SAP Multibank Connectivity Integration: BASIS Perspective

[Rushi_Sangamkar]

Introduction

SAP Multi-Bank Connectivity is an SAP Business Technology Platform (BTP) solution managed by SAP to provide customers connectivity with their banks.

SAP Multi-Bank Connectivity is based on integration services deployed in the SAP Cloud that enable the integration of business processes spanning different departments, organizations, or companies.

For the integration between the customer's SAP system and SAP Multi-Bank Connectivity, the connector for SAP Multi-Bank Connectivity is utilized. All messages to and from SAP Multi-Bank Connectivity pass through the connector. Message monitoring is available at the connector for SAP Multi-Bank Connectivity using either the classical Connector Monitor (/BSNAGT/MONITOR, for releases before SAP S/4HANA 1909 FP01) or the Manage Bank Messages SAP Fiori app (starting at SAP S/4HANA 1909 FP01 or SAP S/4HANA Cloud).

Each message sent through the connector for SAP Multi-Bank Connectivity has a Sender ID, Receiver ID, message type, filename, message content, as well as other context information, such as SWIFT parameters or approval user information required for the integration towards the banks.

Landscape

From the MBC landscape perspective, there are 2 MBC tenant provided. One tenant is connected to SAP Non-Production environment and another tenant is connected to SAP Production environment.

Especially for Non-Production SAP Landscape, consisting of Dev/QA/Pre-Prod systems, it is important to note that, only one SAP system can connect to test MBC tenant at a time, therefore it becomes critical to choose the phase in the project lifecycle, when the test MBC tenant will be pointing to Development/Demo system and when it should be integrated to QAS/UAT/SIT system.

Also it should be noted that connection to MBC is client specific, meaning, if the QAS system is having 2 client let's say 100 and 200, then the end points (covered later in this blog) provided by MBC team will be different for 100 and 200 and it will have different client specific RFC connections. And it will be connected to either QAS-100 or QAS-200 client at a time.

Direct connection from backend SAP system to the SAP MBC tenant should be allowed. This is to establish connectivity between on-premise SAP systems and SAP MBC tenants.

Configuration

There are 2 types of configuration possible for ERP systems to SAP MBC:

1. HTTP Connectivity
2. XI engine Connectivity

This blog covers HTTP connectivity option.

Following prerequisites are required for performing ERP system integration to SAP MBC:

1. SSL Client Standard PSE should be signed by SAP-trusted CA.
2. Direct connection from backend ERP system (S/4HANA or ECC) should be allowed to MBC tenant in order to establish connectivity.

Integration Procedure

Configuring SAP Multi-Bank Connectivity Firewall Trusted Certificate Authorities

Get SSL Client Standard PSE certificate (own-certificate) CA signed for Transport Level Security. This is a mandatory prerequisite step to enable ERP system to exchange messages with MBC tenant. This step is required to be completed before the MBC onboarding phase.

Follow below procedure to get SSL Client Standard PSE certificate CA signed.

1. Login to SAP system and execute STRUST.
2. Export the SSL Client Standard Certificate (own-certificate) and get it CA signed by SAP-trusted CA.
3. Import the CA response to SSL Client Standard.

Once the SSL Client standard PSE certificate is signed by SAP trusted CA, export this certificate (own-certificate) and send to MBC Onboarding team. MBC team will upload this certificate to relevant MBC tenant.

For the easy of certificate maintenance, one CA signed certificate can be used for Non-Production environment by maintaining SAN names for all the non-production system while creating the certificate signing request (CSR).

Configure SSL Client Standard PSE by importing Root and Intermediate certificates of MBC Load Balancers.

1. Download the certificates from root and intermediate ceritifcates
2. Login to desired SAP system and execute STRUST.
3. Open SSL Client Standard PSE and import the Root and Intermediate certificates.
4. Save the changes.

Configuring Connectivity Between an ERP System and SAP Multi-Bank Connectivity Tenant

Prerequisite Notes

As a pre-requisite check applicability of below SAP Notes, depending on the Support Pack and version of your ERP system

3091189 - Objects for direct http communication (HTTP API)

3103718 - Mention RFC Destination for HTTP API

3133824 - Maintenance view for HTTP API settings

Configuring G-Type RFC destinations for direct communication with MBC from ERP system

Before proceeding with configuring the destinations, make sure direct connectivity is enabled and certificates are exchanged between MBC and ERP system. 

While sending the CA signed certificates to MBC, also mentioned the SAP SID and SAP Client for which MBC connectivity would be configured. In return to this, MBC team would be sending following details:

1. MBC tenant hostname
2. End points for following RFC destinations.

To create the RFC destinations, login to SAP system and execute SM59 transaction.  Use below details

1. MBC tenant hostname
2. End points for following RFC destinations.

To create the RFC destinations, login to SAP system and execute SM59 transaction.  Use below details

The result of the connection test is expected to HTTP-500. If that is the result then connectivity to MBC is assumed to be established. Actual connectivity can only be determined when payload is passed using these RFC connection to the MBC tenant.

Maintaining Routing Settings

Login to SAP System and execute SPRO --> Multi-Bank Connectivity --> Maintain Routing Settings.
Create new entry with following details and SAVE the changes.

Configure Pull Type Settings

To pull messages from MBC, you need to setup default pull type that uses HTTP API
To set this, proceed with maintaining following configuration in SPRO --> Multi-Bank Connectivity --> Maintain Pull Type and SAVE your changes.

Configuring STRUST for Message Level Security

Along with TLS, MBC uses Message Level Security (MLS) for

• Sending Data: Data is signed and encrypted by MBC Connector
• Receiving Data: Data is decrypted and verified by MBC Connector.

Follow below steps for configuration Message Level Security

Create BSNAGT SSF application PSE

1. Login to SAP system --> Execute transaction SSFA
2. Create new application entry  and choose BSNAGT and provide following details:

Hash Algorithm : SHA256
Encryption Algorithm: AES128-CBC
Select Checkbox: Include Certificate and Digital Signature with Data 

Setting up MLS Key Store

Execute transaction STRUST and you will see an entry for SSF BSNAGT. Initially the BSNAGT entry would have a cross sign as the PSE would not have been created.
Right Click on BSNAGT entry and create PSE, provide necessary details and you will have BSNAGT PSE created, similar to below.

Sending MLS BSNAGT certificate to SAP MBC

Export the own certificate for BSNAGT PSE and send the certificate to SAP MBC team.

Importing MLS certificate from MBC

SAP MBC team would provide the MLS certificate to be imported in to BSNAGT PSE. Once received, import the certificate into BSNAGT PSE.

Maintaining Secure Store and Forward (SSF) Profile Data

Go to SPRO, and navigate to below configuration item

Add new entry and maintain following,

Monitoring

Messages can be monitored using /n/BSNAGT/MONITOR (Connector Monitor)