Fiori app deployed to BTP ABAP environment gets "403 blocked by UCON" error

[WenjingLiu]

Hi there.

I am using an SAP BTP Trial account, and following the SAP Tutorial "Create a SAP Fiori App and Deploy it to SAP BTP, ABAP Environment". I can test run the app from Business Application Studio (refer to the screenshot), and I have successfully deployed the app. However I will be asked to log in with SAP Universal ID then get 403 error when I use the deployed app URL below.

https://6654aaf7-905f-48ea-b013-3811c03fcba8.abap-web.us10.hana.ondemand.com/sap/bc/ui5_ui5/sap/znov...

The error message reads "403 Forbidden The request has been blocked by UCON. Server time: 2022-10-10 00:13:10". I suspect it is some issue related to "CORS", but I am new to Fiori and don't understand things under the hood. Can anyone kindly explain the situation? Thanks!

Anyway, here is some endpoint information. Please let me know if it is not sufficient.

• my BTP Trial ABAP environment: https://<ABAPInstanceID>.abap.us10.hana.ondemand.com
• my BAS Trial: https://<TrialID>.us10cf.trial.applicationstudio.cloud.sap/index.htm
• my CF API endpoint: https://api.cf.us10-001.hana.ondemand.com
• my Fiori app deployed at: https://<ABAPInstanceID>.abap-web.us10.hana.ondemand.com/sap/bc/ui5_ui5/sap/znov05_trvl_app
• my test run endpoint: https://port8080-workspaces-ws-8d5lg.us10.trial.applicationstudio.cloud.sap/test/flpSandbox.html?sap-ui-xx-viewCache=false#znov05travelapp-tile&/...

P.S. I am not sure whether this question is related. Just list it here for reference.

Update:
Alright, it is not "CORS". My SAP Universal ID has two P-User IDs, say P1 and P2. I created everything such as the trial account and the app with P1, and I get 403 error with P1. If I log in with the Universal ID and then select P2, I will be able to access the Fiori app. It seems to be some issue between "Trial systems and Universal IDs"?

[WenjingLiu]

It seems that many people have the same issue with SAP Universal ID.

[former_member239751]

Hi,

if you receive a 403 for your service or app, please make sure

1. you linked the UIAD object of your UI5 application to an IAM App and
2. you published the IAM App and a Business Catalog containing the app via ADT ('Publish locally' button, top right corner of both ADT UIs).

This might take some time, depending on current system load, but should lead to your UI being accessible via the path /sap/bc/ui5_ui5/sap/<BSP app name>.

Best Regards,

Thomas

[Pavan_Golesar]

Hi arwen.liu,

That is a good elaborative post on your query.

I see that the status returned is 403 i.e. (Forbidden) status code which indicates that the server you are trying to reach has understood the request but refuses to authorize it. From Oct 1st all SAP access were to upgrade to SAP Universal ID's. It does seems to be some issue with the ID. can you try checking with other ID under yours SAP universal ID list.

Hope it helps,

Pavan Golesar

[wobauer1]

Hi,

Is there any solution for it?

I get the same error trying to call an odata from abap environment BTP.

Br

W.B.

[JulianKuipers]

Hi @wobauer1,

For me the issue was fixed logging out (or opening the url in an incognito window) and logging in with my SAP Universal ID's main e-mail adress.

Hope this helps,

Kind regards,

Julian