SAP Approuter Headers using Private Link Service for Azure Blob Storage

[ReinertM]

Dear Experts,

I have a question in regards to the SAP Approuter (https://www.npmjs.com/package/@sap/approuter) and its handling of the "Authentication" header when sending backend requests via the SAP Private Link Service.

Use Case Explanation (see attached picture for better unterstanding):

In a recent implementiation in a customer project, I was given the task to implement PLS for writing Data to an Azure Blob Storage by use of the SAP Integration Suite. The policies within Azure only allowed Entra-Id based authentication on the Storage Account, so using Access Keys or SAS was not even a considerable option. A Service Prinicple was the way to go here. To have the endpoint of the approuter secured, we implemented an XSUAA which authenticates the Integration Suite to call the approuter endpoint (via x-approuter-authorization Header), however the JWT Token for access to the Blob had to be part of the HTTP Call as well (this must be passed with the standard "Authentication"-Header).

Problem/Question:

It took me a while to find out why the Authentication-Header never appeared in the approuter, until I found out, that the SAP approuter by default deletes this header before sending the request to the backend. On the offical documentation it says because of "security reasons" (see section "Headers"). I would like to know what are these reasons in particular? From my point of view this blocks the support of entra-id-based authentication on blob storages in Azure, which is - btw - the only officially recommended authentication mechanism by Microsoft.

For this setup to work, a manual modification of the approuter was necessary, which is not ideal, especially because it is also not clear why the authetication header is being deleted in the first place.

I would highly appreciate if someone could give an explanation, to see if or how a workaround can be achieved.

Many thanks and Best Regards

[gregorw]

Can you explain why SAP Integratio Suite needs to do the call via an Approuter? Who is the client calling Integration Suite? I would suggest to check if you find a post by @MartinRaepple that would help you to solve your scnario. Or please provide more details of the full screnario so others can help.

[ReinertM]

Hi @gregorw,

[ReinertM]

Thanks for your response. The reason to use an Approuter is, that as far as i know SAP Cloud Integration (resp. Integration Suite) does not support Private Link Services directly. The App router acts as a proxy as described here: https://community.sap.com/t5/technology-blogs-by-sap/sap-private-link-service-use-cases-for-sap-clou... (see section "How to achieve this"). As this blog post is from 2 years ago, this might be outdated but I am not aware of a way to connect PLS with Integration Suite directly. In my opinion this is not an authentication issue, but rather a missing feature of the approuter.