Creating SAP Connections

Before the SAP Inventory Agent can collect data on an inventory beacon, you need to configure the connection and provide the credentials on the inventory beacon.

After the import is executed on the inventory beacon, the connections that you set up on an inventory beacon are automatically imported into IT Asset Management and are added to the corresponding system landscape.

You need to add a connection to an SAP Admin module before you can add connections to its dependent SAP systems.

To define a connection to an SAP system:

1. On the inventory beacon, from the Windows Start menu, run FlexNet Beacon.

Note:To run FlexNet Beacon, you must have system administrator rights.

2. In the Data collection section, click SAP systems.
3. Click New...

The SAP Connection dialog window displays.

4. In the System landscape details section, complete the following fields:
a. The System landscape field displays your system landscape(s). Choose the landscape that contains the SAP Admin module or independent SAP system that you want to connect to.
b. From the SAP suite type drop-down list, choose the type of SAP suite for this connection. Available options are:
Classic Business Suite 
c. From the SAP system type drop-down list, select the type of system to which you want to connect from the drop-down list. Available options are:
Admin Module—Your primary or root system that collects data from its dependent SAP systems. This option does not support S/4HANA.
Independent SAP System—An SAP system that is not connected to an SAP Admin module.
Dependent SAP system—An SAP system that is connected to an SAP Admin module. This option only displays when a connection to an SAP Admin module has already been established.
d. Choose the Master SAP system from the drop-down list. If you are creating a beacon connection to a dependent SAP system, select the SAP Admin module to which the dependent system is connected.
5. In the Connection details section, complete the following fields:
a. Choose the type of connection you want to establish from these options:
Direct connection—Select to establish a direct connection.
Load balancer—Select this option to establish a connection to a load balanced solution manager. This option automatically distributes user logons to individual instances or to groups of SAP instances (application servers) in a load balancing environment.
b. In the Server name text box, select from these options:
If Direct connection was selected above, enter either the DNS name of the SAP system, or its IP address. This value will be used by the RFC connection.
If Load balancer was selected above, enter the message server host name.
c. In the System ID text box, enter the unique identifier of the SAP system to which you want to connect.
d. In the System number text box, enter the SAP system number which will be used by the RFC connection.
e. In the Logon group text box, enter the name of the logon group which will be used for load balancing.

This option is enabled when Load balancer is selected at Step 5a.

Logon groups are created when configuring your SAP server. This option automatically distributes user logons to individual instances or to groups of SAP instances (application servers) in a load balancing environment.

6. In the Logon details section, complete the following fields:
a. In the User name text box, enter the user name to be used when connecting to the SAP system and making RFC calls.
b. In the Password text box, enter the password.

The password that is to be used when connecting to the SAP system and making RFC calls.

Important:The password should not contain any backward slashes (\). Otherwise, the connection to the SAP system cannot be established.

Important:On some configurations, a logon error can occur when connecting an independent SAP system. The issue may affect SAP systems up to SAP Basis release 6.4, but primarily affects systems running SAP Basis 4.6. It is recommended that you test the connection using the Test connection button. If the test returns an error saying that the connection to the system was established, but that credentials were incorrect, enter the password in uppercase letters. For more information, see SAP Note 792850.

c. In the Client ID text box, enter the client ID of the SAP system to which you want to connect.
7. If you chose to collect data for an Independent SAP System, the Digital access data section enables you to set the time period to collect the digital access data for by choosing from these options:
Last [3] months—Select to collect data for one or more months and optionally modify the default selection of 3 months to a value from 1 up to a maximum of 12 months.
Last calendar year—Select to collect data from 1 January until 31 December for the previous year.
Custom date—Select to set any custom date range using the Start date and End date fields.
8. Optionally, if you are using Secure Network Communication (SNC) for your target system (whether an Independent SAP System or an Admin Module), complete the following fields in the Secure Network Communication (SNC) configuration section.

Using the SNC feature on FlexNet Beacon requires some preliminary configuration:

If your enterprise is already using SNC in your SAP environment, confirm whether you are using X-509 or Kerberos certificates. (If SNC is not already in use on your SAP system, please ask the SAP Basis team to configure SNC on SAP, and then confirm the certificate type.)
Ask your SAP Basis team to help with the following for your inventory beacon:
a. Install the SAP Cryptographic Library/SAP Client Encryption on the inventory beacon.
b. Create a Personal Security Environment (PSE) and self-signed public-key certificate. While doing so, take note of the SNC name of this inventory beacon server, as you need this later in the process.
c. Create credentials for the inventory beacon.
d. Configure the certificate for use between FlexNet Beacon and the SAP Admin Module server, using STRUST and SGENPSE.

When these preparations are complete, you can proceed with the following settings in the SAP Connection dialog:

Tip:There are regulations in various countries that restrict the use of encryption in software applications. Pay close attention to the regulations applying in your area. Use the following settings only where permitted.

a. Select the Enable SNC check box.

When this is selected, the following four fields are enabled.

b. Use the Browse button to identify the location of the SNC library for this connection.

This is mandatory for this connection. Typically you may identify the sapcrypto.dll file, or you may check the environment variable SNC_LIB on the target SAP system.

c. From the Level of protection drop-down, choose one of the following values (the strange numbering follows the SAP conventions for these options):
1. Authentication only—Verifies the identity of the communication partners (in this case, IT Asset Management and your SAP system)
2. Integrity protection (authentication—Detects any changes or manipulation of the data exchanged, as well as verifying identities
3. Privacy protection (integrity and authentication)—Encrypts communications, as well as the two previous kinds of protection
8. Default protection—Takes the value from snc/data_protection/use on the SAP application server
9. Max protection—Takes the value from snc/data_protection/max on the SAP application server.
d. In the mandatory field for Partner SNC name, insert the SNC name of SAP NetWeaver Application Server for ABAP.

This value is available on the SAP NetWeaver Application Server for ABAP in the profile parameter snc/ identity/as. An example is:

p:CN=ABC, O=MyCompany, C=US

e. In My SNC name, specify the SNC name of this inventory beacon server.

You took note of this name while configuring the PSE on this inventory beacon. Example:

p:CN=FlexNetBeacon, O=MyCompany, C=US

f. Click Test connection to verify that the secure connection to SAP works.

If the SNC connection from the inventory beacon fails, ask your SAP Basis team to install the SAPGUI client on the inventory beacon. Activate the SAPGUI client, and check whether the secure connection to SAP works now. If it still does not succeed, ask for the help of your SAP Basis team to identify and correct the issue (for example, make sure that the same SAP Crypto library has been specified on the inventory beacon and the target SAP server).

9. If you have not already done so, click Test connection to test whether a connection can be established. This button is only available when you are creating or modifying the connection to an SAP Admin module or to an independent SAP system.
10. Click Save.

The new connection is added to the list of connections.

Your new connection can now be executed by the SAP Inventory Agent on this inventory beacon.

The SAP system connections are saved in %ALLUSERSPROFILE%\Flexera\Beacon\Config.xml. The SAP Inventory Agent uses the connection details saved in this file to access the SAP systems and gather inventory data.