Ctrlk
Contact SupportProduct
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Configure a proxy

Route the ABAP Agent's traffic through your corporate proxy — the connection to SeaLights and the connections to your test repositories.

Use this guide when the Windows host that runs the ABAP Agent reaches the internet or your test tools only through a proxy server. The agent has two independent proxy settings, because it talks to two kinds of systems:

  • SeaLights — the [proxy] section of config.toml (or environment variables). Used by slabapcli, the watcher, and the SeaLights ABAP Server Windows service.

  • Test repositories — the [adapters] section of config.toml. Used by the test repository connectors that call a web API.

Configuring one does not configure the other. Most proxy setups need both.

Before you start

  • The agent is installed and config.toml exists (see Setup and installation).

  • You know the proxy address (for example http://proxy.example.com:8080) and, if the proxy requires it, a user name and password.

  • You can open a terminal as an Administrator in the agent's bin directory.

Overview

Connection
Setting used
Restart needed

slabapcli calls to SeaLights (for example sealights set and sealights test)

[proxy] or SL_PROXY* environment variables

No. Applies the next time you run a command.

Watcher jobs (build modifications, footprints, and similar)

[proxy] or SL_PROXY* environment variables

No server restart. Build Modifications use the new settings on their next run. Footprints runs continuously, so run slabapcli footprints stop, then slabapcli footprints run for each pipeline.

SeaLights ABAP Server service (SeaLights API calls and uploads)

[proxy] or SL_PROXY* environment variables

Yes. Run slabapcli server stop, then slabapcli server start.

Test repositories

[adapters], used by tosca, toscacloud, ado, qtest, and ssm. See Part 2.

No. Applies to the next connection test or search.

SAP RFC connections

None. RFC does not use an HTTP proxy. See SAP RFC connections.

Not applicable

Part 1: Connect to SeaLights through a proxy

The agent does not read the Windows system proxy settings for its SeaLights connection. It uses a proxy only if you configure one with the steps below.

1

Save the proxy

Run proxy set with your proxy address. Add --auth if the proxy requires a user name and password. The CLI then prompts for them.

  • --server (-s) is required. It must be an http:// or https:// address that includes a host name. Include the port.

  • --auth (-a) prompts for the user name and password. The password is not displayed, and the sha1 value is a short fingerprint you can use to confirm you typed the password you intended.

  • The user name and password are stored encrypted when secret protection is on (see Configuration settings).

  • Proxy credentials are used only when both a user name and a password are set. The CLI and the watcher support basic proxy authentication only.

  • proxy set replaces the whole [proxy] section. If you run it again without --auth, the proxy is saved without credentials and any credentials stored earlier are discarded.

The command writes this section to config.toml:

2

Check the saved proxy

If no proxy is saved, the output ends with No proxy configured. If the proxy has no credentials, it shows Authentication: disabled. When secret protection is not enabled, the stored password is shown in clear text.

proxy list shows only the [proxy] section. If you also set SL_PROXY* environment variables, those take precedence (see Optional: use environment variables).

3

Test the connection to SeaLights

This test runs in the CLI itself, so it already uses the new proxy. It does not prove that the server uses it: the server only reads the proxy when it starts.

4

Restart the server

The SeaLights ABAP Server service reads the proxy settings only when it starts. There is no server restart command, so stop and start the service:

Until you restart, the server keeps using the previous proxy settings. See Live reload and restart-required fields and Start the ABAP Agent Server.

If [proxy].server is not an absolute http:// or https:// address, the server does not start. Correct the value and start it again.

Optional: use environment variables

Instead of (or on top of) the [proxy] section, you can set environment variables. They take precedence over [proxy].

Variable
Meaning

SL_PROXY_SERVER

Proxy address. Checked first.

SL_PROXY

Proxy address. Used only if SL_PROXY_SERVER is not set.

SL_PROXY_USERNAME

Proxy user name. Overrides [proxy].username.

SL_PROXY_PASSWORD

Proxy password. Overrides [proxy].password.

  • Always include http:// or https:// and the port in the address.

  • The server reads the variables when it starts, and slabapcli and the watcher read them when they start. Set them as system (machine-level) variables so the Windows service and scheduled jobs see them, then restart the service and open a new terminal.

Environment variables are stored in plain text. Prefer slabapcli proxy set --auth for credentials, which stores them encrypted when secret protection is on.

Optional: allow a TLS-inspecting proxy

Some proxies decrypt and re-encrypt HTTPS traffic with their own certificate. If the agent then reports SSL server verification failed, the preferred fix is to install the proxy's root certificate in the Windows certificate store. As a workaround in a controlled environment, you can turn off certificate verification:

disableSslCheck = true turns off TLS certificate verification for all HTTPS calls made by slabapcli, the watcher, and the server, including the calls that carry your SeaLights token. Anyone who can intercept the connection can then impersonate SeaLights. Use it only on a trusted network, and remove it once the certificate is installed.

[http].disableSslCheck needs a server restart, like the proxy. It does not affect test repository connections (see Part 2 for those). For the full error and resolution, see E-008.

Change or remove the proxy

  • Change it: run slabapcli proxy set again with the new address (and --auth if needed), then restart the server.

  • Remove it: there is no proxy command that deletes the setting. Delete the whole [proxy] section from config.toml, remove any SL_PROXY* environment variables, and restart the server. Check the result with slabapcli proxy list, which then prints No proxy configured.

Part 2: Test repositories

Test repository connectors do not use [proxy]. They read the [adapters] section of config.toml, which applies to all your test repositories.

Test repository

Uses the [adapters] proxy?

What it uses instead

tosca (Tosca REST API)

Yes

toscacloud (Tosca Cloud)

Yes, for the REST calls and for the sign-in request

ado (Azure DevOps)

Yes

qtest (Tricentis qTest)

Yes

ssm (SAP Solution Manager)

Yes

excel, xray

Not needed

These read a workbook file and make no web calls.

certify

Not needed

It connects directly to a database and makes no web calls.

alm (OpenText ALM)

No

The agent has no proxy setting for ALM.

octane (OpenText Octane)

No

The agent has no proxy setting for Octane.

calm (SAP Cloud ALM)

No

The agent has no proxy setting for SAP Cloud ALM.

For the connectors in the last three rows, the agent does not apply a proxy of its own. Their traffic uses the default network behavior of the Windows host.

1

Edit the [adapters] section

Open config.toml (by default C:\ProgramData\Tricentis\SeaLights\ABAP Agent\config\config.toml) as an Administrator. The default file already contains an [adapters] section with blank proxy values. Fill them in:

Key
Description

proxyAddress

Proxy address. If you leave it blank, the agent configures no proxy for the connector and the Windows host's default behavior applies.

proxyUsername, proxyPassword

Proxy credentials. Optional.

proxyDomain

Domain for domain-joined proxies (NTLM). Optional. When set, it is sent with the user name and password.

  • proxyAddress is required when proxyUsername, proxyPassword, or proxyDomain is set. Otherwise the connector fails with [adapters].proxyAddress is required when proxyUsername, proxyPassword, or proxyDomain is set.

  • For toscacloud, the sign-in request goes directly to the identity provider when proxyAddress is blank. Set proxyAddress whenever sign-in must also pass through the proxy.

  • The [adapters] section also holds other settings, such as restClientTimeoutSeconds. See Configuration settings.

2

Handle the credentials

proxyUsername, proxyPassword, and proxyDomain are secret fields, like the credentials of a test repository.

  • Secret protection off (key and iv in [settings] are empty): type the values in plain text, as in the example above.

  • Secret protection on: the agent reads these three fields as encrypted values. A plain text value makes the connection test fail. proxyAddress is never encrypted, so a proxy that needs no credentials works the same way in both modes.

No slabapcli command sets the [adapters] proxy credentials. If secret protection is on and your proxy requires credentials for test repositories, contact SeaLights support before you edit the file.

3

No restart needed

The agent reads [adapters] each time it connects to a test repository, so the new values apply to the next connection test or search. You do not restart the server for [adapters] changes. A search that is already running finishes with the previous values.

4

Test the test repository connection

Use the pipeline and test repository names from your config.toml.

The server must be running for this command. See Configure test repositories for all options and error messages.

Optional: allow a TLS-inspecting proxy for a test repository

[http].disableSslCheck does not apply to test repositories. Two connectors have their own switch, in their own config.toml section:

The default is false for both.

When ignoreCertificateErrors is true, the connector accepts any TLS certificate, so anyone who can intercept the connection can impersonate the test tool and read the credentials you send. Use it only on a trusted network. The preferred fix is to install the proxy's root certificate in the Windows certificate store.

SAP RFC connections

Connections to your SAP systems use SAP RFC, not HTTP, so neither [proxy] nor [adapters] applies to them. If your network requires a SAProuter between the agent and SAP, add a router value, in SAProuter string format, to the RFC Destination's [[rfc]] entry in config.toml (for example router = '/H/sap_router_host/S/3299/H/target_host/S/3200'). rfc set has no option for it, but keeps an existing value. See Create, test, and list RFC Destinations and the [[rfc]] section of Configuration settings.

Troubleshooting

Symptom
What to check

sealights test fails with a connection error or timeout

Run slabapcli proxy list and check the address, scheme (http or https), and port. Check whether SL_PROXY_SERVER or SL_PROXY is set on the host: environment variables override [proxy]. If the proxy needs credentials, run proxy set again with --auth.

sealights test succeeds, but server uploads fail

The server reads [proxy] and SL_PROXY* only at startup. Run slabapcli server stop, then slabapcli server start.

SSL server verification failed

A TLS-inspecting proxy is replacing the certificate. Install its root certificate in the Windows certificate store, or see Optional: allow a TLS-inspecting proxy and E-008.

The server does not start after you edit [proxy]

[proxy].server must be an absolute http:// or https:// address with a host name. Fix or remove the section, then start the server.

testrepo test fails, but sealights test succeeds

The two use different settings. Check [adapters] proxyAddress, and confirm that your test repository type is one that uses it (see the table in Part 2). Read the adapter log of the failed task. See Troubleshooting the ABAP Agent.

[adapters].proxyAddress is required when proxyUsername, proxyPassword, or proxyDomain is set.

You set proxy credentials or a domain but left proxyAddress blank. Set the address, or remove the credentials.

The test repository connection test fails after you added [adapters] proxy credentials on an installation with secret protection on

The agent expects encrypted values in these fields. See step 2 of Part 2, Handle the credentials.

Related reading

PreviousTosca Cloud runner and TIA
NextFiori support

Last updated

Was this helpful?