SAP CPI Authentication into workspace API

[nunocpereira3]

We have SAP CPI in place and we want to implement E2E deployment via CI/CD using jenkins. However, since we're using script collections and the deployment of script collections is not available via odata api, I was searching for alternatives.

I traced from the UI that a call like this is being done to deploy a script collection via the CPI workspace API:

https://2f67008btrial.it-cpitrial04.cfapps.eu10-002.hana.ondemand.com/itspaces/api/1.0/workspace/09d...

If I call this from this /itspaces/api/1.0/workspace api via browser authenticated with my sap id it works, because I have the cookies necessary that have my authentication details (JSESSIONID and __VCAP_ID__).

However, when calling via postman without these cookies, I get redirected to:

https://2f67008btrial.authentication.eu10.hana.ondemand.com/oauth/authorize?response_type=code&clien...

If I manually proceed to call directly the link above via postman I get into a page where I can sign with the default sap identity provider having the url:

https://accounts.sap.com/oauth2/authorize?client_id=45be646d-1b42-4c0c-a44a-3fa237b59fe3&response_ty...

If I finally open this final url I get into a page stating:

"OpenID provider cannot process the request"

Do you know what I need to create like a client id and client secret that would allow me to call the api without problems? I tried already to create a service instance for xsuaa, for cpi, but nothing seems to work :(.

[sunny_kapoor]

Hi nunomcpereira,

It is not recommended and advised to use the internal and unlisted APIs.

I strongly recommend not to go in this direction.

Regards,

Sunny

[nunocpereira3]

Hi Sunny,

many thanks for your input, I fully agree that this approach should be avoided at all means and it can stop working without notice since it was not officially published by SAP (same as with the Operations API), but the requirement still exists so I'm searching for alternatives.

I was also curious to understand from a POC perspective if there's some standard way using XSUAA or any other method to be able to use these internal APIs and bypass these oauth checks (meaning how to collect a bearer token that grants access to these internal apis). Do you have any experience with this?

Thanks,

Nuno Pereira

[venkatesh789]

Hi Nuno,

Did you able to test the API. I'm also doing the POC. Need your inputs to test the API.