SAP BTP Application - Destination OAuth2ClientCredentials

[rolfhoven12342]

Hello together,

we have developed a UI5 application which is using Destinations. The Destinations have OAuth2ClientCredentials configured for authentication. When the user is loading the first time the application Single-Sign-On is used for authentication. But when the user loads the same application after some time again we are getting 401 error.

What would be the best approach to fix this problem? For now, the only way I find, is to reload the page again.

Thanks and best regards,

Julian

[rolfhoven12342]

Hi,

I'm trying to do the same, by calling a Destination from BAS. ( Trial )

I followed this video: https://www.youtube.com/watch?v=AkKD5pBrmVk

...but my curl command only reply with a "internal error".

Is there any limitations in the Trial-BTP at the moment ?

Best regards,

Rolf

[Ivan-Mirisola]

Hi julian_vogel,

OAuth2ClientCredentials is not intended for front-end consumption. It is indented for services that will consume an API. Therefore, the service will have to handle the validity of the token received (bearer) and it should request a new one once it detects it has expired. Usually this is inside the implementation of a server-side-application (such as NodeJs or Java).

If the service is implemented on the same project (meaning, it is the srv module), then you ought to be forwarding the JWT obtained on your application router to the destination. That can be achieved using the "forwardAuthToken" on your MTA. You can read more here:

https://blogs.sap.com/2022/07/08/fundamentals-of-security-in-btp-implement-authentication-in-a-node....

Here is another blog explaining how you can forward the JWT token using CAPM on an MTA project:

https://blogs.sap.com/2020/07/20/cap-demystify-user-authentication/

If in fact you are calling an external API (outside of BTP's scope), then the destination must be of type OAuth2ClientCredentials and it should be used inside a service implementation on BTP (not be directly consumed by a Front-End application). The reason is that HTML5 applications will load the destination information in clear text - so every user that has access to this application will know the secure ID and Secret being used - all they need to do is open the browser's developer tools and inspect the request that loads the destination.

You can easily create an API proxy in CAPM consuming another REST API or SOAP WS if you want to and have it working with the "forwardAuthToken".

Best regards,
Ivan

[rolfhoven12342]

Hi,

From BAS, using command: curl -v -i https://btpcpisub.dest/http/ui5test1

I have a Destination: btpcpisub with OAuth2.0 to CPI , where my iflow is: /http/ui5test1 working from Postman.

This is a Trial-account.

Any idea why I get this Internal Server Error?

Log from the curl-command: