Triggering SCP workflow instance from ABAP on premise system

[sankar_bhatta]

Hi,

I have built a sample SCP workflow in my trail account. I want to trigger that workflow from an ABAP program which runs in an on premise S4 system. I went through the workflow API in SAP API hob and took the code snippet pertaining to ABAP there. I wanted to first test the code for getting xCSRF token, as this is the first step to take for trigeering the workflow. my final code looks as below

DATA: lo_http_client TYPE REF TO if_http_client.
DATA: response TYPE string.
"create HTTP client by url
"API endpoint for API sandbox
CALL METHOD cl_http_client=>create_by_url
 EXPORTING
 url = 'https://bpmworkflowruntimewfs-p1942918606trial.hanatrial.ondemand.com/workflow-service/rest/v1/xsrf-token'
 IMPORTING
 client = lo_http_client
 EXCEPTIONS
 argument_not_found = 1
 plugin_not_active = 2
 internal_error = 3
 OTHERS = 4.
IF sy-subrc <> 0.
 "error handling
ENDIF.
"setting request method
lo_http_client->request->set_method('GET').
"adding headers
lo_http_client->request->set_header_field( name = 'X-CSRF-Token' value = 'Fetch' ).
lo_http_client->request->set_header_field( name = 'Content-Type' value = 'application/json' ).
lo_http_client->request->set_header_field( name = 'Accept' value = 'application/json' ).
lo_http_client->request->set_header_field( name = 'Authorization' value = 'Basic UDE5NDI5MTg2MDY6U2Fua2FyQGhhbmE=' ).

CALL METHOD lo_http_client->send
 EXCEPTIONS
 http_communication_failure = 1
 http_invalid_state = 2
 http_processing_failed = 3
 http_invalid_timeout = 4
 OTHERS = 5.
IF sy-subrc = 0.
 CALL METHOD lo_http_client->receive
 EXCEPTIONS
 http_communication_failure = 1
 http_invalid_state = 2
 http_processing_failed = 3
 OTHERS = 5.
ENDIF.
IF sy-subrc <> 0.
 "error handling
ENDIF.
response = lo_http_client->response->get_cdata( ).
WRITE: 'response: ', response.

The code returns sy-subrc 1 where we are calling receive method of http client. In the response i can see below error

500 SSL Peer Certificate Untrusted
SSL handshake with bpmworkflowruntimewfs-p1942918606trial.hanatrial.ondemand.com:443 failed: SSSLERR_PEER_CERT_UNTRUSTED (-102)
The peer's X.509 Certificate (chain) is untrusted
SapSSLSessionStartNB()==SSSLERR_PEER_CERT_UNTRUSTED

Is there any BASIS activity that we need to perform like installing certificated etc., before we can call API from ABAP?

I installed the certifiacte in STRUST and restarted the SMICM. now i am getting below error

404 Connection refused

---

Connect to bpmworkflowruntimewfs-p1942918606trial.hanatrial.ondemand.com:80 failed: NIECONN_REFUSED(-10)

[Ivan-Mirisola · Accepted solution]

Hi Sankara,

You need to import the CAs that signed the certificate for hanatrial.ondemand.com. Your ABAP instance is not performing the SSL handshake expected by the server - thus you get a connection refused.

You need to first add the CAs to the ABAP's database following this procedure:

CN = DigiCert SHA2 Secure Server CA O = DigiCert Inc C = US

CN = DigiCert Global Root CA OU = www.digicert.com O = DigiCert Inc C = US

Once you have the above certificates in the database, you may import the following wildcard certificate into the anonymous client PSE and add it to the access control list.

CN = *.hanatrial.ondemand.com OU = SAP Cloud Managed Services O = SAP SE L = Walldorf C = DE

Check note 510007 for more details.

Regards,
Ivan

[sankar_bhatta · Accepted solution]

Hi,

thanks for the reply. how do i download the certificate files?

[Ivan-Mirisola · Accepted solution]

Open the cockpit and click on the lock icon on your browser. If it on windows you should be able to save the certificates. If you are using Linux, you can use openssl, like this:

openssl s_client -connect account.hanatrial.ondemand.com:443 -showcerts

Each certificate in the chain is listed. The one with index 0 (Zero) is the wildcard cerificate which you should add to your ACL. The index 1 and 2 are intermediate and root certificates (the ones you should import in the database)

Best Regards,
Ivan