“Principal Propagation”, it is commonly understood as the ability of a system to securely forward
or propagate the authenticated user (principal) from a sender to a receiver in a way that the forwarded user information is kept confidential and – even more important – cannot be changed during transit.
One of the ways for Enabling Principal Propagation is through OAuth.
In this blog, we will see how to enable OAuth configuration, create a destination, assign the destination to the client application and propagate the authenticated user (principal) from a client application(HTML5) to a backend system through SAP Cloud Platform API Management.
Let’s get started!
OAuth client is needed to get an access token for the OAuth-protected resources in the application.
In the cloud cockpit, navigate to the subaccount, select OAuth, click on clients and then select “Register a new client”.
Fill in the following details, click on confidential, give the client secret and Save it.
Note: In this scenario, my HTML5 application and Apiportal application are on the same sub-account so trust configuration between accounts is not needed
For this scenario, I will be using AP2 SAP Gateway system as a backend
Downloading and configuring cloud connector refer
https://blogs.sap.com/2015/02/11/set-up-your-sap-web-ide-on-hana-cloud-part-2/
Type https://localhost:**** on your browser following screen should come up
Enter Username and password to log in as Admin
Click on Add Account to add an account
Fill in the appropriate details as shown below for your account
Under Account Dashboard; Account should be added
As I have added my hanatrial account as host so my hanatrial account should be added as shown below
Now we will be adding the On-Prem system for eg ER9 (S/4 HANA system)
Click on Cloud To On-Premise
Add Backend System as SAP Gateway and Click Next
Select Protocol as HTTPS and click Next
Add host and port of Backend System and click Next
In Virtual Host and port don’t put the same name and port as above
Select Principle Type as X509 Certificate and Click Next
Check the summary, select internal host checkbox and select Finish
The system should get added
Click on Add button under Resources Accessible to add URL path as”/” this is to consider all the resources after “/”
With this, we have configured our backend system in Cloud Connector
Note: - This configuration can be skipped if SAML has been already activated in the SAP Gateway.
Please refer blog under section “Configuration on the SAP Backend (SAP Gateway) Side” for configuring SAP backend.
Login to your SAP Cloud Platform account (say https://account.hanatrial.ondemand.com/cockpit).
Navigate to the Services tab, search for API Management service tile and click to open API Management service.
Click on the link Access API Portal to open API Portal.
Navigate to API Provider and click on Create
Give a name lets say “AP2” in this case as we are connecting AP2 backend
Navigate to CONNECTIONS tab and fill the details
Navigate to develop and click on create
Fill in the following details and Save and click on Create
Save and Deploy
Copy API Proxy URL and save it in a notepad as it will be used in the destination
Navigate to the cockpit and from left hand-side select Destinations and click on New Destination
Fill in all the fields
Save the created destination.
In this blog, the pre-requisite is that HTML5 application is already created and deployed on the same subaccount where we have the API portal subscription and therefore I will not be showing you how to create an HTML5 application.
From the left-hand-side navigate to HTML5 Application and make sure your application is in the started state.
Click on the application and Under required destinations fill in the following details and select the destination created above.
Now copy the application URL.
Append the URL with URL/APIMgmtEndPoint/< API Proxy name>
Hit the above URL in the browser and without giving user and password, user principal will be propagated to the backend via API Management and you should get the response
or propagate the authenticated user (principal) from a sender to a receiver in a way that the forwarded user information is kept confidential and – even more important – cannot be changed during transit.
One of the ways for Enabling Principal Propagation is through OAuth.
In this blog, we will see how to enable OAuth configuration, create a destination, assign the destination to the client application and propagate the authenticated user (principal) from a client application(HTML5) to a backend system through SAP Cloud Platform API Management.
Let’s get started!
Creating an OAuth Client
OAuth client is needed to get an access token for the OAuth-protected resources in the application.
In the cloud cockpit, navigate to the subaccount, select OAuth, click on clients and then select “Register a new client”.
Fill in the following details, click on confidential, give the client secret and Save it.
Note: In this scenario, my HTML5 application and Apiportal application are on the same sub-account so trust configuration between accounts is not needed
Configuration on SAP Cloud Connector for On-Premise connectivity
For this scenario, I will be using AP2 SAP Gateway system as a backend
Downloading and configuring cloud connector refer
https://blogs.sap.com/2015/02/11/set-up-your-sap-web-ide-on-hana-cloud-part-2/
Type https://localhost:**** on your browser following screen should come up
Enter Username and password to log in as Admin
Click on Add Account to add an account
Fill in the appropriate details as shown below for your account
Under Account Dashboard; Account should be added
As I have added my hanatrial account as host so my hanatrial account should be added as shown below
Now we will be adding the On-Prem system for eg ER9 (S/4 HANA system)
Click on Cloud To On-Premise
Add Backend System as SAP Gateway and Click Next
Select Protocol as HTTPS and click Next
Add host and port of Backend System and click Next
In Virtual Host and port don’t put the same name and port as above
Select Principle Type as X509 Certificate and Click Next
Check the summary, select internal host checkbox and select Finish
The system should get added
Click on Add button under Resources Accessible to add URL path as”/” this is to consider all the resources after “/”
With this, we have configured our backend system in Cloud Connector
Configuration on the SAP Backend (SAP Gateway) Side
Note: - This configuration can be skipped if SAML has been already activated in the SAP Gateway.
Please refer blog under section “Configuration on the SAP Backend (SAP Gateway) Side” for configuring SAP backend.
Create an API Provider to SAP Gateway System
Login to your SAP Cloud Platform account (say https://account.hanatrial.ondemand.com/cockpit).
Navigate to the Services tab, search for API Management service tile and click to open API Management service.
Click on the link Access API Portal to open API Portal.
Navigate to API Provider and click on Create
Give a name lets say “AP2” in this case as we are connecting AP2 backend
Navigate to CONNECTIONS tab and fill the details
Create an API Proxy to connect to SAP Gateway
Navigate to develop and click on create
Fill in the following details and Save and click on Create
Save and Deploy
Copy API Proxy URL and save it in a notepad as it will be used in the destination
Creating Destination on the subaccount
Navigate to the cockpit and from left hand-side select Destinations and click on New Destination
Fill in all the fields
Save the created destination.
Testing the Flow from HTML5 Application
In this blog, the pre-requisite is that HTML5 application is already created and deployed on the same subaccount where we have the API portal subscription and therefore I will not be showing you how to create an HTML5 application.
From the left-hand-side navigate to HTML5 Application and make sure your application is in the started state.
Click on the application and Under required destinations fill in the following details and select the destination created above.
Now copy the application URL.
Append the URL with URL/APIMgmtEndPoint/< API Proxy name>
Hit the above URL in the browser and without giving user and password, user principal will be propagated to the backend via API Management and you should get the response
Further Reads
- Enhanced features of SAP Cloud Platform API Management
- Monitoring and Governing 3rd Party APIs
- API Security Best Practices
- Accelerate digital application development
- For more blogs on SAP Cloud Platform, API Management visit us at SAP Community
- Single Sign-On
- SAP Managed Tags:
5 Comments
| User | Count |
|---|---|
| 4246 | |
| 3365 | |
| 2605 | |
| 2153 | |
| 1983 | |
| 1257 | |
| 1164 | |
| 1122 | |
| 1100 |
