How to Authenticate APIRule in SAP BTP, kyma Runtime to secured the application

[shobhtyagi]

Hello Community ,

currently I am working on SAP BTP Kyma runtime and I have one UI application which I wanted to authenticate via API Rule via Access Strategy JWT option but after applying this JWT Access Strategy I could not able to get any way how to pass JWT token to it since its started giving me 401 authentication issue.

My Question is how do I pass my token or security credentials to API rules so that it will open my Web Application

[strekm]

hello shobhtyagi!
Could you share some details on how you are securing your application? Are you using Istio? APIRule?

Cheers,
Magda

[shobhtyagi]

Hi Magdalena Strek,
I am using APIRule and in access strategy I have provided the JWT and JWKs url

[john_barrow]

Have you entered a Trusted Issuer as well?

[shobhtyagi]

Yes I have entered the trusted issuer

[john_barrow]

OK, so can you get a token by calling the Trusted Issuer URL with your client ID and client Secret?
And have you tried calling your application with that token as a Bearer header?

[hemchand_sharma]

Thanks for reply john.barrow it would be helpful if you can point some example or documentation as you mentioned in above comments .. We tried passing bearer token from xsuaa service via postman but its still throwing 401. What do you mean Bearer as header BTW can you share any example?

[john_barrow]

Ok, I'm doing the same thing, calling a JWT-protected (via XSUAA) Function using Postman.

[hemchand_sharma]

Hello john.barrow,

The above solution is working for me via postman, I am also getting 200 status for my web url but same thing i want to try with actual business scenarios lets say sharing a url with User which will lead user to login page and after authentication, it should open the actual Kyma web app.

I tried same thing with below approach.

Now what i did , i created a BTP destination with Kyma API Rule URL with XSUAA authentication configs and i am trying it to open via workzone tenant url with dynamic destination approach. but i am not able to open my web app and getting 500 internal server error.

Url we are trying to open app.
http://<workzone launchpad tenant url>/dynamic_dest/KYMAROUTE

Can you guide us what could be the wrong here.

[john_barrow]

Have you looked at this?
https://blogs.sap.com/2023/10/18/sap-btp-kyma-api-rules-with-destinations-and-a-managed-approuter./

[hemchand_sharma]

Thanks John This blog was helpful. It worked for me. Thanks a Lot for your help

[quovadis]

Hello shobhtyagi

Thanks for the question and a very comprehensive diagram

For the sake of the audience, here goes the line-up of the blogposts that relate to the matter:

• https://blogs.sap.com/2023/10/18/sap-btp-kyma-api-rules-with-destinations-and-a-managed-approuter./
• https://blogs.sap.com/2023/11/30/protect-your-kyma-workloads-from-eavesdropping-with-jwt-access-stra...
• https://blogs.sap.com/2023/12/05/protect-your-kyma-workloads-from-eavesdropping-with-introspection-a...
• https://blogs.sap.com/2023/03/20/destinations-routing-easy-with-sap-build-work-zone-standard-edition...
  

kind regards; Piotr

PS. Many thanks to john.barrow for promptly pointing shobhtyagi to the right blogpost