Description

Logali SAP RFC Guard

Security-first n8n community node for governed SAP RFC/BAPI reads and isolated
Communication-user provisioning.

> Early access (0.4.x): the n8n governance contract and synthetic examples
> are testable now. Real SAP execution additionally requires the operated JCo
> sidecar, SAP’s proprietary JCo runtime and a least-privilege SAP identity.

The node does not load native RFC libraries into n8n. It calls an operated HTTPS sidecar that
owns SAP JCo or SAP NetWeaver RFC SDK, the SAP technical identity, connection pooling, RFC type
conversion, and SAP-side authorization.

n8n workflow -> Logali SAP RFC Guard -> HTTPS sidecar -> RFC/SNC -> SAP R/3, ECC, or S/4HANA

Security model

• Read operations remain on a dedicated sidecar that must attest readOnly: true.
• User creation requires a different sidecar, token and credential that attest writeEnabled: true.
• Deny by default. Credentials contain an exact business-operation allowlist.
• Technical names such as BAPI, RFC, Z, and Y are rejected in workflows.
• Every operation has a required response-field allowlist.
• Request bytes, response bytes, rows, and timeouts are bounded.
• AI Tool use requires a separate credential opt-in and keeps the same operation and field policies.
• SAP usernames and passwords never enter n8n credentials or workflow JSON.
• HTTPS is mandatory except for an explicitly enabled isolated local contract test.
• The only write alias creates one prefix-restricted Communication user with short validity, no roles and no profiles.
• The initial password remains in the provisioning sidecar secret and is never sent to or returned by n8n.

Sidecar contract

Health:

GET /v1/health
Authorization: Bearer 
X-RFC-Guard-Mode: read-only

{
  "status": "ok",
  "service": "sap-rfc-guard-jco",
  "version": "0.4.4",
  "backend": { "systemId": "S4D", "client": "100" },
  "capabilities": { "readOnly": true, "operations": ["listSu01Users"] }
}

Execute an approved business alias:

POST /v1/operations/listSu01Users/execute
Authorization: Bearer 
X-Correlation-ID: 
X-RFC-Guard-Mode: read-only

{
  "operation": "listSu01Users",
  "parameters": { "client": "100", "inactiveDays": 90 },
  "context": { "client": "n8n-sap-rfc-guard", "readOnly": true }
}

Expected response:

{
  "operation": "listSu01Users",
  "correlationId": "trace-id",
  "data": [
    {
      "username": "TRAINING_USER",
      "userType": "Dialog",
      "lastLogonAt": "2026-08-20",
      "accountStatus": "Active"
    }
  ],
  "meta": {
    "readOnly": true,
    "source": "sap-jco",
    "syntheticData": false,
    "operation": "listSu01Users"
  }
}

The source name is evidence returned by the sidecar, never an operation accepted from the
workflow.

The private standalone sidecar uses Authorization: Bearer. For the SAP BTP
Tomcat deployment, select X-RFC-Guard-Token (SAP BTP) in the n8n credential;
XSUAA reserves the standard bearer header before the request reaches the
application, while the custom header remains protected by the same HTTPS route
and secret comparison.

Install the stable node

npm install n8n-nodes-sap-rfc-guard

Self-hosted n8n must still be configured to load community packages. Installing
the npm package does not install SAP JCo, create SAP credentials or start the
real sidecar.

The validation and publication evidence for the current security hardening is
recorded in docs/RELEASE-VERIFICATION-2026-08-24.md.

Credential configuration

For an SU01 reporting credential:

Allowed Operations:
listSu01Users, getSu01UserDetail

{
  "listSu01Users": [
    "username",
    "userType",
    "validFrom",
    "validTo",
    "lastLogonAt",
    "lockStatus",
    "accountStatus"
  ],
  "getSu01UserDetail": [
    "username",
    "userType",
    "fullName",
    "email",
    "validFrom",
    "validTo",
    "lastLogonAt",
    "lockStatus",
    "accountStatus"
  ]
}

Operations

• Connection / Test Connection checks authentication and the capability expected by the selected credential mode.
• Company Code / Get Many maps to BAPICOMPANYCODEGETLIST.
• Company Code / Get Details maps to BAPICOMPANYCODEGETDETAIL.
• Material / Search maps to bounded BAPIMATERIALGETLIST.
• Material / Get Details maps to BAPIMATERIALGET_DETAIL.
• Material / Check Availability maps to BAPIMATERIALAVAILABILITY and returns ATP confirmation dates and quantities.
• Purchase Order / Get Details maps to BAPIPOGETDETAIL1, including schedules, confirmations and receipt/invoice totals.
• Sales Order / Get Status maps to BAPISALESORDERGETSTATUS.
• Incoming Invoice / Get Many and Get Details map to the standard MM-IV list/detail BAPIs.
• Incoming Invoice / Detect Potential Duplicates compares vendor, normalized reference, amount, currency and a bounded date window.
• Open Item / Get Vendor Open Items and Get Customer Open Items map to the standard AP/AR open-item BAPIs.
• Open Item / Summarize Overdue Items calculates due dates and currency-grouped ageing buckets in the sidecar.
• Vendor / Get Details and Customer / Get Details return minimized master and company-code data.
• Read Operation / Execute Approved Read runs one credential-allowlisted business operation.
• User Administration / Create Communication User calls the isolated provisioning sidecar

after an exact CREATE confirmation. It maps only to BAPIUSERCREATE1 and does
not accept technical function names, roles, profiles or password input from a workflow.

The visible operation description states which fixed BAPI is used, but the BAPI
name is never editable. See docs/BAPI-VS-BADI.md for
the distinction between an external business interface and an internal SAP
enhancement point.

An example least-data field policy for the 0.4.0 business aliases is provided
in docs/BUSINESS-FIELD-POLICIES.example.json.
Copy only the operations the credential must use and narrow the fields further
when the workflow does not need all of them.

The node is intentionally separate from Logali HANA Guard. They share governance principles but
use different transports: HANA Guard speaks HANA SQL; SAP RFC Guard speaks HTTPS to an RFC
sidecar.

Compatibility and optional snapshot

The transport does not require HANA. It can target compatible SAP R/3, ECC and
S/4HANA systems, but every enabled BAPI and its exact structure must be checked
in each target release. SAP documents BAPIUSERGETLIST from release 6.20;
older R/3 systems may require a narrowly scoped custom read RFC. See
docs/COMPATIBILITY.md.

Current SU01 data should normally be read from the standard BAPIs. When a
historical point-in-time report or a large scheduled extract is required, use
the separated governed Z snapshot pattern in
docs/Z-SNAPSHOT-PATTERN.md, never an unrestricted
table-reader RFC.

Synthetic contract test

contract-sidecar/ contains an isolated test double for validating the node before a real SAP
sidecar is available. It does not implement RFC and it returns only fictitious SU01-style
records. It exposes listSu01Users, marks responses with source: contract-fixture and
readOnly: true, and rejects every other operation.

The importable workflow is
examples/rfc-guard-su01-contract-test.json. It is deliberately distributed without a linked
credential. After import, select a dedicated fixture credential and keep the workflow unpublished.
Never reuse the fixture token or the insecure HTTP option for a real SAP connection.

examples/su01/ adds focused examples for a webinar or acceptance test: active dialog users,
technical users, locked/expired/inactive accounts, one governed user detail, account-status
summary, last-logon review and system readiness. Their JSON files contain no credential IDs or
internal URLs. Expected results and business aliases are listed in examples/su01/README.md.

examples/business/real/ adds first-class company, material, ATP, purchasing,
sales, invoice and open-item examples. Document workflows contain placeholders
and fail input validation until an approved ID from the target client is supplied.
The AI Agent example uses n8n’s generated sapRfcGuardTool variant, requires an
AI-enabled read-only credential and remains limited by the same operation and
field allowlists as the normal workflow node.

Real SAP JCo sidecar

The GitHub repository’s jco-sidecar/ directory contains the
production-oriented Java 21 implementation for the
same HTTPS contract. It uses SAP JCo only at runtime, exposes no technical RFC
names, maps the verified standard user BAPIs, requires TLS and fails closed
when JCo, SAP configuration or SAP connectivity is unavailable. Its deployment
is deliberately separate from the synthetic fixture.

Provisioning is also separate from reporting: operate a second container with
RFCGUARDMODE=user-provisioning, its own certificate/API token, a fixed
username prefix and user group, a short maximum validity, and a server-held
initial password. Never point a read-only credential at that endpoint.

Development

npm install
npm test
npm run lint
npm run build

See ROADMAP.md for the early-access acceptance gates and planned
work. If the SAP JCo download is blocked, the minimal authorization request is
available in docs/SAP-DOWNLOAD-REQUEST.md.