XS Advanced Error 403 Forbidden

[Former Member]

Hello everyone,

Could any one help over here..

We got a problem after installing XSA on our SP12 system, Whenever we try accessing WEBIDE over the URL from xs app webide -urls we are getting an error/message “Forbidden”, not sure what went wrong..

The header response says 403 forbidden..
We have a clean install of SP12, XSA, and we followed the TinyWorld tutorial. https://blogs.sap.com/2016/03/28/developing-with-xs-advanced-a-tinyworld-tutorial/

The SAP HANA Runtime Tools works fine.

I tried to get the URL of HANA Xs Administation tools but I didn't find the app. I don't know if it is installed or we need to install it separately.

Thanks in advance

[thomas_jung · Accepted solution]

XSA Admin Tutorial: just use the command xs install <admin.zip file>. You can download the XSA Admin MTAR zip installation file from the Service Marketplace or its on the HANA installation media.

As far as doing the role collection from the command line: The command you found is for the controller role. It is not enough for the SAP Web IDE. The Web IDE also requires an XSA application role as well. I would really recommend the use of the XSA admin tool to create this additional role.

[Former Member · Accepted solution]

Thanks, I will try to follow your tutorial to create the role collection. Unfortunately I didn't find the XSA Admin MTAR in Service Marketplace. Can you please provide a link ?

[Former Member]

Hi friends,

Finally I found what was missed!

As mentioned in the guides I had already set up role, roles collection and assigned to XSA_TEST user and so on.

I log on XS Admin

Afterwards i have been able to connect WEBIDE

Thanks a lot for your comments

Best regards.

[Former Member]

Hi Emilie

I think this is the same as xs set-space-role USER orgname SAP SpaceDeveloper

Thanks

[Former Member]

Hi Houssem,

When I installed XS Advanced I had to define a orgname XXXXX, later SAP space depends on this org, when I did it from XS Admin I could select my orgname and mark flag for developer. So I supose the command is the same, but you have to adapt your data like orgname I guess.

Regards.

[Andreas5]

Beside

• Assigning the XSA Roles to the user and
• the Space (as explained by Emili),

I also had to either open a new incognito window or clear cookies for logging in with the development user.

If you switch between admin/dev, it seems that there is a conflict in cookies.

[Jonathan_Haun]

Using SAP HANA Express 2.0 SPS1.... I was able to work around the error by exporting the server certificate using Internet Explorer and then importing it again into the xsa-admin using the Trusted Certificates tile. I think you can also use the XS cli to import it.

[former_member311928]

Hi, same problem as mentioned by Emili Delgado

I get "Forbidden" when trying to access the Web IDE. The log says: "GET request to /watt/index.html completed with status 403 - You do not have the required scopes to access this resource."

I think I have the correct components installed. I have:

• XS Monitoring - Installed Version: 1.4.0
• SAP Web IDE Web Client - Installed Version: 4.1.0
• SAP HANA XS Advanced Runtime - Installed Version: 1.0.55.288028

I have access to Web UI for XS Advanced Administration.

I have users with parameter: parameter 'XS_RC_XS_CONTROLLER_USER' = 'XS_CONTROLLER_USER'

I have given: xs set-space-role Morten orgname SAP SpaceDeveloper, I tried the same for user XSA_ADMIN

I have made a role collection with Role Template (and Role Name) = WebIDE_Developer (this is from Application Name webide!i1).

I have assigned this role collection to both XSA_ADMIN and Morten.

The command: "xs app webide -urls" tells me the WebIDE is at https://vhcalhdbdb.dummy.nodomain:51023, so I go there, but get the error mentioned: Forbidden.

What have I missed?

[former_member368981]

Hi Morten Espelid,

You have granted needed roles to connect WEBIDE. Maybe the problem is port conflict, can you check 51023 ?

Could you post more webide log and xscontroller.log ?

Regards,

Duy Ngo

[former_member311928]

Hi Duy,

I do not have the mentioned system anymore, however, I will probably try to set up the same thing another time and if I get the same problem then I can refer to your answer again.

By the way, I managed to set up Web IDE on a HANA Express instance. The problem mentioned above occured on a "SAP HANA, developer edition 1.0 SPS 12" instance from SAP Cloud Appliance Library.

These days I just work in Web IDE on the SAP Cloud Platform, however I do not have the opportinity to use node.js and so on there, as was my intention of setting up the Web IDE mentioned above.

[former_member368981]

Hi Morten Espelid,

Please comment here if the issue happen to you again.

Best Regards,

Duy Ngo

[draschke]

Hi,

in our case were the RoleCollections empty after the upgrade (2.0 SPS 01)

Now its working again...

[Former Member]

Dear Thomas,

I have the same issue HTTP 403 when I try to Access to web ide. However in my case I have installed XSA-ADMIN and I can see logs for webide app

[1493053594836] [APP/1-3] SYS #2.0#2017 04 24 19:06:34:835#+02:00#ERROR#/Handler#########AhPm6M77yKuAltaM-GRmJkl5CdxGFN5V######j1wdk6vd#PLAIN##GET request to /watt/index.html completed with status 403 - You do not have the required scopes to access this resource.#

[1493053594906] [APP/1-3] SYS #2.0#2017 04 24 19:06:34:906#+02:00#ERROR#/Handler#########AhPm6M77yKuAltaM-GRmJkl5CdxGFN5V######j1wdk6xi#PLAIN##GET request to /favicon.ico completed with status 403 - You do not have the required scopes to access this resource.#

[1493053594921] [APP/1-3] SYS #2.0#2017 04 24 19:06:34:921#+02:00#ERROR#/Handler#########AhPm6M77yKuAltaM-GRmJkl5CdxGFN5V######j1wdk6xz#PLAIN##GET request to /favicon.ico completed with status 403 - You do not have the required scopes to access this resource.#

Roles and permissions seems to be ok

Any idea?

Thanks in advanced

[Former Member]

Hi Emili

You need to create the role WEBIDE and then assign it to your user

[thomas_jung]

The name is perhaps a bit misleading in the Service Marketplace. Its called XSACMONITORING.

https://launchpad.support.sap.com/#/softwarecenter/template/products/_APP=00200682500000001943&_EVEN...

Navigation path:

• SAP IN-MEMORY (SAP HANA )/
• HANA PLATFORM EDITION/
• SAP HANA PLATFORM EDITION/
• SAP HANA PLATFORM EDITION 2.0/

XS MONITORING 1

Depending upon your release you might have to adjust the above for HANA 1.0 or HANA 2.0.

[Former Member]

Thanks Thomas, It works.

I would like to know, should i install webide in SAP Space or in DEV space ( the created space). Actually i installed webide and tried to build my first project but i get error that the builder not availabe. The di-core and di-runner apps are available in SAP space but not in DEV space.

thanks in advance

[thomas_jung]

They should be installed in the SAP space only. This is why you have di-space-enablement-ui application. Run that and it will install the di-builder into any space you select (in your case the DEV space).

[Former Member]

I am getting error 403 when i login into di-space-enablement-ui url with my XSA_ADMIN user. should i create a new collection role too ? can I run it directly with CLI ?

[thomas_jung]

When you created the role collection, there were two role templates WebIDE_Administrator or WebIDE_Developer. You need the additional WebIDE_Administrator to run the di-space-enablement-ui.

>can I run it directly with CLI ?

The di-space-enablement tool? No it is a Web UI, you should access it via a web browser.

I strongly recommend the SAP Web IDE for SAP HANA installation and upgrade guide.

https://help.sap.com/viewer/1a8e7ab05a2e4119b02b702f211422f5/2.0.00/en-US/731c647f126d4850a176ff4aa2...

It contains all these details which we've been discussing.

[thomas_jung]

It appears as though the XSA Admin tool isn't installed on this system. I strongly recommend its installation. As far as forbidden error, have you create the role collection and assigned it to your user?

[Former Member]

Thanks for your reply. could you please provide me a tutorial to install XSA Admin tool ?
As far as forbidden error, could you please tell me how can I create the role collection without the XSA Admin tool ?
is "xs set-space-role Peterinitial SAP SpaceDeveloper" not enough to login on SAP Web IDE ?