Introduction
The purpose of this blog is to describe the essential configuration steps required to manually set up the SAP S/4HANA attachment service working with Document Management as a content server within the system landscape that has been already installed.
Disclaimer:
- For this scenario to be successfully implemented, SAP Document Management Service, Integration Option is recommended. There is no support for SAP Document Management Service, Application Option, at this time. SAP S/4 HANA will always be the front end, and we do not support the SAP Document Management Service, Application option for onboarding the repository or allowing you to view any files.
- The free tier subscription will not work for this scenario. If you wish to try it out, please opt for the standard plan.
- The following scenario is applicable for SAP S/4 HANA on-premise releases of 1809, 1909, and 2020 onwards.
- There could be some issues in your client applications due to changes in the certificate. Please refer to this blog post Changing the SAP BTP Cloud Foundry Environment Root Certificate Authority, SAP Note 3327214 - Root Certificate Replacement in the SAP BTP, Cloud Foundry Environment, and BTP Trust Store: Collection of TLS Server Root CA certificates used by SAP BTP.
Prerequisite
- You must read and execute the following SAP Notes:-
- SAP Note - 2361898
- SAP Note - 3035517
- SAP Note - 3003350
- SAP Note - 3003412
- SAP Note - 3008650
- SAP Note - 3126655
- SAP Note - 3168437
- SAP Note - 3334586
- You've downloaded the SSL certificate of SAP BTP. For more information about the steps, refer to this knowledge base article KBA-2853519.
- Ensure the Root CA certificate of the SAP Cloud Foundry server is uploaded to "SSL client <client> SAP Default". This certificate has to be uploaded to the ABAP back-end system using STRUST transactions.


Section 1. Repository Onboarding
In this section, you need to onboard the Document Management Repository.
The following steps must be executed to onboard a repository. You can ignore the steps if some of them have been already performed.
- You've created a subaccount and space. See Creating a Subaccount and Space.
- You've created a service instance and service key. See Creating a Service Instance.
- You've onboarded a repository into the Document Management Service, Integration Option instance.
- To onboard a repository using a REST API, you must generate a JSON Web Token (JWT). Use the JWT for authorization when making the onboarding REST API calls. See Generate a JSON Web Token.
- See Generate a JSON Web Token.
- Execute an onboarding repository API to onboard repository into Document Management Service. See Add Your Repository Using the Onboarding API.
- The displayName and externalId should start with ‘Z’ and it should be in upper case.
- This name and externalId would be used as a content repository name in the SAP S/4HANA backend system.
- You must pass the parameter isContentBridgeEnabled as true in your payload.
- The externalId and isContentBridgeEnabled are mandatory during repository onboarding.
Sample Payload
{
"repository": {
"displayName": "<OAC0 repository name>",
"externalId":"<OAC0 repository name>",
"isContentBridgeEnabled":"true",
<You can add other parameters for onboarding the repository, like repositoryType, Description, etc.,>
}
}
Section 2. SAP S/4HANA Back-end Configuration
In this section, you learn the back-end system configurations by following the steps.
Create an OAuth Client Profile
- Start the object navigator (transaction SE80).
- Choose Development Object in the drop-down list.
- To create a development object in the SAP namespace, choose to Create OAuth 2.0 Client Profile in the context menu of the object name.
- Enter the object name in the Client Profile field.
- Choose the type of service provider as HANA_CLOUD_PLATFORM.
- Save your changes.

- Go to the Administration tab and choose the No authorization check option.

Create an OAuth Client Configuration
SAP Document Management uses OAuth Authentication. Hence, OAuth client configuration must be done in the SAP S/4HANA backend system.- Go to transaction OA2C_CONFIG.
- Click ‘Create’.
- Choose OAuth Profile created in section 3.1.
- Enter the configuration name of your choice.
- Enter ‘Client Id’ from the service key created in section 1.
- Click ‘OK’.

- Enter ‘Client Secret’ from the service key created in section 1.2.
- Choose Selected Grant Type as Client Credentials.
- Enter Authentication Endpoint. It is the "uaa": "url" parameter in the service key created in section 1.2 without ‘https’.
- Enter Token Endpoint. It is the "uaa": "url" parameter in the service key with ‘/oauth/token’ as a suffix without ‘https’.
- Enter the Proxy Host: and Proxy Port: if applicable.
- Click 'Save'.

Create an RFC destination for Document Management
Go to the transaction, SM59, and create a Type G destination.
Enter host: “ecmservice”:”url” copied from service key created in section 1.2 without ‘https’.
Enter path prefix as ‘/browser’.
In the Port b field, enter the “HTTPS” port of the ABAP system.

- Enter the Proxy Host: and Proxy Service: if applicable.
- Go to Logon & Security Tab.
- Select ‘Do not use a user’ in Logon Procedure.

- In Security Options, choose SSL Active radio button and select the certificate from the dropdown.

- Save the RFC destination.
Create Content Repository in OAC0
Go to transaction OAC0.
Click on ‘Create’.
Give the content repository name the same as the value of the ‘externalId’ parameter given during the onboarding repository in Section 1.3 (#2).
Enter Document Area.
Select Storage Type as ‘CMIS Content Server’.
Enter the RFC destination created in the previous Part.
Select the ‘Is OAuth’ checkbox.
Save the configuration
Enter the OAuth Profile name.
Save the configuration.
Do the connection test and check if the connection test is successful in the repository.

- Click the Send RFC info button and it should display “Certificate was sent”.
Create Secondary Types and Folders
Execute Transaction SE38.
Enter Report Name ‘CMIS_REPOSITORY_SETUP’.
Execute report.
Inputs:-
RFC_DEST = RFC destination of the repository created in SM59CMIS_REP = Content Repository Name created in OAC0
Create Storage Category in OACT
Go to transaction OACT.
Click ‘New Entry'.
Enter a Category Name.
Enter Document Area.
Enter the Content Repository Name created in the previous Part.
Save Storage Category.

Activate Storage Category
Go to transaction SPRO.
Click on SAP Reference IMG to display the IMG Activities.
Go to Cross Application Components → Document Management → Additional Settings- Simplification → Attachment Service- Storage Repository Activation.
Choose ‘Create New Entries’.
Enter the Storage Category created in OACT in the previous part and mark it as active by selecting the checkbox.
Save the configuration.

"Congratulations. You have successfully completed the Attachment Service integration with Document Management".
I hope you can benefit from the steps presented in this blog post. In case of questions or feedback, please feel free to comment on this blog.