SAP Cloud SDK - Principal Propogation & Cloud Connector

[vfweiss]

Hello All,

We have been using the SAP Cloud SDK with a service user to our on-premise backend, so far so good.
However now we are trying to enable Principal Propagation.

So we set the destination to On Premise and the Authentication method to PrincipalPropagation.

However this causes the Execute to fail, with the thrown error:

Failed to build authorization header for the given destination. Make sure to either correctly configure your destination for principal propagation, provide both a username and a password or select "NoAuthentication" in your destination configuration.

I found that this came from buildAuthHeader in the authorization-header.js as the case 'PrincipalPropagation' isn't covered.
Is it possible to use PrincipalPropagation with the SAP Cloud SDK to an On Premise system? And if so, what am I missing? 😄

Thanks in advance,

Vincent

[dhem]

Hi Vincent, we are aware that this is currently not working properly in the SAP Cloud SDK for JavaScript and are already tracking it in our backlog. Is this a critical issue for you or is it possible to work around it for now?

[vfweiss]

If it's fixable by using a workaround by adding custom headers, I could try that, but I don't know how and what exactly I should do in that case. (Was thinking set to No Authentication and add custom stuff, but so far I haven't got that working).

Else we need to switch to a Service User, but for traceability that is not the preferred way. (Manually forward Username and update it in SAP after and such).

[dhem]

This may sound strange, but can you try the following: I'm assuming you're already passing the user's jwt when executing the request (otherwise principal propagation won't work anyway). Can you set the authentication to "NoAuthentication" and see what happens then (i.e. without doing anything else in terms of custom headers and so)?

[vfweiss]

That seems to be working indeed 🙂

[dhem]

Glad to hear it worked! I'll write that up in the answer, just to make the workaround more visible to others. We will fix this in an upcoming release.

[frank_essenberger1 · Accepted solution]

I also put this as an answer, because in a comment this could be overseen. We fixed the bug in the SDK that now also with AuthenticationType "PrincipalPropagation" the user should be propagated. The old work around using "NoAuthentication" keeps working in the versions 1.X.Y of the SDK. We plan to remove this from version 2.X.Y onwards.

[vfweiss · Accepted solution]

Thank you Frank. Also switched this as the Active Answer now, so people can see the most up to date information on top. 🙂

[dhem]

Principal propagation with SAP S/4HANA OnPremise is currently slightly buggy. You can work around it by changing the AuthenticationType from "PrincipalPropagation" to "NoAuthentication" and keeping the rest of the configuration as is.

[marcmaurí]

Hi Dennis,

Let me take advantage of your answer to launch a related question.

Does this solution also apply when the target is an S/4 Hana Cloud system?

Thanks in advance.

Best regards,

Marc

[dhem]

Hi Marc,

no, this won't help you when it comes to SAP S/4HANA Cloud. There is an execellent blog post by my colleague Marco on how to configure principal propagation with S/4HANA Cloud. However, I see that you've already commented on this blog post. Are there problems that you're currently facing with principal propagation?

Best regards,
Dennis

[marcmaurí]

Thank you very much Dennis!
I tried to implement principal propagation a few months ago with a java app, but I didn't get success and I set basic authentication.
Now I'm back to it, but trying to implement it in a nodejs CAP based application. I will follow the blog again and in case of any problem, I will let you know.
Kind regards,
Marc

[frank_essenberger1]

We fixed the bug in the SDK that now also with AuthenticationType "PrincipalPropagation" the user should be propagated. The old work around using "NoAuthentication" keeps working in the versions 1.X.Y of the SDK. We plan to remove this from version 2.X.Y onwards.