Cloud Connector & Connectivity

You're installing a shadow Cloud Connector alongside a running master on the same host. What are the easy-to-miss differences from a normal install?

After you enable HA on the master, it warns 'No Shadow Host Restrictions.' What's the security implication, and how do you lock it down correctly?

You need a second person to administer the Cloud Connector. Why isn't just adding another account in the UI enough, and what does multi-user actually require?

Your destinations are modeled and visible in the space, but a cloud app fails to use them at runtime. What prerequisite is missing?

Your app calls a public internet REST API and also an on-premise ABAP system. Which needs the Connectivity service and which only needs the Destination service?

Before installing a newer Cloud Connector, why must you check the host's JVM version first?

What are the four destination types the SAP Destination service can define?

A backend's server name, IP, and credentials are about to change. Why doesn't this force a code change in every consuming app?

SAP BTP Connectivity is two services. Which one holds the technical details and which one actually moves the traffic?

A security team asks which inbound firewall ports to open for the Cloud Connector. What's the correct answer?

A new admin without an SAP Service Marketplace (S-user) account is blocked trying to get the Cloud Connector. Are they actually blocked?

When a backend requires mutual TLS, which Cloud Connector certificate is presented, and whose trust store must contain its issuer?

With principal propagation enabled, under whose identity does the on-premise backend execute — and what proves you've configured it rather than a technical user?

What connection types can the SAP Connectivity service use to reach on-premise systems?

You can't reach the Cloud Connector admin UI at the address you assumed. What port does it actually listen on by default, and how do you confirm or change it?

What is the minimum you must back up to fully restore a Cloud Connector, and why is the usual database-dump habit wrong here?

A freshly installed shadow Cloud Connector refuses to connect to the master even though the host and credentials are correct. What do you check first?

An admin forgot the Cloud Connector password and there's no other admin. How do you recover without reinstalling, and what's the easy-to-miss step?

From the BTP side, you need to confirm which Cloud Connectors serve a subaccount and what backends they expose — without logging into each connector. Where do you look?

Your Cloud Connector runs fine on macOS in a developer's local setup. Why is that not acceptable for production?

For a production Cloud Connector, why must you pick the installer over the portable version — name the two capabilities the portable one lacks that matter most?

You set a destination's Proxy Type to OnPremise but traffic still doesn't route through the Cloud Connector. What's the URL detail you missed, and at what scope is the destination defined?

What are the default Cloud Connector login credentials on first login, and what two choices does first login force?

Out of the box, which local backend TLS certificates does the Cloud Connector trust, and why is that a hardening concern?

How does the Cloud Connector expose on-premise systems to BTP without you opening the backend to inbound traffic?

With default Check Interval and Take-Over Delay, roughly how long can a master Cloud Connector be down before the shadow takes over — and what does each parameter control?

What does the Cloud Connector's On-Premises User Store let SAP BTP do, and why does that mean BTP isn't your master user database?

Throughput through one Cloud Connector is maxing out. Can you just add nodes to scale it horizontally, and if not, how is load actually distributed?

The shadow has taken over and the original master comes back online. Does the old master reclaim primary, and what role does it end up in?

Admins still get a browser trust warning after you import a UI certificate into the Cloud Connector. What's the likely CN mistake, and what is the UI certificate even for?

You're sizing the Cloud Connector for heavier load and want to give it more memory. Where do you set that, which three values, and what's the operational catch?

The shadow connects to the master, but HA still isn't production-ready. Which two shadow-side steps remain, and how does the shadow stay current with the master?

A network glitch makes the shadow think the master has died, but the master is actually still up. Why don't you end up with two masters fighting over the tunnel?

Beyond avoiding hardcoded endpoints, what does using one fixed destination name (say, ERP) across your dev and prod tenants buy you organizationally?

You've modeled destinations but apps can't use them, and you also need the proxy to reach on-premise. How do you create the two service instances, and which Connectivity plan do you pick?

Once the Cloud Connector is live, where can you monitor it — both from a central ALM tool and locally on the connector itself?

You've opened outbound port 443 for the Cloud Connector as usual. When would you still (a) narrow that outbound rule further, and (b) have to open inbound ports after all?

Before running the Cloud Connector installer on Windows Server, which runtime and system library must already be in place, and what do you have to pick during setup?

Your Cloud Connector's LDAP user store config broke and locked you out, and separately you need to move audit logs off the default directory. Which install-directory scripts handle these jobs?

Right after the first password change on a brand-new Cloud Connector, what screen do you land on, and where does all later configuration live?

You want a compliance banner on the Cloud Connector login screen, but only on the master instance. Where do you set it, and what controls where it shows?

You're wiring BTP's cloud user store to a corporate LDAP and want both failover and encryption. Which fields make that happen, and what do User Path and Group Path mean?

Your data center's region isn't in the Cloud Connector's region dropdown. Is that a hard blocker, and where do you resolve it?

When the Cloud Connector registers with a backend, how does it present its identity, and does choosing a CA-based approach vs a plain trust store change the setup steps?

You want single-identity propagation to backends using Kerberos. Which Kerberos mechanism does the Cloud Connector use, and why won't it work for your ABAP system?

Routing a plain RFC connection through the Cloud Connector needs no special setup, but securing it does. What extra config and prerequisite does SNC require, and what does SNC protect against?

On-premise throughput and reconnection behavior feel off and you want to tune the Cloud Connector itself, not the backend. Which Advanced-tab knobs control connection concurrency and resilience?

Requests carrying large SAML assertions or JWTs fail through the Cloud Connector while smaller calls work fine. Which tuning parameter is the usual culprit, and what related HTTP size limits sit beside it?

Your developers want to read destination details (endpoints, properties, certificates) programmatically instead of clicking through the cockpit. What API do they use and what can it do?

Rotating a subaccount's signer certificate for principal propagation normally risks an outage window. What has SAP announced to make that rotation uninterrupted, and where does it land first?

The Cloud Connector sits behind a corporate forward proxy. Where do you point it at that proxy, and what can't you validate afterward?

On the Reporting tab you're hunting for a 'Solution Management' entry to set up Cloud Connector monitoring, but the name looks different now. Why, and what must you install on the host?