Skip to content

Communication Scenario 467:
Printing – Notification Integration

Literature - SAP documentation

Refer to SAP_COM_0467 for further information.

The communication scenario 467 extends the communication scenario 466 by adding a notification route to the seal-cpm-checkin service. The notification route is used by the SAP system to notify PLOSSYS Output Engine about jobs to print.

Set up communication scenario SAP_COM_0467 on the SAP side first, using the section matching your deployment type below. Then configure the seal-cpm-checkin service with the values obtained there.

Configure SAP_COM_0467 in SAP (Private Cloud)

For on-premise and private cloud systems:

  1. Activate the OData service API_CLOUD_PRINT_PULL_SRV on the SAP system, following SAP Basis Configuration - Server - System Description as of version 1.5.1, chapter OData Service Activation.

  2. Create or use a technical user with the rights described in SAP Note 3420465 - Print queues in on-premise systems.

  3. Ensure the seal-cpm-checkin service URL is reachable from within the SAP system landscape.

  4. Note the SAP system's host, port, and the technical user's name and password; they are used in Configure the cpm-checkin Service and below.

Configure SAP_COM_0467 in SAP (Public Cloud)

This section describes only the SAP-side setup, using the Communication Management apps of SAP S/4HANA Cloud Public Edition. It does not apply to on-premise or private cloud systems, see Requirements for their SAP-side setup. The system URL, user and password obtained here are used in Configure the cpm-checkin Service and below.

  • seal-cpm-checkin requires a certificate issued by an official certification authority, with the correct DNS names for the notification route. The certificate must be added to SAP's list of trusted certificates, see Maintain Trusted Certificates.

Prerequisites

  • The solution process 1LQ Output Management is installed in the SAP system.

  • A user with the business roles Communication Management (SAP_CORE_BC_COM) and Output Management (SAP_CORE_BC_OM or SAP_CORE_BC_OM_PRT) is available. Without these roles, the configuration steps below cannot be performed.

Check Communication Scenario SAP_COM_0467

  1. Sign in to the SAP S/4HANA system with the user described above.

  2. Go to the Communication Management section and start the app Display Communication Scenarios.

  3. Find the communication scenario described above in the list. If the entry does not exist, the system is not set up correctly; contact SAP.

Create a Communication User

  1. Go to the Communication Management section and start the app Maintain Communication Users.

  2. Create a new user for this scenario: enter user name, description and a password, or use Propose Password. Do not use the certificate section; only basic authentication is currently implemented.

  3. Press Create to save the new user.

Create a Communication System

  1. Go to the Communication Management section and start the app Communication Systems.

  2. Create a new communication system, using a System ID that was not used before. The System Name is filled automatically; keep it unchanged to avoid confusion.

  3. In the General section, enter the host name or IP address and port of the notification route that SAP sends notifications to.

  4. In the Users for Inbound Communication section, add the communication user created above.

  5. In the Users for Outbound Communication section, add a user accepted by PLOSSYS Output Engine.

  6. Save the communication system.

Create a Communication Arrangement

  1. Go to the Communication Management section and start the app Communication Arrangements.

  2. Create a new communication arrangement for the communication scenario described above, referencing the communication system created above. The user name is filled automatically with the communication user created earlier.

  3. Save the arrangement.

Create a Print Queue

  1. Go to the Output Management section and start the app Maintain Print Queues.

  2. Create a new print queue of type OMS for Notification Integration Queue — the default queue type is for SAP's own Cloud Print Manager and does not appear in the OMS.

  3. Enter a name and description for the queue, choose a format, and select the communication user and arrangement created above.

  4. Choose the notification type: a single notification, or one notification per given number of items, sent out either once that number is reached or after 3 minutes as a fallback.

  5. Note the system URL shown at the bottom of the print queue list; it is needed in Configure the cpm-checkin Service and below.

A communication user can have any number of print queues. When changing the user or the notification destination of a communication arrangement, the print queue names using that user can be updated automatically via the arrangement's additional properties.

Configure SAP_COM_0467 in SAP (BTP)

This section assumes the pull integration for SAP BTP is already configured. SAP BTP does not use communication scenarios; push notifications are configured per service instance using a BTP destination instead.

  1. In the SAP BTP cockpit, go to the Connectivity section, open Destinations and create a new destination:

    • Type: HTTP
    • URL: the notification route of the seal-cpm-checkin service, see below
    • Proxy Type: Internet
    • Authentication: matching the AUTH_TYPE configured for seal-cpm-checkin, e.g. BasicAuthentication with the user and password expected by HTPASSWD

    If the notification route's certificate is not signed by a public certification authority, add it to the destination's own trust store instead of using the default trust store.

    Hint - Check Connection may report a false error

    In the Cloud Foundry environment, a destination's Check Connection button only performs a plain HTTP HEAD request; it does not send the configured authentication header and does not build up the trust store. An SSLHandshake or 401 error reported there does not necessarily mean the destination is misconfigured (see SAP KBA 3245877). Verify the connection by sending an actual print job instead.

  2. Update the service instance created for pull integration - or create a new one - with the following configuration parameters (JSON), replacing <destination> with the name of the destination created above:

    {
  "notifications": [
    { "destinationName": "<destination>", "usage": "OMS" }
  ]
}

  3. In the Maintain Print Queues app, assign the updated service instance to the print queue as Print User and choose a notification type, e.g. Single Notification.

Failed notifications are retried by SAP up to three times; after that, an error is logged to the subaccount's Audit Log Service instead of being redelivered.

Notification Route

The general URL of the notification route is:

https://<oms_host>:<oms_port>/v1/jobs/notification

<oms_host> and <oms_port> are host and port of the seal-cpm-checkin service, see seal-cpm-checkin in the port list for the default port.

Example - notification route URL

https://out-ngn-server.example.com:2148/v1/jobs/notification

For the notification route to work correctly and secure, the following service keys need to be configured:

  • TLS_EXTERNAL_DIR: Directory with TLS certificates and keys used for TLS encryption and authentication

  • USE_HTTP: Optional, if set to true, the seal-cpm-checkin service will only use HTTP for communication with the SAP system. This is useful for cloud environments that handle traffic via load balancers and nginx controllers. Default is false.

Logging

If LOG_SAP_API_CALLS is set to true, incoming notification requests sent by SAP to the notification route are logged in addition to the outgoing API calls made to SAP.

Authentication

Since SAP calls the notification route to deliver print job notifications, it must be secured against unauthorized access. The authentication type is configured with the following key:

  • AUTH_TYPE: The authentication type to use for the notification route, possible values are none, basic, cert and oidc, default is none. Depending on the authentication type, different environment keys are required.

Caution - AUTH_TYPE none and basic

The AUTH_TYPE none is dangerous, because it allows any user to access the notification route without authentication. Do not expose the seal-cpm-checkin service to the internet if you use this authentication type.

basic authentication is risky because credentials are sent with every request. Use it only over HTTPS/TLS and only if no better option exists. Prefer modern auth (oidc or cert) for production.

Certificate Authentication

Requirements:

  • AUTH_TYPE is set to cert
  • For AUTH_TYPE cert to work the TLS_EXTERNAL_DIR directory may need to contain the certification authority certificate ca.pem.

Certificate authentication is handled at the TLS layer (mutual TLS). No further environment keys are required.

OIDC Authentication

Requirements:

When using OIDC authentication, the following environment keys are relevant:

  • AUTH_ISSUER_URL: URL of the OIDC identity provider. Used to fetch the provider's public signing key via the OpenID Connect discovery document. Mandatory unless ID_PROVIDER_CERT is set.

  • ID_PROVIDER_CERT: Path to a static certificate file used to verify the token signature instead of fetching it via AUTH_ISSUER_URL. Optional, alternative to AUTH_ISSUER_URL.

  • AUTH_PROXY: Optional URL of a proxy for accessing the OIDC identity provider, only relevant when AUTH_ISSUER_URL is used.

  • ID_PROVIDER_NAME: Expected issuer of the token. Mandatory.

  • TRUSTED_CLIENT: Expected client name of the token, checked against its azp or aud claim. Default is sap.

Basic Authentication

Requirements:

When using basic authentication, the following environment keys are available.

  • HTPASSWD_FILE: File with user/password combinations for basic authentication.

  • HTPASSWD: Single user/password combinations for basic authentication, has priority over HTPASSWD_FILE.

Test the Connection (Public Cloud)

This section applies to the public cloud SAP-side setup and assumes Configure the cpm-checkin Service and the Notification Route/Authentication configuration above are already done.

  1. Use the system URL, together with the user and password created earlier, to connect PLOSSYS Output Engine to the SAP S/4HANA system.

  2. From the Maintain Print Queues app, create a few test pages without an assigned printer for the print queue. They should appear with status new in both SAP and PLOSSYS Output Engine.

  3. Assign a physical printer to the print queue in PLOSSYS Output Engine.

  4. The queued documents should print, and their status in SAP should change to successful.

Back to top