Deployment from BAS to SAP S/4HANA Public cloud dev tenant

[JariYlitolonen]

Hi,

I'm experiencing problems in BAS when deploying a Fiori app to Public cloud development tenant. It is giving me an authentication error even though I'm using right username and password. I have not configured username and password anywhere but destination I am using. I get the same error when entering username and password manually. Any idea what is wrong?

[JariYlitolonen]

I still have the same problem. I have done more testing on deployment.
I have destination with SAMLBearer authentication as described in this blog:

https://developers.sap.com/tutorials/abap-custom-ui-bas-connect-s4hc.html

When creating Fiori application and using "Connect to a system" I get an error: "all catalog service requests failed for system xxx, OData versions V2, V4". Did not find reason for this, so I created the application using destination with communication user and direct URL to OData service.

When deploying using destination with SAMLBearer authentication, I get "HTTP 500, internal server error" message.
When deploying using destination with communication user authentication, I get "HTTP 403, forbidden" message. OData error log shows message: "You do not have start authorization for /UI5/ABAP_REPOSITORY_SRV version 0001"
When deploying with destination with my user credentials it keeps asking username and password like I explained in my first posting.

Now, which application in SAP S/4HANA Public cloud I use to find reason for HTTP 500 error?
There is no communication scenario for /UI5/ABAP_REPOSITORY_SRV OData service, so communication user can't be used for deployment?
Why using own credentials does not accept login?

[EgbertVenema]

Hi Jari, did you ever manage to find out what was wrong? I'm running into the exact same issue.

Retrieving the service from the customizing client is no problem. I can generate and preview the app. Deploying to customizing client obviously fails in the end, but no username/password requirements there. Just a field to give it a repository. When selecting the development client, *poof* there are the username/password fields again. No matter what I try, not getting that to work.

Checked all the tutorials, blogs, documentation... the configuration is exactly as it should be. Checked with basis colleagues, all looks ok. What am I missing here?

[JariYlitolonen]

Hi Egbert, our basis did something and SAMLBearer authentication started working. I'm sorry I don't know what was done.

[EgbertVenema]

Our basis guy did something as well and now it all works! In our case it was about using the same credential parameter for both S/4 Cloud and BTP.

In the tutorial it is the nameIDFormat parameter. It is mentioned that this has something to do with the SAML authentication, but we simply assumed that having the same config for development as customizing would mean this would be the same as well. That'll show us to assume things 😅

Required in case your subaccount sends the e-mail address as SAML Subject Name Identifier for authentication (configured as Subject Name Identifier in its SAP Cloud Identity Service Application, see Tutorial: Set Up Trust Between SAP Cloud Identity Services and SAP BTP Cloud Foundry Environment), although SAP S/4HANA Cloud system expects user login by default. That is the case with a trial Account. This also requires the e-mail address to be maintained for SAP S/4HANA Cloud system business users.