SAP Build Process Automation Call from SAP UI5 Application throws error

[divyagopal]

Calling the SBPA from SAP UI5 application gives the below mentioned error

• {
  "error": {
  "code": "bpm.workflowruntime.rest.principalpropagation.not.possible",
  "message": "The operation that you performed requires principal propagation but you are authenticated with an OAuth grant that cannot be propagated. Please perform this operation with a grant type that contains a user identity.",
  "logId": "615e37d6-6a46-4043-b30e-8420afe1c0e8"
  }
  }

Created destination using outh2clientcredentials.
Can someone help with this quickly.

[VaradBhagwat]

Hi, I'm getting 401 unauthorized error while calling Build Workflow API trigger from my SAPUI5 application (both locally running or from Build workzone). The URL called is "https://spa-api-gateway-bpi-us-prod.cfapps.us10.hana.ondemand.com/workflow/rest/v1/workflow-instance..." to get X-CSRF token. My Workflow created as per tutorial https://developers.sap.com/tutorials/spa-academy-run-salesorderprocess.html#fb19e3da-bee0-4477-afc4-... Can you suggest what is the possible resolution for this issue.

What is the correct URL to trigger the BPA workflow API from the SAP UI5 app. And what is the correct method to call the API ?

1. Calling SBPA Workflow API to trigger process from SAPUI5 app

2. 401 unauthorized error -

3. CORS issue while testing UI5 app locally or from Build Workzone

[maheshpalavalli]

Can you share the API that you are using? Guessing on the error, you are using the destination with client credentials. It's expecting principal propagation (eg. OAuth2UserTokenExchange). Then you should allow your UI5 app to propagate the user from the app to destination.

[MustafaBensan]

Hi Mahesh,

I have also seen authentication method OAuth2SAMLBearerAssertion used in destination configuration for principal propagation. In your experience, what are the considerations in choosing between this and OAuth2UserTokenExchange for principal propagation?

Thanks,

Mustafa.

[maheshpalavalli]

Yes, I've used both. You will see SAML while consuming the analytics cloud service. AFAIK, it depends on the provider; if the provider IDP is based on SAML then we need to use OAuth2SAMLBearerAssertion.

[MustafaBensan]

Thanks Mahesh.

[MustafaBensan]

Hi Divya,

This is the destination configuration that worked for me:

Did you also setup an API Trigger for the process?

Regards,

Mustafa.

[divyagopal]

Hi Mahesh,

Please find the details below

API - https://spa-api-gateway-bpi-eu-prod.cfapps.eu10.hana.ondemand.com/workflow.

Authentication - OAuth2ClientCredentials

[maheshpalavalli]

Can you share me where you got the api, like in api.sap.com URL for this service.

[MustafaBensan]

I would have expected the API URL in your destination configuration to be more like the following:

https://spa-api-gateway-bpi-eu-prod.cfapps.eu10.hana.ondemand.com/workflow/rest/v1/workflow-instance...