Connecting from SCP workflow to SAP PI(On-premise) via cloud connector

[soumen_das8]

Hi,

I am trying to connect SCP workflow to a REST service on SAP PI(on-premise) via cloud connector but keep getting 403 forbidden error.

Have installed a docker system on local desktop which hosts the cloud connector. While testing the REST service from POSTMAN on local desktop it works just fine but while trying to initiate an instance from SCP trial account via cloud connector(again installed on local system based docker system) it fails.

Here's the destination configuration on trial tenant. Used virtual host:port defined in cloud connector for URL:

Here's the cloud connector setting to On-premise PI system, Resource is maintained as '/' :

Am I missing something under additional properties for Destination definition? I referred this link to see the possible parameters but it has values for odata,abap and UI5 majorly. No mention of PI connectivity details.

While trying to invoke the connection this is the error I get :

With same credentials am able to reach the REST service via POSTMAN but here it gives 403 forbidden.

Appreciate any inputs with this?

Thanks in advance!!!

[tobias_breyer]

Hi,

testing with Postman can only show that the credentials work. But there are lots of differences when the call goes through two additional components.

I suppose you will get the best hints on what's wrong when looking at traces on PI side, possibly rather the low-level security traces than PI specific ones.

AFAIK, the PI REST Adapter is on the Java stack, if you have a classical double stack and no Process Orchestration. That means, you probably need to check on the Java stack.

Maybe also check the Principal Type setting of the Cloud Connector. Some settings there make the calls fail when the backend system's logon procedures are configured in certain ways. I'd recommend either Principal Type "None" or "X.509 strict".

Overall, Cloud Connector and backend connections can be tricky to get them working. I'd recommend to open a support incident if the above does not help. Then you get more support on where exactly you can turn on the traces.

Regards,

Tobias

[soumen_das8]

Thanks for the response Tobias.

Thing is both POSTMAN and Cloud connector are installed on my local system. So ideally credentials should behave similarly in theory. Principal type is set to none in CC.

Under destination there are certain properties required usually but in SAP help ( link ) I see parameters for ABAP, UI5 etc but none for PI/PO. Any idea if its a miss or for connecting with PI/PO no such properties need to be set in destinations?

Meanwhile I will try to get in touch with basis for low level log files.

TIA!!!