Architect / Cross-trackintermediate

OData Gateway Part 4: Gateway Architecture — Hub vs Embedded

Key takeaway

Understand how SAP Gateway is split into a frontend (IWFND, service registration, HTTP handling) and a backend (IWBEP, your MPC/DPC code), how hub and embedded deployments differ, how system aliases and trusted RFC connect them, and what SAP recommends for S/4HANA.

Explanation

📌 KEY POINTS
✅ Gateway has two layers: the frontend (IWFND) receives HTTP requests, handles registration, caching and routing; the backend (IWBEP) runs your model (MPC) and data provider (DPC) code.
✅ Embedded deployment: both layers in the same system (e.g. S/4HANA). Hub deployment: a separate frontend server (FES) routes to one or more backends via RFC.
✅ The system alias (SPRO / /IWFND/MAINT_SERVICE) tells the frontend which backend (RFC destination) serves a service.
⚠️ For S/4HANA, SAP recommends embedded deployment for Fiori; hub deployments still exist in many landscapes — always know which one you are working in before debugging.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Parts 1–3 built services. Before registering and testing them (Part 5), understand where each piece runs.

━━━━━━━━━━━━━━━━━━━━
▶ 1. COMPONENTS

SAP_GWFND (since NetWeaver 7.40) contains both frontend and backend components.
Frontend: /IWFND/ transactions — MAINT_SERVICE, GW_CLIENT, ERROR_LOG, TRACES, CACHE_CLEANUP.
Backend: /IWBEP/ — model and data provider classes, /IWBEP/ERROR_LOG, backend cache cleanup.

━━━━━━━━━━━━━━━━━━━━
▶ 2. EMBEDDED DEPLOYMENT

Frontend and backend in the same system; system alias usually LOCAL.
Simpler landscape, no RFC hop, one place for logs.
Fiori launchpad may also run in the same system (S/4HANA embedded).

━━━━━━━━━━━━━━━━━━━━
▶ 3. HUB DEPLOYMENT

Separate frontend server (FES) with Fiori launchpad and UI5 apps; backends (ECC, S/4, CRM) connected via trusted RFC.
One entry point for several backends; UI lifecycle separate from backend upgrades.
Service code (MPC/DPC) still lives in the backend; registration and HTTP handling in the hub.

━━━━━━━━━━━━━━━━━━━━
▶ 4. SYSTEM ALIAS AND RFC

System alias = logical name pointing to an RFC destination (SM59) with trusted connection (SMT1) so the user's identity is passed.
Assigned per service in /IWFND/MAINT_SERVICE.
Wrong or missing alias → "No system alias found" errors.

━━━━━━━━━━━━━━━━━━━━
▶ 5. REQUEST FLOW

Browser/app → ICF node /sap/opu/odata/… on the frontend → IWFND checks registration and alias → IWBEP in backend → your DPC_EXT method → response back.

━━━━━━━━━━━━━━━━━━━━
▶ 6. WHERE TO LOOK WHEN IT FAILS

Registration, alias, ICF node: frontend.
ABAP errors in your code, BAPI messages: backend (/IWBEP/ERROR_LOG), also surfaced in /IWFND/ERROR_LOG.
Authorizations: S_SERVICE on frontend, business objects on backend.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Check in your system whether /IWFND/MAINT_SERVICE shows alias LOCAL (embedded) or a remote alias (hub).
Open SM59 for the alias RFC destination if hub; note the trusted setting.
Trace one request path for your Part 1 service.
Write down where frontend and backend logs are for your landscape.

✅ CHECKPOINT: you can tell hub from embedded, explain the system alias and know where each log lives.

Code example

ABAP Code

* ===== STEP 1: find out your deployment - small classic report =====REPORT zgw_landscape_check. DATA: lv_sysid TYPE sy-sysid,      lv_rfc   TYPE rfcdest VALUE 'NONE'. PARAMETERS p_dest TYPE rfcdest DEFAULT 'S4BACKEND_TRUSTED'. START-OF-SELECTION.  lv_sysid = sy-sysid.  WRITE: / 'Current system:', lv_sysid. * ===== STEP 2: check a backend RFC destination (hub scenario) =====  lv_rfc = p_dest.  CALL FUNCTION 'RFC_PING' DESTINATION lv_rfc    EXCEPTIONS      system_failure        = 1      communication_failure = 2      OTHERS                = 3.  IF sy-subrc = 0.    WRITE: / 'Backend reachable via', lv_rfc.  ELSE.    WRITE: / 'Backend NOT reachable via', lv_rfc, 'rc =', sy-subrc.  ENDIF. * ===== STEP 3: request flow (reference) =====* Client -> ICF /sap/opu/odata/sap/ZSALES_SRV (frontend, IWFND)*        -> registration + system alias check (/IWFND/MAINT_SERVICE)*        -> RFC (hub) or local call (embedded, alias LOCAL)*        -> IWBEP runtime -> ZCL_ZSALES_DPC_EXT method (backend)* Logs: frontend /IWFND/ERROR_LOG, backend /IWBEP/ERROR_LOG

Real project scenario

A Fiori app failed only in quality with "No system alias found for service". Developers checked their DPC_EXT code for hours.
The landscape was a hub: the service had been registered on the quality FES with the development backend alias copied from a screenshot. Assigning the correct alias (pointing to the quality backend via trusted RFC) in /IWFND/MAINT_SERVICE fixed it without any code change. The team then documented alias names per system in the transport checklist.

Common mistakes

Debugging DPC code when the problem is registration or alias.
Non-trusted RFC in a hub, so all calls run as a technical user.
Looking only in /IWBEP/ERROR_LOG on a hub frontend (or vice versa).
Assuming the service code is on the hub.
Forgetting S_SERVICE authorization on the frontend.

Best practices

Know your deployment before troubleshooting.
Use trusted RFC so user authorizations apply in the backend.
Document system aliases per landscape tier.
Prefer embedded deployment for new S/4HANA Fiori landscapes unless there is a clear hub reason.
Check both frontend and backend logs.

Interview angle

Questions: "Hub vs embedded deployment?", "What is a system alias?", "Where does DPC code run in a hub?"
Strong answer: frontend IWFND handles HTTP, registration and routing; backend IWBEP runs MPC/DPC. Embedded: both in one system (alias LOCAL), SAP's recommendation for S/4 Fiori; hub: separate FES routing via trusted RFC to backends. System alias maps a service to an RFC destination. DPC code always runs in the backend.

Practice this lesson

Quick check

1. In an embedded Gateway deployment on S/4HANA, which system alias is typically assigned to a service?

2. In a Gateway hub deployment, where does the DPC_EXT code of a service run?

3. A service works on the backend but the Fiori launchpad on the hub reports "No system alias found". What is the first fix?

Interview questions

1. External partner requires OAuth2 on OData. Approach?

Answer it in your own words first, then compare.

2. A service works in /IWFND/GW_CLIENT on the backend but fails from the Fiori launchpad on the frontend server with "No system alias found". What is happening?

Answer it in your own words first, then compare.

Practice more with Interview AI →

Reference-verified: the steps are checked against official SAP documentation and tutorials, and object and field names in the sample code are checked for consistency. The code has not been compiled or run on an SAP system by ERPClimb. Syntax marked release-dependent varies by SAP release, so check it in your own system.