This document provides recommendations for common architecture patterns when deploying SAP Fiori applications, the Fiori launchpad, and SAP Enterprise Portal. It discusses high-level overviews of extranet and intranet deployment scenarios, options for deploying the Fiori launchpad, and approaches for implementing risk-based authentication and single sign-on. The presentation also provides legal disclaimers around the information presented.

1. Aviad Rivlin, Product Manager & SAP Mentor
Thomas Csapo, Senior Technology and Solution Architect
Dimitar Mihaylov, Product Owner
Donka Dimitrova, Product Manager
SAP Enterprise Portal and SAP Fiori
Common Architecture Recommendations

2. © 2014 SAP AG. All rights reserved. 2
The information in this presentation is confidential and proprietary to SAP and may not be disclosed without the permission of SAP. This
presentation is not subject to your license agreement or any other service or subscription agreement with SAP. SAP has no obligation to pursue
any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This
document, or any related presentation and SAP's strategy and possible future developments, products and or platforms directions and
functionality are all subject to change and may be changed by SAP at any time for any reason without notice. The information in this document is
not a commitment, promise or legal obligation to deliver any material, code or functionality. This document is provided without a warranty of any
kind, either express or implied, including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-
infringement. This document is for informational purposes and may not be incorporated into a contract. SAP assumes no responsibility for errors
or omissions in this document, except if such damages were caused by SAP´s willful misconduct or gross negligence.
All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations.
Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not
be relied upon in making purchasing decisions.
Legal disclaimer

3. © 2014 SAP AG. All rights reserved. 3
Architecture - Fiori Apps, Launchpad and SAP Portal
High-level overview – Extranet Scenario [OPTION 1]
INTERNETOUTER
DMZ
INNER
DMZ
INTRANET
SAP Enterprise Portal
SAP Business Suite (ERP, SRM, …)
HANA / anyDB
SAP Non-SAP
Non-SAP
Non-SAP
HTTPS
HTTPS
HTTPS
HTTPS
SAP
SAP
HANA / anyDB
ODATA
LDAP
LDAP
HTTPS
HTTPS
ODATA
RFC
HTTPS
HTTPS
Single Sign-On
 SAML 2.0
 X.509
 3rd party ticket issuer
 Other…
Single Sign-On (desktop) only
 SPNego
Security:
 Fiori security guide
 NetWeaver security guide
Recommended
SAP NetWeaver Gateway
Fiori Front End Server
Reverse Proxy / Load Balancer
HTTP connection is also an option for all
connections below the Reverse Proxy

4. © 2014 SAP AG. All rights reserved. 4
Architecture - Fiori Apps, Launchpad and SAP Portal
High-level overview – Extranet Scenario [OPTION 2]
INTERNETOUTER
DMZ
INNER
DMZ
INTRANET
SAP Enterprise Portal
SAP Business Suite (ERP, SRM, …)
HANA / anyDB
SAP Non-SAP
Non-SAP
Non-SAP
HTTPS
HTTPS
HTTPS
HTTPS
SAP
SAP
HANA / anyDB
HTTPS
ODATA
ODATA
HTTPS
LDAP
LDAP
SAP NetWeaver Gateway
Fiori Front End Server
HTTPS
RFC
HTTPS
HTTPS
HTTPS
Single Sign-On
 SAML 2.0
 X.509
 3rd party ticket issuer
 Other…
Single Sign-On (desktop) only
 SPNego
Security:
 Fiori security guide
 NetWeaver security guide
Recommended
Reverse Proxy / Load Balancer
HTTP connection is also an option for all
connections below the Reverse Proxy

5. © 2014 SAP AG. All rights reserved. 5
Architecture - Fiori Apps, Launchpad and SAP Portal
High-level overview – Intranet Scenario
INTRANET
SAP Enterprise Portal
SAP Business Suite (ERP, SRM, …)
HANA / anyDB
SAP Non-SAP
Non-SAP
Non-SAP
HTTPS
HTTPS
HTTPS
SAP
SAP
HANA / anyDB
ODATA
ODATA
HTTPS
LDAP
SAP NetWeaver Gateway
Fiori Front End Server RFC
HTTPS
Single Sign-On
 SAML 2.0
 X.509
 3rd party ticket issuer
 Other…
Single Sign-On (desktop) only
 SPNego
Security:
 Fiori security guide
 NetWeaver security guide
Recommended
Reverse Proxy / Load Balancer
HTTP connection is also an option

6. Fiori launchpad deployment

7. © 2014 SAP AG. All rights reserved. 7
Architecture - Fiori Apps, Launchpad and SAP Portal
Fiori launchpad running on the ABAP Front End Server
INTERNETOUTER
DMZ
INNER
DMZ
INTRANET
SAP Enterprise Portal
SAP Business Suite (ERP, SRM, …)
HANA / anyDB
SAP Non-SAP
Non-SAP
Non-SAP
Reverse Proxy / Load Balancer
HTTPS
HTTPS
HTTPS
HTTPS
SAP
SAP
HANA / anyDB
ODATA
LDAP
LDAP
HTTPS
HTTPS
ODATA
RFC
HTTPS
HTTPS
Single Sign-On
 SAML 2.0
 X.509
 3rd party ticket issuer
 Other…
Single Sign-On (desktop) only
 SPNego
Security:
 Fiori security guide
 NetWeaver security guide
Recommended
SAP NetWeaver Gateway
Fiori Front End Server
HTTP connection is also an option for all
connections below the Reverse Proxy

8. © 2014 SAP AG. All rights reserved. 8
Architecture - Fiori Apps, Launchpad and SAP Portal
Fiori launchpad running on the SAP Enterprise Portal
INTERNETOUTER
DMZ
INNER
DMZ
INTRANET
SAP Enterprise Portal
SAP Business Suite (ERP, SRM, …)
HANA / anyDB
SAP Non-SAP
Non-SAP
Non-SAP
Reverse Proxy / Load Balancer
HTTPS
HTTPS
HTTPS
HTTPS
SAP
SAP
HANA / anyDB
ODATA
LDAP
LDAP
HTTPS
HTTPS
ODATA
RFC
HTTPS
HTTPS
Single Sign-On
 SAML 2.0
 X.509
 3rd party ticket issuer
 Other…
Single Sign-On (desktop) only
 SPNego
Security:
 Fiori security guide
 NetWeaver security guide
Recommended
SAP NetWeaver Gateway
Fiori Front End Server
HTTP connection is also an option for all
connections below the Reverse Proxy

9. © 2014 SAP AG. All rights reserved. 9
Architecture - Fiori Apps, Launchpad and SAP Portal
Fiori launchpad running on both SAP Portal and ABAP FES
INTERNETOUTER
DMZ
INNER
DMZ
INTRANET
SAP Enterprise Portal
SAP Business Suite (ERP, SRM, …)
HANA / anyDB
SAP Non-SAP
Non-SAP
Non-SAP
Reverse Proxy / Load Balancer
HTTPS
HTTPS
HTTPS
HTTPS
SAP
SAP
HANA / anyDB
ODATA
LDAP
LDAP
HTTPS
HTTPS
ODATA
RFC
HTTPS
HTTPS
Single Sign-On
 SAML 2.0
 X.509
 3rd party ticket issuer
 Other…
Single Sign-On (desktop) only
 SPNego
Security:
 Fiori security guide
 NetWeaver security guide
Recommended
SAP NetWeaver Gateway
Fiori Front End Server
HTTP connection is also an option for all
connections below the Reverse Proxy

10. Risk-based Authentication and
Single Sign-On

11. © 2014 SAP AG. All rights reserved. 11
Architecture - Fiori Apps, Launchpad and SAP Portal
Risk-based Authentication and Single Sign-On
INTERNETOUTER
DMZ
INNER
DMZ
INTRANET
SAP Enterprise Portal
SAP Business Suite (ERP, SRM, …)
HANA / anyDB
SAP Non-SAP
Non-SAP
Non-SAP
HTTPS
HTTPS
HTTPS
HTTPS
SAP
SAP
HANA / anyDB
ODATA
LDAP
LDAP
HTTPS
HTTPS
ODATA
RFC
HTTPS
HTTPS
SAP NetWeaver Gateway
Fiori Front End Server
Reverse Proxy / Load Balancer
SAP Single Sign-On
SAP Authenticator
SAP Authenticator
SAP Single Sign-On 2.0
Solution
 SSO based on SAML 2.0
 Two-factor authentication
based on One-Time
Passwords
 Mobile SSO via SAP
Authenticator application
 Risk-based authentication
and authorizations
*OTP – One-Time Password

12. Thank You
Aviad Rivlin | Product Manager and SAP Mentor | aviad.rivlin@sap.com
Thomas Csapo | Senior Technology and Solution Architect | thomas.csapo@sap.com
Dimitar Mihaylov | Product Owner | dimitar.mihaylov@sap.com
Donka Dimitrova | Product Manager | donka.dimitrova@sap.com

13. © 2015 SAP SE or an SAP affiliate company. All rights reserved.
© 2015 SAP SE or an SAP affiliate company. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company.
SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate
company) in Germany and other countries. Please see http://global12.sap.com/corporate-en/legal/copyright/index.epx for additional trademark information and notices.
Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors.
National product specifications may vary.
These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP SE or its
affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or SAP affiliate company products and
services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as
constituting an additional warranty.
In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop
or release any functionality mentioned therein. This document, or any related presentation, and SAP SE’s or its affiliated companies’ strategy and possible future
developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time
for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-
looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place
undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.