Connection to SAP RFC

The SAP RFC connector reads explicitly selected transparent tables, DDIC database views and CDS view entities from an SAP system through the SAP application server (AS ABAP). It needs no database login. DQC requires the S_TABU_NAM display authorization for each source, SAP's DDIC display authorization check applies to tables and database views, and CDS access controls remain effective.

The SAP RFC connector is available on request and is not enabled by default. It needs a DQC environment with the SAP RFC runtime, a network route to your application server and the DQC ABAP component in your SAP system. Contact us to check availability for your DQC environment and to plan the setup.

For an overview of all ways to bring SAP data into DQC, see Connecting to SAP systems.

How it works

The DQC Platform runs outside SAP. It opens an RFC client connection to one application server, logs on with a dedicated communication user and calls exactly these function modules:

What this means for your SAP system:

• Only approved sources. DQC reads only sources that your data owner has approved by exact technical name and that are granted in the communication user's role. DQC never lists the whole Dictionary: a search reads only the Dictionary entries that start with the prefix you enter and returns only sources the user may read. There is no full-system extraction.

• Only selected columns. Within each source, DQC reads the columns you select, plus the key fields it needs to read in blocks. If you select no columns, DQC reads all supported columns.

• Bounded load. Rows are read in compressed blocks of at most 5,000 rows per call (default). An optional execution window per source (for example 22:00-04:00 Europe/Berlin) stops further reads when it closes. An interrupted extraction resumes from its last saved block where possible.

• When DQC reads from SAP. DQC keeps the last complete extraction of each source and reuses it for up to 24 hours (default). A refresh or a check after that period reads the source again in full; there are no delta loads. Before DQC uses a source, it checks the source's authorization and structure in SAP with one short call, also outside the execution window. Outside the execution window DQC reads no rows and keeps using the last complete extraction.

• Where the data is kept. The DQC component creates no tables and holds no data in SAP. DQC stores the extracted columns in the DQC Platform, where the rules run on them. Each new extraction replaces the previous one, and deleting the connector deletes the stored data.

Prerequisites in SAP

Supported sources are active transparent tables, DDIC database views and CDS view entities without parameters, with supported field types and a usable key for reading in blocks. CDS view entities require ABAP 7.55 or later.

Step 1: Install the DQC ABAP component

DQC delivers the ABAP source code with a machine-readable manifest, checksums and an installation and acceptance guide. DQC does not deliver a transport request: your SAP team creates the objects in its own development system and moves them through its normal change process.

The component consists of 13 objects in the customer namespace:

• Function group Z_DQC_RFC with the four remote-enabled function modules Z_DQC_PING, Z_DQC_GET_CAPABILITY, Z_DQC_SEARCH_TABLES and Z_DQC_FETCH

• Eight DDIC structures (ZDQC_S_*). They are structures, not database tables

Important:

• Keep the object names. The DQC Platform calls the modules by name and the role grants the function group by name

• Put nothing else into function group Z_DQC_RFC: the role grants the whole group

• Transport all 13 objects together. A partly imported component passes the connection test and fails when data is read

• Run ATC with your usual check variant for classic ABAP. The installation guide lists the expected findings and their background

Step 2: Create the communication user and role

All steps take place in the target client.

1. User (SU01): create a dedicated user of type Communication (for example DQCRFC), one per DQC environment that connects to this system (for example one for test and one for production). Never a dialog user, never SAP* or DDIC, never shared with another integration. Hand the password over through your secret process; it is entered once into the encrypted DQC connector configuration.

2. Role (PFCG): create exactly one single role (for example Z_DQC_RFC_READ) with manually maintained authorization data, no menu and no transactions. The authorization values are listed in the table below. Assign no other role or profile to the user.

3. Profile and user master comparison: generate the profile, assign the role to the user and perform the user master comparison. A generated but uncompared profile is not effective at runtime; this is the most common cause of "the role looks right, but the call fails".

Two details that are often set up incorrectly:

• The two S_RFC entries must be separate authorizations. One authorization with both RFC_TYPE values would grant every combination of both lists

• S_TABU_NAM is the allowlist the whole model rests on. S_TABU_DIS cannot replace it. Do not grant S_TABU_DIS with *, S_TABU_CLI, S_DEVELOP, SAP_ALL or SAP_NEW

Not needed: no SM59 destination, no gateway reginfo or secinfo entry, and no authorizations for the Dictionary function groups (SDIFRUNTIME, SDIF, SVIW) or the tables DD02L, DD03L, DD25L or DDDDLSRC. If Unified Connectivity (UCON) is active in the target client, add the four Z_DQC_* function modules and, where not already assigned, RFC_PING, RFC_SYSTEM_INFO and RFC_METADATA_GET to the responsible communication assembly.

To add a source later, add its exact name to S_TABU_NAM, regenerate the profile, perform the user master comparison and select the source in DQC. No new ABAP code is needed.

Step 3: Provide a network route

DQC connects to the application server on the RFC gateway port 33<NN>, where <NN> is the instance number (for example 3300 for instance 00). The connection uses the application server directly; message server load balancing (logon groups), SAProuter and SNC are currently not supported. Without SNC, SAP does not encrypt the RFC connection, so the route must be an encrypted private connection.

• Direct private route: DQC connects through an encrypted private connection (for example an IPsec VPN) from a small, fixed set of source IP addresses that DQC provides during setup. Allow exactly these addresses on TCP 33<NN> to the application server, and make the application server's logical host name resolvable on that path.

• DQC in your private cloud or on-premise: the DQC Platform runs inside your network and reaches the application server directly. See Private cloud & on-premises deployments.

SAP RFC through the DQC Proxy is not available yet. If your network only allows outbound connections, contact us.

Step 4: Create the connector in DQC

Go to the Data Connectors screen, choose SAP RFC and fill in:

Then add the sources:

1. Enter at least two leading characters of a technical name (for example MARA) and load the matching sources. DQC only finds sources that the communication user is authorized to read. If more than 100 sources match, DQC asks for a longer prefix.

2. Select a source and preview its extraction plan; the preview loads the available columns. Select the columns to extract and set the agreed row ceiling, rows per RFC call and execution window. By default a source may have at most 1,000,000 rows. A source with more rows than its ceiling fails instead of being loaded partially; contact DQC if a source needs a higher ceiling.

3. Optionally enter the expected number of rows to get estimated call and data volume figures (the preview does not count the rows in SAP). Preview the plan again after changing settings, review the limits and save.

When the connector is saved and before every refresh, DQC checks each selected source again. If a source is no longer authorized or available, the refresh stops before any data in DQC is changed.

Step 5: Verify the setup

1. Run the connection test. It checks the logon, the system ID and client, and the DQC component version.

2. Search for a source that is not in the role. It must not appear.

3. Preview the extraction plan of an approved source and run the first load inside the agreed execution window.

Troubleshooting

If SU53 names RFC_GET_FUNCTION_INTERFACE or DDIF_FIELDINFO_GET, do not add them to the role. The DQC connector reads function metadata through RFC_METADATA_GET; contact DQC support instead.

Notes

• DQC only reads; the component offers no function that writes to SAP

• Agree row limits and execution windows with your SAP Basis team before the first full load

• Learn more: Connecting to SAP systems, Connection to SAP HANA, Supported data sources