SAP ERP on HANA Setup Guide

Configure SAP user

Configure a SAP Communication or System user with the following permissions/authorizations:

• RFC access to standard SAP functions to establish connection:

  AUTHORIZATION OBJECT	AUTHORIZATION FIELD	AUTHORIZATION VALUE
  S_RFC	ACTVT	16
  	RFC_TYPE	FUGR
  	RFC_NAME	BTCH RFC1 SDIFRUNTIME

  AUTHORIZATION OBJECT	AUTHORIZATION FIELD	AUTHORIZATION VALUE
  S_RFC	ACTVT	16
  	RFC_TYPE	FUNC
  	RFC_NAME	RFCPING

  • RFC access to the Fivetran function groups:

    AUTHORIZATION OBJECT	AUTHORIZATION FIELD	AUTHORIZATION VALUE
    S_RFC	ACTVT	16
    	RFC_TYPE	FUGR
    	RFC_NAME	/FIVETRAN/SAPAPPCONNECT /FIVETRAN/TRIGGERS

    The /FIVETRAN/TRIGGERS function group is required only when using the Default sync mechanism. If you select the No-trigger sync mechanism, this authorization is not needed.

  • Authorization required for batch process administration to schedule background jobs:

    AUTHORIZATION OBJECT	AUTHORIZATION FIELD	AUTHORIZATION VALUE
    S_RFC	ACTVT	16
    	RFC_TYPE	FUGR
    	RFC_NAME	S_BTCH_JOB

    AUTHORIZATION OBJECT	AUTHORIZATION FIELD	AUTHORIZATION VALUE
    S_BTCH_ADM	BTCADMIN	Y

    AUTHORIZATION OBJECT	AUTHORIZATION FIELD	AUTHORIZATION VALUE
    S_BTCH_JOB	JOBACTION	RELE
    	JOBGROUP	*

    AUTHORIZATION OBJECT	AUTHORIZATION FIELD	AUTHORIZATION VALUE
    S_PROGNAM	P_ACTION	BTCSUBMIT
    	P_PROGNAM	/FIVETRAN/RETRIEVE

• Data access authorizations:

  The S_TABU_SQL authorization object can be used to manage access rights for every data table in the SAP database. This authorization object consists of four fields namely - ACTVT (activity), DBSID (database name), TABOWNER (database user), TABLE (name of the database table).

  • To grant full access, apply the following settings:

    Authorization Object	Authorization Field	Authorization Value
    S_TABU_SQL	ACTVT	33
    	DBSID	*
    	TABOWNER	*
    	TABLE	*

  • To restrict access, add separate values for each individual table. As an example, the following configuration grants access to the BSEG table:

    Authorization Object	Authorization Field	Authorization Value
    S_TABU_SQL	ACTVT	33
    	DBSID	*
    	TABOWNER	*
    	TABLE	BSEG

  • Fivetran needs access to specific HANA tables. If data access is generally restricted, access rights must be enabled for the following tables:

    Authorization Object	Authorization Field	Authorization Value
    S_TABU_SQL	ACTVT	33
    	DBSID	*
    	TABOWNER	SYS
    	TABLE	DUMMY HAS_NEEDED_SYSTEM_PRIV* M_CS_TABLES M_DATABASE M_OBJECT_LOCKS M_RECORD_LOCKS M_SERVICES M_TABLES M_TABLE_LOCKS NUMA_NODE_PREFERENCE_ P_GRANTEDPRIVS_ P_OBJTYPES_ P_PRINCIPALS_ P_PROCEDURES_ P_SCHEMAS_ P_TRIGGERS_ TRIGGERS _SYS_GRANTED_OBJECTS _SYS_GRANTEE_OIDS _SYS_SCHEMAS_WITH_PRIVILEGES_O

    Access to P_TRIGGERS_ and TRIGGERS tables is needed only when using the Default sync mechanism. If you select the No-trigger sync mechanism, we do not need authorizations for these tables.

  • Fivetran needs additional read access to runtime tables it creates, such as /FIVETRAN/DELTRG and shadow tables like /FIVETRAN/DELETES_*:

    Authorization Object	Authorization Field	Authorization Value
    S_TABU_SQL	ACTVT	33
    	DBSID	*
    	TABOWNER	*
    	TABLE	/FIVETRAN/*

    The /FIVETRAN/DELTRG and /FIVETRAN/DELETES_* tables are created only when using the Default sync mechanism. If you select the No-trigger sync mechanism, these tables are not created and this authorization is not required.

Install Fivetran NetWeaver API

The Fivetran NetWeaver API contains Fivetran’s ABAP functions that enable data transfer between the SAP system and Fivetran. The Fivetran NetWeaver API can be downloaded from the connection setup form as well as from the Account Settings -> Downloads menu of the Fivetran dashboard.

To install the Fivetran NetWeaver API on your SAP system, use your company's default method.

The Fivetran NetWeaver API also includes optional files containing sample authorization roles that can be uploaded using transaction PFCG:

• /FIVETRAN/SYS – system role with RFC access rights and data access rights to technical tables
• /FIVETRAN/TRIGGERS – additional access to trigger functions for the “trigger deletes capture” scenario. This role is only required when using the Default sync mechanism.
• /FIVETRAN/DATA_FULL – example role with full data access

Receiver namespace

Fivetran-specific ABAP code is created in the /FIVETRAN/ namespace. The Fivetran NetWeaver API automatically manages this namespace.

Enable Secure Network Communication (optional)

We support Secure Network Communication (SNC), which provides an additional security layer over the communication between Fivetran and your SAP system. You can enable SNC during the configuration of your connection in the connection setup form.

Steps needed in your SAP system:

• Load the Fivetran certificate in the Trust Manager (transaction STRUST) of your SAP system.
• Link your SAP user to Fivetran's SNC name.
• Safelist Fivetran's SNC name.

Choose connection method

Choose your preferred method for connecting Fivetran to your SAP Application Server. The supported connection methods depend on your deployment model.

• For SaaS deployment, we support SSH, private networking, and Proxy Agent connection methods. If you enable SNC mode, direct connection is also available.

• For Hybrid Deployment, we support only direct and Proxy Agent connection methods.

Use SAP Message Server (optional)

By default, Fivetran connects to a specific SAP Application Server using its host address and instance number. If your SAP landscape includes multiple application server instances, you can use SAP Message Server instead.

SAP Message Server is a component of your SAP system that manages communication between application servers and handles logon load balancing. When Fivetran connects through Message Server, SAP automatically routes the logon to the least-loaded available application server in the specified logon group, and redirects to a healthy instance if one becomes unavailable.

Consider using SAP Message Server when:

• Your SAP landscape has multiple application server instances
• You want to use SAP's built-in load balancing across application servers
• You need automatic failover if an application server becomes unavailable

To use SAP Message Server, ask your SAP administrator for the following:

• Message Server Host: Hostname or IP address of your SAP Message Server
• Message Server Port: Service port of the Message Server (for example, 3601 for system number 01)
• R3 Name: Three-character SAP System ID (for example PRD)
• Group: SAP Logon Group name (for example PUBLIC)

Use SAP Router (optional)

SAP Router is an SAP program that acts as a proxy and intermediate station for RFC traffic between external systems and your SAP landscape. It operates at the SAP application layer and is typically deployed in a DMZ to control which systems can establish RFC connections to your SAP Application Server.

Consider using SAP Router when:

• Your SAP system is only accessible through an SAP Router node
• Your organisation's network security policy requires RFC traffic to pass through SAP Router

To use SAP Router, ask your SAP administrator for the SAP Router connection string. The string uses the following format: /H/hostname/S/port. For connections that route through multiple SAP Router nodes, chain the hops in sequence, for example: /H/router1/S/port1/H/router2/S/port2.

The default SAP Router port is 3299.

SAP date to LOCALDATE conversion (optional)

By default, we convert SAP DATS data type to STRING.

When you set the Enable SAP date to LocalDate conversion toggle to ON, we do one the following, depending on the column type:

• For primary key columns: We keep the original column as a STRING type and create a new column with the original column's name appended with the suffix _DATE, with its values converted from DATS to LOCALDATE type.

• For non-primary key columns: We always convert the original values to LOCALDATE type.

When we attempt to convert a DATS value but the date is invalid, we do one of the following, depending on the value:

• For the SAP default value 00000000 and an empty STRING value, we set the converted value to NULL.
• For other invalid dates, such as when the number of months in date value 20241301 is larger than 12, we set the value to the default date 1970-01-01.

This feature follows the general data mapping workflows.

Configure Fivetran in SAP (optional)

We offer several configuration parameters that you can optionally use to tune and optimize data extraction. You can access these parameters using the SAP transaction /N/FIVETRAN/CONFIG. In most cases, the parameters can be left with the default values.

Finish Fivetran configuration

This section outlines the steps to configure your connection in the connection setup form within your Fivetran dashboard.

1. Enter a Destination schema prefix of your choice. This prefix applies to each replicated schema and cannot be changed once your connection is created.

2. In the Destination schema names field, choose the naming convention you want Fivetran to use for the schemas, tables, and columns in your destination:

   • Fivetran naming: Standardizes the schema, table, and column names in your destination according to the Fivetran naming conventions.
   • Source naming: Preserves the original schema, table, and column names from the source system in your destination.
   • The Source naming feature is not compatible with Quickstart transformations. To ensure successful syncs, we automatically disable Quickstart transformations for connections configured with Source naming.
   • If you want to modify your selection, make sure you do it before you start the initial sync.

3. (Hybrid Deployment only) If your destination is configured for Hybrid Deployment, the Hybrid Deployment Agent associated with your destination is pre-selected for the connection. To assign a different agent, click Replace agent, select the agent you want to use, and click Use Agent.

4. In the Connection mode field, NetWeaver Connection is selected by default. You cannot modify this setting after you click Save & Test.

5. Ensure you have installed the Fivetran NetWeaver API on your SAP system.

6. (Optional) In the SNC mode field, select your desired SNC mode:

   • No SNC (default)
   • SNC with certificate
   • SNC with certificate and user/password

7. (Optional) Set the Use SAP Message Server toggle to ON to use SAP Message Server for load balancing across multiple application server instances. When enabled, the ASHOST and SYSNR fields are replaced by the following fields:

   • Message Server Host: Enter the hostname or IP address of your SAP Message Server.
   • Message Server Port: Enter the service port of the SAP Message Server (for example, 3601 for system number 01).
   • R3 Name: Enter the three-character SAP System ID (for example, PRD).
   • Group: Enter the SAP logon group name (for example, PUBLIC).

8. In the ASHOST field, enter the hostname or IP address of your SAP Application Server.

   • If you select Connect via private networking in the Connection method step below, specify the fully qualified DNS name of the private endpoint. The DNS name must follow the format: <private-link-name>.<region>.<cloud_provider>.privatelink.fivetran.com. For example:
     • Azure: sap-erp-privatelink.eastus.azure.privatelink.fivetran.com
     • AWS: sap-erp-privatelink.us-east-1.aws.privatelink.fivetran.com
   Fivetran provides the DNS name during the private endpoint creation process (see our AWS PrivateLink setup guide or Azure PrivateLink setup guide).

   This field does not appear when the Use SAP Message Server toggle is ON.

9. In the SYSNR field, enter a two-digit instance number of your SAP system.

   This field does not appear when the Use SAP Message Server toggle is ON.

10. In the CLIENT field, enter a three-digit SAP system client number.

11. In the USER field, enter the username of the SAP Communication or System user.

    The field does not appear when you select SNC with certificate as the SNC mode.

12. In the PASSWORD field, enter the password associated with the specified SAP user.

    The field does not appear when you select SNC with certificate as the SNC mode.

13. In the SNC FIVETRAN NAME field, copy the SNC name generated by Fivetran and link your SAP user to Fivetran's SNC name in your SAP system. You must safelist Fivetran's SNC name in the SAP system.

    The field appears only when you select SNC with certificate or SNC with certificate and user/password as the SNC mode.

14. In the FIVETRAN CERTIFICATE, download the SNC certificate generated by Fivetran and load it in the Trust Manager (transaction STRUST) of your SAP system.

    The field appears only when you select SNC with certificate or SNC with certificate and user/password as the SNC mode.

15. In the SNC SOURCE NAME field, enter the SNC name of your SAP system.

    The field appears only when you select SNC with certificate or SNC with certificate and user/password as the SNC mode.

16. In the SOURCE CERTIFICATE field, upload the SNC certificate of your SAP system.

    The field appears only when you select SNC with certificate or SNC with certificate and user/password as the SNC mode.

17. (Optional) Set the Use SAP Router toggle to ON to route the connection through an SAP Router. In the SAP Router field, enter the SAP Router connection string.

    The Use SAP Router toggle does not appear when the Use SAP Message Server toggle is ON. In that case, the SAP Router field is displayed directly and is required.

18. Select your chosen Connection method.

    For SaaS deployment, the direct connection method is available only when you enable SNC mode, due to security concerns. For Hybrid Deployment, direct connection is available by default.

    • If you selected Connect via an SSH tunnel, copy or make a note of the Public Key and add it to the authorized_keys file while configuring the SSH tunnel, and provide the following information:

      • SSH Host: Enter the hostname or IP address of your SSH server. Do not use a load balancer's IP address/hostname.
      • SSH Port: Enter the port number of your SSH server. The default port number is 22.
      • SSH User: Enter the username for SSH access.

    • If you selected Connect via Proxy Agent, choose the necessary proxy agent from the Proxy agents drop-down list (if available) or configure a new proxy agent.

19. In the Sync mechanism field, select the sync mechanism for your connection. You cannot change this setting after you save the connection.

    • Default: Fivetran creates delete triggers and associated shadow tables in your SAP system to capture deletes. Column-store transparent tables retain their original primary keys.
    • No-trigger: Fivetran uses queries only to detect changes, including deletes. No triggers or shadow tables are created in your SAP system. Column-store transparent tables replicate in Live mode with a Fivetran-generated _fivetran_id column as the primary key.

    For more information, see our Sync mechanism documentation.

20. (Optional) The Enable SAP date to LocalDate conversion toggle converts SAP DATS data type fields from STRING to LOCALDATE. The toggle is ON by default — turn it OFF to keep DATS fields as STRING. You cannot change this setting after you click Save & Test.

21. (Not applicable to Hybrid Deployment) Copy the Fivetran IPs /Host names (or CIDR) that you must safelist in your firewall.

22. Click Save & Test. Fivetran saves your configuration and runs a series of tests to validate your connection.

    View all tests

    • The Connecting to SSH Tunnel test validates the SSH tunnel details provided in the setup form. It then checks that we can create an SSH tunnel to your SAP Application Server. If connection method is Direct, then this test is skipped.
    • The Validating Credentials test checks the credentials provided in the setup form.
    • The Checking SAP SNC setup test checks the SAP SNC setup, if one of the SNC modes is selected in the setup form. In case No SNC mode is selected, this test is skipped.
    • The Checking SAP source connection test ensures Fivetran can connect to the SAP system.
    • The Checking authorizations and retrieval processes test ensures the correct authorization permissions are set and retrieval processes can be created.

    The tests may take a few seconds to finish running, up to a minute.

23. After all tests pass successfully, click Continue to proceed to the next step - selecting data to sync.

Select data to sync

This section outlines the steps to select tables or views to replicate in the Select Data to Sync page before running the initial sync. At this stage, no tables are selected by default.

1. In the search field, enter one or more terms to find the tables or views you want to sync.

   Search syntax and guidelines

   Search input:

   • Enter exact table or view names (for example, T000, T001, T002).
   • Use wildcards to broaden your search (for example, T00*, *BAK).
   • Combine exact names and wildcards in the same search (for example, VBAK, T00*, DD0*).

   Formatting rules:

   • Separate multiple search terms with commas. Spaces are optional and ignored.
   • Each search term must contain at least three alphanumeric characters.
   • Allowed special characters: *, ?, _, -, ., /.

   Search results:

   • Each search returns matching tables or views, sorted alphabetically.
   • An object appears in the results only if it exists in both the SAP HANA database and the SAP application layer.
   If your SAP administrator restricted table availability using /N/FIVETRAN/CONFIG → Source tables list, only those tables will appear in the search results. For more information, see our Limiting table availability documentation.

2. Select the schemas/tables you want to sync and click Save & Continue. Fivetran takes you to the connection’s Status tab.

3. (Optional) Choose the sync mode per table. On the Schema tab, the Sync mode column defaults to Soft delete mode. Leave it as is or switch individual tables to the History mode.

   • Soft delete mode: Fivetran marks records as deleted in the destination when they are deleted in the source. This mode requires less storage in your destination and is suitable for most use cases.
   • History mode: Fivetran retains all historical changes, including deletions, by adding metadata columns to track changes over time. This mode is useful for auditing and compliance purposes but requires more storage in your destination.
   You can't pick sync mode for views and row-store tables, they are synced in Live mode only.

   For more information about the sync modes in the SAP ERP on HANA connector, see our Updating data documentation.

4. (Optional) Add row filters to replicate only the rows you need. Filters are defined per table. For steps on how to add filters, as well as supported operators and data types, see our Row Filtering documentation.

5. To begin replication, open the Status tab and click Start initial sync.