403 Forbidden - Backend ODATA Error

[natalymoros]

Hello everyone,

We are currently developing a CAP project that acts as an handler of ODATA calls for our Fiori applications, exposing various entities from our SAP backend, that is exposed on BTP through Cloud Connector.

The Business Application Studio instance is deployed on subaccount A, while the CAP itself is to be deployed on subaccount B.

We're facing this issue: via BAS Run configuration it is impossible to test any kind of OData call as every call results in a 403 Forbidden, without additional infos. We initially thought this to be a XCSRF Token issue, so we included the token in the request in the test.http file and also included the boolean values "csrf" and "csrfinbatch" in the package.json.

We also made an .env file bound to the correct service instances (and included it in the run configuration), and we also created a default-env.json containing all the necessary data taken from the deployed CAP project.

None of this has worked and we're still finding it impossible to test any kind of network call unless we deploy the CAP project.

[WouterLemaire]

how is the authentication configured for both subaccounts? I can imagine that the jwt token of one account is not valid for the other. At least both need to be configured with the same idp and I think a trust between the two subaccounts is needed.

Have you tried with basic auth instead of xsuaa in your cap backend?

[natalymoros]

No trust configuration from what I can tell. I am using Basic Auth for testing purposes to go on SAP.

https://answers.sap.com/questions/13652327/bas-testing-a-destination-error-no-such-host.html

Please check this thread, I'm having the same issue as this user and even on that thread there's no solution.

[WouterLemaire]

not sure what goes wrong.

A workaround could be to load cap and ui into bas and run both in bas.

[Pavan_Golesar]

Did you try to test it via POSTMAN or ADVANCE REST CLIENT?

Link to test OData API: YouTube

[former_member770713]

Hello,

The service works normally through Postman or deployed application. I think the issue lies with how the CAP is run in the Business Application Studio.