Diese Seite (Version-94) wurde zuletzt am 14-Feb.-2025 11:15 von Administrator geändert.

Diese Seite wurde am 09-Nov.-2024 16:04 von Administrator erstellt.

Du bist nicht autorisiert, diese Seite umzubenennen.

Du bist nicht autorisiert, diese Seite zu löschen.

Versionsgeschichte der Seite

Version Zuletzt geändert Größe Autor Änderungen Kommentar
94 14-Feb.-2025 11:15 13 KB Administrator zur vorherigen
93 31-Jan.-2025 13:04 13 KB Administrator zur vorherigen | zur neuesten
92 22-Jan.-2025 08:44 12 KB Administrator zur vorherigen | zur neuesten
91 06-Jan.-2025 14:30 12 KB Administrator zur vorherigen | zur neuesten
90 06-Jan.-2025 14:11 12 KB Administrator zur vorherigen | zur neuesten
89 06-Jan.-2025 14:01 12 KB Administrator zur vorherigen | zur neuesten
88 06-Jan.-2025 13:59 12 KB Administrator zur vorherigen | zur neuesten
87 06-Jan.-2025 13:31 12 KB Administrator zur vorherigen | zur neuesten
86 06-Jan.-2025 13:22 12 KB Administrator zur vorherigen | zur neuesten
85 06-Jan.-2025 13:08 12 KB Administrator zur vorherigen | zur neuesten
84 06-Jan.-2025 13:08 12 KB Administrator zur vorherigen | zur neuesten
83 06-Jan.-2025 11:51 12 KB Administrator zur vorherigen | zur neuesten
82 06-Jan.-2025 11:49 12 KB Administrator zur vorherigen | zur neuesten
81 06-Jan.-2025 11:44 12 KB Administrator zur vorherigen | zur neuesten

Links

Eingehende Links Ausgehende Links
ABAP OAuth
ABAP OAuth

Versionsunterschiede

Unterschiede zwischen Version und .

Zeile 23: 2 Zeilen hinzugefügt.
! How to connect to multiple SF instances
You can use below default configuration if you want to connect your SAP system to ONE SF instance only, otherwise you need to copy/adjust everything
Zeile 26: 8 Zeilen hinzugefügt.
When you create a configuration with x.OA2C_CONFIG you need to enable SAML2 with the "SAML2 2.0 Disabled" button.\\
You can also re-do that if you use button "<TRASHBIN> SAML 2.0 Settings" and and re-enable.\\
__First time and each time you re-enable SAML 2.0 a new certificate in STRUST at "SSF OAuth2 Client Identity Provider -Signature" is created.__\\
You cannot have multiple STRUST certificates for different SF instances (one for each instance), because SSF application OA2CS is hardcoded at class CL_OA2C_SAML20_METADATA->CHECK_SSF_APPLICATION_OA2C().\\
__The trick__ is to use the one and only STRUST certificate in all SF instances at "Manage OAuth2 Client Applications".
When you create a second OA2C_CONFIG configuration for the second instance, no new certificate at STRUST "SSF OAuth2 Client Identity Provider -Signature" is created!\\
This happens only if you re-enable SAML 2.0.
Zeile 25: 2 Zeilen geändert.
* OAuth profile, default "SUCCESSFACTORS", use SE80 > Create > Others > OAuth 2.0 Client Profile (t.OA2C_PROFILES)
* Application ID, default "DEFAULT", x.CLB2_APPLI
* OAuth profile type, SM30 > OA2C_TYPES (used as filter in the BAdI)
* OAuth profile, default "SUCCESSFACTORS", use SE80 > Create > Others > OAuth 2.0 Client Profile (t.OA2C_PROFILES, you can search in SE80 with "_QS Development Object")
Zeile 38: 5 Zeilen hinzugefügt.
* Application ID, default "DEFAULT", x.CLB2_APPLI
* API Method, default GENERIC, SM30 > CLB2V_PTYPE_METH (copy default)
* API Method Version, default V1 and CL_CLB2_METHOD, SM30 > CLB2V_PTYPE_VERS (copy default)
* Server, default "SuccessFactors", SM34 > CLB2VC_PLATF_DEF to set server with url, provider, csfr + api version
* Collaboration: Communication Server Settings, SM30 > CLB2V_PLATF
Zeile 29: 4 Zeilen geändert.
* Server Communication, default "SuccessFactors", SM34 > CLB2VC_PLATF (SM30 > CLB2V_PLATF), make sure to fill also the "Authentication Methods" like USER
* Server, default "SuccessFactors", SM34 > CLB2VC_PLATF_DEF
* Application Settings" for each instance with SM30 > CLB2V_APPL_DATA
* Parameters for each instance with SM30 > CLB2V_APPL_EXT, here we have company_id
* Server Communication, default "SuccessFactors", SM34 > CLB2VC_PLATF, make sure to fill also the "Authentication Methods" like USER
Zeile 34: Eine Zeile geändert.
x. OA2C_CONFIG (t.oa2c_client)
! Transaction OA2C_CONFIG
Stored at t.oa2c_client.\\
Zeile 36: 4 Zeilen geändert.
<sf_host>/oauth/token
form, header, current, SAML
www.successfactors.com
998}}}
Client Secret: is mandatory, but does NOT matter here (use anything like xxx)
Token Endpoint: <sf_host>/oauth/token
enable Form Fields, Header Fields, Current user related, SAML 2.0 Bearer Assertion
SAML 2.0 Audience = www.successfactors.com
SAML 2.0 Recipient = token endpoint
User E-Mail for SAML 2.0 Name ID = 998 (see below)
SSL Client PSE = choose Default or Anonym (where you put the SF general SSH certificate)
}}}
Zeile 41: 3 Zeilen geändert.
!Modifications
Whenever you choose to create SAML a new STRUST is created:
"SSF OAuth2 Client Identity Provider - Signature"
! SAML Subject Name Identifier (user) / Modification
This refers to OA2C_CONFIG at "User E-Mail for SAML 2.0 Name ID".\\
You can have the options specified at CL_OA2C_SAML20_ASSERTION->BUILD_NAME_ID().\\
By default the local SAP username is passed to SF, but SF expects a userId, so this will not work.\\
The only option which made sense to me is to use __998__ and specify the userId as Alias at the SAP user.\\
But you can have only the ALIAS only as upper case in SAP, so the SF userId must be uppercase too (or just numbers).\\
I modified the SAP code at CL_OA2C_SAML20_ASSERTION->BUILD_NAME_ID():
Zeile 45: 21 Zeilen geändert.
" Create entry with r.ZMDW_TEST, the new applic need to be assigned to the type via SM30 > CLB2V_PTYPE
FORM create_sf_application.
  DATA: ls_app         TYPE ssfapplic,
        ls_appt type SSFAPPLICT,
        lv_new_app_name TYPE string.
  delete from ssfapplic where applic = 'OA_CD'.
  delete from ssfapplict where applic = 'OA_CD'.
  lv_new_app_name = 'OACD'.
  SELECT SINGLE * FROM ssfapplic INTO ls_app WHERE applic = 'OA2CS'.
  ls_app-applic = lv_new_app_name.
  MODIFY ssfapplic FROM  ls_app.
  WRITE: / |modified { lv_new_app_name }, rc={ sy-subrc }|.
  SELECT SINGLE * FROM SSFAPPLICT INTO ls_appt WHERE sprsl = 'E' and applic = 'OA2CS'.
  ls_appt-applic = lv_new_app_name.
  ls_appt-descript = |OAuth2 Client Identity Provider - { lv_new_app_name }|.
  MODIFY SSFAPPLICT FROM  ls_appt.
  WRITE: / |modified { lv_new_app_name }, rc={ sy-subrc }|.
ENDFORM.
es_saml20_name_id-_value = to_lower( es_saml20_name_id-_value ).
Zeile 67: 2 Zeilen gelöscht.
Add SFF ID specific parameters with
* x.SSFA (t.SSFAPPLIC) or SM30 > VSSFARGS (x.SIMG > Multi Bank Connectivity Connector > Maintain SSF Application Parameters)
Zeile 69: Eine Zeile hinzugefügt.
! Create BAdIs, copy/adjust classes
Zeile 77: 2 Zeilen geändert.
BADI Definition: OA2C_SPECIFICS_BADI_DEF
BADI Implementation: SMI_OA2C_SPEC_SFSF_BIZX
(default) (custom)
Enh. Spot OA2C_SPECIFICS (not visible in OA2C_CONFIG)
Enh. Impl. SMI_OA2C_SPEC_SFSF (not visible in OA2C_CONFIG)
BAdI Def OA2C_SPECIFICS_BADI_DEF
BAdi Impl. SMI_OA2C_SPEC_SFSF_BIZX => Z_SMI_OA2C_SPEC_SFSF_BIZX_CD*
Filter Value: SUCCESSFACTORS => <Your_New_Filter>
Implementation Class: CL_SMI_OA2C_SPEC_SFSF => copied to ZCL_SMI_OA2C_SPEC_SFSF_CD
=> replace all references from class CL_SMI_OA2C_CONFIG_SFSF to ZCL_SMI_OA2C_CONFIG_SFSF_CD
=> edit method IF_OA2C_SPECIFICS~GET_CONFIG_EXTENSION (replace R_CONFIG_EXTENSION name)
*SE18 > es.OA2C_SPECIFICS
> Right-Click > Create implementation > ei.Z_SMI_OA2C_SPEC_SFSF_CD
> bi.Z_SMI_OA2C_SPEC_SFSF_BIZX_CD
> assign class from above and add filter
}}}
{{{
Enh. Spot OA2C_CONFIG_EXTENSION
Enh. Impl. SMI_OA2C_CONFIG_SFSF
BAdI Def OA2C_CONFIG_EXTENSION_BADI_DEF
BAdi Impl. SMI_OA2C_CONFIG_SFSF_BIZX
Zeile 80: 7 Zeilen gelöscht.
Implementation Class: CL_SMI_OA2C_SPEC_SFSF => copied to ZCL_SMI_OA2C_SPEC_SFSF_CD
=> exchange all references from class CL_SMI_OA2C_CONFIG_SFSF to ZCL_SMI_OA2C_CONFIG_SFSF_CD
=> edit method IF_OA2C_SPECIFICS~GET_CONFIG_EXTENSION (replace R_CONFIG_EXTENSION name)
BADI Definition: OA2C_CONFIG_EXTENSION_BADI_DEF
BAdI Implementation: SMI_OA2C_CONFIG_SFSF_BIZX
Filter Value: SUCCESSFACTORS
Zeile 88: 6 Zeilen geändert.
=> update attributes GC_APPLICATION and GC_SMI_SP_SFSF
SE18 > BAdI OA2C_CONFIG_EXTENSION_BADI_DEF
> Right-Click > Create implementation > ei.Z_SMI_OA2C_SPEC_SFSF_BIZX_CD
> bi.Z_SMI_OA2C_SPEC_SFSF_CD
> assign class from above and add filter
=> update attributes GC_APPLICATION and GC_SMI_SP_SFSF
SE18 > es.OA2C_CONFIG_EXTENSION
> Right-Click > Create implementation > ei.Z_SMI_OA2C_CONFIG_SFSF_CD
> bi.Z_SMI_OA2C_CONFIG_SFSF_BIZX_CD
> assign class from above and add filter
}}}
Zeile 95: 5 Zeilen geändert.
SE18 > BAdI OA2C_SPECIFICS_BADI_DEF
> Right-Click > Create implementation > ei.Z_SMI_OA2C_CONFIG_SFSF_CD
> bi.Z_SMI_OA2C_CONFIG_SFSF_BIZX_CD
> assign class from above and add filter
}}}
! SuccessFactors "Manage OAuth2 Client Applications"
# button "Register Client Application"
# Application name = you can use any, but I recommend "SAP_<sysid>_<mandt>" of source SAP system
# Application URL = any, example http://SAP_<sysid>_<mandt>
# X.509 Certificate = the one created at STRUST at "SSF OAuth2 Client Identity Provider -Signature"
** export at STRUST
** double click on "SSF OAuth2 Client Identity Provider -Signature"
** double click on subject to get the certificate below
** button "Export certificate" > as Base64 > into any file
** open file and copy/paste certificate without header/footer
# Register
After that you get an "API key", which is the "OAuth 2.0 Client ID" at OA2C_CONFIG.\\
You also need to use this one at the OAuth configuration above. Actually you can create this one first, create SAP OAuth and come back here to update certificate afterwards.
Zeile 120: 97 Zeilen hinzugefügt.
!OAuth with RFC Connections
You can use RFC for OAuth.
# create RFC of type G - "HTTP Connections to External Server"
# Host = SF server, Port = 443
# Path Prefix = keep EMPTY, if this is empty you can override it like below code
# Activate SSL, do not use a user
# button "OAuth Settings"
** Profile = your OAuth profile name
** Configuration = the OA2C_CONFIG configuration name
If everything is correct you can use button "Connection Test" and get a HTTP 200 response.\\
If not there is no proper response, you need to set __a session (!) breakpoint at cl_oa2c_client_protocol_utils=>get_tokens() to capture the response__ to know why.
{{{
REPORT ZMDW_EC_RFC.
DATA:
lo_client TYPE REF TO if_http_client,
lv_res_data_bin TYPE xstring,
lv_res_data_str TYPE string,
lv_req_data_bin TYPE xstring,
lv_req_data_str TYPE string,
lo_conv TYPE REF TO cl_abap_conv_in_ce.
cl_http_client=>create_by_destination(
EXPORTING
"destination = 'SF_Instance1_OAuth'
destination = 'SF_Instance2_OAuth'
IMPORTING
client = lo_client
EXCEPTIONS
argument_not_found = 1
destination_not_found = 2
destination_no_authority = 3
plugin_not_active = 4
internal_error = 5
OTHERS = 6
).
lo_client->request->set_method( if_http_request=>co_request_method_get ).
"New path ->
lo_client->request->set_header_field( name = '~request_uri' value = '/odata/v2/FODivision?$filter=externalCode+eq+''204''' ). " <=========
lo_client->send( ).
lo_client->receive( ).
lv_res_data_bin = lo_client->response->get_data( ).
lo_conv = cl_abap_conv_in_ce=>create( input = lv_res_data_bin ).
lo_conv->read( IMPORTING data = lv_res_data_str ).
lo_client->close( ).
cl_demo_output=>display(
EXPORTING
data = lv_res_data_str
name = 'Response'
).
}}}
!Modifications (OLD, NOT NECESSARY)
Whenever you choose to create SAML a new STRUST is created:
"SSF OAuth2 Client Identity Provider - Signature"
{{{
" Create entry with r.ZMDW_TEST, the new applic need to be assigned to the type via SM30 > CLB2V_PTYPE
FORM create_sf_application.
  DATA: ls_app          TYPE ssfapplic,
        ls_appt         TYPE ssfapplict,
        lv_old_app_name TYPE string,
        lv_new_app_name TYPE string.
  lv_old_app_name = 'ZOACQ'.   " erase former custom ones, set blank if none
  lv_new_app_name = ''.
  IF lv_old_app_name <> ''.
    DELETE FROM ssfapplic WHERE applic = lv_old_app_name.
    DELETE FROM ssfapplict WHERE applic = lv_old_app_name.
    WRITE: / |deleted { lv_old_app_name }, rc={ sy-subrc }|.
  ENDIF.
  IF lv_new_app_name <> ''.
    SELECT SINGLE * FROM ssfapplic INTO ls_app WHERE applic = 'OA2CS'.
    ls_app-applic = lv_new_app_name.
    MODIFY ssfapplic FROM  ls_app.
    WRITE: / |modified { lv_new_app_name }, rc={ sy-subrc }|.
    SELECT SINGLE * FROM ssfapplict INTO ls_appt WHERE sprsl = 'E' AND applic = 'OA2CS'.
    ls_appt-applic = lv_new_app_name.
    ls_appt-descript = |OAuth2 Client Identity Provider - { lv_new_app_name }|.
    MODIFY ssfapplict FROM  ls_appt.
    WRITE: / |modified { lv_new_app_name }, rc={ sy-subrc }|.
  ENDIF.
ENDFORM.
}}}
Add SFF ID specific parameters with
* x.SSFA (t.SSFAPPLIC) or SM30 > VSSFARGS (x.SIMG > Multi Bank Connectivity Connector > Maintain SSF Application Parameters)
Zeile 227: 2 Zeilen hinzugefügt.
* with transaction OA2C_GRANT you can create/delete tokens (for your own user only)
* tokens are stored at table OA2C_TOKEN_ADM (and OA2C_TOKEN_SCOPE, not used here). You can delete records here to force re-authentication
Zeile 230: 6 Zeilen hinzugefügt.
! SF Token lifetime
With r.OA2C_GENERIC_ACCESS you can see we get a token which is valid 24h.
The token metadata are stored at table OA2C_TOKEN_ADM for the current user and it is reused.\\
In other words: You can skrew up configuration now for the next 24h but the connection still works.\\
To re-authenticate delete records at OA2C_TOKEN_ADM (or use CL_OA2C_CLIENT->DELETE_TOKENS()?)
Zeile 146: Eine Zeile geändert.
Wrong certificate between STRUST and SF
* Wrong certificate between STRUST and SF
OR
* you have a mismatch in the codes/attributes in the custom classes of the two BAdIs
Zeile 281: 2 Zeilen hinzugefügt.
OR
* you use 998, the alias is always upper case, but the SF userid is lower case
Zeile 288: 3 Zeilen hinzugefügt.
! 400 - Parameter "company_id" is required in the OAuth request
You haven't created the BAdIs and copied/adopted the classes to provide
Zeile 293: 6 Zeilen hinzugefügt.
! HTTPIO_ERROR_OA2C_NO_SECRET
=> OA2C_CONFIG > Edit and re-enter the client secret > Save
! Direct connect to <server> failed: NIECONN_REFUSED(-10)
=> network / proxy issue, see [note 3518358|https://me.sap.com/notes/3518358/E]
Diese Seite (Version-94) wurde zuletzt am 14-Feb.-2025 11:15 von Administrator geändert.Top