Connection creation for SAP OData connector with mTLS

The CPD SAP OData connector has been enhanced to support mTLS (Mutual TLS), enabling secure communication for data extraction. This new feature strengthens the existing SAP OData connector by providing an added layer of security through mutual authentication. 

Overview of SAP OData mTLS

SAP Configurations: Preparing and uploading CA-SIGNED X509 certificate

Creating new connection for SAP Odata using mTLS

Modifying existing SAP OData connection to mTLS

Overview of SAP OData mTLS 

Mutual Transport Layer Security (mTLS) is a robust authentication method that enhances the security of SAP OData services by requiring both the client and server to authenticate each other using certificates. This two-way authentication ensures that both parties are verified, establishing a secure communication channel for data transmission. 

SAP Configurations: Preparing and uploading CA-SIGNED X509 certificate 

• Step 1: Prepare the CA-Signed X.509 Certificate Keypair
  1. Generate a Certificate Signing Request (CSR) and Private Key by running the following command. Please note that the following command is provided as an example of the expected format: openssl req -new -newkey rsa:4096 -nodes -out CSR.csr -keyout PrivateKey.key -subj "/C=US/ST=California/L=San Jose/O=<organization>/OU=IT/CN=<common_name_certificate>"
  2. The above step generates:
     • CSR.csr – The certificate signing request
     • PrivateKey.key – The private key (RSA 4096-bit, unencrypted)
  3. Submit the CSR to the Certificate Authority (CA).
     • Send the CSR.csr file to your Certificate Authority (CA).
     • Ensure that the received certificate is in. pem format (Base64 encoded).
  4. Convert the Private Key to PKCS8 Format(Optional). If required, convert the private key from PKCS1 (RSA) to PKCS8 (PEM) format: openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in PrivateKey.key -out pkcs8.pem . This generates pkcs8.pem, which may be needed for certain integrations.
• Step 2: Upload the CA-signed x509 certificate to the communication user.
  1. On S/4HANA Cloud, either use an existing communication user or create a new one to upload a CA-signed x.509 client certificate.
  2. Ensure that the communication user is assigned to the communication system, with the authentication type set to SSL Client Certificate.
  3. Click on Maintain User to navigate to the Communication User Maintenance app.
  4. Under the Users for Inbound Communication section, click the Upload button to upload the certificate chain for the user. Please ensure that the x.509 certificate includes the full chain of certificates.
  5. Click on Upload, and once the certificate is added, a confirmation message should appear, indicating successful addition.
  6. The certificate has now been successfully configured on the S/4HANA Cloud platform.

Note:

• A CA-signed x.509 certificate can be assigned to only one technical communication user.
• The client application will rely on this CA-signed x.509 certificate trust, which is bound to the technical communication user, instead of using a dynamically propagated business user identity, enabling password-less communication with S/4HANA Cloud.

Creating new connection in CPD for SAP Odata using mTLS 

1. Select or create the project.
2. Under Assets, click “New Asset” in the top right corner.
3. Click on the "Connect to a data source".
4. Select SAP OData Connector and click "Next".
5. Create Connection by providing relevant details like SAP Gateway URL, Connection name, SAP OData Service Version etc.
6. Select “None” option in the authentication method.
7. Check the "Use mutual authentication" box.
8. Enter Required Details like client certificate chain, Client Private Key, Passphrase (optional) if you are using encrypted private key.
9. Click on "Test connection".
10. Click on "Create" to create the connection.

Modifying existing SAP OData connection in CPD to mTLS 

1. Open existing created connection from Assets.
2. Go to "Edit Connection" Page.
3. Select “None” option in authentication method.
4. Check the "Use mutual Authentication" box.
5. Enter SSL certificate, Client Certificate chain, Private Key, Passphrase(if required).
6. Click on "Test connection" and "Save" to save the connection.
7. The existing connection gets updated with mTLS connection.

Note: 

This mTLS connection can further be used to design and run a job in CPD environments.