Empowering Everywhere™

Kony for SAP Installation

Kony, Inc.
9225 Bee Cave Rd #300, Austin, TX 78733

Phone: 1.512.792.2900

[email protected]
www.kony.com

A
l
i
s
o
n
O
Download the software
Once you have logged onto the Kony community portal
community.kony.com , choose Downloads and scroll the
end of the page and choose Download Kony for SAP
components:

In the Platform download section, click on the software

tab and then choose the release you want to download.

From this page you can download SAP add-ins as well as

secure container / gateway installation packages. If you
are utilizing the Kony Studio the secure container will be
bundled with the application and a separate installation is
not required on the device.

Page 2 www.kony.com
General Knowledge
SAP add-ins are delivered as STMS transport objects and the Basis team will import
these into the SAP environment.
The Sky SAP add-in resides in the /SKY/ namespace and will not conflict with any
existing SAP objects.
The import will utilize a limited license during setup; a valid license should be obtained
as part of the installation process.
Application specific objects reside in the /SKYTECH/ namespace and will not conflict
with any existing SAP objects.
The standard SAP transaction codes exist in the /SKY/ namespace and can be
accessed by entering /n/SKY/<transaction code> into the command prompt. An
optional transport is available that contains the transaction codes without the
namespace qualifier, the check install of the MEAP add in will determine if there are
any conflicts preventing the install of this optional transport.

SAP Add-in Installation Steps

Obtain a valid Sky license

If you require more than a free license of Sky you will need to get a valid license from your
account representative. Licenses come in the form of a file, usually called "license.dat". They
are typically sent through email to the customer who then installs them into the SAP
environment using the Sky software management utility YECI (/n/sky/yeci). Licenses are
linked to the SAP installation number and valid for all instances within the installation
landscape, you can get your SAP installation number from menu path System  Status.
Page 3 www.kony.com
Page 4 www.kony.com
Download the SAP Add-in software
Navigate to the Kony for SAP page in the Kony Developer Portal, select the version of the Sky
SAP add-in that you want to install and click on the Software tab, from here choose the
download option to download the transport to your local device.

Unzip and copy the SAP transport files

The transport is in a zipped format and must be unzipped prior to importing into SAP.
Important! You must copy the transport files to the SAP trans libraries in binary mode
to avoid possible corruption. In UNIX, you may need to use the chmod utility on each
file so that the SAP TP utility can read the contents.

Check the prerequisites

Verify the following SAP attributes;
• SAP Kernel release is 640 or higher
• Ensure that there is at lease 20 MB free storage in the USR/SAP/TRANS directory
• Ensure that there is sufficient free space (200MB+) in the SAP customer (user)
database areas to physically create the /sky/ database tables. As a rule of thumb,
the index free space should be approximately 1/3 of this, for example, 70mb.

Shut down any connected SkyMobile Access Gateways (upgrade only).

If you are upgrading an existing SAP add-in, shut down any existing SkyMobile Access
gateways prior to importing the STMS transport.

Import the SAP Add-in transport

Your SAP basis team will import the transport using standard STMS transport utilities. Here is
an overview of the steps:

To import using the transport management system (STMS), perform the following steps using a
user id with sufficient authorization.
• Start transaction STMS.
• Select the target system <SID>.
• Select Extras -> Other Requests -> Add, and enter the transport request, for
example, SKPK######.
• Highlight the new request, and select Request -> Import
• Enter the target client <nnn>
• Select additional options (expert mode)
• Select all options.

Page 5 www.kony.com
Run the check install process in each SAP client that is relevant for mobility
After the Sky software is imported into the SAP system and before you can be use, you must
register it. Sky provides a generic utility to do this. To start the utility, use transaction /SKY/YECI
or just YECI if using short cut transactions. A screen showing the product registration details,
licensing attributes and SAP system information. If you are doing an upgrade, Sky
automatically detects the new release and prompts you to perform a check installation
process that you can run at any time.

Import the license

To import a license definition, use transaction /SKY/YECI or just YECI if using the shortcut
transactions, click Import License button on the application toolbar. A confirmation prompt
appears, after which you are prompted for the location of the license file that Sky provided
you with. Select the file and click the Save button. The license file is now installed.

You may also export your Sky license definition at any stage to a file on your desktop. You may
choose to do this as a backup or to migrate the license file to your other SAP systems in the
same installation. To perform an export, click Export license on the application tool bar.

Import the shortcuts transport (optional but recommended).

By default, you need to prefix the transactions used to start the SAP add-in functionality with
the namespace, for example, /n/sky/yvtw. This can be very tedious. Sky provides an optional
transport of shortcut transaction codes that are a lot easier to use, for example, YVTW. The
reason that we do this as a separate transport is that you need to implement as non-
namespace objects and as such there is a remote chance that they may clash with existing
customer transaction codes. They are prefixed with "Y" which should only be used for 3rd
party utilities by convention that is customized transactions should start with "Z".

To implement the shortcut transaction codes, you need an additional transport, which is
downloaded from the Kony Developer Portal. The procedure is the same as importing the Sky
namespace SAP add-in.

Important! Before you implement the SkyMobile shortcut transaction codes, first check for
any existing custom transactions that could be potentially overwritten. The check install
process highlights any potential conflicts. If in doubt, run the check install again and review the
short cut transaction code analysis.

Page 6 www.kony.com
SAP Add-in Post Installation Steps

Create authorization profile for Sky Administrative Users

Kony does not supply any security profiles or authorization objects with the installation as the
configurations and policies differ considerable from organization to organization. See the SAP
authorization slides for an example authorization role.

Create a service user

The SAP RFC client requires a service (interface) user to be set up in SAP and specified in its
configuration file. This enables SkyMobile to execute the SAP add-in functions. Note that a
service (interface) user cannot log directly onto SAP; the external interface programs may only
use using the RFC protocol. Sky does not provide any security profile or authorization objects
with the installation because these configurations and policies differ considerably from
customer to customer.

Verify the check install process

The check install procedure automatically creates ECS process and schedules to execute
standard Sky functions, such as daily housekeeping. These are all created under the
SPI_SERVICES, ECS_SERVICES and VTI_SERVICES groups. Normally, you never need to maintain
these internal definitions. But if you do, standard ECS workbench functionality may be used to
review and maintain the ECS process and schedules. The following is a list of the generated
processes and schedules, to review these processes use transaction /N/SKY/YECW and
transaction /N/SKY/YECT for the schedules.

Important: Ensure that the following schedules are active.

Page 7 www.kony.com
 Process Description
ECS_CHECK_HBEAT Check Secure Container heartbeats
ECS_ESCALATE_PROCESS ECS notification: Escalate Process
ECS_ESCALATE_SCHED ECS ECS notification: Escalate Schedule
ECS_HOUSEKEEPING ECS daily housekeeping routine (Workdays)
ECS_HOUSEKEEPING_SUN ECS: weekend housekeeping routine (Sunday)
ECS_IDOC_MONITOR ECS: IDOC monitor
ECS_PHASE_TIMEOUT Check Phase timeout
ECS_RFC_MONITOR ECS: SAP RFC destination monitor
ECS_SCHEDULE_CHECK ECS: check activated schedule definitions
ECS_SERVER ECS: Background server
ECS_SERVER_CHECK ECS: Check active background servers
ECS_START_SCHEDULE ECS: Start nested schedule definition
ECS_START_SERVER Start background server
SPI_HOUSEKEEPING SPI: Daily housekeeping routine
TSX_CHECK_HBEAT TSX: Check Java server connections
TSX_LOG_DATA TSX: Log unknown SAP connections
TSX_PING TSX: Ping remote Java server
VTI_EXAMPLE_DOBUPL SkyMobile: Example DOB upload process
VTI_EXAMPLE_UPLOAD SkyMobile: Example LDB upload process
VTI_HOUSEKEEPING SkyMobile: Periodic housekeeping routine
VTI_ISF_TRAN SkyMobile: Execute stored ISF transaction
VTI_USER_APPS SkyMobile: Maintain user applications

Schedule Frequency
ECS_HOUSEKEEPING EVERY WORK DAY AT 060000
ECS_HOUSEKEEPING_SUN EVERY SUN FROM 20120101 AT 060000
ECS_SCHEDULE_CHECK EVERY DAY, EVERY 01 HOURS
ECS_SERVER_CHECK EVERY DAY, EVERY 01 HOURS
ECS_START_SERVER WHEN /SKY/START_PROCESS_#CLIENT IS TRIGGERED
SPI_HOUSEKEEPING EVERY DAY AT 040000
VTI_HOUSEKEEPING EVERY DAY AT 050000

*Note: Schedule ECS_SERVER_CHECK is used to startup ECS servers if necessary, in a system

where there is minimal activity you should increase this check from every hour to every 2-3
minutes if developers are working and submitting transactions periodically.

Page 8 www.kony.com
Authorization Summary
For communications between the Kony Access gateway and the SAP RFC gateway a service
user must be created in SAP and specified in the Kony access gateway configuration.
This service user will require authorizations not only to communicate via RFC but to access
all of the necessary transactions contained in the Kony for SAP add-in for SAP.
Kony does not supply any security profiles or authorization objects with the installation as the
configurations and policies differ considerable from organization to organization.
If this service user is also utilized as the control user for the Event Control System, the user
will require all roles to perform any transactions required by the mobile interfaces.

Authorization Objects Required

Authorization Object Description Attribute Value
S_RFC Authorization check for RFC Access ACTVT 16
RFC_NAME /SKY/Y*
SYST
RFC_TYPE FUGR
S_TCODE Transaction Code Check at TCD SESSION_MANAGER
Transaction Start /SKY/*
S_BTCH_NAM Background Processing: BTCUNAME *
Background User Name
S_BTCH_JOB Background Processing: JOBACTION DELE
Operations on Background Jobs LIST
PLAN
PROT
RELE
SHOW
JOBGROUP *
S_DATASET Authorization for file access ACTVT 06: Delete
33: Read
34: Write
A6: Read with filter
A7: Write with filter
FILENAME *
PROGRAM *
S_GUI Authorization for GUI Activities ACTVT 02: Change
04: Print, Edit Messages
60: Import
61: Export
S_LOG_COM Authorization to execute logical COMMAND *
operating system commands
HOST *
OPSYSTEM *

Page 9 www.kony.com
S_RFC

Authorization check when using RFC to access program modules (such as function groups)

Defined Fields
This authorization object contains the following three fields:
RFC_TYPE: Type of the RFC object to be protected, Currently, this field can
take the value FUGR (function group) .
RFC_NAME: Name of the RFC object to be protected, this field contains the names of
the function groups.
ACTVT: Activity 16 (Execute) is the only activity supported.

S_TCODE

This authorization object contains the name of the SAP transaction code and users must have
authority to the transactional code before they can access the transaction in SAP. The session
manager transaction is not needed for current releases of SAP but is listed here for legacy
reasons.

S_BTCH_NAME

Is needed if user needs to have ability to run a job under some other user id than his own. For
example, the background servers in SAP run under a service user and need the ability to
submit other jobs as the mobile device user..

S_BTCH_JOB

You use this object to assign users authorizations for all operations except scheduling. For
example, you could assign users authorization to delete their own jobs. This object is used to
check all critical administration operations for background processing (Tools -> Administration
-> Jobs -> Job overview.

JOBACTION Operations the user is allowed to perform.


DELE Delete background jobs
LIST Display spool requests created by jobs
PLAN Copy or repeat jobs
PROT Display job processing logs
RELE Release jobs (automatic release after scheduling possible)
SHOW Display job queue

JOBGROUP Names of permitted job groups. Reserved: Set to *.

Page 10 www.kony.com
S_DATASET

When you access sequential files on the application server using the following statements the
system automatically checks the user’s authorization against the authorization object
S_DATASET.
OPEN DATASET
READ DATASET
TRANSFER
DELETE DATASET

The object S_DATASET consists of the following fields:

Program Name of the ABAP program from which access is allowed. This allows you to
restrict file access to a few programs specifically for that task.
Activity Possible values are:
Read file normally
Write to or delete file normally
Read file with filter (operating system command)
Write to file with filter (operating system command)
File Name Name of the operating system file. This allows you to restrict the files to which
the user has access.

S_GUI

Authorization object S_GUI is checked for activities with reference to GUI objects (lists,
screens, controls, ...) With this object, you can, for example, assign authorization to save lists
in local files (download lists).

The authorization object checks the following fields:

ACTVT Activity

61 Download; This authorizes you to save lists displayed on the screen in local
files (either unconverted, in spreadsheet format, or in Rich Text
Format). This authorization can only be granted or denied for all
lists in the system - you cannot restrict it to a selection of lists.
60 Upload This authorizes you to load data into the system using ws_upload
or gui_upload. You cannot select the data to be uploaded.
04 Print (not yet implemented)
02 Buffer Buffer; authorization to copy screen data to the buffer (Ctrl+C).

Page 11 www.kony.com
S_LOG_COM

Authorization object S_LOG_COM allows you to execute external operating system

commands. This authorization is used by users who want to create job steps with External
commands in background processing.
 With this authorization, the system checks whether or
not the user can execute the external command in a background job.

COMMAND Name of the external command in R/3. You can display the external commands
defined using Transaction SM59.
OPSYSTEM Operating System of Application Server. Type of operating system on the target
host (see system field SY-OPSYS: values ANYOS, AIX, UNIX, WINDOWS NT)
HOST Name of Current Application Server, Host name of the target host (see SY-
HOST)

Page 12 www.kony.com
SkyMobile Access Gateway Installation

The Access Gateway option is required for all Secure Containers running on remote devices. It is
essentially an implementation of a Secure Container on either a UNIX or Windows server, but with
just a gateway port configured.

Make sure that the operating system is appropriate to support multiple TCP/IP port connections, for
example, Windows 2008 server edition. Some operating system versions are designed only to support
a limited number of connections, for example, Windows 7 professional. The Access Gateway is usually
implemented behind the firewall in the DMZ with one external port exposed and a host connection
pool to a back end system.

It essentially acts as a single point of entry into the WAN/LAN. All communication between the Access
Gateway and remote Secure Containers on the device is through TCP/IP sockets or HTTP(s) and you
should configure to compress and encrypt. Multiple gateways are supported with automatic fail over
capability. For more information on this, refer to the gateway switchover section in the management
guide. Usually the Access Gateway does not require a lot of hardware resources, but if the application
is transferring large quantities of data object and/or binary data, Sky recommends that you properly
size the target server(s) to enable optimum performance and allow for growth.

Each Access Gateway manages a shared RFC connection pool with configuration for the minimum and
maximum number of connections to manage. A SAP user id and password is also provided to establish
the RFC connections. This SAP user is set up as a service type user and must have SAP access to the
/SKY/YVTI function group as a minimum.

Host interfaces
You need to configure at lease one host interface definition to configure to define how the gateway
implements and manages connections with the back end host system. In the case of SAP, this is a
standard RFC connection pool.

Page 13 www.kony.com
 You can use this table as a guideline for minimum
memory requirements for a SkyMobile Access Gateway.
The gateway is multi-threaded and is usually only
constrained by available memory if large sets of data
(database and binary) are being de-compressed. You can
control the amount of data handled for a device at any
one time using the "transfer buffer" configuration. Large
binaries associated with data objects should use the
"load asynchronously" data object option. Once
implemented, you can use the gateway statistics page to
highlight bottlenecks for both Container connections and
SAP host processing.

The amount of disk space is constant at 100mb and assumes a minimum processor speed of
1.66GHz+. Most organizations have a standard SOE for servers and in general, the Sky
recommendation is a “low end server” typically with dual 1.66GHz processors, 2-4 GB of memory and
80GB of disk. This does seem like overkill given the table above, but it does give scope for growth and
the ability to run multiple gateways and/or a central SkyMobile server (if required).

This is the web status page from a default SkyMobile

Access gateway installation. The key points from this
slide are:

• The SAP RFC Client attaches to the standard SAP RFC

port for the SAP system you are connecting to. If you are
connecting directly to the instance it will utilize port
32<SAP System ID> and if you are connecting via an SAP
Message server it will connect to port 33<SAP System
ID>.

• The other ports created include, the port numbers for these are the default-selected ports and
may be modified in the configuration for the access gateway.

• Command Port
• HTTP Control Port (Web status page (above) is accessed via this port)
• XML Gateway Port(Devices communicate via this port)
• Relay Port

• Your network team should ensure that you can connect with the SAP RFC port from the gateway
and that the XML Gateway Port is accessible from the mobile devices.

Page 14 www.kony.com
 The SkyMobile Access Gateway requires a java virtual
machine exist on the server prior to the installation of
the gateway. Ensure that you download the correct
virtual machine for your server, (i.e. 32-bit versus 64-bit).

Windows Installer
Once you launch the installer, you will need to select the
install of an access gateway and provide the SAP
connection attributes including SAP user and password.

The access gateway is now installed and should be

started on your server. Verify that the local service is
active on your host machine.

Advanced settings for the gateway are discussed in more

detail in the basic provisioning class or in the online
documentation.

Page 15 www.kony.com
Unix (Linux) Installation Prerequisites
Installation User

We recommend setting up a separate user that "owns"

the Sky mobile access gateway software. Important! It
is generally not appropriate to install or run the software
as the root user, because this has undesirable security
implications.

Installation Directory
You can install the Sky Application Gateway Servers anywhere on the UNIX host, but typically they are
installed in a directory called sky or skytech under /opt, /usr/local, or /var. Select an appropriate
location based on the configuration of, and conventions adopted on, your Unix host.
Once the target directory is created, you should change its permissions to give the UNIX logon that
"owns" the software full control of the directory (read, write, and execute).

Throughout the remainder of this documentation, this directory will be referred to as <<SKY HOME>>.

C Compiler
You require a full ANSI C compiler to allow the Sky Application Server libraries to compiled on the
target system. The table below details the recommended compiler for some common Unix Platforms.

Environment Recommended C Compiler

AIX AIX C Compiler or GCC
HP/UX HP ANSI C Compiler or GCC.
Please note that a "bundled" C compiler is installed by default with HP/UX. This is a cut
down C compiler that is primarily intended for use in kernel rebuilds, so it is NOT
suitable for installation of the software. The HP ANSI C Compiler is a separate product.

Linux GCC
Solaris/SunOS GCC

Note: Once the Sky runtime libraries are compiled using the C compiler, you can generally copy them
over to other machines with a similar configuration. Typically, therefore, you can install a C compiler
on a development or test host machine and use to build libraries that you then copy over to the
production host. This removes the need for any further compilation of code in the production
environment.

Page 16 www.kony.com
Java Development Kit
You require a full Java Development Kit (JDK) for compilation of the Sky Application Gateway Server
libraries. A Java Runtime Environment (JRE) is not sufficient for this purpose, although it is possible to
compile the Sky runtime libraries using a JDK and then use them under a JRE in a production
environment.

SAP RFC Libraries

You require a copy of the SAP RFC libraries in order to build the Sky runtime libraries. You are
recommended to the use v6.40, although earlier and later versions of the SAP RFC libraries are used
successfully in the past.

You need to source the appropriate version of the libraries for the target environment based on the
following factors:
• The flavour of Unix in use (Linux, Solaris, HP/UX, and AIX)
• The hardware chipset (SPARC, x86, PA-RISC, and Itanium)
• The operating system release (32 bit vs. 64 bit)

SAP offers both a Unicode and a non-Unicode version of the SAP RFC libraries for each target
environment. Currently only the non-Unicode version is supported under UNIX. This has no bearing
on whether or not the target SAP system has a Unicode kernel, as it is still possible to communicate in
non-Unicode mode with a SAP system running a Unicode kernel.

Unix (Linux) Installation Steps

• Confirm installation of the C compiler and the Java Development Kit.
• Unpack the SAP RFC SDK.
• Unpack the Sky software.
• Configure the Makefile.
• Compile the Sky JNI libraries.
• Configure the Sky Application Servers.
• Test the Sky Application Servers.
• Configure server launch and monitoring.
• Tailor environment variables.

Use this link to the Kony Developer Portal for detailed instructions on installing the SkyMobile Access
gateway on a Unix host.

Kony Developer Portal (Unix Install Instructions)

Page 17 www.kony.com
SAP Business Connector

Page 18 www.kony.com
 Namespace Repair
• Run transaction SE01
• Goto  Transport Organizer Tools
• Administration  Display/Change Namespaces

Field Value
Namespace /SKYTECH/
Namespace role C
Repair License 27422850591400827449
Short Text Sky Technologies Pty Ltd – Template Applications

 Navigate back to Transport Organizer Tools

 Administration  Set System Change Option
 Locate the /SKYTECH/ namespace and ensure the namespace is set to
modifiable

Page 19 www.kony.com