring Single Sign-On. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1239
Configuring the SAP BTP Application Connectivity to SAP Cloud for Customer APIs. . . . . . . . . 1252
5.4 Extending SAP Ariba in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258
Configure Single Sign-On (SSO). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1259
Connect the Application Running on SAP BTP to SAP Ariba. . . . . . . . . . . . . . . . . . . . . . . . . . 1262

6 Administration and Operations, Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1277

SAP BTP, Neo Environment

Content PUBLIC 5
6.1 Account Administration in the Cockpit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1277
Navigate in the Cockpit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1277
Managing Global Accounts Using the Cockpit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1279
Managing Directories Using the Cockpit [Feature Set B]. . . . . . . . . . . . . . . . . . . . . . . . . . . . .1294
Managing Subaccounts Using the Cockpit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1298
Managing Entitlements and Quotas Using the Cockpit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1304
Managing Members Using the Cockpit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1308
6.2 Account Administration Using the SAP BTP Command Line Interface (btp CLI) [Feature Set B]
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1331
Download and Start Using the btp CLI Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1333
Command Syntax of the btp CLI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1336
General Commands and Options in the btp CLI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1341
Commands in the btp CLI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1356
6.3 Account Administration in the Neo Console Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1359
Create Subaccounts Using the Console Client in the Neo Environment. . . . . . . . . . . . . . . . . . 1359
Add Quotas to Subaccounts Using the Console Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1360
Console Client for the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361
6.4 Application Operations in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1599
Using Multiple Subaccounts for Staged Application Development. . . . . . . . . . . . . . . . . . . . . . 1599
Java: Application Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1601
SAP HANA: Application Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1644
HTML5: Application Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1644
Configuring Application URLs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1656
Configuring Application Access via On-Premise Reverse Proxy. . . . . . . . . . . . . . . . . . . . . . . . 1680

7 Security, Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1683

7.1 Authorization and Trust Management in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . 1684
Securing Java Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1688
Securing HTML5 Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1758
Securing SAP HANA Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1760
7.2 Platform Identity Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1760
Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1760
1. Create Trust with the Identity Authentication Tenant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1761
2. Add Identity Authentication Tenant Users as Subaccount Members. . . . . . . . . . . . . . . . . . . 1763
(Optional) 3. Configure the Identity Authentication Tenant for the Required Scenarios. . . . . . . .1764
Accessing the SAP BTP Cockpit with the Tenant User Base. . . . . . . . . . . . . . . . . . . . . . . . . . .1764
Using the Console Client with the Tenant User Base. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1765
7.3 OAuth 2.0 Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1765
OAuth 2.0 Authorization Code Grant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1767
OAuth 2.0 Client Credentials Grant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1773
OAuth 2.0 Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1774
Principal Propagation to OAuth-Protected Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1782

SAP BTP, Neo Environment

6 PUBLIC Content
7.4 Keystore Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1787

Keystore API. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1787

Keys and Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1789

Enabling Client Certificate Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1805

Enable Strong Encryption in Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1815

Storing Passwords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1816

7.5 Audit Logging in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1818

Audit Log Retrieval API Usage for the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1818

Audit Log Retention API Usage for the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1823

7.6 Principal Propagation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1824

Principal Propagation Between Neo Subaccounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1825

Principal Propagation from the Neo to the Cloud Foundry Environment. . . . . . . . . . . . . . . . . . 1829

Principal Propagation from the Cloud Foundry to the Neo Environment. . . . . . . . . . . . . . . . . . 1835

7.7 Protection from Web Attacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1843

Protection from Cross-Site Scripting (XSS). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1844

Protection from Cross-Site Request Forgery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1848

7.8 Data Protection and Privacy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1856

Glossary for Data Protection and Privacy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1858

Change Logging and Read-Access Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1859

Personal Data Record. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1860

Deletion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1860

Consent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1863

8 Getting Support, Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1864

1. Log On to SAP ONE Support Launchpad. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1864

2. (Optional) Search in the Knowledge Base for Existing Solutions. . . . . . . . . . . . . . . . . . . . . . . . 1864

3. Choose Report an Incident. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1865

4. Provide System Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1865

5. Provide Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1867

6. Provide Attachments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1868

7. Set Priority. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1869

8. Choose Support Channel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1869

8.1 Providing Details for Database Problems in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . 1870

8.2 Gather Support Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1871

8.3 Platform Updates and Notifications in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . .1871

8.4 Operating Model in the Neo Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1872

8.5 Support Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1879

SAP BTP, Neo Environment

Content PUBLIC 7
1 What Is SAP BTP, Neo Environment

SAP BTP, Neo environment is an enterprise platform-as-a-service (enterprise PaaS) that provides
comprehensive application development services and capabilities, which lets you build, extend, and integrate
business applications in the cloud.

 Tip

This documentation refers to SAP Business Technology Platform, Neo environment. If you are looking
for documentation about other environments, see SAP Business Technology Platform.

At its core, SAP BTP enables you to do the following:

● Extend on-premise and cloud solutions

Personalize and extend your existing applications, regardless of whether they run on-premise or in the
cloud, to achieve agility and go to market faster.
● Integrate on-premise and cloud solutions
Bring together disparate systems and IT landscapes to streamline your business processes and increase
efficiency.
● Develop new cloud applications
Create new cloud applications with a small capital investment in software and hardware.

The Neo environment lets you develop HTML5, Java, and SAP HANA extended application services (SAP HANA
XS) applications. You can also use the UI Development Toolkit for HTML5 (SAPUI5) to develop rich user
interfaces for modern web-based business applications.

The Neo environment also allows you to deploy solutions on SAP BTP. In the context of SAP BTP, a solution is
made up of various application types and configurations created with different technologies, designed to
implement a certain scenario or task flow. You can deploy solutions by using the Change and Transport System
(CTS+) tool, the console client, or the SAP BTP cockpit, which also lets you monitor your solutions. The SAP
multitarget application (MTA) model encompasses and describes application modules, dependencies, and
interfaces in an approach that facilitates validation, orchestration, maintenance, and automation of the
application throughout its life cycle.

The Neo environment lets you use virtual machines, allowing you to install and maintain your own applications
in scenarios that aren't covered by the platform.

Capabilities and Services

According to your use cases, you may want to consume a set of services that are provided by SAP BTP. For
more information, see Solutions and Services [page 19].

SAP BTP, Neo Environment

8 PUBLIC What Is SAP BTP, Neo Environment
Regions

You can deploy applications developed in the Neo environment to various SAP data centers around the world.
For more information about regional availability of the Neo environment, see Regions and Hosts Available for
the Neo Environment [page 16].

Integration with SAP and Non-SAP Software

SAP BTP facilitates secure integration with on-premise systems that are running software from SAP and other
vendors. Using platform services such as the Connectivity service applications can establish secure
connections to on-premise solutions, enabling integration scenarios with your cloud-based applications. For
more information about the Connectivity service, see What Is Connectivity for the Neo Environment? [page
25].

Secure Data

The comprehensive, multilevel security measures that are built into SAP BTP are engineered to protect your
mission-critical business data and assets, and to provide the necessary industry-standard compliance
certifications.

Quality Certificates

Third-party certification bodies provide independent confirmation that SAP meets the requirements of
international standards. You can find all certificates at https://www.sap.com/corporate/en/company/
quality.html .

1.1 Account Model

Learn more about the different types of accounts on SAP BTP and how they relate to each other.

1.1.1 Global Accounts

Global accounts are hosted environments that represent the scope of the functionality and the level of support
based on a customer or partner’s entitlement to platform resources and services.

The global account is the realization of the commercial contract with SAP. A global account can contain one or
more subaccounts in which you deploy applications, use services, and manage your subscriptions.

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 9
Global accounts are region- and environment-independent. Within a global account, you manage all of your
subaccounts, which in turn are specific to regions and environments.

1.1.2 Subaccounts

Subaccounts let you structure a global account according to your organization’s and project’s requirements
with regard to members, authorizations, and quotas.

Subaccounts in a global account are independent from each other. This is important to consider with respect to
security, member management, data management, data migration, integration, and so on, when you plan your
landscape and overall architecture. Each subaccount is associated with a region, which is the physical location
where applications, data, or services are hosted. It is also associated with one environment. The specific region
and environment are relevant when you deploy applications and access the SAP BTP cockpit. The quotas that
have been purchased for a global account have to be assigned to the individual subaccounts.

1.1.2.1 Using Beta Features with Subaccounts

SAP may offer, and a customer may choose to accept access to functionality, such as a service or application,
which is not generally available and has not been validated and quality assured in accordance with SAP
standard processes. Such functionality is defined as a beta feature.

Beta features let customers, developers, and partners test new features on SAP BTP. The beta features have
the following characteristics:

● SAP may require that customers accept additional terms to use beta features.
● Beta features are released for enterprise accounts, trial accounts, or both.
● To allow the use of beta services and applications in the subaccounts available to you in the SAP BTP
cockpit, you need to set the Enable beta features option. You do this on global account level by choosing the
edit icon on the subaccount's tile.
● No personal data may be processed by beta functionality in the context of contractual data processing
without additional written agreement.

 Caution

You shouldn't use SAP BTP beta features in subaccounts that belong to productive enterprise accounts. For
more information, see Important Disclaimers and Legal Information.

Related Information

Change Subaccount Details [page 1300]

SAP BTP, Neo Environment

10 PUBLIC What Is SAP BTP, Neo Environment
1.1.2.2 Using Experimental Features in Subaccounts

SAP may choose to experiment with a feature before it decides whether to make it available for productive use.
In such a case, we ask customers, developers, and partners to provide feedback on that feature.

The experimental features have the following characteristics:

● Experimental features are not part of the officially delivered scope that SAP guarantees for future releases.
This means, that experimental features may be changed by SAP at any time for any reason without notice.
● Experimental features are not for productive use. You may not demonstrate, test, examine, evaluate, or
otherwise use the experimental features in a live operating environment or with data that has not been
sufficiently backed up

The purpose of experimental features is to get feedback early on, allowing customers and partners to influence
the future product accordingly. By providing your feedback (for example, in the SAP Community), you accept
that intellectual property rights of the contributions or derivative works shall remain the exclusive property of
SAP.

1.1.3 Directories [Feature Set B]

Directories allow you to organize and manage your subaccounts according to your technical and business
needs.

A directory can contain one or more subaccounts. It cannot contain other directories. Using directories to
group subaccounts is optional - you can still create subaccounts directly under your global account.

Directories allow you to:

● Group and filter subaccounts

● Monitor usage and, for contracts that use the consumption-based model, cost
● Set custom properties and tags for identification and reporting purposes

In addition, you can also add the following features to your directories (optional):

● Manage Entitlements: Enables the assignment of a quota for services and applications to the directory
from the global account quota for distribution to the directory's subaccounts.
When you assign entitlements to a directory, you express the entitlements and maximum quota that can
be distributed across its children subaccounts. You also have the option to choose the auto-assignment of

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 11
 a set amount of quota to all subaccounts created or moved to that directory. Subaccounts that are already
in the directory when you select that option will not be auto-assigned quota.
● Manage Authorizations: Enables a custom identity provider and/or authorization management for the
directory. For example, it allows certain users to manage directory entitlements. You can only use this
feature in combination with the Manage Entitlements feature.

Related Information

Getting a Global Account

Setting Up Your Account Model
Managing Global Accounts Using the Cockpit
Managing Directories Using the Cockpit [Feature Set B] [page 1294]
Managing Subaccounts Using the Cockpit [page 1298]
Working with Global Accounts, Directories, and Subaccounts Using the btp CLI [page 1357]
Add, Move, or Remove Subaccounts from Directories [Feature Set B] [page 1296]

1.1.4 Relationship Between Global Accounts and

Subaccounts

A global account can group together different subaccounts that an administrator makes available to users.
Administrators can assign the available quotas of a global account to its different subaccounts and move it
between subaccounts that belong to the same global account.

Subaccounts in a global account are independent from each other. This is important to consider with respect to
security, member management, data management, data migration and management, integration, and so on,
when you plan your landscape and overall architecture.

Each subaccount is associated with a particular region, which is the physical location where applications, data,
or services are hosted. The specific region associated with a subaccount is relevant when you deploy
applications (region host) and access the SAP BTP cockpit (cockpit URL). The region assigned to your
subaccount doesn't have to be directly related to your location. You could be located in the United States, for
example, but operate your subaccount in Europe.

For more information about the relationship between a global account and its subaccounts, see the graphic in
Basic Platform Concepts. For best practices, see Setting Up Your Account Model.

You can enable a subaccount to use beta features, including services and applications, which are occasionally
made available by SAP for SAP BTP. This option, unselected by default, is available only to administrators, for
your enterprise account.

 Caution

You shouldn't use SAP BTP beta features in subaccounts that belong to productive enterprise accounts. For
more information, see Important Disclaimers and Legal Information.

SAP BTP, Neo Environment

12 PUBLIC What Is SAP BTP, Neo Environment
1.1.5 Relationship Between Global Accounts, Subaccounts,
and Directories [Feature Set B]

A global account can group together different directories and subaccounts that an administrator makes
available to users. Administrators can assign the available entitlements and quotas of a global account to its
different subaccounts and move it between subaccounts that belong to the same global account.

 Note

The content in this section is only relevant for cloud management tools feature set B. For more information,
see Cloud Management Tools - Feature Set Overview.

The hierarchical structure of global accounts, directories, and subaccounts lets you define an account model
that accurately fits your business and development needs. For example, if you want to separate development,
testing, and productive usage for different departments in your organization, you can create a directory for
each department, and within each directory, you group subaccounts for development, testing, and production.

1.1.6 Custom Properties [Feature Set B]

Custom properties allow you to label or tag your directories and subaccounts according to your own business
and technical needs. This makes organizing and filtering your directories and subaccounts easier within your
global account.

You create and assign custom properties when you create or edit a directory or subaccount. Using custom
properties is optional.

Each custom property has a name (also referred to as a key) and typically one or more values that are
associated with the property. You can also assign a custom property to a directory or subaccount without
giving a specific value. When no value is given, the custom property behaves like a tag. Here are some examples
of custom properties:

Custom Property (Name) Property Values

Landscape Dev
Test
Production

Department HR
IT
Finance
Sales

Cost Center 000001134789

000002155534
To be defined

Flagged for Deletion (no values)

Important (no values)

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 13
Consider the following when working with custom properties:

● Each directory or subaccount can have up to 10 custom properties assigned to it.

● You cannot add the same custom property with a different value to the same directory or subaccount.
● Directories do not share their custom properties with subaccounts, and vice versa. However, when you
view the custom properties of a subaccount, it also shows the custom properties assigned to its parent
directory, if one exists.
● When you create a custom property or assign a new value to a property in a directory, they become
available for use across all the directories in your global account. The same applies to subaccounts.
● The property names and values that you enter are case-sensitive; be careful not to create unnecessary
variants of the same names or values with different casing, style, or spacing.
● Property names (keys) are case-insensitive, which means you cannot create variants of the same property
name with different casing (for example, "MyKey" and "myKey" cannot coexist). Property values on the
other hand are case-sensitive; be careful not to create unwanted variants of the same names or values with
a different casing or styling.
● To remove a custom property that is assigned to a directory or subaccount, or to change the assigned
value of a property, you must edit the directory or subaccount.
● Currently, you cannot manage or delete all the custom properties centrally for your directories and
subaccounts.

 Tip

● You can quickly view the custom properties that are assigned to a directory or subaccount by choosing
the More Info option in the Directories and Subaccounts pages in the SAP BTP cockpit. Custom
properties are listed after the standard properties that exist for directories and subaccounts, such as
ID, description, and creation date. Custom properties without a value are marked with a dash symbol
(-).
● In the Directories and Subaccounts pages in the cockpit, you can filter the displayed directories and
subaccounts by their assigned custom properties.

Related Information

Create a Subaccount
Change Subaccount Details
Create a Directory [Feature Set B] [page 1295]
Cloud Management Tools — Feature Set Overview

SAP BTP, Neo Environment

14 PUBLIC What Is SAP BTP, Neo Environment
1.1.7 User Accounts

A user account corresponds to a particular user in an identity provider, such as the SAP ID service (for
example, an S-user, P-user) and consists, for example, of an SAP user ID and password.

Platform Users vs Business Users

There are two types of users on SAP BTP: platform users and business users. Platform users are the members
of global accounts and subaccounts: usually developers, administrators or operators who deploy, administer,
and troubleshoot applications and services. They can view a list of all global accounts and subaccounts, and
access them using the cockpit.

Business users are those who use the applications that are deployed to SAP BTP. For example, users of
subscribed apps or services, such as SAP Web IDE, are business users.

1.2 Regions in the Neo Environment

You can deploy applications in different regions. Each region represents a geographical location (for example,
Europe, US East) where applications, data, or services are hosted.

All regions that are available for the Neo environment are exclusively provided by SAP. For an overview of all
available regions for the Neo environment, see SAP Cloud Platform Regions and Service Portfolio.

Selecting a Region

A region is chosen at the subaccount level. For each subaccount, you select exactly one region and one
environment. The selection of a region is dependent on many factors: For example, application performance
(response time, latency) can be optimized by selecting a region close to the user. For more information, see
Selecting a Region in Regions.

Deploying Applications in Regions

When deploying applications, consider that a subaccount is associated with a particular region and that this is
independent of your own location. You may be located in the United States, for example, but operate your
subaccount in a region in Europe.

To deploy an application in more than one region, execute the deployment separately for each host.

Regions and Hosts Available for the Neo Environment [page 16]
Each region represents a geographical location (for example, Europe, US East) where applications,
data, or services are hosted.

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 15
 Resilience, High Availability, and Disaster Recovery [page 17]
SAP has a number of processes in place to support resilience in SAP BTP, and provides different
offerings so that you can support the high availability of your applications.

1.2.1 Regions and Hosts Available for the Neo Environment

Each region represents a geographical location (for example, Europe, US East) where applications, data, or
services are hosted.

To find out about the regions available for multi-enviroment subaccounts, see Regions.

Regions, Hosts, and IP Ranges Available for the Neo Environment

Region (all operated
by SAP) Technical Key Host Cockpit Logon IP Ranges

Australia (Sydney) neo-ap1 ap1.hana.onde­ Link 157.133.96.0/23

mand.com

Brazil (São Paulo) neo-br1 br1.hana.onde­ Link 157.133.246.0/24

mand.com

Canada (Toronto) neo-ca1 ca1.hana.onde­ Link 157.133.54.0/24 and

mand.com 157.133.62.0/24

Europe (Amsterdam) neo-eu3 eu3.hana.onde­ Link 157.133.141.0/24 and

mand.com 157.133.140.0/24

Europe (Frankfurt) neo-eu2 eu2.hana.onde­ Link 157.133.70.0/24,

mand.com 157.133.204.0/24,
157.133.205.0/24 and
157.133.206.0/24

Europe (Rot) neo-eu1 hana.ondemand.com Link 155.56.128.0/17

eu1.hana.onde­
mand.com

Japan (Tokyo) neo-jp1 jp1.hana.onde­ Link 157.133.150.0/24

mand.com

Kingdom of Saudi Ara­ neo-sa1 sa1.hana.onde­ Link 157.133.93.0/24

bia (Riyadh) mand.com

Russia (Moscow) neo-ru1 ru1.hana.onde­ Link 157.133.2.0/24

mand.com

UAE (Dubai) neo-ae1 ae1.hana.onde­ Link 157.133.85.0/24

mand.com

SAP BTP, Neo Environment

16 PUBLIC What Is SAP BTP, Neo Environment
Region (all operated
by SAP) Technical Key Host Cockpit Logon IP Ranges

US East (Ashburn) neo-us1 us1.hana.onde­ Link 65.221.12.0/24,

mand.com 206.112.73.0/24,
157.133.16.0/24 and
157.133.18.0/24

US West (Chandler) neo-us2 us2.hana.onde­ Link 64.95.110.0/24,

mand.com 64.95.111.0/24,
157.133.24.0/24,
157.133.25.0/24 and
157.133.26.0/24

US East (Sterling) neo-us3 us3.hana.onde­ Link 169.145.117.0/24,

mand.com 169.145.118.0/24 and
169.145.125.0/25

US West (Colorado neo-us4 us4.hana.onde­ Link 157.133.45.0/24

Springs) mand.com

IP Range Notation

The IP ranges listed here are displayed in the Classless Inter-Domain Routing (CIDR) notation. The CIDR
notation is a compact way to specify an IP address and its associated routing prefix. The notation is made up of
the IP address, a forward slash character (/), and the number of leading 1-bits in the subnet mask.

For example: The CIDR notation 157.133.246.0/24 consists of the IP ranges between 157.133.246.0 and
157.133.246.255.

For more information about how CIDR ranges represent multiple IP addresses, you can read online about CIDR
notation.

1.2.2 Resilience, High Availability, and Disaster Recovery

SAP has a number of processes in place to support resilience in SAP BTP, and provides different offerings so
that you can support the high availability of your applications.

How SAP Provides Resilience

SAP applies resilience principles when developing, updating, and deploying our SAP BTP applications and
services. In the Neo environment, SAP provides resilience through the following:

● Backups and Disaster Recovery

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 17
 In the Neo environment, we back up all SAP BTP components every 24 hours. The backups are replicated
to a secondary site, from where they can be restored in case of a disaster. For more information, see
Standard Disaster Recovery and Disaster Recovery as Part of the Business Continuity Plan [page 18].
● High Availability for SAP HANA
If you use the SAP BTP, SAP HANA service, you can set up your databases in high availability mode to
increase the availability of your systems. For more information, see Managing Database Systems in a High
Availability Setup.

Best Practices for Resilient Applications

In addition to the services offered by SAP BTP, you can follow our best practices for developing and deploying
applications, which help you to make your applications running on SAP BTP stable and highly available:

● Develop Resilient Applications

When developing your applications, apply the principles and patterns of resilient software design that fit
your use case. For more information, see Developing Resilient Apps on SAP BTP.
● Implement Failover
Use a multi-region setup and implement automatic failover to ensure the high availability of your
applications. For more information, see Planning Failover on SAP BTP.

1.2.2.1 Disaster Recovery as Part of the Business

Continuity Plan

The cloud platform disaster recovery (DR) plan is part of the overall cloud platform business continuity plan,
which includes crisis management and process continuity activities that are triggered by a declared disaster.

What Constitutes a Disaster?

A disaster is declared by SAP when there is a loss of utilities and services, and uncertainty about whether they
can be restored within a reasonable period of time. A disaster can be caused by a natural catastrophe or a man-
made incident. As long as the production site has power and is connected to the Internet, it’s not considered a
disaster.

How Is a Disaster Declared?

Emergency incidents are assessed by SAP as part of its business continuity plan and an SAP management
member with proper authorization must officially declare a disaster to initiate a disaster recovery plan.

If a disaster is declared, operations are moved to a disaster recovery site based on the process laid out in the
business continuity plan.

SAP BTP, Neo Environment

18 PUBLIC What Is SAP BTP, Neo Environment
Standard Disaster Recovery

SAP can restore productive tenants from backups as soon as practicable in case of a disaster resulting in the
loss of the primary production data center.

As the magnitude of a disaster is unpredictable, a region might not be restored in a reasonable time. In
addition, a new infrastructure might need to be set up at a different location, which might require the purchase
and setup of new hardware. Therefore, we can't guarantee any fixed recovery timelines.

1.3 Solutions and Services

Consume the solutions and services by SAP BTP according to your use cases.

Solutions

SAP BTP offers fast in-memory processing, sustainable, agile solutions and services to integrate data and
extend applications, and fully embedded analytics and intelligent technologies.

Services

Services enable, facilitate, or accelerate the development of business applications and other platform services
on SAP BTP. Services are grouped into the following service types:

● Business services: Services that enable, facilitate, or accelerate the development of business process
components or provide industry-specific functionalities or content within a business application.
● Technical services: Services that enable, facilitate, or accelerate the development of general or domain
independent content within a business application, independent of the application's business process or
task.

You find all available services, solutions, and use cases in the SAP Discovery Center .

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 19
Use the service catalog to access service-specific resources:

1.4 Connectivity for the Neo Environment

SAP BTP Connectivity: overview, features, restrictions.

 Note

This documentation refers to SAP BTP, Neo environment. If you are looking for information about the
Cloud Foundry environment, see Connectivity (Cloud Foundry environment).

Content

In this Topic

Hover over the elements for a description. Click an element for more information.

SAP BTP, Neo Environment

20 PUBLIC What Is SAP BTP, Neo Environment
● Overview [page 21]
● Features [page 22]
● Restrictions [page 23]

In this Guide

Hover over the elements for a description. Click an element for more information.

● What Is Connectivity for the Neo Environment? [page 25]

● Cloud Connector (Neo Environment) [page 224]
● Connectivity Support [page 533]

Overview

The Connectivity service allows SAP BTP applications to securely access remote services that run on the
Internet or on-premise. This service:

● Allows subaccount-specific configuration of application connections via destinations.

● Provides a Java API that application developers can use to consume remote services.
● Allows you to make connections to on-premise systems, using the Cloud Connector.
● Lets you establish a secure tunnel from your on-premise network to applications on SAP BTP, while you
keep full control and auditability of what is exposed to the cloud.

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 21
A typical scenario for connecting your on-premise network to SAP BTP looks like this:

● Your company owns a global account on SAP BTP and one or more subaccounts that are assigned to this
global account.
● Using SAP BTP, you subscribe to or deploy your own applications.
● To connect to these applications from your on-premise network, the Cloud Connector administrator sets
up a secure tunnel to your company's subaccount on SAP BTP.
● The platform ensures that the tunnel can only be used by applications that are assigned to your
subaccount.
● Applications assigned to other (sub)accounts cannot access the tunnel. It is encrypted via transport layer
security (TLS), which guarantees connection privacy.

For inbound connections (calling an application or service on SAP BTP from an external source), you can use
Cloud Connector service channels [page 433] (on-premise connections) or the respective host [page 16] of
your SAP BTP region (Internet connections).

Back to Content [page 20]

Features

The Connectivity service supports the following protocols and scenarios:

Protocol Scenario

HTTP(S) Exchange data between your cloud application and Internet

services or on-premise systems.

● Create and configure HTTP destinations to make Web

connections.
● Connect to on-premise systems via HTTP, using the
Cloud Connector.

RFC Invoke on-premise ABAP function modules via RFC.

● Create and configure RFC destinations.

● Make connections to back-end systems via RFC, using
the Cloud Connector.

TCP Access on-premise systems via TCP-based protocols using a

SOCKS5 proxy.

LDAP Enables LDAP-based user management if you are operating

an LDAP server within your network.

SAP BTP, Neo Environment

22 PUBLIC What Is SAP BTP, Neo Environment
Protocol Scenario

Mail Protocols Applications use the standard javax.mail API. The e-

mail provider and e-mail account are configured using mail
destinations.

● The SMTP protocol allows you to send e-mail messages

from your Web applications using e-mail providers that
are accessible on the Internet, such as Google Mail
(Gmail).
● The IMAP and POP3 protocols let you retrieve e-mails
from the mailbox of your e-mail account.

Back to Content [page 20]

Restrictions

General [page 23]

Protocols [page 24]

Neo Environment [page 24]

Cloud Connector [page 25]

 Note

For information about general SAP BTP restrictions, see Prerequisites and Restrictions.

General

Topic Restriction

Java Connector To develop a Java Connector (JCo) application for RFC com­
munication, your SDK local runtime must be hosted by a 64-
bit JVM, on a x86_64 operating system (Microsoft Windows
OS, Linux OS, or Mac OS X).

On Windows platforms, you must install the Microsoft Vis­

ual Studio C++ 2013 runtime libraries (vcredist_x64.exe),
see Visual C++ Redistributable Packages for Visual Studio
2013 .

Ports For Internet connections, you are allowed to use any port
>1024. For cloud to on-premise solutions there are no port
limitations.

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 23
Topic Restriction

Destination Configuration ● You can use destination configuration files with exten­
sion .props, .properties, .jks, and .txt, as
well as files with no extension.
● If a destination configuration consists of a keystore or
truststore, it must be stored in JKS files with a stand­
ard .jks extension.

Back to Restrictions [page 23]

Protocols

For the cloud to on-premise connectivity scenario, the following protocols are currently supported:

Protocol Info

HTTP HTTPS is not needed, since the tunnel used by the Cloud
Connector is TLS-encrypted.

RFC You can communicate with SAP systems down to SAP R/3
release 4.6C.

TCP You can use TCP-based communication for any client that
supports SOCKS5 proxies.

LDAP Enables LDAP-based user management if you are operating

an LDAP server within your network.

Back to Restrictions [page 23]

Neo Environment

Topic Restriction

E-Mail ● You cannot communicate with an e-mail provider via an

unencrypted SMTP protocol on port 25.
● Fetched e-mail is not scanned for viruses.
● Sending e-mail with attachments using
javax.activation.DataHandler works with
SAP BTP SDK for Java EE 6 Web Profile.
● Mail destinations can be configured only on application
level. That is, configuration on a subscription or cus­
tomer subaccount level is not supported.
● For SAP BTP SDK for Java Web and SAP BTP SDK for
Java EE 6 Web Profile: Applications must use the
javax.mail version that is provisioned by the SAP
BTP runtime (see Connectivity and Destination APIs
[page 127]). Applications must not include the
javax.mail library as part of the web archive.

SAP BTP, Neo Environment

24 PUBLIC What Is SAP BTP, Neo Environment
Back to Restrictions [page 23]

Cloud Connector

Topic Restriction

Scenarios To learn in which system landscapes you can set up the

Cloud Connector, see Extended Scenarios [page 228].

Installation To check all software and hardware restrictions for working

with the Cloud Connector, see Prerequisites [page 231].

Back to Restrictions [page 23]

Back to Content [page 20]

Related Information

What's New for Connectivity [page 28]

Connectivity via Reverse Proxy [page 531]

1.4.1 What Is Connectivity for the Neo Environment?

Use SAP Connectivity service for your application in the Neo environment. Learn about destination
management, connectivity scenarios, and required user roles.

 Note

This documentation refers to SAP BTP, Neo environment. If you are looking for information about the
Cloud Foundry environment, see Connectivity (Cloud Foundry environment).

Content

In this Topic

Hover over the elements for a description. Click an element for more information.

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 25
● Destinations [page 26]
● User Roles [page 27]
● Scenarios [page 26]

In this Guide

Hover over the elements for a description. Click an element for more information.

● Operations [page 52]

● Development [page 127]

Destinations

To use of the Connectivity service, you must first create and configure destinations, using the corresponding
communication protocol and other destination properties.

You have several options to create and edit destinations, see Managing Destinations [page 52].

To learn how to configure a destination for a specific protocol, see:

● HTTP Destinations [page 89]

● RFC Destinations [page 107]
● LDAP Destinations [page 118]
● Mail Destinations [page 120]

Back to Content [page 25]

Scenarios

Scenario More Information

Connect Web applications and external servers via HTTP Consume Internet Services (Java Web or Java EE 6 Web Pro­
file) [page 148]

Make connections between Web applications and on-prem­ Consume Backend Systems (Java Web or Java EE 6 Web
ise backend services via HTTP Profile) [page 162]

Connect Web applications and on-premise backend services Invoke ABAP Function Modules in On-Premise ABAP Sys­
via RFC tems [page 186]

SAP BTP, Neo Environment

26 PUBLIC What Is SAP BTP, Neo Environment
Scenario More Information

Use LDAP-based user authentication for your cloud applica­ LDAP Destinations [page 118]
tion

Access on-premise systems via TCP-based protocols using a Using the TCP Protocol for Cloud Applications [page 196]
SOCKS5 proxy

Send and fetch e-mail via mail protocols Sending and Fetching E-Mail [page 200]

Back to Content [page 25]

User Roles

The following user groups are involved in the end-to-end use of the Connectivity service:

● Application operators - are responsible for productive deployment and operation of an application on SAP
BTP. They are also responsible for configuring destinations and certificates for the remote connections
that an application may need, see Operations [page 52].
● Application developers - create a connectivity-enabled SAP BTP application by using the Connectivity
service API, see Development [page 127].
● IT administrators - set up the connectivity to SAP BTP in your on-premise network, using the Cloud
Connector [page 224].

Some procedures on the SAP BTP can be done by developers as well as by application operators. Others may
include a mix of development and operation tasks. These procedures are labeled using icons for the respective
task type in the corresponding task topics.

Task Types

Operator Developer Operator and/or Devel­

oper

To perform connectivity tasks in the Neo environment, the following user roles and authorizations apply:

Connectivity UI (Level) in the Cockpit Subaccount Roles OAuth Scopes

Cloud Connectors Administrator manageSCCTunnels

Cloud Connector Admin

Destinations (subaccount level) Administrator manageSCCTunnels

Destinations (application level) Administrator manageSCCTunnels

Developer

Destinations (subscription level) Administrator manageSCCTunnels

SAP BTP, Neo Environment

What Is SAP BTP, Neo Environment PUBLIC 27
Connectivity UI (Level) in the Cockpit Subaccount Roles OAuth Scopes

Destinations (service) Administrator manageSCCTunnels

For more information on the configuration levels available for destination management, see Managing
Destinations [page 52] (section Configuration Levels (HTTP and RFC)).

See also:

Managing Member Authorizations in the Neo Environment [page 1315]

Managing Roles [page 1724]

Platform Scopes [page 1321]

Back to Content [page 25]

Related Information

Prerequisites and Restrictions

Operations [page 52]
Development [page 127]
Security
Multitarget Applications for the Neo Environment [page 1035]
Prerequisites and Restrictions

1.4.2 What's New for Connectivity

Find the latest features, enhancements and bug fixes for SAP BTP Connectivity .

What's New for Connectivity

Related Information

2020 Connectivity (Archive) [page 29]

2019 Connectivity (Archive) [page 37]
2018 Connectivity (Archive) [page 44]
2017 Connectivity (Archive) [page 48]

SAP BTP, Neo Environment

28 PUBLIC What Is SAP BTP, Neo Environment
1.4.2.1 2020 Connectivity (Archive)

2020

Techni­
cal Envi­ Availa­
Com­ Capa­ ron­ ble as
ponent bility ment Title Description Type of

Con­ Inte­ Neo Java JCo provides the new property New 2020-1
nectiv­ gration Cloud Connec­ jco.client.tls_client_certificate_logon to 2-17
ity Suite Foun­ tor (JCo) support the usage of a TLS client certificate for logging on to an
dry - Client ABAP system via WebSocket RFC.
Certifi-
For more information, see:
cates
User Logon Properties (Cloud Foundry environment)

User Logon Properties (Neo environment)

For more information on WebSocket RFC, see also:

WebSocket RFC

Con­ Inte­ Cloud HTTP Authentication type SAP Assertion SSO is deprecated. It will Depre­ 2020-1
nectiv­ gration Foun­ Destina­ soon be removed as a feature from the Destination service. cated 2-17
ity Suite dry tions -
Use Principal Propagation SSO Authentication instead, which is
Authenti­
the recommended mechanism for establishing single sign-on
cation
(SSO).
Types

Con­ Inte­ Neo HTTP Authentication type SAP Assertion SSO is deprecated. Depre­ 2020-1
nectiv­ gration Destina­ cated 2-17
Use Principal Propagation SSO Authentication instead, which is
ity Suite tions -
the recommended mechanism for establishing single sign-on
Authenti­
(SSO).
cation
Types

C