How the SAP integration works
The ingest model, where each kind of SAP data lands in TENSOR, and the isolation, protection, audit and runtime details behind it.
The SAP module plugs into TENSOR's universal integration platform. Each SAP system is an integration record with encrypted credentials and health events. SAP data does not create a parallel world: it is written through the existing modules — Changes, the CMDB, incidents, identity reporting and licence management.
Ingest, don't fetch
TENSOR never opens an RFC connection into your network. Instead, a connector agent that you run on your own premises reads SAP via RFC (and HANA via SQL) and pushes signed data packages — envelopes — to TENSOR. Your RFC and HANA credentials stay on that machine.
The only systems TENSOR calls directly are cloud systems: Cloud ALM is polled from TENSOR, read-only and through OAuth. TENSOR never writes back to SAP or to Cloud ALM.
What data lands where
| SAP data | Arrives via | Lands in |
|---|---|---|
| Transport headers (E070) | Agent, transports collector | Changes with linked transport metadata; drift ledger |
| Transport object lists (E071) | Agent, transports collector | Collision detection on the Change and in the change calendar |
| System info, clients (RFC_SYSTEM_INFO, T000) | Agent, inventory collector | CMDB CIs of class SAP system and SAP client |
| Role assignments (AGR_USERS, AGR_AGRS) | Agent, authorisations collector | SAP authorisation baseline and SoD findings |
| User master (USR02, USER_ADDR) | Agent, licence measurement collector | USMM measurement runs and SLAW aggregation |
| CCMS alerts (XMI/XAL) | Agent, monitoring collector, or signed webhook | Incidents linked to the SAP system CI |
| HANA views (M_SYSTEM_REPLICATION, M_BACKUP_CATALOG and others) | Agent, HANA collector | HANA status history and the HANA database CI |
| Cloud ALM tasks and events | TENSOR poll over OAuth | Read-only Cloud ALM records with drift markers |
| EarlyWatch Alert PDFs | Manual upload | Evidence attached to the SAP system CI |
| SolMan ChaRM and ITSM history | CSV import | Sealed SolMan archive |
Tenant isolation
All SAP tables live in your tenant's own database schema, and every request sets the tenant context before it reads or writes. Agent calls carry the tenant in their address and are resolved before any tenant data is touched. An agent may only deliver data for the SAP connections it has been allowed; items for any other connection are rejected one by one.
Core entities
| Entity | Purpose |
|---|---|
| SAP connection (integration record) | System ID, auth mode, host data or token URL, system type; secrets stored separately and encrypted |
| SAP landscape | Name, DEV, QA and PROD connections, CAB role per stage |
| SAP system, SAP client, HANA database CIs | SID, product, release, kernel, landscape role, deployment kind; client number and purpose; replication role and backup dates |
| Transport metadata | TR number, originating SID, target SIDs, landscape position, QA and PROD import times, linked Change |
| Transport objects | Object type and name per TR, used for collision detection |
| Import schedule | Target SID, maintenance window, planned time, sequence order, confirmation or cancellation |
| Transport drift event | Kind of drift, SAP status, TR, linked Change |
| Authorisation assignment, user mapping, SoD risk rule | SAP user and role per connection; SAP user to TENSOR user; curated risky role pairs |
| USMM run and user measurement | Scheduled measurement per system and its user-type results |
| Connector agent and envelope | Agent identity, status, allowed connections, collectors; idempotency ledger of received envelopes |
| EWA report | Period and file of an EarlyWatch Alert report on the SAP system CI |
| HANA status event | Replication, backups, tablespace usage, BackInt tool |
| Cloud ALM record | Read-only copy of a Cloud ALM task, event or requirement |
| SolMan import batch and archive record | Sealed batch with content hash; read-only ChaRM change or ITSM ticket; links to live transports |
| Transport sync and migration settings | Auto-create switch; migration mode and cutover date |
How other modules are used
| Module | How the SAP integration uses it |
|---|---|
| Change management | Transports become Normal Changes; approvals, the change state machine and the post-implementation review gate apply unchanged. Import scheduling, collision and drift cards appear on the Change page. See Changes. |
| Maintenance windows | Scheduled imports are checked against the maintenance window's affected CIs. |
| Change calendar | Shows in-flight transport collisions as a sub-view. |
| CMDB | SAP system, SAP client and HANA database CIs; HANA status updates the CI through normal versioning; EWA reports attach to the SAP system CI. See CI classes and reconciliation. |
| Incident management | CCMS and Solution Manager alerts create incidents with the SAP system CI as affected CI. See Incidents. |
| Identity and reporting | The SAP SoD risk catalog appears in the Berechtigungskonzept export. |
| Workforce | SAP skills (Basis, ABAP, HANA, FI, SD, MM and more) in the skill catalog for routing. |
| Licence management | USMM measurements and SLAW aggregation; the licence true-up offers an SAP USMM vendor format. |
| Attachments | EWA files are virus-scanned and retained as evidence. |
| Integrations platform | Encrypted secrets, signed intake, health events for degraded agents and drift. |
| Dashboards | SolMan migration widget on the administrator start page. |
Background jobs
| Job | Schedule | What it does |
|---|---|---|
| Agent collectors | Per collector, set in TENSOR (for example transports every 5 minutes, inventory daily) | Read SAP and push envelopes; licence measurement only runs when TENSOR reports a due run. |
| Agent heartbeat monitor | Every 5 minutes | Marks an agent as missing heartbeat after 15 minutes of silence and raises a health event. |
| Cloud ALM poll | 15-minute tick, default 30 minutes per connection with backoff | Pulls Cloud ALM tasks and events read-only. |
| USMM scheduler | Daily at 03:00 UTC | Processes due licence measurement runs and records failures explicitly. |
Feature flag
Everything in the SAP integration is controlled by the capability flag sap_integration (default off, not sticky). With the flag off:
- the SAP settings pages show a hint instead of content;
- all SAP procedures refuse requests;
- the agent endpoints stay closed;
- the licence measurement scheduler does nothing for your tenant.
The Berechtigungskonzept export additionally needs bait_berechtigungskonzept_export. See the toggle catalog for every flag.
Health events and notifications
Degraded agents, transport drift and Cloud ALM drift raise integration health events, which appear under the connection's Recent health events. Drift is also shown as a card on the affected Change. Incidents created from SAP alerts follow the incident SLAs and notifications of your tenant — see SLA policies and notifications.
Data protection
- RFC and HANA connection data (host, client, technical user, password) stay in the agent's local configuration and are never sent to TENSOR.
- OAuth client secrets for cloud systems are stored encrypted (KMS envelope encryption) and never shown again. The agent's signing secret is also stored encrypted, and every access to it is audited.
- SAP usernames and role assignments are classified as identifying personal data. SolMan archive requesters and assignees are masked for roles without de-masking rights.
- Agent logs contain counts and stable IDs only — never credentials, SAP usernames, transport owners or raw payloads. The local offline spool is owner-readable only.
- HANA and CCMS telemetry carry no personal data.
- Enrollment tokens are stored only as a SHA-256 hash and shown once.
Audit trail
Every SAP mutation writes one hash-chained audit row in the same transaction:
- connection changes and health checks;
- agent creation, enrollment and disabling;
- transport changes and position updates, and drift events;
- collision overrides;
- import scheduling, confirmation and cancellation;
- SoD refusals;
- authorisation syncs, HANA status and EWA uploads;
- migration mode changes and SolMan batch sealing.
A PROD import that closes a Change writes a sealing audit row. Each SolMan import batch is sealed with the SHA-256 hash of its content, so the archive can be verified against the audit chain.
Technical detail for IT administrators
- Agent runtime. Node.js 22 or newer on a host with HTTPS egress to your TENSOR address. Outbound only; no inbound port.
- SAP libraries. For live mode you install the SAP NW RFC SDK and
node-rfcunder your own SAP licence; for the HANA collector,@sap/hana-client. TENSOR does not ship or redistribute them. Without them the agent runs in clearly labelled fixture mode. - Technical SAP user. Needs RFC_READ_TABLE on the tables of the enabled collectors (E070, E071, T000, AGR_USERS, AGR_AGRS, USR02, USER_ADDR), RFC_SYSTEM_INFO and, for CCMS, the XMI/XAL BAPIs. The HANA user needs SELECT on M_DATABASE, M_SYSTEM_REPLICATION, M_BACKUP_CATALOG and M_DISKS.
- Signing. After enrollment every request is signed with HMAC-SHA256 over timestamp and raw body. Envelope IDs are idempotency keys.
- Offline behaviour. Network errors, 408, 429 and 5xx responses use bounded exponential backoff. Undeliverable envelopes are spooled to disk and flushed in order once TENSOR is reachable.
- Endpoints. Agent:
/api/sap/agent/<tenant>/enroll,/envelope,/heartbeat,/config. Webhook alerts:/api/integrations/sap/<tenant>. - Severity mapping. CCMS alert levels 1 to 5 map by default to SEV1, SEV2, SEV3, SEV3, SEV4. The map can be overridden per connection, but there is no screen for the override yet.
SAP integration
Bring SAP transports, systems, monitoring alerts and authorisation data into the same change, incident, CMDB and audit processes as the rest of your IT.
SAP roles and permissions
Which roles configure the SAP integration, schedule, confirm and force transport imports, and read the SolMan archive — and the separation-of-duties rules enforced in code.