Docs / Connectors / Google Cloud Pub/Sub

Google Cloud Pub/Sub Connector

The ASAPIO Integration Add-on connects SAP S/4HANA and SAP ECC directly to Google Cloud Pub/Sub, publishing business events in real time using JWT-authenticated REST calls. The connector uses a Google Cloud service account key (P12) stored in the SAP SSF application layer for secure, non-interactive authentication.

Overview

Prerequisites

A Google Cloud project with Pub/Sub enabled and a service account with at least the Pub/Sub Publisher role (or a custom role granting pubsub.topics.publish). The SAP application server must have HTTPS connectivity to pubsub.googleapis.com and oauth2.googleapis.com.

Google Cloud Authorization Setup

The connector authenticates using a Google Cloud service account JWT. The service account requires the IAP-secured Web App User role.

Create Service Account and P12 Key

1. In Google Cloud Console, navigate to IAM & Admin → Service Accounts.
2. Create a new service account and assign the required roles.
3. Go to the service account's Keys tab, click Actions → Manage keys, then Add Key → Create new key.
4. Select P12 format and download the key file. Note the key password (default: notasecret).

SSL Certificate (STRUST)

Google services use certificates issued by GlobalSign. Download the GlobalSign root CA certificate from support.globalsign.com and import it into the SAP SSL trust store.

In transaction STRUST:

1. Select SSL Client (Anonymous).
2. Click Import Certificate and select the downloaded GlobalSign certificate.
3. Click Add to Certificate List and save.

SSF Application Setup

The P12 service account key must be registered as an SSF application in SAP so the connector can use it for JWT signing.

Modern SAP Systems (transaction SSFA)

1. Open transaction SSFA (or SE16 table SSFAPPLIC to locate the correct application entry).
2. Select the SSF application entry for the Google connector.
3. Choose PSE → Import and import the .p12 key file using the P12 key password.
4. Choose PSE → Save as SSF Application to register it.

Older SAP Systems

On older SAP systems where SSFA is not available, import using sapgenpse:

sapgenpse import_p12 -p <drive>:usr<SSF_Profile> <key>.p12

SAP Connection Setup (in SAP Gui)

The connection setup in SAP GUI is a required first step for all configuration paths. This creates the RFC destinations, activates the cloud adapter, and registers the connection instance that both Event Studio and SAP GUI-based event configuration rely on.

Step 1 — Create RFC Destinations (SM59)

Create two HTTP type G RFC destinations:

• OAuth token endpoint: host oauth2.googleapis.com. Note: HTTP 404 on connection test is expected and not an error.
• Pub/Sub endpoint: host pubsub.googleapis.com. Note: HTTP 404 on connection test is expected. An SSL error indicates a misconfiguration in STRUST.

Enable SSL on both RFC destinations using the certificate list where the GlobalSign cert was imported.

Step 2 — Configure Cloud Adapter (SPRO)

In SPRO → ASAPIO Cloud Integrator → Maintain Cloud Adapter, set:

• Cloud Type: GOOGLE_PS
• ACI Handler Class: /ASADEV/CL_ACI_GPUBSUB_HANDLER

Step 3 — Create Connection Instance

In transaction /ASADEV/ACI_SETTINGS, create a connection instance and set the following mandatory default values:

Create an outbound interface (Event Studio)

Prerequisite: The connection instance must already be set up in SAP GUI (see SAP Connection Setup above) before Event Studio can be used to configure events.

Event Studio is the recommended web-based interface for creating and managing events. To configure a Google Pub/Sub event:

1. Open Event Studio and select the backend SAP system.
2. Go to the Data Catalog to find the data object to stream.
3. In the Available Standard Events table, click Deploy, or use Create to define a new event.
4. Select the Google Pub/Sub connection from the Connection dropdown — the Header Fields table auto-populates with the connection's default attributes including GCP_EMAIL_SERVICEACCT_JWT_ISS, GCP_TOKEN_DESTINATION, and GCP_SSF_PROFILE.
5. Set GOOGLE_TOPIC to the full Pub/Sub topic path.
6. Save and activate the event.

After creating the interface in Event Studio, see Header Attributes for message configuration and Custom Message Attributes for advanced metadata.

Header Attributes

Configure the following header attribute on the outbound object. Header attributes apply equally when configuring via Event Studio or SAP GUI.

Create an outbound interface (SAP Gui)

Create Outbound Object

In transaction /ASADEV/68000202, select the connection instance and add an entry under Outbound Objects. Set the method, message type, and Formatting FM as shown above. Set GOOGLE_TOPIC under the Header Attributes tab.

Event Linkage (SWE2)

Register the event trigger in transaction SWE2:

• Receiver Function Module: /ASADEV/ACI_EVENTS_TRIGGER
• Tick Type linkage Activated

Packed Load — Header Attributes

Custom Message Attributes

Available from release 9.32507. Google Pub/Sub supports up to 100 custom message attributes per message. These key-value pairs are visible on every message and can be used by Pub/Sub subscription filters.

Configuration (Field Mapping Section)

In the Field Mapping section of the outbound object, add entries with:

• Source structure / field: the SAP field providing the value
• Target field: the Pub/Sub attribute name
• Default value: optional static fallback

A conversion class/method can be specified to transform raw field values. The resulting attribute values are visible in the ASAPIO monitor when tracing is activated.