Knowledge base / Data and connections
ClearDuty Connector
The Connector is a small program your Basis team runs inside your network. It reads the SAP tables ClearDuty needs and serves them to the browser, so an administrator can pull a fresh extract with one click instead of exporting from SE16N.
Pilot. Connector 1.0 has been tested against its demo mode and the ClearDuty app. Run the first SAP connection in a development or quality system, compare the row counts with SE16N, then move to production.
What it reads
| Dataset | Table | Fields |
|---|---|---|
| Role authorizations | AGR_1251 | AGR_NAME, OBJECT, AUTH, FIELD, LOW, HIGH (DELETED blank) |
| Org-level values | AGR_1252 | AGR_NAME, VARBL, LOW, HIGH |
| User assignments | AGR_USERS | AGR_NAME, UNAME, FROM_DAT, TO_DAT |
| Composite roles | AGR_AGRS | AGR_NAME, CHILD_AGR |
| User master | USR02 | BNAME, USTYP, UFLAG, GLTGV, GLTGB |
| Profiles | UST04 | BNAME, PROFILE |
| Transaction texts | TSTCT | TCODE, TTEXT (language E) |
ST03N usage cannot be read this way; upload it on the Data tab. Rulesets, controls and GRC exports are uploaded on the Data tab as well.
Set-up
- Install Python 3.9 or later on a computer or server inside the network.
- Download the SAP NetWeaver RFC SDK 7.50 from the SAP Support Portal (S-user required) and install
pyrfc. - Ask Basis for a service user (type System) with
S_RFCfor function group SDTX (RFC_READ_TABLE) andS_TABU_DIS/S_TABU_NAMdisplay access to the seven tables. Nothing else. - Copy
connector.example.initoconnector.iniand fill in the SAP connection. - Start it:
python clearduty-connector.py --config connector.ini. It prints its address and a token. - In ClearDuty: System Connections → Add system. Enter system ID, client, address and token, click Test, then Load extracts now.
To try the path without SAP: python clearduty-connector.py --demo.
Security
- Every request must carry the token (
Authorization: Bearer …). Keep the INI file readable only by the service account. - By default it listens on 127.0.0.1 only, so only a browser on the same computer can reach it. For analysts on other computers, run it on a server behind HTTPS (nginx or IIS) with
--bind 0.0.0.0 --origin https://clearduty.eu. - It only reads. The browser never talks to SAP directly, and SAP data never leaves your network.
- Every pull is recorded in the change log with row counts and file fingerprints, exactly like an upload.
Still stuck? Ask us — we answer within one working day.