SAP Cloud ALM Configuration in S4HANA system (on-premise)

[Venuobbireddy816]

As you may all be aware, SAP Solution Manager is scheduled to be deprecated around 2027 and will be replaced by SAP Cloud ALM. In this blog, our objective is to provide a comprehensive, end-to-end guide on configuring SAP Cloud ALM. The following steps outlined in this blog are specifically focused on integrating SAP S/4HANA as a connected system (backend on-premise) with Cloud ALM.

Technical Prerequisites

1. SAP_BASIS Release

Required: Either 7.40 SP16 or higher (accordingly 7.50 SP05)

1. SAP_UI Version:

Required: Either SAP_UI 740 SP15 or higher

1. ST-PI 7.40 

Required: ST-PI 7.40 Support Packages and keep them up-to-date,ST-PI 7.40 SP26 

1. Check that profile parameter

 icm/HTTPS/client_sni_enabled is set to TRUE

SAP Note 510007 - Additional considerations for setting up SSL on Application Server ABAP

Check that profile parameter

ssl/client_ciphersuites  =  150:PFS:HIGH::EC_X25519:EC_P256:EC_HIGH

1. Below certificates Imported in STRUST under SSL Client (Anonymous) and SSL Client (Standard).

DigiCert Global Root CA

DigiCert Global Root G2

DigiCert RSA4096 Root G5

Network Prerequisites:

• You need to obtain the SAP Cloud ALM Service Key to connect to the SAP Cloud ALM system
• You need to make sure that the following URLs can be reached:
• The Cloud ALM API URL (service key "endpoints":"Api" without /api)
• The Cloud ALM OAuth URL (service key "uaa":"url" extended by /oauth/token)
• In case you use a proxy in your network, please make sure that it is configured to allow calls to these URLs

• If your SAP ABAP system is hosted with SAP Enterprise Cloud Services (ECS), please open a service request with SAP ECS to add the following URLs to the "Allow-List" for your environment
• Root URL: SAP Cloud ALM service key parameter "endpoints":"Api" without /api
• OAuth URL: SAP Cloud ALM service key parameter "uaa":"url"

Required authorization:

• The user performing the setup: To run transaction /SDF/ALM_SETUP your personal user needs the PFCG role SAP_SDF_ALM_SETUP. 

Please note: In this role you need to maintain the authorization field S_BTCH_NAM > BTCUNAME either with '*' or with the user name of the user you plan to use as data collection background job user

ST-PI 7.40 SP25 and higher

In addition to the authorizations for ST-PI 7.40 SP24, you need: SAP_SDF_ALM_METRIC_PUSH_CSA This role contains authorization objects delivered by SAP with no authorization. To use the SAP Cloud ALM scenario Configuration & Security Analysis (CSA), please maintain make sure the following authorization objects are maintained: S_RFC_ADM: ICF_VALUE = '*' S_DATASET: FILENAME = '*', PROGRAM = '*' S_LOG_COM: HOST = '*', OPSYSTEM = '*' SAP_SDF_ALM_METRIC_PUSH_CSA_S This role allows the detection of special users (such as SAP*) using default passwords Before ST-PI 7.40 SP25 you can either use the existing SAP Focused Run roles for Configuration & Security Analysis or the ones delivered by the SAP Note 3372078 (recommended).

Procedure:

Log on to the relevant client

Transport Management: The setup must always be performed in client 000

All other use-cases: The setup must be performed in the client, for which you want to collect monitoring data (e.g. the production client). You can perform the setup in more than one client.

1. Transaction /n/SDF/ALM_SETUP
2. Enter "Target ALM Description"

1. Maintain HTTP Destination

• Click "Update destination"

1. You can copy & paste the content from the JSON file created during the enablement of the SAP Cloud ALM APIs by clicking "Paste Service Keys

How to get Cloud ALM service key

Logon SAP Cloud ALM > Landscape Management > click on Configuration >Open SAP Cloud ALM Service Key.

Created the HTTP destination

1. Enter background user and register system 

Enter the background user you created to perform the data collection

• Make sure that it has the authorizations as described on tab "Required Authorizations" under "Prerequisites"

• Click on "Register" to call SAP Cloud ALM and register the system. If it is successful, a LMS ID is retrieved and is displayed.

Scheduled the SAP CLOUDALM JOB

a LMS ID is retrieved and is displayed

1. Select the use cases you want to collect and push data for

1. Registration in SAP Support Backbone connection

Enter the Technical S- user ID .

If backbone is setup already exist show the already setup screen.

 After the successful setup the SAP S/4HANA or SAP Business Suite system will show up as "Registered" service in the Landscape Management application of your SAP Cloud ALM tenant.

Go to administration > click Landscape Management

System will displayed .

Configure the Health monitoring.

Open Operations > Health Monitoring

Click on SID

Here showing the system details

 

Alert & Notification configuration

Cleck on configuration

Please turn on the create alert.

Before Notification configuration Add the mail ids in Notification Management

Once the email id is added in notification management you will get email to verify.

Please click on here.

Once click here subscribed to SAP Cloud ALM

Once done the notification Management

Go to Health monitoring

Add the mail ids

Click on save

Active the notification

With this the SAP Cloud ALM setup is completed.

[HemantVaswani]

Hi @Venuobbireddy816 

very well articulated post. thanks.

on following the above steps, when i reach on step of click "Register" , i am getting following error

"Connect to proxy:3128 failed: NIEHOST_UNKNOWN(-2)"

even if i remove the values of proxy host "proxy" and proxy port "3128" as mentioned in the SAP portal (inside maintain destination), i get following error :

SSL handshake with spotless-services-ltd-cloudalm.authentication.ap10.hana.ondemand.com:443 failed: SSSLERR_PEER_CERT_UNTRUSTED (-102)#Peer's X.509 certificate (chain) validation failed (missin...

this is for my on-prem NW 7.5 based SAP BW system. BASIS patch 30  and all patch pre-requisites met.

kindly suggest for the way forward

Thanks

Hemant

[Venuobbireddy816]

Hi Hemant,

Please check the CALM RFC connection, is it working or not?

Thanks

Venu Gopala Reddy O