SAP Connection
Overview
The SAP connection allows IB-X Agents to connect to SAP systems and interact with SAP business data and services using OData APIs.
SAP connections can be used by workflow activities to perform operations such as:
- Retrieve SAP Business Object records
- Create records
- Update records
- Delete records
- Execute OData functions
- Execute OData actions
IB-X supports SAP OData services exposed by supported SAP S/4HANA Cloud and SAP S/4HANA On-Premises environments.
Authentication
SAP connections support the following authentication methods:
| Authentication Type | Description |
|---|---|
| Basic | Authenticates using an SAP user name and password. |
| OAuth | Authenticates using OAuth 2.0 client credentials and the configured SAP OAuth scope. |
The authentication method available to you depends on how authentication and API access are configured in your SAP environment.
Contact your SAP administrator if you are unsure which authentication method or credentials should be used for your SAP system.
Creating an SAP Connection
When creating an SAP connection, configure the SAP system details and the authentication method required to access it.
Name
A user-defined name used to identify the SAP connection within IB-X.
Description
An optional description that provides additional information about the connection.
SAP Variant
Specifies the type of SAP environment to connect to.
Select the SAP variant that corresponds to your SAP deployment.
Base URL
The base URL of the SAP system that exposes the OData services.
For example:
https://sap.example.com/sap/opu/odata/sap
IB-X uses this URL to discover and communicate with the OData services available through the SAP connection.
OData Version
Specifies the OData protocol version used when communicating with SAP.
| Option | Description |
|---|---|
| Auto (detect) | Automatically determines the OData version based on the configured connection. This is the default option. |
| OData V2 | Uses the OData V2 protocol. |
| OData V4 | Uses the OData V4 protocol. |
Use the default Auto (detect) option unless your SAP environment requires a specific OData version.
SAP Client
Specifies the SAP client associated with the connection.
An SAP client is typically represented by a three-digit value, such as 100.
The required SAP client value is determined by your SAP environment.
Language
Specifies the language used when communicating with the SAP system.
The default language is EN - English.
Timeout
Specifies the maximum amount of time, in seconds, that IB-X waits for an SAP request to complete.
The default timeout is 60 seconds.
Verify SSL
Determines whether IB-X validates the SSL certificate presented by the SAP server.
Keep Verify SSL enabled for secure production connections.
Disabling SSL certificate verification can expose the connection to security risks. Disable it only when required for controlled development or testing environments.
Basic Authentication
Select Basic as the Authentication Type when the SAP system is configured to authenticate using an SAP user account.
User Name
The SAP user name used to authenticate with the SAP system.
Password
The password associated with the specified SAP user.
The configured SAP user must have the permissions required to access the OData services and Business Objects used by the Agent.
OAuth Authentication
Select OAuth as the Authentication Type when the SAP system is configured to use OAuth 2.0 Client Credentials authentication.
Before creating an OAuth-based SAP connection in IB-X, the SAP system must be configured for OAuth access. This includes activating the required OData services, configuring an OAuth client, enabling the Client Credentials grant, and assigning the required OAuth scopes.
For information about preparing SAP for OAuth authentication, see Configure SAP for OAuth 2.0.
SAP OAuth configuration typically requires SAP administrative access. If you do not manage the SAP environment, contact your SAP administrator to configure OAuth and provide the required connection details.
OAuth Client ID
The OAuth client identifier configured for accessing the SAP system.
OAuth Client Secret
The client secret associated with the configured OAuth client.
Token Endpoint
The OAuth token endpoint used by IB-X to obtain an access token.
For SAP systems using the standard ABAP OAuth endpoint, the token endpoint typically uses the following path:
/sap/bc/sec/oauth2/token
The actual token endpoint depends on the OAuth configuration of your SAP environment.
For some SAP environments, the OAuth token endpoint may be hosted separately from the SAP OData Base URL.
Use the token endpoint provided by your SAP administrator or SAP communication configuration.
Scope
The OAuth scope authorized to access the required SAP OData services.
Enter the scope ID configured for the OAuth client in SAP.
If multiple scopes are required, specify them as space-separated values.
The scope is defined as part of the OAuth configuration in SAP and is associated with the OData services that the OAuth client is allowed to access.
Obtain the appropriate scope ID from the OAuth client configuration or Communication Arrangement used for the SAP connection.
For information about configuring and assigning OAuth scopes, see Configure SAP for OAuth 2.0.
If you are unsure which scope to use, contact your SAP administrator.
A valid OAuth Client ID and Client Secret may allow IB-X to obtain an access token, but the token must include the appropriate scope to access the required SAP OData services.
Testing the SAP Connection
After configuring the SAP connection, select Test Connection to verify that IB-X can connect to and authenticate with the configured SAP system.
Testing the connection can help identify issues such as:
- Incorrect SAP Base URL
- Invalid SAP Client
- Incorrect user name or password
- Invalid OAuth Client ID or Client Secret
- Incorrect OAuth Token Endpoint
- Missing or incorrect OAuth scope
- SSL certificate validation failures
- Authentication or authorization failures
- SAP OData service accessibility issues
Successful authentication does not necessarily mean that the configured credentials have permission to access every SAP OData service or Business Object.
The SAP user or OAuth client must have the permissions required by the workflow activities that use the connection.
If OAuth authentication succeeds but SAP OData APIs cannot be accessed, verify the configured OAuth scope, technical user permissions, and OData service activation.
For additional troubleshooting guidance, see Configure SAP for OAuth 2.0.
Using the SAP Connection in Workflows
Once created, the SAP connection can be selected in supported SAP workflow activities.
After selecting the connection, the activity can retrieve the available SAP services. Based on the selected service, you can select the corresponding Business Object and configure the operation to perform.
SAP OData activities include operations for:
- Getting a single record
- Getting multiple records
- Creating a record
- Updating records
- Deleting records
- Executing OData functions
- Executing OData actions
The services, Business Objects, fields, functions, and actions available to an activity depend on the OData services exposed by the connected SAP system.
Security Considerations
When configuring SAP connections:
- Use SAP accounts or OAuth clients with only the permissions required by the intended automation.
- Prefer OAuth authentication where required by your organization's SAP security policies.
- Protect SAP user passwords, OAuth Client IDs, and Client Secrets from unauthorized access.
- Configure only the OAuth scopes required by the SAP services used by the Agent.
- Keep Verify SSL enabled for production environments.
- Follow your organization's policies for managing SAP users, communication arrangements, OAuth clients, and API access.
For information about creating, editing, testing, cloning, deleting, and auditing connections, see Connections.