403 Forbidden error on consuming CAPM API in a Custom SAPUI5 project

[RjainCap68]

Hi All,

We are currently facing issues with authorization on our CAPM service, where on reaching out to CAPM API through application router from Custom SAPUI5 app using standalone approuter, we get 403 forbidden error.

We have binded both the modules with the same destination service instance, connectivity instance & xsuaa instance. 

The same setup works in our internal system, but it is failing out in client environment.

Earlier, the UI app was also not accessible, it was giving auth error, but after adding below properties in xs-security.json file, the app was accessible - 

"oauth2-configuration": {

    "redirect-uris": [

      "..UI Approuter URL/**",

      "..CAPM SRV URL../**"

    ],

    "system-attributes": []

  }

UI Approuter mta properties:- 

CAPM SRV mta.yaml :- 

XS-app.json :- 

[marcel_schork62]

Hi, it seems that the user accessing the app does not have the required authorizations. In your xs-app.json you defined the scope "uua.user" for your CAP API. Did you (manually) create a role from the role template defined in xs-security.json and connected this role to a role collection? These role collection then needs to be assigned to the users who should have access to your CAP API. For me it looks like that one of these steps were not yet done.