azuredevcollege / sap Goto Github PK

To me it seems like the Postman configuration parameters are not matching the parameters set in the tutorial?

Include SAP & Microsoft references / links?
https://wiki.scn.sap.com/wiki/display/Security/Using+OAuth+2.0+from+a+Web+Application+with+SAML+Bearer+Assertion+Flow

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/sap-netweaver-tutorial --> Explain the difference between NW system config for SAML & OAuth (Enterprise apps needed for SSO with SAML and OAUTH flow --> Potential for wrong config)

https://blogs.sap.com/2020/07/17/principal-propagation-in-a-multi-cloud-solution-between-microsoft-azure-and-sap-cloud-platform-scp/

Are all reply URLs in this screenshot mandatory?
https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/AzureActiveDirectoryConfiguration/img/AADEnterpriseApplicationRegistrationSAPSingleSignOnBasicConfiguration.png

Comment / Advise how to implement SAML SSO / OAuth Principal propagation in parallel?

In order to make the steps more and easier reproducible a suggestion would be to implement the tutorial based on the following SAP CAL image:
SAP NetWeaver 7.50 SP1 AS ABAP and SAP BW on SAP HANA SPS10 - Developer Edition
https://caldocs.hana.ondemand.com/caldocs/help/Getting%20started%20guide%20NetWeaver%207.5%20on%20SAP%20HANA_v2.pdf

Implement Postman example with NodeJS as chatbot. (Roman)

Even after following all the explanation in this repo https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md beautifully and in detail, here is one thing which got me stuck and postman call to OData service was failing to retrieve data and sending back for login (in our case to Azure AD login as SSO enabled). In layman terms it was ignoring the Authorization header with OAuth token (bearer) value.

We followed step by step to setup as follows:

1. Azure AD and SAP SSO setup - Azure AD SSO config with SAP Netweaver
2. Azure AD configuration - register applications (Frontend App, Enterprise App), export SAML metadata for trust configuration in SAP
3. SAP NetWeaver Configuration - Generate user, setup federation an trust between SAP NetWeaver and Azure AD, setup OData service, configure OAuth client, configure scopes

While testing postman queries at last step were getting following error

Later when opened ticket with SAP, we got to know some configurations due to which it was not accepting OAuth token (it is not default enabled in SAP)
While creating new OData Service, default HTTP handler is different and it can't handle OAuth authorization.
It has to be replaced in ICF node with this /IWFND/CL_SODATA_HTTP_HNDL_OAT.
And Execute the report /IWFND/R_OAUTH_SCOPES to create an OAuth scope for your service.

Also in OAuth client registered for on-behalf-of authentication, please tick check-box for SSL certificate

Some screenshots are in German.

Include a section "How to debug/troubleshoot?" with tools like:
SEC_TRACE_ANALYZER
https:///sap/bc/webdynpro/sap/sec_diag_tool?sap-client=122&sap-language=EN#

1688545 - OAuth 2.0 Server in AS ABAP Troubleshooting

Configuration of IdP in SAP via config file and certificate of Azure AD not required?
https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-using-saml

--> See trusted IdP config:
https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/sap-netweaver-tutorial#register-the-new-oauth-20-client-id-with-the-creation-wizard