Using destination with OAuth2SAMLBearerAssertion

[y_oshri]

Hello

Senario;

i am using cap cds with node

i have application A on CF for subacount X with xsuaa

i have application B on CF for subacount Y with xsuaa

i want to access an odata api from application B to application A

i created a OAuth2SAMLBearerAssertion destination

but when i try to use this destination i am getting an error

Failed to build headers. Caused by: The destination tried to provide authorization tokens but failed in all cases. This is most likely due to misconfiguration.Original error messages:\n' +

'Error determining metadata contracts

i flow this post https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/user-propagation-between-cloud-foundr...

i create a trust between the account except the part of setting role collection that i didn't had a clear understanding what role should i set/configure

any help ??

[CarlosRoggan · Accepted solution]

Hello Yaniv,

I went through a similar scenario, and created a little series of detailed blog posts.
I hope you'll find it helpful to go through it:

https://blogs.sap.com/2022/06/10/sap-btp-how-to-call-protected-app-across-regions-with-saml-and-oaut...

You'll see that the trust configuration is using both subaccount-SAML-metadata and the SAML-metadata of the destination itself.
Maybe you missed this part?
As the error message seems to be complaining about a missing SAML-metadata

Good luck,
Carlos

[y_oshri · Accepted solution]

Hi Roggn

Thanks a lot for your answer and for the amazing post

with the help of your article i was able to call my backend

the missing part was the role-collection that you define and later on assign to my user

but i have one question

my frontend application should be used for all sap users

and i am not able to give for each user this role-collection

so how should i handle this case?

[CarlosRoggan · Accepted solution]

Hi Yaniv,

I'm so glad to hear that the blog post could unblock you !!

About the second question, the answer would be "Role Collection Mapping"
In the Role Collection, you don't assign single user names.
Instead, one section below, "Groups", you define a mapping of your RC to a user group
Here, you have to specify the Identity Provider in the drop down (previously defined Trust in Trust Cofiguration).
And you specify the exact name of a group which exists in the IDP.
Usually, every user of an IDP should be assigned to multiple user groups.
Like that, all these users automatically get the Role Collection assigned

Does this help?

[y_oshri · Accepted solution]

Thank you very much Roggan for your help I really appreciate it

[jlong]

Here is another scenario, exposing your CAP project at subaccount level and then going to the next step and exposing it cross subaccounts;

https://github.com/SAP-samples/fiori-tools-samples/blob/main/cap/destination/README.md

John