BTP & Integrationintermediate

BTP Fundamentals Part 3: Destinations for On-Premise and Cloud Systems

Key takeaway

Configure destinations correctly: URL, proxy type (Internet or OnPremise), location ID, authentication types (basic, OAuth2 client credentials, OAuth2 SAML bearer, principal propagation), additional properties, and how apps and services consume them — with troubleshooting tips.

Explanation

📌 KEY POINTS
✅ Destinations store connection details centrally so apps don't hard-code URLs or credentials.
✅ Proxy type Internet for cloud targets; OnPremise for systems behind Cloud Connector (with location ID if several connectors).
✅ Authentication: technical user (basic/OAuth client credentials) or user propagation (SAML bearer, principal propagation).
✅ Additional properties (e.g. for SAP Build, HTML5 apps) tell consuming tools how to use the destination.
⚠️ Using technical users where business user identity is needed breaks authorization and audit in the back end.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 2 covered runtimes and connectivity. Now destinations.

━━━━━━━━━━━━━━━━━━━━
▶ 1. BASICS

Name, type HTTP, URL, proxy type.

━━━━━━━━━━━━━━━━━━━━
▶ 2. AUTHENTICATION

Basic, OAuth2 client credentials, OAuth2 SAML bearer, principal propagation.

━━━━━━━━━━━━━━━━━━━━
▶ 3. ON-PREMISE

Virtual host from Cloud Connector; location ID.

━━━━━━━━━━━━━━━━━━━━
▶ 4. CONSUMPTION

Apps via destination service; tools via additional properties.

━━━━━━━━━━━━━━━━━━━━
▶ 5. TROUBLESHOOTING

Check connection, Cloud Connector logs, trust configuration.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Create an Internet destination to a public API.
Create an OnPremise destination to the Cloud Connector virtual host.
Check connection and test from an app.

✅ CHECKPOINT: both destinations respond successfully.

Code example

ABAP Code

===== EXAMPLE (OnPremise, principal propagation) =====Name: S4H_PRD_ODATA | Type: HTTP | URL: http://s4h-virtual:443 | Proxy Type: OnPremiseAuthentication: PrincipalPropagation | Location ID: PLANT_EU (if multiple connectors)Additional properties: sap-client=100 | HTML5.DynamicDestination=true | WebIDEEnabled=true ===== TROUBLESHOOTING =====Check connection → Cloud Connector monitor (access denied? path not exposed?) → trust/principal propagation setup

Real project scenario

An app showed data the user wasn't authorized to see in S/4HANA because the destination used a technical user. Switching to principal propagation made S/4HANA apply each user's authorizations.

Common mistakes

Hard-coded URLs.
Personal credentials.
Wrong proxy type.
Technical users for user-specific data.
Inconsistent names.

Best practices

Central destinations.
Technical or propagated users by design.
Correct proxy type.
Principal propagation for user context.
Naming conventions.

Interview angle

Questions: "What is a destination?", "Which authentication types exist?", "What is principal propagation?"
Strong answer: purpose, proxy types, auth options, consumption, troubleshooting.

Practice this lesson

Quick check

1. What is the main purpose of the Destination service in SAP BTP?

2. What is the primary function of a directory in the SAP BTP account hierarchy?

3. An app shows data the user isn't authorized for in S/4HANA because it calls with a technical user. What should the destination use?

Interview questions

1. Several apps hard-code URLs and passwords for back-end systems. How do you redesign connectivity with destinations?

Answer it in your own words first, then compare.

2. Explain the role of Destinations and the SAP Cloud Connector when connecting BTP to an on-premise S/4HANA system.