No public access to oData

[MelinaLuciaAlt]

Hi experts

To my actual issue I found a lot of questions and answers, but nothing really fits to my case.

I created a database (MDC) with tables in my HCP trial account. Via Editor I generate an OData service using the following code:

.xsapp

{}

.xsaccess

{

"anonymous_connection": "iotmmsxs::anonuser",

"authentication" : null,

"exposed": true

}

.xspivileges

{ "privileges" :

       [ {

           "name" : "Basic", "description" : "Basic usage privilege"

          },

          {

           "name" : "Public", "description" : "Public usage privilege"

          }

        ]

}

anonuser.xssqlcc

{

"description" : "Anon SQL connection"

}

iotservice.xsodata

service namespace "iotmmsxs" {

    "SYSTEM"."T_IOT_DA677557E5D134C8DAEF" as "IPHONEMELINA" key generate local "ENTRY_ID";

    "SYSTEM"."T_IOT_M0T0Y0P0E1" as "AUTOIOTSERVICE" key generate local "GEN_ID";

}

Opening https://iotmmsdbd066202trial.hanatrial.ondemand.com/iotmmsxs/iotservice.xsodata is always working, but to access https://iotmmsdbd066202trial.hanatrial.ondemand.com/iotmmsxs/iotservice.xsodata/IPHONEMELINA for example, I have to log on.

When I am not logged on at the SAP HANA Web-based Development Workbench, this occurs:

(I guess) that is the reason why I get this error in my SAPUI5 application (WebIDE), when I want to write data from "/IPHONEMELINA" into a table:

XMLHttpRequest cannot load https://iotmmsdbd066202trial.hanatrial.ondemand.com/iotmmsxs/iotservice.xsodata/$metadata. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://webidetesting7993401-d066202trial.dispatcher.hanatrial.ondemand.com' is therefore not allowed access.

I am thankful for any comment!

Best regards,

Melina

[anton_levin · Accepted solution]

Hello Melina,

you may combine two examples from the IoT StarterKit:

1. Expose XSODATA (T_IOT tables) iot-starterkit/src/apps/xs/consumption at master · SAP/iot-starterkit · GitHub

2. Consume IoT MMS ODATA from UI5 app iot-starterkit/src/apps/ui5/consumption at master · SAP/iot-starterkit · GitHub (for your usecase you will consume not MMS ODATA but your XSODATA service, communication in that example app is done via HTTP destinations -> they will solve your COSR issue mentioned by Chris above)

Regards,

Anton

[MelinaLuciaAlt · Accepted solution]

Hi Anton,

thanks for your response!

The first link was my guide to build the oData service! And as soon as I am logged on at the SAP HANA Web-based Development Workbench, everything works fine.

The data from my IoT Service is correctly stored at the tables and the oData service.

Within my search I also found your second link.

I still have destinations for iotmms, iotrdms and https://iotmmsdbd066202trial.hanatrial.ondemand.com/iotmmsxs/iotservice.xsodata and also https://iotmmsdbd066202trial.hanatrial.ondemand.com.

I added the 'CORS'-Plugin to Chrome as well, but no changes (IE and Firefox fire an error as well)

Best,

Melina

[anton_levin · Accepted solution]

A follow-up question. Do you make use of those destination from your web app? Just having them configured is not enough.

[MelinaLuciaAlt · Accepted solution]

I guess, no.

I found this: and SAPUI5 - Setup the DataSource in the local application | SAP.

But stuck with both.

The first one insert code into Component.js and neo-app.js, but I have no idea wich serviceURL to add in my case.

The second one changes manifest.json and neo-app.js, but I am not able to add a data source (there is another dialog box and nothing to select).

Are they / one of them the correct approach or am I off the track?

Thanks!

[anton_levin · Accepted solution]

I would suggest to follow the StarterKit example and compare it with your setup. Let's take "iotmms" destination as an example:

1. Destination itself iot-starterkit/iotmms at master · SAP/iot-starterkit · GitHub (this one you create/import in your HCP Cockpit)

2. neo-app.json file iot-starterkit/neo-app.json at master · SAP/iot-starterkit · GitHub (here you declare your destination for your app, see lines 4-11)

3. Usage from JS code iot-starterkit/models.js at master · SAP/iot-starterkit · GitHub (you refer to iotmms in line #50, this one is declared in neo-json and when actual HTTP call is made it will use the URL from the destination, imported in HCP Cockpit)

Hope, this describes it better.

Regards,

Anton

[MelinaLuciaAlt · Accepted solution]

Thank you for your support, Anton!

But, unfortunately, still the same error. No changes.

Just to be sure, do the changes seem to be right?

By reference to the starterkit code, I guess, that I have to consume the data in another way than by

this.oModel = new sap.ui.model.odata.v2.ODataModel(

  "https://iotmmsdbd066202trial.hanatrial.ondemand.com/iotmmsxs/iotservice.xsodata", {}

  );

.

.

.

oTable.setModel(this.oModel);

  oTable.bindRows("/IPHONEMELINA");

But isn't it possible to configure my oData / destination, so that I can use it like that?

Best regards,

Melina

[anton_levin · Accepted solution]

I see several issues now which need to be solved separately:

1. I tried to access https://iotmmsdbd066202trial.hanatrial.ondemand.com/iotmmsxs/iotservice.xsodata from incognito mode and was able to access it without any authentication -> you specify "system" user in your destination. This makes no sense since your service is not protected and moreover "system" is a DB user not application user.

2. If for consumption you use UI5 ODataModel, then the top level url (which you specify in argument) should point to *.svc or *.xsodata (service url of your Odata service). Later on you bind a concrete EntitySet to UI control (like Table). To get more details on how data binding works, I would suggest to follow UI5 official documentation.

3. Try to figure out (just from the browser) why you can't access your EntitySets when launching ..*iotservice.xsodata/EntitySetName URL -> something is wrong with the service implementation itself.

Regards,

Anton

[ChrisPaine · Accepted solution]

I think we need to consider what CORS is - and why it exists as this is the error! (having an unauthenticated web service is a different albeit important issue)

CORS is there to stop/allow web pages from accessing other web servers other than the server that the web page is originally server from. I.e. if I access a page from www.wombling.com I should not expect it to be fetching data from www.sap.com and presenting it. Mainly this restriction is to secure web pages and to stop injection of content from other sources. By using CORS a web service explicitly nominates the servers to which it should be allowed to publish content and which are allowed to read content from it.

Because your UI5 app is running on a different domain to your web service you cannot consume the web service inside the app unless the service supports CORS.

Have a look at this thread which deals with adding CORS support to your XSOData service.

[MelinaLuciaAlt · Accepted solution]

Hi Chris,

thanks for your reply and the explanation about CORS.

After uncountable hours spending with searching through SCN and trying a lot of changes in my project, there is public access to my oData, but the service still doesn't support CORS.

I followed the instructions, Denis Descause mentioned in the thread you recommend me.

I "found" XS Admin UI and also SQL Connection Details and configured them.

Additionally I added a xsjs file and insert the following code

I used the code from Create an XS SQL Connection Configuration - SAP HANA Developer Guide for SAP HANA Studio - SAP Libra..., because I don't really know where to add Denis' code.

I noticed, that in most examples, they are using HANA Studio.

Am I forced to create an oData via HANA Studio? Could this be the reason why the error is still the same?

I simply have opened Editor and created the required files.

Please excuse my frequent inquires and all misunderstanding, I am a beginner in this topic...

Thanks and

regards,

Melina

[MelinaLuciaAlt]

finally it works

I created a new XS and UI5 project in Eclipse and integrated them like Jagannathan shows in this document

Many thanks to Chris and Anton for improving my understanding of XS and CORS

[ChrisPaine]

Hi Melina,

your issue appears to be CORS related rather than authentication based.

check out for a little background - might help you look in the right places to resolve your issues.

Cheers,

Chris

[MelinaLuciaAlt]

Hi Chris,

thanks for your response!

Within my search I stumbled across 'CORS' and added destinations to https://iotmmsdbd066202trial.hanatrial.ondemand.com/iotmmsxs/iotservice.xsodata and also https://iotmmsdbd066202trial.hanatrial.ondemand.com.

I also added the 'CORS'-Plugin to Chrome, but there is still an error  (IE and Firefox fire error as well).

Something that I forgot to think about?

Best,

Melina