How to use Application based permission type in OAuth authentication in SAP ABAP?

[former_member694960]

Hi,

We have ABAP application to get the data from the exchange online server(Microsoft EWS) and for this, We have used the EWS web-service and Basic authentication(RFC). But we want to change authentication type from RFC to OAuth 2.0.

I have already implemented OAuth 2.0 in SAP ABAP and it is user/Delegation based. The problem with this permission type is, Every user has to login individually and request for the access token and also some of the feature is not working. So the alternative is to use the Application based permission type. Is it feasible in SAP ABAP?.

Application based means, their will be one token(it will be requested by the administrator) and this token will be used by all the user for authentication.

is SAML 2.0 bearer assertion an alternative ?

Your suggestion would be very helpful. Please assist me.

Best Regards,

Sanjay Naik.

[former_member612251]

This should work if I understand the requirement correctly. The services would be authenticating with OAuth and the users would be using the SAML Bearer to authenticate to maintain the audit trail. As long as the users are in the IDP that has been trusted with the SP (ABAP) then it should work. They couldnt use the same token as such but they would use the SAML to authenticate.

[Private_Member_467521]

Hi sanjay_naik,

SAML is one of the feasible solutions:

https://help.sap.com/doc/saphelp_nw74/7.4.16/en-us/4a/112f1a2228101ee10000000a42189b/frameset.htm

Here is one Business example for reference:

https://help.sap.com/doc/saphelp_nw74/7.4.16/en-us/f0/bd635533e9477a9bb99c69de3465d1/content.htm?loa...

Also, OAuth 2.0 Scopes could come handy:

https://help.sap.com/doc/saphelp_nw74/7.4.16/en-us/8d/2a607a70024a33bd0349e70b05a467/content.htm?loa...

Cheers,

Luis

[former_member694960]

HI luedazfr1

Thanks for your suggestion.

SAML will not be suitable for our application. So we are using the OAuth 2.0 Auth code grant and Oauth 2.0 Client credentials grant. Both the flow is working,But in both the flow we need to send the client secret(This we will get from Microsoft Azure) while requesting the access token code. I don't know, how to send the client secret. is it to be encrypted?. In the Microsoft documentation it is given that, client secret should be URI encoded.

https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow

Best Regards,

Sanjay

[Private_Member_467521]

Greetings sanjay_naik,

Our fellow community member Divya Mary has created this blog, which should shed a light for your topic on how to send the client secret.

Secure connectivity (OAuth) to SAP Cloud Platform Integration

https://blogs.sap.com/2018/03/12/part-1-secure-connectivity-oauth-to-sap-cloud-platform-integration/

Cheers,

Luis

[jakob_steen-petersen]

Hi Sanjay

I know this is an old post. But did you manage to connect to EWS with oAuth withput having each user loggin in?