Enterprise Resource Planning Blogs by Members
Gain new perspectives and knowledge about enterprise resource planning in blog posts from community members. Share your own comments and ERP insights today!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Secret Manager with ABAP SDK for Google Cloud

ameya_2023
Participant
‎2023 Sep 23 6:51 AM
1,069

Many API’s which are part of Google Library use API key as a credential for execution. As best practice, we should not embed credentials directly in code or application source tree. The ideal way would be to store them centrally with access restricted to administrators. Storing centrally also means that the application using these credentials need to have an easy way to retrieve them for their functioning.


Google Cloud Secret Manager is a secure and convenient storage system for API keys, passwords, certificates, and other sensitive data. Secret Manager provides a central place and single source of truth to manage, access, and audit secrets across Google Cloud.


ABAP SDK provides an implicit way to connect and use Google Cloud Secret Manager API to store and retrieve secrets.


This quickstart shows you how to use Secret Manager API to store and retrieve API keys using ABAP SDK and use it to call Translate AI API.


The configuration steps in this quickstart guide assumes that the SAP system is hosted on Google cloud platform. If needed you can refer to this blog, to get the ABAP Platform Trial 1909 running on Google Cloud Platform within 30 mins.


To learn more about authentication step for SAP system hosted outside Google Cloud Platform, please refer to the documentation “Authenticate using API key stored in Secret Manager”.



Before you begin


Before you run this quickstart, make sure that you or your administrators have completed the following prerequisites:




Create a API Key and Save in Secret Manager


Enable required services



  • Click Activate Cloud Shell at the top of the Google Cloud console to Open Cloud Shell. We will use the Cloud Shell to run all our commands.



Enable Google Service to be accessed by ABAP SDK (Replace the string PROJECT_ID with your Google Cloud project Id)



gcloud auth login

gcloud config set project PROJECT_ID

gcloud services enable iamcredentials.googleapis.com

gcloud services enable secretmanager.googleapis.com

Create Service Account


Create a Service Account to be used by ABAP SDK and assign it the Secret Manager Secret Accessor role. (Replace the string PROJECT_ID with your Google Cloud project Id)



gcloud iam service-accounts create abap-sdk-qs \

    --description="ABAP SDK Quick Start" \

    --display-name="ABAP SDK Quick Start"



gcloud projects add-iam-policy-binding PROJECT_ID \

    --member="serviceAccount:abap-sdk-qs@PROJECT_ID.iam.gserviceaccount.com" \

    --role="roles/secretmanager.secretAccessor" \

    --condition="None"

Create a API Key


To create API keys using the Google Cloud console, perform the following steps:




  • In the Google Cloud console, go to the Credentials page: “Go to Credentials”

  • Click Create Credentials and select API key from the menu.

  • The API key created dialog displays the API key string. Copy your key string and keep it secure. You need this API key to configure authentication in SAP.

  • By default, API keys are unrestricted. We recommended that you restrict API keys by selecting the APIs to which this API key can be used. For now please restrict by selecting “Cloud Translation API”.




Create a Secret to save the API Key


In the Google Cloud console, create a secret with the name TEST_SECRET, and store the API key as the latest version.
Go to Secret manager


For information about how to create a secret, see Create a secret.


The ABAP SDK for Google Cloud by default retrieves only the latest version of a secret.



Configure client key for Secret Manager access


The below configuration will be used by the ABAP SDK to connect to the secret manager API.




  • Goto SPRO > ABAP SDK for Google Cloud > Basic Settings > Configure Client Key and add the following new entry. (Replace the string PROJECT_ID with your Google Cloud project Id)


Google Cloud Key Name:CLIENT_KEY_SM

Google Cloud Service Account Name:abap-sdk-qs@PROJECT_ID.iam.gserviceaccount.com

Google Cloud Scope:https://www.googleapis.com/auth/cloud-platform

Google Cloud Project Identifier:PROJECT_ID

Authorization Class:/GOOG/CL_AUTH_GOOGLE

NOTE Leave the other fields blank.


  • Validate the configuration ‘CLIENT_KEY_SM’ using SPRO > ABAP SDK for Google Cloud > Utilities > Validate Authentication Configuration.




Configure client key for the Tanslate API call using API Key


The below configuration will be used by the ABAP SDK to 1) connect to the secret manager API, 2) retrieve the API key stored in the secret 3) connect to the Translate AI API.




  • Goto SPRO > ABAP SDK for Google Cloud > Basic Settings > Configure Client Key and add the following new entry. (Replace the string PROJECT_ID with your Google Cloud project Id)


Google Cloud Key Name:DEMO_TRANSLATE
Google Cloud Service Account Name:Leave this field blank.
Google Cloud Scope:https://www.googleapis.com/auth/cloud-platform
Google Cloud Project Identifier:PROJECT_ID
Authorization Class:/GOOG/CL_AUTH_API_KEY_SM
Authorization Parameter 1:CLIENT_KEY_SM → This is the client key that you've created for Secret Manager access
Authorization Parameter 2:TEST_SECRET → This is the ID of the secret, which has the API key stored

NOTE Leave the other fields blank


  • Validate the configuration ‘DEMO_TRANSLATE’ using SPRO > ABAP SDK for Google Cloud > Utilities > Validate Authentication Configuration.



The SDK configuration is now complete, and API keys can be stored and retrieved. These keys can be used to call compatible APIs, such as Cloud Translation and Google Maps API like Address Validation, Directions, Distance Matrix, Elevation, Geocoding, Places, Roads, and Time Zones.


We can now proceed with a sample invocation of the Cloud Translation v2 API using the API key configuration that is retrieved from Secret Manager.



Create a program to translate a text



  • Create a program in SE38 and paste the linked code (also pasted below), which translates the English sentence to German language.

  • Note: The Client key used in the program is DEMO_TRANSLATE which will be used by the SDK to retrieve the API key stored in the Secret Manager.


REPORT zr_qs_translate_texts.



" data declarations

data: lv_text         type string,

      lv_msg          type string,

      lv_ret_code     type i,

      lv_err_text     type string,

      ls_err_resp     type /goog/err_resp,

      ls_input        type /goog/cl_translation_v2=>ty_006,

      ls_output       type /goog/cl_translation_v2=>ty_007,

      lt_translations type /goog/cl_translation_v2=>ty_translations,

      ls_texts        type /goog/cl_translation_v2=>ty_008,

      lo_translate    type ref to /goog/cl_translation_v2,

      lo_exception    type ref to /goog/cx_sdk.



TRY.

" instantiate api client stub

    create object lo_translate

      exporting

        iv_key_name = 'DEMO_TRANSLATE'.



" pass the text to be translated to the required parameter

    lv_text = 'The Earth is the third planet from the Sun'.

    APPEND lv_text TO ls_input-q.



    ls_input-format = 'text'.

    ls_input-source = 'en'.

    ls_input-target = 'de'.



" call the api method to translate text

    call method lo_translate->translate_translations

      exporting

        is_input    = ls_input

      importing

        es_output   = ls_output

        ev_ret_code = lv_ret_code

        ev_err_text = lv_err_text

        es_err_resp = ls_err_resp.

    IF lo_translate->is_success( lv_ret_code ) = abap_true.

        lt_translations = ls_output-data.

        READ TABLE lt_translations-translations INTO ls_texts INDEX 1.

        WRITE: / 'Translation Successful'.

        WRITE: / 'Translated Text is: ', ls_texts-translated_text.

      ENDIF.

  

" close the http connection

      lo_translate->close( ).



  CATCH /goog/cx_sdk INTO lo_exception.

" write code here to handle exceptions

  endtry.


Program to retrieve the secret


Referring to the above example, you can use Secret Manager to store any secrets relevant for your requirement. The SDK can be used to retrieve the secret directly from the secret manager service. The reference code to access a secret version available in this link. Try running the code with Client Key as CLIENT_KEY_SM and Secret Id as TEST_SECRET to retrieve the stored secret.



Example Input:


"Open HTTP Connection

DATA(lo_sm) = NEW /goog/cl_secretmgr_v1( iv_key_name = 'CLIENT_KEY_SM' ).

 

"Populate relevant parameters for the API call

lv_p_projects_id = lo_sm->gv_project_id.

lv_p_secrets_id = 'TEST_SECRET.

lv_p_versions_id = 'latest'.



 "Call the API method

 CALL METHOD lo_sm->access_versions ....

 ...

Conclusion and Next Steps


Hope the article was able to give you a quick insight on using Secret Manager with ABAP SDK for Google Cloud.


Ready to start using ABAP SDK for Google Cloud?


Bookmark What’s new with the ABAP SDK for Google Cloud for the latest announcements and follow installation and configuration instructions.


Check out these blog posts to get started with ABAP SDK for Google Cloud




  • This blog, explains how you can evaluate ABAP SDK for Google Cloud using ABAP Platform Trial 1909 on Google Cloud Platform.

  • Read this blog from deveshsin on how a business process such as Sales Order entry in SAP can be automated using ABAP SDK for Google Cloud.

  • This blog by ajith.urimajalu is an excellent start to understand how BigQuery ML which is a powerful machine learning service that lets you build and deploy models using SQL queries. you can now be accessed with ABAP SDK for Google Cloud.

  • Also check out kritisugandha blog post about ABAP SDK Code Wizard , one of the many Engineering excellence delivered as part of ABAP SDK.


Happy Learning! and Happy Innovating!

4 Comments
Labels in this area
Popular Blog Posts