Facing 401 unauthorized error while trying post data to CPI via SAP API Management

[MadhuraJogi]

Hi,

I am trying to send request to SAP CPI via API Management.

But I am facing "401 Unauthorized" error while connecting to CPI though I have maintained correct credential in KeyValue Map. (CSRF token is unchecked in CPI HTTP adapter)

Using same credentials I am able to call CPI endpoint directly from Postman send data successfully.

I tried to test from both API Management and Postman(by calling API endpoint) but no luck. Also tried removing all the other policies.

Can someone help me understand if we have to do any kind of whitelisting or additional roles to be added to call CPI from APIM?

Below is the screen from APIM Debug :

Thanks in advance.

Regards,

Madhura

[nageshrao]

Hi Madhura,

HTTP 404 is fine when doing a connectivity test. It simply is a ping test to the Cloud Integration Tenant and means its gone through successfully. 
HTTP 401 comes when you have an unauthorised access. This might be coming when you are hitting the exact iflow URL via APIM. 
Please check the username and password that was configured in keyvalue map. Another way to check that your credential is being passed correctly is to check the request headers just before hitting the Cloud Integration Tenant and ensure that the Authorization header has the exact same value as you would have in Postman. Base 64 encrypted username/password.

Please refer to the below two posts and also have a read through the comments and these might be helpful. 

https://community.sap.com/t5/technology-q-a/sap-api-management-expose-integration-flow-endpoint-as-a...
https://community.sap.com/t5/technology-blogs-by-sap/sap-api-management-discover-integration-flows-f...
https://community.sap.com/t5/technology-blogs-by-sap/working-with-encrypted-key-value-maps-using-sap...

[MadhuraJogi]

Hi,

There was a mismatch with the Key used in the policy and KVM. After making the changes, I am able to post the data successfully to CPI.

Thanks for suggestions.

Regards,

Madhura

[Dinu · Accepted solution]

No. Nothing special is needed. The provided credentials are wrong or provided with the wrong header. 

The best way to connect to iflows from API Management is using API Provider of type Cloud Integration Flow. You start by configuring an API Provider of type Cloud Integration and then create an API Proxy with discovery using this. There is no need to configure any policies to connect to iFlows, if you do it this way. 

[MadhuraJogi · Accepted solution]

Hi,

I tried to create API Provider as well. First of all it is give 404 Not Found warning while doing the connectivity test.

And if I try to create an API Proxy using that API Provider, it is not able to connect when I click on Discover option.

Regards,

Madhura

[Dinu · Accepted solution]

You configuration is not correct. The response should be 200; Message OK. Use the hostname and credentials from the key for plan api from service SAP Process Integration Runtime. This provider is for discovery. When you configure the iflow later, you need to provide the credentials from the plan integration-flow. Warning: The iflow has to be of type API (REST or oData) for discovery to list these.