SAP BTP Connectivity: Destination Service & Cloud Connector

How cloud applications on BTP securely reach both cloud and on-premise backend systems using the Destination and Connectivity services.

Every BTP application that talks to anything else needs this configured. It is two components solving two problems.

The Destination service is like a company's centrally-maintained address book that employees (application code) look up by contact name rather than memorizing addresses directly, so when someone moves offices (environment change) only the address book needs updating; Cloud Connector is a pre-arranged, one-way secure courier route the building itself sets up to receive deliveries from BTP without ever leaving its own front door unlocked to the public street.

Key Concepts

The Destination service holds connection details, outside the code.

    name            S4_BACKEND
    URL             https://s4.internal.corp/sap/opu/odata/...
    authentication  OAuth2, Basic, certificate, principal propagation
    ProxyType       Internet or OnPremise

The application asks for the destination by name. It does not know the URL and never sees a credential.

Which means one build runs everywhere. Development, quality and production differ only in the destination configured in each subaccount. No rebuild, no environment-specific configuration file, and no credentials in source control.

Cloud Connector solves the second problem: reaching a system with no public address. Most customer S/4HANA systems are inside a corporate network.

    corporate network                    SAP BTP
    +---------------------+              +-----------------+
    |  S/4HANA            |              |  your app       |
    |  Cloud Connector    | ==tunnel===> |  destination    |
    +---------------------+              +-----------------+
         connection opens outward

The direction is the point. Cloud Connector is installed inside the network and opens an outbound connection to your BTP subaccount, keeping it open. Traffic then flows through that tunnel.

No inbound firewall port is opened. Nothing internal is exposed to the internet. And the administrator whitelists exactly which internal hosts and paths may be reached — so a compromised BTP application can reach those and nothing else.

A destination with ProxyType: OnPremise routes through the tunnel automatically.

ProxyType: OnPremise

Principal propagation is the part worth knowing properly. Two ways an application can authenticate to the backend:

    technical user         every request arrives as one service account.
                           The backend cannot tell users apart, so its
                           own authorisations are useless and the audit
                           log names the service account.
    principal propagation  the logged-in BTP user's identity is forwarded
                           with a short-lived certificate. The backend
                           applies that user's authorisations, and logs
                           their name.

The second preserves the authorisation model you already have in S/4HANA, rather than replacing it with one account that must be permitted to do everything any user might do.

The layering. The Connectivity service provides the tunnel mechanics that Cloud Connector uses; the Destination service is the higher-level configuration your code actually asks for. Most application code only ever touches the destination.

What the interviewer is probing.1. "Why use the destination service instead of a URL in code?" Probing: the argument. Stalls: "Convenience." Moves up: the endpoint and credentials are configuration per subaccount, so the same application artifact runs in every environment.

2. "How does the Cloud Connector avoid an inbound firewall hole?" Probing: the mechanism. Stalls: "A VPN." Moves up: it establishes the tunnel outbound to BTP and the cloud side invokes through it, so no inbound port is opened.

3. "What is principal propagation?" Probing: the identity part. Stalls: "A technical user." Moves up: forwarding the actual end user's identity to the backend so authorisation and audit are per person, not per service account.

4. "What do you check when a destination fails?" Probing: the method. Stalls: "The URL." Moves up: the Cloud Connector access control entry for that exact path, the virtual-to-internal host mapping, and the certificate trust for principal propagation.