Connections and the connector agent

Every SAP system you bring into TENSOR is a connection. On-premises systems are served by a connector agent that you run on your own network; cloud systems use OAuth 2.0. Landscapes group connections into transport paths, and collectors decide what the agent reads and how often.

Step-by-step instructions are in Guides for setup and Basis administrators.

Supported SAP systems and connections

Each SAP system is a separate connection. Connections show their status — Healthy, Degraded, Failing or Not checked — the last check time and recent health events.

RFC connections hold no password

For an RFC connection you enter only the application server host, system number, client and SID. No SAP password is entered in TENSOR. The technical user and password go only into the connector agent's local configuration on your network, and RFC data arrives only through the agent.

Because TENSOR never opens an RFC connection itself, Test connection is for cloud connections and fails for an RFC system. Judge their health by the connector agent's Last heartbeat and Last envelope instead.

OAuth connections

For a cloud system you enter the token URL, client ID, client secret, API base URL and system ID, and choose the system type (S/4HANA Cloud, SAP BTP or Cloud ALM). The client secret is stored encrypted (KMS envelope encryption) and never shown again. For Cloud ALM, the read-only poll starts automatically once the connection is saved.

System inventory

The inventory collector keeps the CMDB current:

• It creates and updates CIs of class SAP system (SID, product, release, kernel, landscape role, deployment kind) and SAP client (client number and purpose). HANA databases are their own CI class.
• Unknown client categories are reported as test clients, never as productive.
• The landscape role of a system — dev, qa, prod or sandbox — is read from its SAP system CI and decides which transports create Changes.

The Push sample inventory button is a test aid, not a data source. For the CI classes themselves, see CI classes; SAP CIs are matched on SID through the same source-identifier mechanism described in reconciliation.

Landscapes

A landscape maps a DEV, a QA and a PROD connection for one logical system — for example ERP, BW or Solution Manager. Any stage can be left Not assigned. Landscape names must be unique.

Each landscape can also name a CAB role per stage. This is partially available: the CAB role is stored and checked by the SolMan cutover checklist, but there is no screen to set it yet.

Auto-created Changes depend on the landscape role of the SAP system CI, so make sure your development systems carry the role dev.

The connector agent

The connector agent is a command-line program you run on a host in your network. It reads SAP via RFC and HANA via SQL, and pushes signed envelopes to TENSOR over outbound HTTPS. It needs no inbound port.

• Runtime. Node.js 22 or newer, with HTTPS egress to your TENSOR address.
• SAP libraries. For live mode you install the SAP NW RFC SDK and node-rfc under your own SAP licence, and @sap/hana-client for the HANA collector. TENSOR does not ship or redistribute them.
• Fixture mode. Without the SAP libraries the agent starts in fixture mode and says so. Use it to test the path end to end before you connect a real system. The agent has so far been tested in fixture mode only.
• Enrollment. You create the agent in TENSOR, which shows a one-time enrollment token. Running tensor-sap-agent enroll exchanges the token for a signing secret and sets the configuration file to owner-only access. The token is stored in TENSOR only as a SHA-256 hash and cannot be retrieved later.
• Signing and idempotency. After enrollment every request is signed with HMAC-SHA256 over timestamp and raw body. Envelope IDs are idempotency keys, so a replayed envelope is recognised and not processed twice.
• Allowed connections. Each agent is allowed a set of SAP connections. Items it sends for any other connection are rejected one by one.
• Offline spool. Network errors, 408, 429 and 5xx responses use bounded exponential backoff. Undeliverable envelopes are spooled to disk — readable by the owner only — and flushed in order once TENSOR is reachable.
• Logs. Agent logs contain counts and stable IDs only, never credentials, SAP usernames, transport owners or raw payloads.

Agent states

The heartbeat monitor runs every 5 minutes. Disabling an agent cannot be reversed. On Settings → SAP connector agents each agent shows its status, Last heartbeat, Agent version, Last envelope and Envelopes.

Collectors

A collector is one reading task of the agent. You switch collectors on per agent under Collectors and set each interval in seconds, minutes or hours. The agent picks up the new configuration on its next pass, and each collector runs on its own schedule — for example transports every 5 minutes, inventory daily.

The licence measurement collector only runs when TENSOR reports a due run. CCMS alerts can also arrive through a signed webhook instead of the agent.

What the technical users need

• The technical SAP user needs RFC_READ_TABLE on the tables of the enabled collectors (E070, E071, T000, AGR_USERS, AGR_AGRS, USR02, USER_ADDR), RFC_SYSTEM_INFO and, for CCMS, the XMI/XAL BAPIs.
• The HANA user needs SELECT on M_DATABASE, M_SYSTEM_REPLICATION, M_BACKUP_CATALOG and M_DISKS.

Initial setup and SAP skills

Settings → SAP integrations → Initial setup offers two actions, both safe to repeat (existing entries are skipped):

• Seed SAP skills adds 15 SAP skills to the workforce catalog: SAP Basis, ABAP Development, SAP Authorizations, SAP HANA Administration, BW Administration, S/4HANA Migration, SAP FI, SD, MM, PP, QM, SAP Solution Manager, SAP Cloud ALM, SAP BTP and SAP Transport Management. Skill-based routing can use them for SAP-related tickets.
• Seed SoD risk catalog loads the catalog of 53 risky role pairs described in Operations and evidence. The seeded catalog is one item of the SolMan cutover checklist.