Teamscale Docs

Appearance

Configuration on the Teamscale Server ​

A few parts of the SAP integration are configured on the machine running Teamscale rather than in its web interface: the cryptographic library for Secure Network Communications, the SAP system's certificate, and a small number of JVM properties. This article collects those steps. Installing the SAP Java Connector is covered in Prerequisites.

Archiving of Raw Export Files ​

When receiving data from the SAP system, Teamscale archives the raw data as zip files in a directory on the Teamscale server. These archived files can be used to investigate problems. To preserve disk space, Teamscale will retain archived files only for one year. This period can be configured with the JVM option -Dcom.teamscale.abap.archivingPeriodInDays=365 (default value is 365) in the jvm.properties configuration file.

SNC Configuration on the Teamscale Server ​

These steps are only required if you secure the RFC communication with Secure Network Communications. They assume the SAP system has already been prepared as described in SNC Configuration of the SAP System.

SNC Configuration for Cloud-Hosted Instances

For instances hosted on our cloud platform, please send the PSE to the Teamscale support team at support@teamscale.com. We'll handle the rest of the configuration.

On the Teamscale server, the following configuration steps are required:

  1. The library files from SAP Cryptographic Library must be saved on the Teamscale server. SAP Cryptographic Library can be downloaded from SAP for Me (requires login) for the required operating system, search for COMMONCRYPTOLIB 8. Two files must be present among the library files:

    • Credential management binary sapgenpse: This is used by Teamscale for creating the cred_v2 credentials and managing the PSE entries inside it.
    • Core SNC OS library: For Unix systems it is libsapcrypto.so and sapcrypto.dll for Windows. The path to this file must be set in the systems environment variable SNC_LIB.

    Note that for Teamscale docker instances, the folder location of the library files has to be mounted to the docker container path /opt/teamscale/lib-ext. Also SNC_LIB is automatically set.

  2. The environment variable SECUDIR must be set to a directory on the server that would contain the cred_v2 credentials file and the PSE files of all SAP systems. The cred_v2 should be only accessible for the operating system user running Teamscale. Note that for Teamscale docker instances:

    • SECUDIR is automatically set to /var/teamscale/snc-cred so ensure that the location of the PSE and cred_v2 files on the host operating system is mounted to it.
    • If the host operating system is Unix-based, the PSE files should be owned by a user with id 1000. This matches the teamscale docker container user and ensures that credential management operations don't fail from permission issues.

    For ease of management, each PSE file should be named after its SAP system name, which should have a corresponding connection in Teamscale. For instance, a SAP system XYZ should have its connection settings in Teamscale named XYZ and an XYZ.pse file.

  3. If the X.509 client certificate should be used for logon (SSO mechanism), the client certificate file (e.g. TEAMSCALE.crt ) must be saved on the Teamscale server.

SNC Credential Management ​

Teamscale since v2025.3 can perform PSE and credential management functions through sapgenpse. For this to work on Teamscale non-docker instances installed as a Windows or Unix service, set the operating system username running Teamscale into the JVM property com.teamscale.abap.snc.credentials-user. For docker instances, this is automatically set. To allow auto-determination of the current operating system user, avoid setting the property.

At start-up, Teamscale auto-creates a cred_v2 file from all available SAP system PSEs. This is controlled by the JVM boolean property com.teamscale.abap.snc.create-credentials-at-startup. On Teamscale's web interface, click Admin > Settings > Manage ABAP SNC Credentials, for more management actions.

On the Admin > Settings view, you may specify the path to the directory containing the library files of SAP Cryptographic Library under SAP > [SAP ABAP System Connections - Global Settings].

The per-connection SNC options are described in the SAP System Connections reference.

Trusting the SAP System's Certificate ​

Teamscale fetches descriptions for ATC checks over HTTPS from the SAP system. If SSL is configured on the SAP system, its certificate from the Trust Manager needs to be added into Teamscale's keystore.

If SSL is yet to be configured, you can start Teamscale with the JVM flag -Dcom.teamscale.disable-ssl-certificate-validation=true. This disables certificate validation for all of Teamscale's outgoing HTTPS connections, so prefer adding the certificate to the keystore and use this flag only as a temporary measure.