Enable OAuth 2.0 Authorization Code for Sales Order (A2X) API

[enes-oerdek]

The Sales Order (A2X) on SAP S/4HANA Public Cloud is one of the most utilized APIs in SAP S/4HANA Public Cloud and brings the efficiency of your business processes onto a new level. This API allows to create, read, update, and delete sales orders in an external system, adaptable to various authorization methods. In this blogpost we are going step-by-step through the process of enabling OAuth 2.0 with Authorization Code.

What is this about?

Setting up the Sales Order (A2X) API and enabling OAuth 2.0 is an easy thing and is well documented here. If you use the API with Basic Auth or with OAuth 2.0 with Client Credentials, the documents are created, read, updated and deleted by the technical user bound to the communication system. In most cases it is not required to identify the user if you integrate sales orders into an external system, but there are some cases where this is needed. OAuth 2.0 with Authorization Code allow API operations, which are bound to the user. 

Prerequisites

In order for OAuth 2.0 with Authorization Code to be enabled and usable, you need an application/web-server, which can provide a callback/client redirect URI. You probably have an application where you got such a callback url. In this guide I will use an API testing tool. But it should be similar in any other OData Client which supports OAuth 2.0 with Authorization Code.

Configuration on SAP S/4HANA Cloud

Determine own OAuth Endpoint Settings

Open the "Communication Systems" App and click "Own SAP Cloud System" (see Illustration 1).

Illustration 1

Here you can find the system's OAuth 2.0 endpoints. These information are needed later in the OAuth 2.0 Client (see Illustration 2).

Illustration 2

Create Communication System with Inbound Communication User

Create a new Communication System. Check "Inbound Only" in the Technical Data (General). Enter the Client Redirect URI which is obtained by the OData/OAuth client (see Illustration 3). In my case, I got this endpoint from my API testing tool. In your case, your OAuth 2.0 client library might have built in functionalities to launch a web-server, which serves as the endpoint.

Illustration 3

Maintain Users for Inbound Communication (see Illustration 4). Enter a OAuth 2.0 Client ID of your choice, this is later used in the ODATA Client.

Illustration 4

Create Communication Arrangement

Create a Communication Arrangement for the Communication Scenario SAP_COM_0109 (Sales Order Integration). Use the previously created Communication System. Review the Inbound Communication and Save (see Illustration 5).

Illustration 5

With that, you are done with the configuration on S/4HANA side. You can now switch to your ODATA Client and configure the authentication there. 

Sample Configuration of OData/OAuth-Client

In your OData Client, the following fields are important for configuration (see Illustration 6 and Illustration 7). This configuration labels might differ depending on the API testing tool you use. 

1. Grant Type: Auth Code with PKCE.
2. Callback Url: Authorize using browser.
3. Auth Url: This is the address from the System Endpoints derived in the configuration Step 1, the OAuth2 Authorization Service URL ending with /sap/bc/sec/oauth2/authorize.
4. Access Token Url: Address from the system endpoints derived in configuration step 1, OAuth 2.0 Public Client Token Service URL ending with /sap/public/bc/sec/oauth2/token.
5. Client ID: Inbound Communication User from Step 2.
6. Client Secret: Leave this field empty.
7. State: Enter any string for the Oauth State, e.g. "API-Test".
8. Client Authentication: Send Client Credentials in Body

Illustration 6

Illustration 7

After clicking on "Get New Access Token", the user is redirected to a browser window, where the user can authenticate with the System. After authentication, the user is asked to grant permission once. With that, the token is available for the external system and operations, which are done with the newly created token are bound to the user.

This concludes this step-by-step guide on how to enable OAuth 2.0 with Authorization Code for the Sales Order (A2X) API on SAP S/4HANA Public Cloud. Read further documentation and articles here:

• SAP S/4HANA Integration Scenarios
• APIs for Sales
• Sales Order (A2X)

Was this article helpful for you? Please vote and share ideas and feedback for future articles in context of Sales Order Processing and Integration. Your feedback is very appreciated for future articles.