Question Re: How to authenticate Cloud Platform API in Technology Q&A

How to authenticate Cloud Platform API

tobias_mitter2 — Tue, 17 Mar 2020 06:52:26 GMT

Hello,

we want to use the cloud foundry platform api (http://v3-apidocs.cloudfoundry.org/version/3.81.0/index.html) to do some automation.

The API is OAuth2 protected. In order to authenticate, we would need to create an oauth client and use the credentials to get a token. We did not find any way to do that.

How can we access the api?

There is one way for testing we found, as according to the cloud foundry documentation you can get an oauth token with the CLI command "cf oauth-token". That is the only way we found to actually being able to call the api, but this is only ok for some quick testing, but for a live scenario we need a REST way to get a token.

Cloud Foundry documentation describes some way to create a client, but this does not work on SAP Cloud Foundry, as we don't have access to tools and infrastructure.

Thanks and regards,

Tobias

Re: How to authenticate Cloud Platform API

gregorw — Tue, 17 Mar 2020 14:52:56 GMT

HI Tobias,

maybe you start with a search at api.sap.com with the keywords cloud foundry. From there you should find more documentation.

Best regards
Gregor

Re: How to authenticate Cloud Platform API

tobias_mitter2 — Mon, 23 Mar 2020 12:20:32 GMT

Hi Gregor,

thanks but we have searched and tried basically everything. I am on and off this topic for half a year now. There is no documentation from SAP regarding this topic. At the moment I believe I haven't overlooked anything, that's why I finally postet the question here in the hope that we are not the only ones trying to use this api for some analytics and automation and maybe somebody else digged out some info.

Best regards,

Tobias

Re: How to authenticate Cloud Platform API

gregorw — Mon, 23 Mar 2020 12:55:20 GMT

Hi Tobias,

according to the current release notes SAP Cloud Platform is running on Cloud Foundry 12.33.0. Maybe the Cloud Foundry API's are helpful for you:

https://apidocs.cloudfoundry.org/12.33.0/

Keep us posted about your progress.

Best regards
Gregor

Re: How to authenticate Cloud Platform API

gregorw — Tue, 24 Mar 2020 08:26:02 GMT

Perhaps you can describe better what "some automation" means in detail. Because there is a way to retrieve the Audit Logs using an API for the Cloud Foundry Environment.

Re: How to authenticate Cloud Platform API

tobias_mitter2 — Mon, 06 Apr 2020 11:25:00 GMT

So I am going to answer this myself. It seems there is no solution yet, but there is one coming.

See this: https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/3670474a58c24ac2b082e76cbbd9dc19.html

Just stumbled over it by accident. When I look at the supported scopes though, it seems it is only a part of the whole api. It doesn't even say which api (v2 or v3), it might even be that SAP is building a facade around it...have to check it out some time. Hope this helps.

Re: How to authenticate Cloud Platform API

mike_zaschka — Tue, 04 Jan 2022 17:06:18 GMT

Hi tobias.mitter2,

did you find a solution in the meantime?
I am stuck with the same problem. The token obtained from the CLI (cf oauth-token) is working fine to access the Cloud Controller API (v2 and v3), but I am not able to get a valid access-token from any authorization endpoint, including the Cloud Management Service.

Kind Regards,

Mike

Re: How to authenticate Cloud Platform API

tobias_mitter2 — Wed, 05 Jan 2022 08:04:58 GMT

Hello Mike, as we are still not on feature set b, we could not move forward here. Regards, Tobias

Re: How to authenticate Cloud Platform API

mike_zaschka — Tue, 11 Jan 2022 12:25:04 GMT

With the help of SAP:

The CF Cloud Controller API is currently not connected to XSUAA and thus it is not possible to obtain a token from there. Instead you have to directly call the CF UAA service and use a valid user (no service key) and the following parameters. You should then get a valid token with cloud_controller.read and cloud_controller.write scopes.

Endpoint

https://login.cf.eu20.hana.ondemand.com/oauth/token (BTP region dependent)

Basic Authentication
user: cf
password: (empty - no password)

Parameters:

username: <BTP user email>
password: <BTP user password>
client_id: cf
grant_type: password
response_type: token

An example CURL call:

curl -v -XPOST -H"Application/json" -u "cf:" --data "username=<BTP user email>&password=<myPassword>&client_id=cf&grant_type=password&response_type=token" https://login.cf.eu20.hana.ondemand.com/oauth/token

Re: How to authenticate Cloud Platform API

danfqa — Thu, 21 Sep 2023 13:39:46 GMT

Hello Mike! Could you please inform me about the CF User and where I can locate it? From what I gather, it's distinct from the BTP Cockpit user email. Also, how can I obtain the CF client_id? I'm attempting to execute the CURL example call on CF CLI, but I'm encountering an unauthorized error. Thanks for your assistance!

Re: How to authenticate Cloud Platform API

marco_spyker — Thu, 09 Jan 2025 08:50:22 GMT

Hi @mike_zaschka,
hi all and a Happy New Year 2025!

We have been struggling with this topic, as well, with some “sleepless nights” and accidentally found this community post and we are very happy to say, that you have provided this information to us – thanks.

Now, with providing a valid user, configured in the BTP (email / password) we have managed to get valid access-tokens.

Because your answer here is 3 years old, maybe you (or some one else here) can give information, if accessing the Cloud Foundry can be managed differently. If we rely on this approach, this would mean, we would need some kind of a technical user on the BTP platform and from security perspective, can we some avoid providing passwords in plain text?

Thanks a lot in advance,

M.Spyker