BTP & Integrationintermediate

BTP Integration Suite Part 4: Securing Integration Flows

Key takeaway

Secure iFlows inbound and outbound: role-based or certificate-based sender authentication, security material (user credentials, OAuth2 credentials, keystore, PGP keys), outbound OAuth and certificate auth, message-level security, and handling secrets without scripts.

Explanation

📌 KEY POINTS
✅ Inbound: role-based (user role such as ESBMessaging.send or custom role) with OAuth/basic, or client certificate authentication.
✅ Security material stores credentials: user credentials, OAuth2 client credentials, keystore certificates, PGP keys.
✅ Receiver adapters reference credentials by alias — never inline.
✅ Message-level security (PGP, PKCS#7, XML signature) protects payloads end to end when required.
⚠️ Reading secrets in Groovy scripts and logging them exposes credentials in MPLs.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 3 built an iFlow. Now security.

━━━━━━━━━━━━━━━━━━━━
▶ 1. INBOUND AUTH

Roles, OAuth, client certificates.

━━━━━━━━━━━━━━━━━━━━
▶ 2. SECURITY MATERIAL

Credentials, OAuth, keystore, PGP.

━━━━━━━━━━━━━━━━━━━━
▶ 3. OUTBOUND AUTH

Basic, OAuth2, certificate.

━━━━━━━━━━━━━━━━━━━━
▶ 4. MESSAGE-LEVEL SECURITY

Encryption, signing.

━━━━━━━━━━━━━━━━━━━━
▶ 5. SECRETS HYGIENE

Aliases, rotation, no logging.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Create OAuth2 client credentials in security material.
Reference alias in receiver adapter.
Set inbound auth to a custom role.

✅ CHECKPOINT: unauthorized senders get 403; outbound calls work.

Code example

ABAP Code

===== SECURITY MATERIAL =====S4_TECH_USER (User Credentials) | PARTNER_OAUTH (OAuth2 Client Credentials) | keystore: partner_cert, own_key | PGP public/secret keyrings ===== ADAPTER CONFIG =====Sender HTTPS: Authorization = User Role → role "Orders.Send" (custom)Receiver HTTP: Authentication = OAuth2 Client Credentials → Credential Name = PARTNER_OAUTH ===== DO NOT =====Groovy: log(credential.getPassword())  // never

Real project scenario

During a project connecting a bank, message-level PGP encryption was required. Configuring PGP keys in security material and encrypt/decrypt steps met the requirement without custom code.

Common mistakes

Inline credentials.
Logging secrets.
Generic roles for all senders.
Untracked certificates.
No message-level security when required.

Best practices

Aliases.
No secrets in logs.
Custom roles.
Certificate monitoring.
PGP/signing where needed.

Interview angle

Questions: "How do senders authenticate to CPI?", "What is security material?", "How do you secure payloads?"
Strong answer: inbound auth, security material, outbound auth, message security, hygiene.

Practice this lesson

Quick check

1. Where should an iFlow's outbound OAuth credentials be stored?

2. How can you restrict which senders may call a specific iFlow?

3. A bank requires encrypted payloads end to end. What should the iFlow use?

Interview questions

1. Secure a set of iFlows exchanging data with a bank and internal systems.

Answer it in your own words first, then compare.

2. An SAP Cloud Integration iFlow works in DEV but fails after transport to TEST. How would you troubleshoot it?