Configuring SAP Landscape Discovery

Introduction

The SAP landscape discovery feature in SAP LeanIX uses SAP Cloud ALM to access and gather landscape information from SAP Cloud ALM and other SAP systems. SAP Cloud ALM's underlying discovery functionality provides a continuous view of your SAP landscape, ensuring that the data in SAP LeanIX is up-to-date and accurate.

Active or regular usage of SAP Cloud ALM is not required for the SAP landscape discovery to work. SAP LeanIX uses SAP Cloud ALM as a gateway to connect with your SAP backend repository to retrieve data from various SAP tools, including SAP Solution Manager and Focused Run. This means there is no need to switch from SAP Solution Manager to SAP Cloud ALM to derive value from this integration.

📘

SAP Cloud ALM

SAP Cloud ALM is an application lifecycle management offering for cloud-centric customers. It is included in cloud subscriptions containing SAP Enterprise Support. To learn more, see SAP Cloud ALM.

Using the SAP landscape discovery feature involves the following steps:

1. Leveraging an existing or setting up a new SAP Cloud ALM instance.
2. Auto-discovering the services & systems in SAP Cloud ALM.
3. Enabling read-only API access to SAP Cloud ALM.
4. Connecting your SAP LeanIX workspace to the SAP Cloud ALM API.
5. Linking new and existing fact sheets in your inventory to the discovered SAP services after reviewing them in the SAP discovery inbox.

📘

Note

Only users with admin rights can configure and manage this integration.

👍

Managing Access

The integration uses a service key to access the Cloud ALM API instead of being tied to a specific user or password. This allows you to manage access independently of individual users.

Scope of SAP Landscape Discovery

Currently, the SAP landscape discovery feature discovers:

• SaaS products and SaaS ERP entries
• SAP On-Premise systems, including ERP systems.

The ability to discover SAP Private Cloud and BTP Services is in the pipeline. Check our product roadmap for more details and to submit your requests: Application Discovery: SAP Private Cloud application landscape discovery and Application Discovery: SAP BTP Service Discovery.

SAP Private Cloud, BTP (PaaS) services, BTP sub-accounts, niche products, and certain product modules are not discovered. As a result, not all services displayed in SAP Cloud ALM will appear in LeanIX's SAP landscape discovery inbox. Note that systems from RISE Starter Systems are also excluded from the discovery.

Please review the diagram below to understand the different hosting options for SAP solutions, and how these are surfaced in SAP Cloud ALM, SAP LeanIX, and in other places.

Please note that systems running in either your own private cloud or your own data center (considered on-premise by SAP) are not automatically discovered and shown by SAP Cloud ALM. This is only the case for manually registered systems. The registration in the Landscape Information Service is typically handled automatically for all systems via SAP Solution Manager. Yet, the underlying SAP systems may only hold partial data or no data at all, given the complexities of on-premise landscapes and options for customers to limit this transfer, such as firewalls or missing configurations.

If certain services are not visible in SAP Cloud ALM itself, it could be because your organization has not subscribed to them in the BTP Cockpit. If your organization has subscribed but the services are still missing, check the SAP Cloud ALM Troubleshooting Guide. You can also create a support ticket through SAP LeanIX Support or SAP for Me.

You can compare the discovered items against the services in SAP Cloud ALM by navigating to Landscapes in SAP Cloud ALM and filtering for Cloud System under the Deployment Model field.

If you want to compare discovered services against SAP for Me instead of SAP Cloud ALM, keep in mind that SAP Cloud ALM only displays subscribed tenants (those actively signed up and available for use), while SAP for Me shows both subscribed tenants and entitled tenants (those granted access rights but not yet activated).

Additionally, SAP Cloud ALM does not display all SaaS products; it only lists those that are supported by Cloud ALM. You can find the complete list of supported solutions published here: SAP Cloud ALM Supported Solutions.

Setting Up an SAP Cloud ALM Instance

If you are not yet using SAP Cloud ALM, to set up and access the system, follow the instructions in these guides:

• How To Get Started With SAP Cloud ALM
• Request SAP Cloud ALM
• Onboard Users
• Assign Roles to Users in SAP Cloud ALM

Auto-Discovering the Services and Systems through SAP Cloud ALM

Once SAP Cloud ALM is set up, enable SAP Cloud ALM to auto-discover your services and systems by setting up landscape management. To set up landscape management in SAP Cloud ALM, see Landscape Management.

You can find the discovered cloud services and systems under Landscape Overview in the SAP Cloud ALM user interface.

Registering Additional Customer Numbers to Your SAP Cloud ALM Tenant

If your company has multiple customer numbers, you may need to register them with SAP Cloud ALM to allow the discovery of systems installed under these numbers. To do this, you can use a so-called ‘corporate group’ consisting of a set of customer numbers. For more information on creating a corporate group, see Corporate Group Function.

Once the group is set up, add an S-User from that group to Cloud ALM by navigating to Administration → Landscape Management. There, click the cog icon to access the configuration screen, and the option to add an S-User by clicking Add S-User.

Enabling API Access to SAP Cloud ALM

🚧

Requirement

Access to the SAP BTP Cockpit is required for this step.

SAP LeanIX requires access to SAP Cloud ALM's API. To learn how to enable the API, see Enabling SAP Cloud ALM API. Ensure you create a new API instance to avoid affecting any existing API keys and other API users.

To create a new API instance, enter basic information for your instance with an appropriate instance name. Then, configure the instance parameters in JSON format. Use the JSON code below as the ‘Binding Parameters'. This limits access to the landscape data in Cloud ALM. Make sure to replace<your-instance-name> with an appropriate instance name. If the API instance is created without a dedicated name, use the 'instance id' (a UUID) instead.

🚧

Note

Make sure you use the following JSON code to ensure correct permissions are passed in the authorities attribute.

{
  "xs-security": {
    "xsappname": "<your-instance-name>",
    "authorities": [
      "$XSMASTERAPPNAME.calm-api.landscape.read",
      "$XSMASTERAPPNAME.calm-api.subscriptions.read"
    ]
  }
}

📘

Note

We support integration with only one Cloud ALM tenant as ultimately all tenants share a single underlying SAP Landscape. We recommend integrating the "main" Cloud ALM tenant linked to all relevant customer numbers. However you can still submit a request, including the reason for your need at SAP LeanIX Product Roadmap.

Validating the Cloud ALM Service Key

We recommend validating the proper functioning of the service key by using the 'Try out' functionality for the Cloud ALM REST API. To access it, visit SAP Business Accelerator Hub.

If the request fails, double-check that the binding parameters were correctly registered for the service key and ensure that the 'xappname' matches the name of the Cloud ALM API instance.

Connecting SAP LeanIX to the SAP Cloud ALM API

To connect SAP LeanIX to SAP Cloud ALM API, do the following:

1. In the administration area of SAP LeanIX, navigate to the Integrations section.
2. Click Add Integrations.
3. Locate SAP Landscape Discovery and click Configure.
4. Depending on your requirements, select or de-select SaaS and on-premise product discovery.
5. Download the service key from the SAP BTP cockpit that you previously created and input it under Authenticate via API.
6. Click Save.

📘

Note

If you had set up the integration before the release of the on-premise discovery feature, you can just enable it on the integration configuration page.

Troubleshooting

The table below lists common errors that you may encounter and how to resolve them.

Errors	Screenshot	Potential Solution
When pasting the API service key, you receive the message: "This does not look like JSON config, please add a different JSON config."		Ensure the JSON is exactly as downloaded from the BTP cockpit. In this example, the values were enclosed in single quotes (') instead of the needed double quotes (").
When pasting the API service key, you receive the message: "Authentication Failed. The JSON API credentials you've provided are incorrect or not recognized. (…)"		Validate the service key as described in Validating the Cloud ALM Service Key. Check if the key has expired. Check if any parts of the secret are missing. Check if necessary ‘Binding Parameters' are absent.
When enabling the SAP Cloud ALM API, you receive the message: "Your credentials are valid, but your service key does not have the necessary permissions to access the resource."		Ensure you use the correct JSON code as given in the section Enabling API Access to SAP Cloud ALM and not the JSON code in the guide Create or Update an Instance. This ensures correct permissions are passed in the authorities attribute.
When adding or updating an instance and generating a service key, upon clicking View Details at the end, you receive the message: "(….) instance-secret is not allowed when using tenant mode shared. Use binding-secret or x509 instead.; ResponseError:"		Include the binding-secret with the oauth2-configuration attribute. You can update your JSON file with the configuration provided below this table.

{
    "xs-security": {
        "xsappname": "<your-instance-name>",
        "authorities": [
           "$XSMASTERAPPNAME.calm-api.landscape.read",
           "$XSMASTERAPPNAME.calm-api.subscriptions.read"
        ],
        "oauth2-configuration": {
            "credential-types": [
                "binding-secret"
            ]
        }
    }
}

👍

Requesting Support

If the issues persist, raise the issue with SAP LeanIX Support. You can also submit the support request at SAP for Me.

To ensure we can address your concerns as quickly as possible, please include as many details as you can about the issue, such as screenshots or Excel export from Cloud ALM about missing systems and more.

Viewing Synchronization Logs for the Integration Runs

Every 24 hours, SAP landscape discovery generates synchronization logs for each discovery run by pulling data from the SAP landscape via SAP Cloud ALM. With synchronization logs, you can promptly identify any integration issues and get details on each failed integration run.

You can view the details of integration runs in the Sync Logging section of the administration area. You can also access it in the Integrations section by clicking View Sync Logging. For more information on synchronization logs, see Synchronization Logging.

Linking Discovered Items to the Fact Sheets

Once the integration is successfully set up, the discovery run discovers your SAP cloud products and lists them in the SAP Landscape Discovery Inbox. In the inbox, you can review the discovered items and link them to existing fact sheets or create and link new fact sheets. To learn more, see SAP Landscape Discovery Inbox.