Connect SAP S/4HANA
Your SAP administrator sets up a user for Docentra, once. The user can read supplier invoices, suppliers and payments. Then you enter the address and the user in Docentra.
Who does it: Your SAP administrator, in about half an hour. Then you, in a minute.
Steps
Send this page to your SAP administrator
What they do is under “For your SAP administrator” below, for the cloud edition and for Private Cloud and on-premise.
Enter the details in Docentra
When you have the address, the user name and the password, open Settings › Accounting system in Docentra, choose Connect next to SAP S/4HANA, enter them and choose Connect. Add the company code if your SAP holds more than one company.
Docentra starts reading
From now on, Docentra reads the supplier invoices you book, and syncs automatically every six hours. Invoices booked before you connected are read only if you ask Docentra, for example to check the last year too.
For your SAP administrator
Docentra checks that the company pays its suppliers what was agreed. It reads posted supplier invoices, supplier names and VAT numbers, whether invoices are paid, and the documents attached to invoices. It sends only read requests: for one company code, for the last 24 months and about every six hours.
Cloud Public Edition: follow the first four steps. Private Cloud Edition and on-premise: follow the last three.
Cloud: create a communication user
Open Maintain Communication Users and choose New. Enter the user name DOCENTRA, then choose Propose Password and Create. Keep the password. It is at least 20 characters long. The user is locked after three failed sign-ins.
Cloud: create a communication system
Open Communication Systems, choose New and create a system named DOCENTRA. Under Technical Data, tick Inbound Only. Under Users for Inbound Communication, add the user DOCENTRA with User Name and Password.
Cloud: create three communication arrangements
Create a communication arrangement for each of the three scenarios: SAP_COM_0057 (supplier invoices and their documents, required), SAP_COM_0008 (supplier names and VAT numbers, required) and SAP_COM_0303 (what is paid and when; without it Docentra can't see payments). For each one, choose New in Communication Arrangements, pick the communication system DOCENTRA and the inbound user DOCENTRA, and save.
In the SAP_COM_0008 arrangement, set the outbound services to inactive, because Docentra receives nothing from SAP. SAP's scenarios are fixed bundles, so 0057 and 0008 also contain services that create and change. SAP has no read-only version. Docentra uses only the read operations.
Cloud: send the details
Send three things to the person connecting Docentra: the service URL shown under Inbound Services in the SAP_COM_0057 arrangement (it starts with https://my…-api.s4hana…), the user name and the company code. Send the password separately.
Private Cloud and on-premise: activate the services
Open Activate and Maintain Services (/IWFND/MAINT_SERVICE) and choose Add Service. Enter the system alias LOCAL and choose Get Services. Add API_SUPPLIERINVOICE_PROCESS_SRV and API_BUSINESS_PARTNER (required), API_OPLACCTGDOCITEMCUBE_SRV (what is paid) and API_CV_ATTACHMENT_SRV (the invoice documents).
Private Cloud and on-premise: create a technical user and its role
In the productive client, create a user of type System, for example DOCENTRA, with a password. In PFCG, give the user a role with start authorisation for the four services. Under Menu › Authorization Default, add “SAP Gateway Business Suite Enablement - Service” and “SAP Gateway: Service Groups Metadata” with each service group's name exactly as /IWFND/MAINT_SERVICE shows it (often with a Z in front).
Give display access only (activity 03), limited to your company code, for supplier invoices, accounting documents for account type K, supplier master data and attachments of supplier invoices. Give no create, change or post authorisations. Run an authorisation trace after the first attempt to connect, and check the role.
Private Cloud and on-premise: make the services reachable
Docentra needs to reach the four services from the internet over https, with a publicly trusted certificate. Allow only GET, and only the paths under /sap/opu/odata/sap/ for the four services. The address must accept user name and password and must not redirect to a single sign-on page.
Send the address (for example https://s4.nordlys.dk, with ?sap-client=100 if the user isn't in the default client), the user name and the company code to the person connecting Docentra. Send the password separately.
What the access allows
The user can only do what its role or the communication arrangements allow. In the cloud edition, SAP's arrangements also include services that create and change. Docentra never uses them.
Docentra only reads. It never creates, changes or deletes anything in your system.
Removing access
In Docentra: open Settings › Accounting system and choose Disconnect. The booked entries are removed from Docentra, but invoices Docentra has already read stay.
In SAP: lock the user created for Docentra (in the cloud edition, in Maintain Communication Users), or delete the communication arrangements.
If something goes wrong
- “SAP didn't accept the user name and password”
- Check them, and check that the user isn't locked in SAP. A cloud communication user is locked after three failed sign-ins.
- “The user can't read supplier invoices in SAP”
- Ask your SAP administrator to give the user access to the supplier invoice service (in the cloud edition: a communication arrangement for SAP_COM_0057). If that is in place, check the address.
- “The user can't read suppliers in SAP”
- Ask your SAP administrator to give the user access to the business partner service (in the cloud edition: a communication arrangement for SAP_COM_0008).
- “Docentra can't reach that address” or “The system didn't answer”
- The address has to be reachable from the internet, over https, with a valid certificate. Check the address and the port with whoever sent them. Also check that the server lets Docentra in.
- “Another accounting system is connected”
- Docentra reads only one accounting system per company. Disconnect the other system first, then connect this one.