Client Certificate Authentication for Integration Flow Processing in SAP CPI from POSTMAN

[Naga_Uday1]

Client Certificate Authentication for Integration Flow Processing in SAP CPI

In this blog, we will discuss Client Certificate Authentication for inbound integration in SAP Cloud Platform Integration (CPI).

Authentication Options

When it comes to authentication, we have two main options:

1. Client Certificate
2. User Role

For Client Certificate Authentication in the HTTP sender adapter of CPI, we will be using the User Role option.

In this scenario, we will share our client certificate with the requester (in this case, Postman) to authenticate the requests to our SAP CPI instance.

Step 1: Log on to CPI BTP Tenant

• Create a new instance of Service Process Integration Runtime and select the plan Integration Flow.

Step 2: Create and Configure the Service Key

• In this step, we need to create a Service Key. This includes:
• Service Key Name: Define a name for your service key.
• Key Type: Choose one of the following:
• Client ID/Secret: The service key contains a client ID and client secret (client credentials).
• Certificate: SAP generates a client certificate and public/private key pair with the service key.
• External Certificate: If a third party shares the certificates, choose this option.

In our case, we will select the Certificate option.

Select the instance> Right hand side select the service key > Click on Create
Add Service Key Name
Key Type- Certificate
Click on create

 

Click on View> select form

Arrange the certificate like below format after copying certificate value into notepad and save as xxx.PEM.

1. Also, copy the private key value to a text editor arrange it like below, and save it as certificate. Key.

Example format:

Step 4: Copy Host URL

• After downloading both certificates, copy the host URL from the form and save it for later use.

Example URL:
https://9368e858trial.it-cpitrial06-rt.cfapps.us10-001.hana.ondemand.com

Now move on the Post man tool

Step 5: Configure Postman

1. In Postman, provide the CPI URL that was created during the I-flow deployment.
2. Create an I-flow using the HTTPS adapter and configure it as required. After deploying the flow in CPI, you will get the URL  under the integration content to use in Postman.
3. Set the authorization type as No AUTH in Postman.

Step 6: Add Certificates in Postman

1. Go to the Settings option in Postman (top right corner of the screen).
2. Click on Certificates.
3. Add the .pem and .key files here.
4. Add the host name (URL) you saved earlier when creating the service key.

and give the CPI URL which was created in CPI.

Step7: In CPI create a I-flow using Https adapter and maintain as like below.

After deploying the flow we will get the URL and use the same in POSTMAN tool. And authorization type as No AUTH

Step 8: Test the Integration

1. Close the settings screen.
2. Trigger a test message from Postman.
3. You should now be able to see the message in CPI.

Trigger test message from POSTMAN.

We can see message in CPI.

Summary

When setting up secure communication between external systems (like Postman) and SAP Cloud Platform Integration, one commonly used method is Client Certificate Authentication. This method ensures that only authorized clients with the appropriate certificates can access your CPI integration flow. In this process, we create and configure a service key with a certificate, then share this certificate with the external requester.

We walked through the steps required to:

1. Log in to the SAP CPI BTP tenant.
2. Create and configure a service key with the certificate option.
3. Download and properly format the .pem and .key files.
4. Configure Postman to use these certificates for authentication.
5. Deploy the integration flow and test the connection using Postman.

Conclusion

Client Certificate Authentication is a robust and secure method for ensuring that only trusted clients can access your SAP CPI integration flows. By following the steps outlined in this blog, you can successfully set up certificate-based authentication, which offers a higher level of security compared to basic authentication methods like username and password.

This approach is particularly useful when integrating with external systems or APIs where maintaining a secure communication channel is critical. By leveraging SAP’s capability to generate certificates, you can simplify the authentication process while maintaining security standards.