--- url: /howto/sap-integration/teamscale-server.md description: >- This article describes the SAP-related configuration you have to perform on the Teamscale server itself. --- # Configuration on the Teamscale Server A few parts of the SAP integration are configured on the machine running Teamscale rather than in its web interface: the cryptographic library for Secure Network Communications, the SAP system's certificate, and a small number of JVM properties. This article collects those steps. Installing the SAP Java Connector is covered in [Prerequisites](../prerequisites/#installation-of-the-sap-java-connector). \[\[toc]] ## Archiving of Raw Export Files When receiving data from the SAP system, Teamscale archives the raw data as zip files in a directory on the Teamscale server. These archived files can be used to investigate problems. To preserve disk space, Teamscale will retain archived files only for one year. This period can be configured with the JVM option `-Dcom.teamscale.abap.archivingPeriodInDays=365` (default value is 365) in the `jvm.properties` [configuration file](../../../reference/administration-ts-installation/#jvm-arguments). ## SNC Configuration on the Teamscale Server These steps are only required if you secure the RFC communication with [Secure Network Communications](../teamscale-sap-connection/#secure-network-communication-optional). They assume the SAP system has already been prepared as described in [SNC Configuration of the SAP System](../sap-system/#snc-configuration-of-the-sap-system-optional). :::tip SNC Configuration for Cloud-Hosted Instances For instances hosted on our cloud platform, please send the PSE to the Teamscale support team at . We'll handle the rest of the configuration. ::: On the Teamscale server, the following configuration steps are required: 1. The library files from *SAP Cryptographic Library* must be saved on the Teamscale server. *SAP Cryptographic Library* can be downloaded from [SAP for Me](https://me.sap.com/) (requires login) for the required operating system, search for `COMMONCRYPTOLIB 8`. Two files must be present among the library files: * Credential management binary `sapgenpse`: This is used by Teamscale for creating the `cred_v2` credentials and managing the PSE entries inside it. * Core SNC OS library: For Unix systems it is `libsapcrypto.so` and `sapcrypto.dll` for Windows. The path to this file must be set in the systems environment variable `SNC_LIB`. Note that for Teamscale docker instances, the folder location of the library files has to be mounted to the docker container path `/opt/teamscale/lib-ext`. Also `SNC_LIB` is automatically set. 2. The environment variable `SECUDIR` must be set to a directory on the server that would contain the `cred_v2` credentials file and the PSE files of all SAP systems. The `cred_v2` should be only accessible for the operating system user running Teamscale. Note that for Teamscale docker instances: * `SECUDIR` is automatically set to `/var/teamscale/snc-cred` so ensure that the location of the PSE and `cred_v2` files on the host operating system is mounted to it. * If the host operating system is Unix-based, the PSE files should be owned by a user with id `1000`. This matches the `teamscale` docker container user and ensures that credential management operations don't fail from permission issues. For ease of management, each PSE file should be named after its SAP system name, which should have a corresponding connection in Teamscale. For instance, a SAP system XYZ should have its connection settings in Teamscale named XYZ and an XYZ.pse file. 3. If the X.509 client certificate should be used for logon (SSO mechanism), the client certificate file (e.g. `TEAMSCALE.crt` ) must be saved on the Teamscale server. ### SNC Credential Management Teamscale since v2025.3 can perform PSE and credential management functions through `sapgenpse`. For this to work on Teamscale non-docker instances installed as a Windows or Unix service, set the operating system username running Teamscale into the JVM property `com.teamscale.abap.snc.credentials-user`. For docker instances, this is automatically set. To allow auto-determination of the current operating system user, avoid setting the property. At start-up, Teamscale auto-creates a `cred_v2` file from all available SAP system PSEs. This is controlled by the JVM boolean property `com.teamscale.abap.snc.create-credentials-at-startup`. On Teamscale's web interface, click *Admin* > *Settings* > *Manage ABAP SNC Credentials*, for more management actions. On the *Admin* > *Settings* view, you may specify the path to the directory containing the library files of *SAP Cryptographic Library* under *SAP* > *\[SAP ABAP System Connections - Global Settings]*. The per-connection SNC options are described in the [SAP System Connections reference](../../../reference/admin-settings/sap-system-connections/#secure-network-communications-snc). ## Trusting the SAP System's Certificate Teamscale fetches [descriptions for ATC checks](../teamscale-sap-connection/#check-descriptions-for-sap-atc-checks) over HTTPS from the SAP system. If SSL is configured on the SAP system, its certificate from the Trust Manager needs to be added into Teamscale's keystore. If SSL is yet to be configured, you can start Teamscale with the [JVM flag](../../../reference/administration-ts-installation/#jvm-settings-jvm-properties) `-Dcom.teamscale.disable-ssl-certificate-validation=true`. This disables certificate validation for all of Teamscale's outgoing HTTPS connections, so prefer adding the certificate to the keystore and use this flag only as a temporary measure.