How to Send SAP ERP Data to a Local Integration Server Without Opening Firewall Ports

The Integration Development Problem

SAP integration projects follow a pattern familiar to anyone who has worked in enterprise IT. The development team builds the middleware a Node.js service, a Python Flask application, a MuleSoft flow, or a custom ABAP-adjacent integration server. They need SAP to send test IDocs to that middleware so they can verify the parsing logic, test the mapping, and confirm the data reaches the downstream system correctly.

To receive an IDoc from SAP, the middleware needs a reachable HTTPS URL. In most corporate environments, the middleware runs on a developer laptop or a local server with no public address. The standard path to a public URL involves the network security team, a change management ticket, a firewall rule approved by a committee, and a DNS entry created by IT. On a complex enterprise network, this can take a week or more per environment.

A Localtonet HTTP tunnel bypasses this entirely for development and testing scenarios. Your local integration server gets a public HTTPS URL immediately. You configure that URL in SAP's SM59 transaction as the RFC destination target. SAP sends IDocs to your laptop as if it were a fully deployed integration server. When the integration is ready for production, you replace the tunnel URL with the real production endpoint.

How SAP Sends Data to External Systems

SAP ERP (ECC and S/4HANA on-premise) uses several mechanisms to send data to external systems. The two most relevant for middleware integration are outbound IDocs via ALE and HTTP calls via RFC destinations.

Build a Local Integration Server

Your integration server receives HTTP POST requests from SAP containing IDoc XML payloads or custom data from ABAP programs. It needs to accept the request, parse the payload, and route data to downstream systems. Below are minimal working examples in Node.js and Python that receive and log SAP IDoc payloads a starting point to build your actual integration logic on.

Node.js (Express)

npm init -y
npm install express body-parser xml2js

// server.js
const express = require('express');
const bodyParser = require('body-parser');
const xml2js = require('xml2js');

const app = express();

// SAP sends IDocs as application/xml or text/xml
app.use(bodyParser.text({ type: ['application/xml', 'text/xml', '*/xml'] }));
app.use(bodyParser.json());

// IDoc receiver endpoint
app.post('/idoc', async (req, res) => {
    console.log('Received IDoc from SAP');
    console.log('Headers:', req.headers);

    try {
        const parser = new xml2js.Parser({ explicitArray: false });
        const parsed = await parser.parseStringPromise(req.body);

        const idocData = parsed.IDOC || parsed;
        console.log('IDoc type:', idocData?.EDIDC40?.IDOCTP || 'unknown');
        console.log('Message type:', idocData?.EDIDC40?.MESTYP || 'unknown');
        console.log('Sender:', idocData?.EDIDC40?.SNDPRT + '/' + idocData?.EDIDC40?.SNDPOR);

        // Add your integration logic here:
        // - Transform and forward to ERP, CRM, WMS, or other systems
        // - Insert into a database
        // - Publish to a message queue
        // - Write to a file for further processing

        // SAP expects HTTP 200 to confirm successful receipt
        res.status(200).send('IDoc received successfully');
    } catch (err) {
        console.error('Error processing IDoc:', err.message);
        // Return 500 so SAP marks the IDoc for retry
        res.status(500).send('Processing error');
    }
});

// Generic HTTP endpoint for ABAP direct calls
app.post('/webhook', (req, res) => {
    console.log('Received webhook from SAP:', req.body);
    res.status(200).json({ status: 'received', timestamp: new Date().toISOString() });
});

app.listen(3000, () => {
    console.log('SAP integration server running on http://localhost:3000');
});

node server.js

Python (Flask)

pip install flask lxml

# app.py
from flask import Flask, request, jsonify
from lxml import etree
import logging

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

app = Flask(__name__)

@app.route('/idoc', methods=['POST'])
def receive_idoc():
    logger.info('Received IDoc from SAP')

    content_type = request.content_type or ''
    raw_body = request.get_data()

    try:
        if 'xml' in content_type:
            root = etree.fromstring(raw_body)
            idoc_type = root.findtext('.//IDOCTP') or 'unknown'
            message_type = root.findtext('.//MESTYP') or 'unknown'
            logger.info(f'IDoc type: {idoc_type}, Message type: {message_type}')

            # Add your integration logic here
            # Forward data, write to database, publish to queue, etc.

        # HTTP 200 confirms successful receipt to SAP
        return 'IDoc received successfully', 200

    except Exception as e:
        logger.error(f'Error processing IDoc: {e}')
        # HTTP 500 causes SAP to retry delivery
        return 'Processing error', 500

@app.route('/webhook', methods=['POST'])
def receive_webhook():
    data = request.get_json(force=True)
    logger.info(f'Webhook received: {data}')
    return jsonify(status='received'), 200

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=3000)

python app.py

Expose the Integration Server with Localtonet

With the integration server running on port 3000, create a Localtonet HTTP tunnel to give it a public HTTPS URL. This is the URL you will configure in SAP as the RFC destination target.

localtonet --authtoken <YOUR_TOKEN>

Go to the HTTP tunnel page, set local IP to 127.0.0.1 and port to 3000. Click Create and start the tunnel. The dashboard shows a public HTTPS URL such as https://abc123.localto.net.

Verify the endpoint is reachable before configuring SAP:

curl -X POST https://abc123.localto.net/idoc \
  -H "Content-Type: application/xml" \
  -d '<TEST><MESSAGE>ping</MESSAGE></TEST>'

If the server logs the request and responds with HTTP 200, the tunnel is working correctly. Proceed to configure SAP.

Step 1: Configure the RFC Destination in SM59

Transaction SM59 manages RFC connections from SAP to external systems. You need to create an HTTP connection of type G (HTTP connection to external server) that points at your Localtonet tunnel URL.

Step 2: Create the IDoc Port in WE21

Transaction WE21 defines the technical port through which SAP delivers IDocs to the external system. For HTTP delivery, use the XML HTTP port type, which wraps the IDoc in XML format and delivers it via the RFC destination you configured in SM59.

Step 3: Configure the Partner Profile in WE20

Transaction WE20 defines partner profiles the rules that determine which IDocs are sent to which port for a given partner system. You need an outbound parameter entry for each IDoc message type you want to deliver to your integration server.

Step 4: Test the End-to-End Flow

With SM59, WE21, and WE20 configured, you can trigger a test IDoc from SAP and verify it arrives at your integration server.

Send a test IDoc via WE19

If the IDoc reaches status 03, check your integration server logs. You should see the IDoc XML payload printed by your server. At this point, the full SAP-to-middleware pipeline is working and you can build out your integration logic.

Security Considerations

Frequently Asked Questions