Accessing SAP Leonardo IoT API-s with authorizations from third party apps

[former_member655843]

Hello,

We are struggling with a situation where we need to provide an API to the Thing data (measurements, metadata, etc.) in our SAP Leonardo IOT to users of third party apps. We were able to provide access as described in https://blogs.sap.com/2017/10/13/access-the-sap-iot-application-enablement-apis-using-postman/ (using the clientid and clientsecret).

As a next step we need to restrict the objects each user is allowed to access.

We have our user access rights set up within Leonardo IoT using authorization groups (each user is allowed to read only a subset of Things). Directly browsing the API (e.g. by browsing to https://<tenant>.iot-sap.cfapps.<zone>.hana.ondemand.com/advancedlist-thing-sap/CompositeThings/v1/T... and logging in when prompted) respects the access rights of the logged-in user as expected.

How can we make these same requests programmatically?

[marcus_behrens1]

Hi, you would have to pass the application context including the user session from your application to the call of the Leonardo IoT api. This would only be possible if both your application and Leonardo IoT have been configured to trust the same identity provider. I will ask a colleague to answer in more detail. Regards, Marcus