SAP Community - SAP Exchange Infrastructure

Skeleton of Mapping Runtime in SAP XI

2006-12-28T10:01:36+01:00

Most of the forum questions are about the errors that occur while mapping source to the target! Did we bother to understand what is happening inside? If you did then you can skim this. Did we bother to understand why the RFC Destination AI_RUNTIME_JCOSERVER is very important? If we did not then please read this aloud.

CL_MAPPING_XMS_PLSRV3 is the object that has to be focussed for understanding the complete flow. CALL_RUNTIME is the method which will be executed during the mapping run time. Now if you can go through the method you understand that depending on the mapping type the appropriate mapping methods CALL_JAVA_RUNTIME,MAP_BY_XSLT, MAP_BY_ABAP are called. If you dig dip into the method CALL_JAVA_RUNTIME then you can see that we use the RFC Destination AI_RUNTIME_JCOSERVER while calling Java Runtime FM SMPP_CALL_JAVA_RUNTIME3.

What next? Does it help in knowing this? How we will see which mapping program is getting executed appropraitely? You will understand by digging but let me be modest by sharing the tables SMPPMAP3 and SMPPREL3 and SMPPSPLIT.Please find the screenshot of mapping table SMPPMAP3 which provides the mapping type , mapping program and interface mapping program and name space of each interface developed in SAP XI.

It is also worth looking at the ABAP objects CL_XMS_EPCACHE for getting exchane profile parameters at the ABAP runtime,CL*XMS* and CL*PLSRV*.

Calling a method from a function library in a UDF in message mapping.

2019-03-12T09:25:52+01:00

Hello,

Introduction:

During SAP PO development all of us at some point in time have come across an issue where we need to re-use methods/functions defined in a Function Library inside our local UDF's. It is fairly easy to use UDF's of a function library inside Graphical Mapping but when it comes to calling methods written in "Attributes and methods" section it becomes tricky.

Here we will have a look at a solution to the problem!

Solution:

I had a requirement where I wrote a Function library(with no UDF's) for writing Custom Audit Log Entries and I wanted to call the method defined in Attributes and method of the Function Library inside my message mapping.

The aim here is to be able to call the function "putAuditLogEntry" inside a message mappings UDF.

(why I am not writing these as a UDF in FL itself and using them in the MM...because I needed to use these methods inside my code multiple times depending on some variables....)

Step 1) Have a closer look at your Function Library!

Function Library.

Now if you look at the highlighted part the Class Name is "AuditLogEntry" and the package name is abc.functionlibrary

To be able to call this method first add this function library to the definition tab of message mapping.

Message Mapping(Definition Tab)

Next import the class in the import area of Functions Tab.

packageName.className

Functions tab

Then create an object of the class inside the UDF or globally!

Now the final part.....calling the method

Conclusion:

This is just a way to access Function Library methods inside a MessageMapping's UDF. It gives more flexibility when we are able to use global methods in local Message mapping UDF code instead of using them as UDF's in Graphical Mapping.

Note: You can also call the UDF's defined in the FunctionLibrary in Similar Fashion.

Cheers

Vinay Mittal

SAP PO - Asynchronous SAP PROXY Lookups!! Yes It Is Possible!

2019-03-13T06:33:24+01:00

Introduction:

I came across a requirement where we had to post a message to a SOAP Proxy "Asynchronously" and at the same time send the request to either System A or System B depending on a value map.

SENDER System X-------->SAP PO--->(Always to SAP PROXY Asynch) and System A or System B.

Calls to System A and B are Synchronous and we will get exactly one response depending on which system is called.

Now we managed to do this without BPM by following this fantastic blog.

https://blogs.sap.com/2007/12/11/sap-netweaver-process-integration-enhanced-receiver-determination-for-synchronous-scenarios/

Now for the SOAP Proxy part there were two options we either do it via BPM or via a SOAP PROXY Lookup!!

You can check how to perform a SOAP Proxy lookup via this wonderful blog.

https://blogs.sap.com/2014/04/04/mapping-lookup-to-abap-proxy/

The first thing that comes to mind is that the "SystemAccessor" by it's default nature works on Synchronous calls and no matter whatever method you may try(limited number of methods) we cannot change the Quality of Service!!.

So when you try to call an Asynchronous Proxy via SOAP Proxy lookup you get an error in SXMB_MONI of ECC that the QOS is invalid!! As it is by default BE(Best Effort) but ECC expects it to be EO(Exactly Once).

Result:

Solution:

while writing the SOAP Proxy lookup always use these two extra methods.SystemAccessor accessor = LookupService.getSystemAccessor(channel);accessor.setOperationName("InboundServiceInterfaceName");

accessor.setOperationNamespace("namespace");

Now as next step dont get the result of the accessor call into the Payload variablePayload SOAPOutPayload = null;//The response will be a Payload. Parse this to get the response field out.

SOAPOutPayload = accessor.call(payload);// DON'T USE THIS

Now Set the Quality of Service AS EO!!! How?
This can be achieved by Module Beans placed in the Receiver SOAP Proxy adapter.

Run the SOAP Proxy lookup in Test mode and check SXMB_MONI and you see a successful message now.

Conclusion:

Asynchronous SAOP Proxy Lookups are possible in SAP PO but then these are not lookups but essentially Data is being posted to ECC.

System Accessor does not support transactional behaviour and should not be used to update the same object as different threads can be trying to update the same Object in ECC (which was not the case in our scenario)

Cheers

Vinay

SAP To SharePoint Integration Via Microsoft Graph using SAP PO REST Adapter (No UDF's for OAUTH)

2019-03-13T06:33:28+01:00

Introduction:

We will hereby explain how to connect to Microsoft Sharepoint Using Microsoft Graph.

This blog is entirely different from what you may have come across till now.

Technology is changing at a very rapid rate and the way you can access certain Systems on the network and their Authentication Mechanism is changing too....

I had a requirement to Integrate SharePoint with SAP PO and was clueless until i came across this blog from Dilip

https://blogs.sap.com/2018/08/26/integrate-sharepoint-using-sap-pi/#

A really nice blog which explains how to perform basic operations on SharePoint.

Problem: We rely on UDF's for getting the accessToken via OAUTH 2.0.

SharePoint works on OAUTH 2.0 authentication mechanism where you generate a client id and client secret. You then get the accessToken from the Sharepoint Auth url.

https://accounts.accesscontrol.windows.net/{TenantID}/tokens/OAuth/2

The problem with this mechanism is that SAP PO REST Sender adapter does not support the OAUTH parameter "resource" which is mandatory for Sharepoint Authentication so we need to get AccessTokens Via UDF!!

Solution:

We have two ways to connect to Sharepoint

Via SharePoint API's which require the steps to be followed mentioned in Dilip's blog.

Via Microsoft Graph which is the STANDARD and recommended way of connecting to SharePoint.

Advantages of using Microsoft Graph:

a) You can use SAP PO Receiver Rest adapter for Oauth without having to worry about any udf's for the access token and let SAP PO Take care of it.

b) Really vast variety of options to query to Sharepoint for instance. I had to read an excel file from Sharepoint and SharePoint's REST API's were returning that file to me as a binary file!!! No other way.

I moved on to Microsoft Graph and i could now query the data in the excel sheet directly! No hassle of any Java Mappings or handling of large Binary files....you only get the rows coulmns you want!!!

c) Works on ODATA and really user friendly to work on!

d) provides you a product wide client id and client secret...it means that if you are using Sharepoint's API directly the client ID and client secret you generate is only valid for a particular "site" on sharepoint and won't work on any other site! But with the client id client secret generated for Microsoft Graph you can access the ENTIRE SHAREPOINT with the same Token!! That's something amazing!!

I can keep going on but need to keep this blog short.

How do we do it!!

Step 1) Generate client-id Client Secret.

Follow the steps as is in this blog and you will have your client-id and client-secret

https://tsmatz.wordpress.com/2016/10/07/application-permission-with-v2-endpoint-and-microsoft-graph/

Step 2) Once you have the admin consent open Postman and try to see if you are able to get the access token.

do a POST to https://login.microsoftonline.com/{yourCompany}.onmicrosoft.com/oauth2/v2.0/token

for example if your sharepoint account is ABC.sharepoint.com then just replace yourCompany in the url by ABC

Content-Type: application/x-www-form-urlencoded

grant_type:client_credentials
client_id:YYYYYYYYYYY
client_secret:XXXXXXXX
scope:https://graph.microsoft.com/.default

Step 3) Import the Microsoft login and Microsoft Graph Certificates into your system

Microsoft Graph URL

https://graph.microsoft.com

Also there is a Microsoft Graph developer portal where you can login via your Company's credentials and test your ODATA queries live!!

Now all you need to do is configure the REST Receiver Channel!!!

URL Tab

Here I am Querying a list for it's Items. My Microsoft Graph URL Is

https://graph.microsoft.com/v1.0/sites/{YourCompany}.sharepoint.com,{site-id}/lists/{list-id}/items?filter=( (fields/JobNumber ne '1234') )&expand=fields(select=Jobnumber,id)

and the result i get from a end to end postman test via SAP PO is

Request Mapping doesn't matter in this case Response mapping is

Step 5) Understanding the ODATA query and how it was made is equally important and you won't find much detail as to how to get these Site-id and list-id etc which can be really frustrating. Here is what i discovered via trial and error!

The query https://graph.microsoft.com/v1.0/sites/{site-id}/lists/{list-id}/items?filter=( (fields/JobNumber ne '1234') )&expand=fields(select=Jobnumber,id)

has two main parts "site-id" and "list-id"

a) to get Site-id go to Microsoft Graph Developer portal

https://developer.microsoft.com/en-us/graph/graph-explorer#

Now SharePoint works on the concept of sites or lets say sub portals under the Share Point or pages in SharePoint where you can store files, images, or create "lists" now enter the query

https://graph.microsoft.com/v1.0/sites/{YourCompanyName}.sharepoint.com:/sites/{YourSharepointSite}/

you will get something like

This becomes your site-id

b) Now we need to get the list we are working on, and a sharepoint site can have multiple lists.

again run the query

https://graph.microsoft.com/v1.0/sites/{site-id}/lists/

this will give you the list of list id's and you can pick up the list id and ready to go!!

Conclusion: We learned how to query Sharepoint via Microsoft Graph(which in turn converts the ODATA query to Share Point's REST API's and you need not worry about the hundreds of API's and functions).

Microsoft Graph and Sharepoint currently support ODATA 2.0 which has a wide array of functionalities.

Sample Microsoft Graph url's for you which i built during some of my developments.

For Reading an Excel sheets row's and column's

https://graph.microsoft.com/v1.0/sites/{site-id}/drive/items/{excelSheetFileID}/workbook/worksheets/Sheet1/UsedRange?$select=values

How to get Drives??

https://graph.microsoft.com/v1.0/sites/{site-id}/drives/

How to get Excel sheet ID??

https://graph.microsoft.com/v1.0/sites/{site-id}/drives/{drive-id}/root/children

Reading binary file from Sharepoint via Microsoft Graph(this covers Image, Text File , excel sheet, virtually everything!!!!) and you get back a Binary version of the file.

https://graph.microsoft.com/v1.0/sites/{site-id}/drive/root:/{FullFilename}:/content

Regards

Vinay

Secure and Fail over Configuration for JDBC Adapter SAP PO

2019-03-18T14:45:58+01:00

In this blog I would like to share the available JDBC option to encrypt the message transfer and failover configuration to have uninterrupted connection during the maintenance of one DB server.

Encryption Option in JDBC:

Data Security is the inevitable requirement in this growing technical world. As a mostly used middleware for transferring data between different systems and companies, SAP Process Orchestration should majorly investigate the available security option for its standard adapters to ensure all the customer data is safe and secured while transferring.

The encryption of the data sent to the Oracle database is taken care by the JDBC driver and not by the PI as every database provides their own data encryption feature. So, the driver parameter should be provided by the Admin of the database which is involved in the integration.

In any network connection, it is possible for both the client and server to support more than one encryption algorithm and more than one integrity algorithm.

To negotiate whether to turn on encryption or integrity, you can specify four possible values for the Oracle Advanced Security encryption and integrity configuration parameters. The four values are listed in the order of increasing security.

REJECTED

ACCEPTED

REQUESTED

REQUIRED

REJECTED:

If the DB side is set to REQUESTED, ACCEPTED, or REJECTED, the connection continues without error even if you use this in JDBC Channel and without the security service enabled.

This parameter need not to be enabled explicitly, if you do not wish to have an encrypted communication with the DB.

ACCEPTED:

This Parameter value will enable the encryption if it is set as requested / required on the DB side and the Algorithm which we are using should match the available algorithm on the DB side.

These kinds of parameters are mostly used on the DB side, Since the server might have connection to multiple clients some of which may not enable encryption option at their configuration.

In this way the connection will be secured if client wish to have and communication will happen without any errors even without encryption.

REQUESTED:

This parameter can be used if the server side permits to have encrypted connection. As usual it works if the algorithm sent and maintained are matching between the systems.

REQUIRED:

This is the needed parameter in case you want to allow only encrypted communication between the SAP PI/PO and Database server. This is the recommended one on client side to not to compromise security.

In this scenario, JDBC Channel with REQUIRED specifies that the security service must be enabled. The connection fails if the other side specifies REJECTED or if there is no compatible algorithm on the other side.

By Default, DB doesn’t enable encryption parameters and can be set based on the request during the connection. Below is the Encryption and Data negotiation chart which clarifies this.

SAP PI/PO	Database Server	Encryption and Data Negotiation
REJECTED	REJECTED	OFF
ACCEPTED	REJECTED	OFF
REQUESTED	REJECTED	OFF
REQUIRED	REJECTED	Connection fails
REJECTED	ACCEPTED	OFF
ACCEPTED	ACCEPTED	OFF
REQUESTED	ACCEPTED	ON
REQUIRED	ACCEPTED	ON
REJECTED	REQUESTED	OFF
ACCEPTED	REQUESTED	ON
REQUESTED	REQUESTED	ON
REQUIRED	REQUESTED	ON
REJECTED	REQUIRED	Connection fails
ACCEPTED	REQUIRED	ON
REQUESTED	REQUIRED	ON
REQUIRED	REQUIRED	ON

The below is the sample which DB team could share with us and it should be prefixed with “driver:” when we use it in JDBC Channel.

SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA1)

SQLNET.ENCRYPTION_TYPES_SERVER = (AES256)

SQLNET.CRYPTO_CHECKSUM_SERVER = ACCEPTED

SQLNET.ENCRYPTION_SERVER = ACCEPTED

To conclude the encryption part, REQUIRED is the recommended parameter value on our JDBC Channel considering the DB doesn’t reject encrypted communication.

2.Failover String in JDBC:

Sometimes SAP PO interfaces using JDBC adapter may transfer business critical data which cannot be delayed for any reasons.

To support high availability of business, the company may have two Databases in parallel (2 separate Hosts, which can be addressed via separate IP or hostnames, one is active, one is passive). In such cases the SAP PI/PO should have the ability to automatically switch from one to the other without manual interaction when there is a downtime with the active database.

To ensure this fail-over connection, below mentioned JDBC connection string can be used for Oracle DB connection from SAP PI/PO.

jdbc:oracle:thin:@(DESCRIPTION =(CONNECT_TIMEOUT=3)(TRANSPORT_CONNECT_TIMEOUT=3)(RETRY_COUNT=3)(ADDRESS_LIST =(FAILOVER = ON)(LOAD_BALANCE = ON)(ADDRESS =(PROTOCOL = TCP)(HOST = <Active database>)(PORT = <port>))(ADDRESS = (PROTOCOL = TCP)(HOST = <Passive database>)(PORT = <port>)))(CONNECT_DATA =(SERVER = DEDICATED)(SERVICE_NAME =<Service name>)))

Active database: FQDN of the primary server to be connected from the PI system.

Passive database: FQDN of the secondary server to be connected from the PI system.

Port: Listening port of the DB server.

Service name: Dedicated service schema used for this connection.

Reference: https://docs.oracle.com

How to create Custom Adapter Module in SAP PI/PO for EJB 3.0 Version

2019-05-03T16:24:47+02:00

Introduction:

In this blog, we will see step-by-step process to create SAP PI/PO Custom Adapter module, EJB version 3.0. As, I don't find any blog, where each steps are clearly mentioned, with detail configuration. Hope this will help SAP PI/PO Developers.

Custom Adapter Module Creation Process:-

Module Name--> ReadExcelFile

In NWDS: Go to File –-> New –-> EJB Project

EJB Project--> ExcelToXML_EJB

EAR Project--> ExcelToXML_EAR

EJB module version --> 3.0

Click Next and Next.

EJB Client JAR --> Uncheck

Generate ejb-jar.xml deployment descriptor --> Check

Click on Finish.

Two Projects are Created as below.

Right Click on EJB Project --> New --> Session Bean (EJB 3.x)

Choose EJB project created before and provide Java package & Class Name.

State Type --> Stateless

Check Remote and Local and Finish.

Below Objects are created.

Add External JAR files and Libraries to EJB project.

Right Click on EJB project --> Preference --> JAVA Build Path --> Add Libraries

Select XPI Library --> Click Next

Select XPI Adapter Libraries from drop down --> Finish

Add "com.sap.aii.af.svc_api.jar" file as External Jars for auditlog

Add "jxl-2.6.jar" for reading Excel File (.xls).

Click on Apply --> Ok

Expand META-INF folder of EJB --> Click on ejb-j2ee-engine.xml --> Change the details as below.

Provide EJB and JNDI name.

JNDI name will be the Adapter Module Name in SAP PI/PO Communication Channel.

<?xml version="1.0" encoding="UTF-8"?>

<ejb-j2ee-engine xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="ejb-j2ee-engine_3_0.xsd">

<enterprise-beans>

<enterprise-bean>

<ejb-name>ReadExcelFile</ejb-name>

<jndi-name>ReadExcelFile</jndi-name>

</enterprise-bean>

</enterprise-beans>

</ejb-j2ee-engine>

Expand META-INF folder of EJB Project --> Click on ejb-jar.xml --> Change the details as below

<ejb-class> --> This need to be your java package name and your Class name

<display-name> --> Your display name

<ejb-name> --> Your ejb name

<?xml version="1.0" encoding="UTF-8"?>

<ejb-jar xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:ejb="http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd"

xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd" version="3.0">

<display-name>ExcelToXML_EJB</display-name>

<enterprise-beans>

<icon/>

<ejb-name>ReadExcelFile</ejb-name>

<home>com.sap.aii.af.lib.mp.module.ModuleHome</home>

<remote>com.sap.aii.af.lib.mp.module.ModuleRemote</remote>

<local-home>com.sap.aii.af.lib.mp.module.ModuleLocalHome</local-home>

<local>com.sap.aii.af.lib.mp.module.ModuleLocal</local>

<ejb-class>com.sap.java.modules.ReadExcelFile</ejb-class>

<session-type>Stateless</session-type>

<transaction-type>Container</transaction-type>

</session>

</enterprise-beans>

</ejb-jar>

Expand META-INF folder of EAR Project --> Click on application-j2ee-engine.xml --> Change the details as below.

<?xml version="1.0" encoding="UTF-8"?>

<application-j2ee-engine xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="application-j2ee-engine.xsd">

<reference-target target-type="service" provider-name="sap.com">engine.security.facade</reference-target>

</reference>

<reference-target target-type="library" provider-name="sap.com">engine.j2ee14.facade</reference-target>

</reference>

<reference-target target-type="service" provider-name="sap.com">com.sap.aii.af.svc.facade</reference-target>

</reference>

<reference-target target-type="interface" provider-name="sap.com">com.sap.aii.af.ifc.facade</reference-target>

</reference>

<reference-target target-type="library" provider-name="sap.com">com.sap.aii.af.lib.facade</reference-target>

</reference>

<reference-target target-type="library" provider-name="sap.com">com.sap.base.technology.facade</reference-target>

</reference>

<fail-over-enable xsi:type="fail-over-enableType_disable"

mode="disable" ></fail-over-enable>

</application-j2ee-engine>

Deploy the EAR File:-

Open Window --> Preferences --> SAP AS java --> Add

Right Click on EAR Project --> Run As --> Run on Server

Select Your Server --> Click Next

Select EJB project --> Finish

Then the project will be deployed in your server and you can see in EJB Explorer (SAP PI/PO ).

Use Created Adapter Module In Sender Communication Channel.

Deployment to Higher Environments:-

Right Click EAR Project --> Export --> SAP EAR File

Sample Adapter Module code:-

package com.sap.java.modules;

import javax.ejb.Stateless;

import com.sap.aii.af.lib.mp.module.Module;

import com.sap.aii.af.lib.mp.module.ModuleContext;

import com.sap.aii.af.lib.mp.module.ModuleData;

import com.sap.aii.af.lib.mp.module.ModuleException;

import com.sap.engine.interfaces.messaging.api.XMLPayload;

import com.sap.aii.af.service.auditlog.Audit;

import com.sap.engine.interfaces.messaging.api.Message;

import com.sap.engine.interfaces.messaging.api.MessageKey;

import com.sap.engine.interfaces.messaging.api.auditlog.AuditLogStatus;

import java.io.ByteArrayInputStream;

import jxl.Cell;

import jxl.Workbook;

/**

* Session Bean implementation class ReadExcelFile

@Stateless

public class ReadExcelFile implements Module {

MessageKey amk = null;

@Override

public ModuleData process(ModuleContext mc, ModuleData imd) throws ModuleException {

String msgType = null;

String nameSpace = null;

Object obj = null;

Message msg = null;

try {

obj = imd.getPrincipalData();

msg = (Message) obj;

amk = new MessageKey(msg.getMessageId(), msg.getMessageDirection());

XMLPayload xp = msg.getDocument();

if (xp != null) {

Audit.addAuditLogEntry(amk, AuditLogStatus.SUCCESS,"AO: Now calling Convert Method to convert Excel(.xls) to XML");

byte by[] = convert(xp.getContent());

Audit.addAuditLogEntry(amk, AuditLogStatus.SUCCESS,"AO: Conversion Done Successfully.");

xp.setContent(by);

}

imd.setPrincipalData(msg);

Audit.addAuditLogEntry(amk, AuditLogStatus.SUCCESS,"AO: Principle data set successfully.");

} catch (Exception e){

ModuleException me = new ModuleException(e);

throw me;

}

return imd;

}

public byte[] convert(byte src[]) throws Exception {

String xmldata = "";

try {

ByteArrayInputStream byteArr= new ByteArrayInputStream(src);

Workbook wb = Workbook.getWorkbook(byteArr);

xmldata ="<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n"+ "<Details>";

Cell[] cells ;

Cell[] cellNames ;

cellNames = wb.getSheet(0).getRow(0);

for(int j=1;j<wb.getSheet(0).getRows();j++) {

xmldata = xmldata+"<Record>";

cells = wb.getSheet(0).getRow(j);

for(int i=0;i<wb.getSheet(0).getColumns();i++){

xmldata = xmldata+"<"+cellNames[i].getContents()+">"+cells[i].getContents()+"</"+cellNames[i].getContents()+">";

}

xmldata = xmldata + "</Record>";

}

xmldata = xmldata + "</Details>";

wb.close();

} catch (Exception e){

ModuleException me = new ModuleException(e);

throw me;

}

return xmldata.getBytes();

}

Note:-

1 ) I am using below details for my development.

NWDS--> 7.3 SP06 PAT0009 and jdk1.8.0_131

SAP PO --> 7.5 SP07

EJB Module Version--> 3.0

2) If you will not find XPI Libraries in your NWDS version, then you can add below jar files , as external jars and any other jar files as per your requirements.

3) Any Suggestion on this blog is always welcome.

4) We can create module and write Java code in different way, which you can find in different blogs.

Integrating Amazon Simple Storage Service (Amazon S3) and SAP ECC v6.0 via SAP PI v7.5 using AWS Signature v5 and Signing Algorithm (HMAC-SHA256)

2019-05-31T14:06:47+02:00

It is not at all surprising that more than a million active customers, from Airbnb to GE, use AWS Cloud solutions to deliver flexibility, fast, scalability, reliability and inexpensive data storage infrastructure. Companies like Netflix, Airbnb, Disney, NASA, BWM and many more are all using AWS to make business decisions in real time. These companies use data collection systems for nearly everything from business analytics to near-real-time operations, to executive reporting, computing and storage.

As part of AWS Storage, Amazon Simple Storage Service (S3) provides scalable object storage for data backup, archival and analytics and used to store and retrieve any amount of data, at any time, from anywhere on the web.

Benefits

Amazon Simple Storage Service (S3) is low cost, 99.99% availability, secure by default, transfer a large amount of data and easy to handle.

Conceptualizes

Amazon Simple Storage Service (S3) Conceptualizes of buckets, objects, regions, keys and Amazon S3 data consistency model.

Data is stored as objects within resources called “buckets”, and a single object can be up to 5 terabytes in size. S3 features include capabilities to append metadata tags to objects, move and store data across the S3 Storage Classes, configure and enforce data access controls, secure data against unauthorized users, run big data analytics, and monitor data at the object and bucket levels.

Amazon S3 is designed for 99.999999999% (11 9's) of durability, and stores data for millions of applications for companies all around the world.

Integration:

Amazon S3 supports the 'REST API'. Support for SOAP over HTTP is deprecated, but it is still available over HTTPS. However, new Amazon S3 features will not be supported for SOAP. Amazon recommends that you use either the REST API or the AWS SDKs.

Recently I had developed a unidirectional interface integrating Amazon Simple Storage Service (Amazon S3) and SAP ECC 6.0 via SAP PI 7.5 using AWS Signature v5 and Signing Algorithm (HMAC-SHA256). This integration scenario defines IDOC to REST by means iDocument-CSV conversion using REST Adapter.

In the server side i.e. Amazon Simple Storage Service (Amazon S3), file should be delivered in the form of comma separated value(.csv) using AWS Signature version 5 and Signing Algorithm (HMAC-SHA256). Amazon has provided authentication methods and signing requests to calculate the Signature process. Below are the methods to generate Header values:

Generate Signature - Authorization

Generate Content Hash - X-Amz-Content-Sha256

Generate Date Stamp -X-Amz-Date

Generate Content Type -Content-Type

Dynamically generate HTTP Headers

Basically, Amazon S3 expects all the above mentioned mandatory header values to authenticate the client and it looks like below:

Common Request Headers:

The following table describes headers that can be used by various types of Amazon S3 REST requests.

Header Name	Description
Authorization	The information required for request authentication. It starts with AWS4-HMAC-SHA256 and value looks like: AWS4-HMAC-SHA256 Credential=access-key-id/date/aws-region/aws-service/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date, Signature=256-bit signature expression where <date> value is specified using YYMMDD format and <aws-service> value is s3 when sending request to Amazon S3.
Content-Type	The content type of the resource in case the request content in the body. Example: text/plain
Content-MD5	The base64 encoded 128-bit MD5 digest of the message (without the headers) according to RFC 1864. This header can be used as a message integrity check to verify that the data is the same data that was originally sent.
Host	For path-style requests, the value is s3.amazonaws.com. For virtual-style requests, the value is BucketName.s3.amazonaws.com.
x-amz-content-sha256	When using signature version 4 to authenticate request, this header provides a hash of the request payload. For more information see Signature Calculations for the Authorization Header: Transferring Payload in a Single Chunk (AWS Signature Version 4). When uploading object in chunks, you set the value to STREAMING-AWS4-HMAC-SHA256-PAYLOAD to indicate that the signature covers only headers and that there is no payload.
x-amz-date	The current date and time according to the requester. Example: Wed, 01 Mar 2006 12:00:00 GMT. When you specify the Authorization header, you must specify either the x-amz-date or the Date header. If you specify both, the value specified for the x-amz-date header takes precedence.

Calculating a Signature:

To calculate a signature, you first need a string to sign. You then calculate a HMAC-SHA256 hash of the string to sign by using a signing key. The following diagram illustrates the process, including the various components of the string that you create for signing.

The process of putting a request in an agreed-upon form for signing is called 'canonicalization'.

Deriving the Header values Using Java (User defined functions)

Generate Signature - Authorization

Generate Content Hash - X-Amz-Content-Sha256

Generate Date Stamp -X-Amz-Date

Generate Content Type -Content-Type

Generate Payload

Dynamically generate HTTP Headers

At first to define the individual global methods for above header parameters.

In the Enterprise service repository:

Step 1: Create a new function library and specify the attributes and methods(global variables) as below:

String dateStamp ="";

String signature ="";

String method = "PUT";

String FileName="";

Step 2: Create a user defined function to Generate Signature

public String generateSignature(String lcl_filePath, String lcl_dateTimeStamp, String contentType, String awsAccessKeyId, String awsSecretKey, String payload, Container container) throws StreamTransformationException{

{

AbstractTrace trace = container.getTrace();

String authorization = "";

try {

String algorithm = "HmacSHA256";

Mac mac = Mac.getInstance(algorithm);

SimpleDateFormat dt1 = new SimpleDateFormat("yyyyMMdd'T'HHmmss'Z'");

Date parsedDate = dt1.parse(lcl_dateTimeStamp.toString());

SimpleDateFormat dt2 = new SimpleDateFormat("yyyyMMdd");

String lcl_dateStamp = dt2.format(parsedDate);

trace.addWarning("Date:" + lcl_dateStamp);

MessageDigest md = MessageDigest.getInstance("SHA-256");

byte[] hashPayloadInBytes = md.digest(payload.getBytes("UTF-8"));

StringBuilder payloadSb = new StringBuilder();

for (byte b : hashPayloadInBytes) {

payloadSb.append(String.format("%02x", b));

}

String hashPayload = payloadSb.toString();

trace.addWarning(hashPayload);

trace.addWarning(lcl_dateTimeStamp);

StringBuffer canonicalRequest = new StringBuffer();

canonicalRequest.append("PUT").append("\n");

canonicalRequest.append(lcl_filePath).append("\n\n");

canonicalRequest.append("content-type:" + contentType).append("\n");

canonicalRequest.append("host:bucketName.s3.amazonaws.com").append("\n");

canonicalRequest.append("x-amz-content-sha256:" + hashPayload).append("\n");

canonicalRequest.append("x-amz-date:" + lcl_dateTimeStamp).append("\n\n");

canonicalRequest.append("content-type;host;x-amz-content-sha256;x-amz-date").append("\n");

canonicalRequest.append(hashPayload);

byte[] hashCanonicalReqInBytes = md.digest(canonicalRequest.toString().getBytes("UTF-8"));

StringBuilder hashCanonicalSb = new StringBuilder();

for (byte b : hashCanonicalReqInBytes) {

hashCanonicalSb.append(String.format("%02x", b));

}

trace.addWarning(hashCanonicalSb.toString());

StringBuffer sringToSignSb = new StringBuffer();

sringToSignSb.append("AWS4-HMAC-SHA256").append("\n");

sringToSignSb.append(lcl_dateTimeStamp).append("\n");

sringToSignSb.append(lcl_dateStamp + "/" + "ap-south-1/s3/aws4_request").append("\n");

sringToSignSb.append(hashCanonicalSb.toString());

String stringToSign = sringToSignSb.toString();

System.out.println(stringToSign);

trace.addWarning(stringToSign);

byte[] kSecret = ("AWS4" + awsSecretKey).getBytes("UTF-8");

mac.init(new SecretKeySpec(kSecret, algorithm));

byte[] kDate = mac.doFinal(lcl_dateStamp.getBytes("UTF-8"));

mac.init(new SecretKeySpec(kDate, algorithm));

byte[] kRegion = mac.doFinal("ap-south-1".getBytes("UTF-8"));

mac.init(new SecretKeySpec(kRegion, algorithm));

byte[] kService = mac.doFinal("s3".getBytes("UTF-8"));

mac.init(new SecretKeySpec(kService, algorithm));

byte[] kSigning = mac.doFinal("aws4_request".getBytes("UTF-8"));

mac.init(new SecretKeySpec(kSigning, algorithm));

byte[] kSignature = mac.doFinal(stringToSign.getBytes("UTF-8"));

String signature = Hex.encodeHexString(kSignature);

authorization = "AWS4-HMAC-SHA256 Credential=" + awsAccessKeyId + "/" + lcl_dateStamp

+ "/ap-south-1/s3/aws4_request,SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date,Signature="

+ signature;

} catch (Exception e) {

e.printStackTrace();

}

return authorization;

}

}

Step 3: Create a user defined function to Generate DateStamp

public String generateDateTimeStamp(Container container) throws StreamTransformationException{

AbstractTrace trace = container.getTrace();

SimpleDateFormat dt1 = new SimpleDateFormat("yyyyMMdd'T'HHmmss'Z'");

dt1.setTimeZone(TimeZone.getTimeZone("GMT"));

dateStamp = dt1.format(new Date());

trace.addWarning(dateStamp);

return dateStamp;

}

Step 4: Create a user defined function to Generate Content Hash

public String generateContentHashing(String payload, Container container) throws StreamTransformationException{

AbstractTrace trace = container.getTrace();

StringBuilder payloadSb = new StringBuilder();

try {

MessageDigest md = MessageDigest.getInstance("SHA-256");

byte[] hashPayloadInBytes = md.digest(payload.getBytes());

for (byte b : hashPayloadInBytes) {

payloadSb.append(String.format("%02x", b));

}

} catch (NoSuchAlgorithmException e) {

e.printStackTrace();

}

trace.addWarning(payload);

return payloadSb.toString();

}

Step 5: Create a user defined function to Generate csv Payload

public void generatePayload(String[] SKUId, String[] EANNumber, String[] Warehouse, String[] Quantity, String[] UOM, String[] Cost, String[] Entity, String[] TransactionType, ResultList rs, Container container) throws StreamTransformationException{

AbstractTrace trace = container.getTrace();
try
{
String header = "SKUId,EANNumber,Warehouse,Quantity,UOM,Cost,Entity,TransactionType"; // field names from your first structure
String content = header + "\n";
for(int i =0; i< SKUId.length; i++)
{

// adjust the below line with your field names from first structure
content = content + SKUId[i] +"," +EANNumber[i] + ","+ Warehouse[i] + "," + Quantity[i] + "," + UOM[i] + "," + Cost[i] + "," + Entity[i] + "," + TransactionType[i] + "\n";

}
trace.addInfo(content);
rs.addValue(content);
}

//Create attachment with CSV data
catch (Exception e)
{
e.toString();
}

Step 6: Create a user defined function to Generate Dynamic HTTP Headers

public String HTTPHeaders(String dateStamp, String signature, String contentHash, String fileName, Container container) throws StreamTransformationException{

DynamicConfiguration conf2 = (DynamicConfiguration) container.getTransformationParameters().get(StreamTransformationConstants.DYNAMIC_CONFIGURATION);

DynamicConfigurationKey key3 = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/REST", "XAmzDate");

conf2.put(key3,dateStamp);

DynamicConfigurationKey key4 = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/REST", "Authorization");

conf2.put(key4,signature);

DynamicConfigurationKey key5 = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/REST", "XAmzContentSha256");

conf2.put(key5,contentHash);

DynamicConfigurationKey key6 = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/REST", "FileName");

conf2.put(key6,fileName);

return "";

Below are the Detailed steps which explains in reading the API headers parameters i.e. the key and value and sending the file name dynamically :

In the first graphical mapper(IDOC to XML) declare the Adapter Specific Message Attributes as an User-defined Functions for deriving the file name scheme as below and map to the target field ‘fileName’ and also pass the respective file path to the target field 'filePath'.

User defined function to generate file name dynamically:

public String getASMAFileName(String CREDAT, String CRETIM, Container container) throws StreamTransformationException{

String filename = “INV_” + CREDAT + “_” + CRETIM + “.csv”;

return filename;

1^st Mapper:

In the second graphical mapper(XML to CSV) use the function libraries mentioned in above steps.

Hard coded values (like file path, content type, aws access key id and aws secret key can be moved to value mapping appropriately.

2nd Mapper:

In the Integration Directory:

Coming to the REST Receiver communication channel, under the REST URL tab the header variables defined in pattern variables are replaced by the respective values in the request message dynamically. For each part, I use an adapter specif attribute to read dynamically the respective values from the Adapter specific attributes.

The URL Pattern describes the full URL produced by this channel by using named placeholders for dynamic parts. Placeholder variable names must be enclosed in curly braces.

Here value source is Adapter specific attribute which retrieves the value from an Adapter-Specific Attribute by name. The predefined names are: service, resource, id, resource2, id2, operation.

Switching to tab REST Operation . Here, I have set the HTTP Operation Source equals PUT which is a static value.

Now defining the format of the messages of the RESTful service. Switch to tab Data Format here the format of the request is JSON and response is expected to be in XML.

Finally in the HTTP Headers define the header and value pattern appropriately.These are dynamically generated using user defined functions.The header value may contain all placeholders defined on the REST URL tab.

Run the Scenario:

Background job is scheduled in ECC and subsequently an iDOc is generated and delivered to PI for transformation and exchange of message.

SAP PI Middleware Server:

Amazon S3 target server:

comma separated value(.csv) looks like:

Conclusion

However, in this blog, I had accomplished this integration using Java mapping as per the recommendations provided by AWS. Below are the references:

https://docs.aws.amazon.com/general/latest/gr/Welcome.html

https://docs.aws.amazon.com/index.html

Other benefits include low cost, 99.99% availability, secure by default, transfer a large amount of data and easy to handle.

In next blogs I will be briefing on the integration with MS Azure and Kafka Applications using external adapters.

Thank you!

10-Steps to Auto - Generate API Documentation from Swagger Inspector for Rest API(S) from SAP CPI

2019-06-19T21:51:02+02:00

Background

"Consumer friendly API Documentation is the key for successfull implementation of API First Strategy as it directly impacts the wider adoption and consumption of API(S) across external and internal suppliers and partners."

While swagger or SAP API designer provides a beautiful way to document API(S) for API consumers via RAML/YAML, it is a manual job for API providers generally to build the API definition i.e RAML in the editors from the scratch especially when the request/response structures are complex i.e SAP Objects or when API(S) are built and handed over to support team without any documentation.

The following tutorial will provide a mechanism on how to auto-generate API documentation using Swagger Inspector for rest API(S) exposed in SAP CPI or SAP PO or API definition in SAP API management instead of manually typing the RAML to create API definition. Please use CORS Chrome Extension if you face CORS issue when sending messages to CPI via Swagger Inspector.

Tutorial

Step1: Create a small CPI package AutoGenerateSwaggerForAPI with a content modifier step that accepts the request and sends the JSON response.

Step 2: Open https://inspector.swagger.io/builder on browser

Step 3: Test CPI Endpoint https://CPITenant-iflmap.hcisbp.eu1.hana.ondemand.com/http/SuccessFactors/EmployeeRequest by passing the required required body and username/password in authorization header.

Step 4: Test CPI Endpoint https://CPITenant-iflmap.hcisbp.eu1.hana.ondemand.com/http/SuccessFactors/EmployeeResponse by passing the required response body and username/password in authorization header.

Step 5: Create API Definition by selecting both the Employee request / response and pressing “Create API Definition”

Step 6: Create Swagger User and sign up

Step 7: Go to Swagger hub and press import open API definition From inspector as shown below:

Step 8: Swagger API Definition for Employee Request/Response should be generated and screen should look like this.

Step 9: You can check request schema and response schema as shown below:

Step 10: You can Download Swagger/OpenAPI JSON as shown below:

Delete cross-container-services for HANA XSA environment

2019-08-13T15:48:14+02:00

This document is designed for the environment on HANA 2.0 SPS03 Rev 34 and above.

you can delete the service from XSA

and from Command line option in the following way.

Still my application is looking for the delete services when i try to build the application.

Then I tried the following by deleting via MTA Editor of that particular project via XSA/WebIDE.

SAP PI System Properties and it's usage

2019-11-20T19:49:52+01:00

We all came across the requirement to get the SAP System name at least once in many of our PI integration projects. We always wanted to get the SAP PI SID dynamically in the mapping and use it for various purposes.

We all probably used the below code snippet in the UDF to achieve this requirement-

String sysName = (String) System.getProperty("SAPSYSTEMNAME");

return sysName;

I have always wondered what are the other system properties we can fetch? and how to use this UDF more dynamically rather than hard-coding the property name.

Here is the little trick, using the below code we can retrieve the entire list of properties of the PI system-

Properties p = System.getProperties();

return p.toString();

This will return the String representation of the key-value pair for all the system properties, similar to below -

Now, we can choose any property and pass it to UDF and get the value of that property.

Below is the revised and modified UDF code which is more dynamic to get any system property value- this UDF requires only one input -property which is the name of any PI system property.

PI system properties are - SAPSYSTEMNAME,SAP_J2EE_Engine_Version,SAPSYSTEM,java.vm.version etc.

String property_val = (String) System.getProperty(property);

return property_val;

Motivation:

https://answers.sap.com/questions/12900629/how-to-get-the-other-system-properties-for-pi-usin.html

Hope this will help the community!

How to Create JMS Queue in SAP PO 7.5 and do e-2-e Testing

2020-01-27T11:24:31+01:00

Introduction:-

While doing Migration from SAP PI 7.1 to SAP PO 7.5 , I come across a situation where, I have to do end-2-end testing for newly installed JMS Libraries. Then I search corresponding blog posts, but I am unable to find full details of configuration and testing. Hence I though of creating this blog post. Hope this will help developers.

We will cover below topics in this blog post.

1) Creating JMS Queue in SAP PO 7.5

2) Creating JMS User and Roles for JMS Connection in SAP PO

3) Creating Integrated Configuration

4) Configuration of Hermes (testing tool) for end-2-end process

1) Creating JMS Queue in SAP PO 7.5

Go to SAP PO NWA --> Configuration --> JMS Server Configuration

Select JMS Resources from drop-down as shown below.

Click on Create and select "JMS Queue" from drop-down.

Below screen will pop-up.

Provide any name as per your choice and select "default" from drop-down, as shown below and save.

Below JMS Queue (jmsqueues/default/JMS_Queue_In) created, as shown below.

Like above I have created another JMS Queue (jmsqueues/default/hermes_test_pod).

2) Creating JMS User and Roles for JMS Connection

With the help of SAP security team or BASIS, we need to create one JMS user with both Consumer and Publisher Roles.

Most of times Consumer roles are added initially, but not the Publisher Roles.

Below Consumer Role and Administrator Role assign to user in NetWeaver Administrator (NWA).

INTEGRATION_VISIBILITY_JMS_SUBS_CONSUMER

Administrator

If Publisher roles are not added, we will get error as "javax.jms.JMSSecurityException: User: Guest has not permission: vpName: default, type: queue, action: consumer, destination:"

I follow SAP Note 2530840 to fix the issue.

As described in the SAP Note,

a) we need to assign below Roles to Group "Everyone" in SAP NetWeaver Administrator (NWA).

topic.all.all

queue.all.all

temp.topic.all.all

temp.queue.all.all

administration.all.all

Then assign the user with role Everyone.

3) Creating Integrated Configuration

Below Integrated Configuration created in Integration Builder.

This a bypass Interface, where I am posting same file, from source JMS Queue to receiver Queue of SAP PO 7.5.

a) Sender JMS Communication Channel Configuration

Configure JMS Sender Channel with below details.

Choose the correct transport protocol = Access JMS provider with JNDI

JMS Queue = jmsqueues/default/hermes_test_pod (already created before)

Connection Factory = Ijmsfactory/default/QueueConnectionFactory

JNDI Server Address = <hostname>:port (port is your java host httpport + 4)

JNDI Context Factory = com.sap.engine.services.jndi.InitialContextFactoryImpl

Credential: Already created JMS User and Password.

b) Receiver JMS Communication Channel Configuration

Configure JMS Receiver Channel with below details.

Choose the correct transport protocol = Access JMS provider with JNDI

JMS Queue = jmsqueues/default/JMS_Queue_In ( already created before)

Connection Factory = Ijmsfactory/default/QueueConnectionFactory

JNDI Server Address = localhost:port (port is your java host httpport + 4)

JNDI Context Factory = com.sap.engine.services.jndi.InitialContextFactoryImpl

Credential = Already created JMS User and Password.

4) Configuration of Hermes testing tool for end-2-end process

As I am familiar with Hermes for testing JMS Queue, I will show you step by step configurations for testing.

a) You can download SOAP UI version -5.4.0 and installed in your local system.

After installation, You will find hermesJMS folder with in this, as its part of "SmartBear".

b) Copy and paste hermesJMS folder to your C drive (C:\hermesJMS)

c) Open folder hermesJMS --> bin --> hermes.bat (edit with notepad or notepad++)

d) Update below details as shown below.

set HERMES_HOME=C:\hermesJMS

Then go to end of the file, and add below highlighted lines and save.

You can choose java 8 version of your system.

e) Open hermes.bat file.

f) Create new session and provide any session name per your choice.

g) Go to Provider tab, as shown below.

Right click --> Add Group --> Provide any Name as per your choice

h) Right click on created group --> add JARS --> select below JARs from your local system

sap.com~tc~exception~impl

sap.com~tc~je~clientlib~impl

sap.com~tc~logging~java~impl

You can find above JAR files from your basis team or if you have SFTP access to your SAP PO file path, you can find these JAR files.

Path: /usr/sap/<your PO SID>/J00/j2ee/j2eeclient

You can I have already added JAR files under group POD.

i) Then go to Sessions tab as shown below and configure with below details.

--> Plug In as "Default"

--> In Loader, select newly created group in Provider tab (POD in my case)

--> Select Class name as "hermes.JNDIQueueConnectionFactory" from drop-down.

Right click--> Add below 5 Properties and update as below.

--> Binding: jmsfactory/default/QueueConnectionFactory (standard same as above)

--> initialContextFactory: com.sap.engine.services.jndi.InitialContextFactoryImpl

--> providerURL: hostname:[httpport+4]

--> securitycrendential: password

--> securityPrincipal: user

In Destination, add both JMS queue created in SAP PO system.

Right click --> Add --> Update your JMS Queue name and go through all the fields and select OK.

Likewise you can add both your JMS Queue.

j) Once both JMS Queue created, then select Apply and OK. Now Hermes looks as below.

k) Once you double click on any JMS Queue, you will see on bottom of Hermes, its shows "Finished. No messages read". As there is no message in JMS Queue.

l) Now select JMS Queue --> Messages --> Send TextMessage --> Select any test message from your local system (I select XML file).

m) Once the message uploaded successfully, you can able to see the test file, after double click on JMS Queue. Make sure, you stop the Sender Communication Channel.

n) Once you start your Sender JMS Communication Channel, test file will be picked and deleted from source JMS Queue and posted to Receiver Queue.

o) Now you can see one Successful message in SAP PO Message Monitor and test file in receiver JMS Queue.

Note: -

This configuration done on SAP PO 7.5 SP7.

This blog post created to test, newly installed JMS libraries in SAP PO 7.5. Even you can use according to your requirements.

Any Suggestion on this blog post is always welcome.

You might find different way of doing this, but I found easiest way to test using Hermes.

OAuth 2.0 Standard Solution with Grant Type as Password in SAP PO 7.5(with Latest Updates)

2020-02-29T11:57:27+01:00

This blog portrays the OAuth2.0 authorization with grant type as ‘Password’.This is implemented in SAP PO 7.5 SPS 16 Patch 15. Lets take a tour into the Standard solution in elucidate with latest updates. ? Over to content below:

1. Introduction:

OAuth(Open Authorization) is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.

OAuth introduces an authorization layer separating the role of the client from that of the resource owner.In OAuth, the client requests access to resources controlled by the resource owner and hosted by the resource server, and is issued a different set of credentials than those of the resource owner.The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service:

(i) On behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service (or)

(ii) by allowing the third-party application to obtain access on its own behalf.

2. Purpose:

The purpose of this blog is to explain OAuth 2.0 in SAP PO 7.5 SPS 16 with grant type as password.Regards to OAuth 2.0 solution worked with SAP in testing this solution and identifying bugs which resulted in correction notes published in the SAP marketplace to make this solution more robust to solve different OAuth 2.0 authentication integrations with varied systems/applications.

3. Authorization Code Grant flow:

Below diagram depicts the Authorization Grant Flow to retrieve the access token and refresh token, POST a call to the authorization server. The client requests authorization from the resource owner and receives grant and then requests tokens by authenticating with the authorization server and presenting the grant. Authorization server validates, if valid then issues the initial access token and initial refresh token with access token expiry(lifetime in secs).

Below diagram elucidate that the client requests the protected resources from the resource server and authenticates by presenting the access token. The resource server validates the access token, and if valid, serves the requests and retrieves the response from the protected resources.

4. SAP PO REST Adapter Configurations:

Before proceeding with the REST receiver communication channel configurations below is the Authorization server (which grants tokens) HTTP request header and HTTP request Body parameters look alike ?

HTTP Request Headers:

HTTP Request Body:

HTTP Response Body:

Below is the Resource server(which does the actual business call) HTTP request header and HTTP request Body parameters look alike

HTTP Request Headers:

HTTP Request Body:

In the REST receiver communication channel that allows you to configure with OAuth 2.0 Client Credentials Grant and Resource Owner Password Credentials Grant. Below configurations explains only about the resource owner password credential grant type.

To Configure the REST receiver channel following are the steps below:

1. To enable new OAuth 2.0 Grant flows, in the "General" tab, check "Authorize with OAuth" checkbox and select "OAuth 2.0 Grant Type Flow".You can choose from the following grant flows:

Client Credentials Grant - flow described in https://tools.ietf.org/html/rfc6749#section-4.4

Resource Owner Password Credentials Grant - flow described in https://tools.ietf.org/html/rfc6749#section-4.3

Important Note: Other grant flows - Authorization Code Grant and Implicit Grant and these are not supported by the REST adapter.

2. You can configure how to use the received access token as defined in https://tools.ietf.org/html/rfc6750.

Select following values for the field "Use credentials and OAuth 2.0 access token as" :

HTTP Header - adds the access token to the request HTTP headers in the following format "Authorization: Bearer <access_token>"

Query Parameter - adds the access token to the resource URL in the following format: http://<host>:<port>/<resource_path>?access_token=<access_token_value>;

Important Note: This OAuth2.0 functionality extracts only the access token and not the refresh token.

Sending access token as "Form-Encoded Body Parameter" is not supported.

3. You can configure the following parameters for OAuth 2.0 Grant Type flows:

For Client Credentials Grant:

Authorization Server URL - the server, which will provide the access token(required).

Scope - The scope of the access request as described in https://tools.ietf.org/html/rfc6749#section-3.3 (optional).

Client ID - The client identifier issued to the client during the registration process as described in https://tools.ietf.org/html/rfc6749#section-2.2 (required).

Client Secret - The client secret as described in https://tools.ietf.org/html/rfc6749#section-2.3.1 (required).

For Resource Owner Password Credentials Grant :

Authorization Server URL - the server which will provide the access token. (required)

Resource Owner Client ID - The client identifier as described in https://tools.ietf.org/html/rfc6749#section-2.2 (optional)

Authorization Server Username and Password - used for authentication with Authorization server as defined in https://tools.ietf.org/html/rfc6749#section-3.2.1 (required)

Resource Owner Username and Password - resource owner credentials as defined in https://tools.ietf.org/html/rfc6749#section-4.3.2 (required)

Scope - The scope of the access request as described in https://tools.ietf.org/html/rfc6749#section-3.3. (optional).

4. OAuth 2.0 Additional parameters need to maintained for the remaining HTTP header and HTTP Query parameters. You can specify the "Parameter Type" to be one of the following:

Query - Parameter will be added to the URL query(HTTP Body).

HttpHeader - Parameter will be added as HTTP Header.

Important Note: As per SAP note 2721684 and 2782239 ,which denotes that in order to send ‘OAuth 2.0 additional HTTP header parameter; with the request.Patch needs to be applied which matches the respective Support Package version(as per SAP Note 952402).It works only with >SAP PO 7.5 SPS 15 Patch 0001. With out any patch upgrade below is the error:

Error while obtaining authorization code - response code: 400 response:

{"errorCode": "GTW-ERROR-001","message": "appkey not found in Header or it's not correct."}

5. In the REST URL, provide the resource server URL which does the actual business API call.

6. Below is the HTTP headers of the resource server:

In the HTTP Headers, there is no necessity to enforce Authorization: Bearer <access_token>.It will be added since in 'General tab' it is defined use access token as HTTP header.

'appkey' is a valid application key passed in HTTP Header which allows you to track your API usage per application.'Content-Type' is the type of representation desired at resource side.

5. Additional Feature- Resource Owner Password Credentials Grant:

When partner server does not support Authorization Basic HTTP Header which got added as Authorization: Basic <credentials> since the authorization user name and password is configured in Communication Channel. There is no configuration which is used to exclude this header before and same is raised with SAP for the additional feature.

As per OAuth2.0 standard Authentication framework, the client must not use more than one authentication method in each request.Refer: https://tools.ietf.org/html/rfc6749#section-2.3

Solution from SAP: New module parameter is defined to the REST receiver channel that allows you to specify how the user authentication is requested from the partner authorization server.Refer SAP Note 2878625.

Parameter name	Parameter value	Perform
Oauth20AutorizationServerRequestType	header (default)	Use the default value header and the fields Authorization Server Username and Authorization Server Password will be used for creation Basic Authorization HTTP Header
	query	Use value query and the fields Authorization Server Username and Authorization Server Password will be used for client_id and client_secret in the OAuth query string. Note:When you use value query do not use field Resource Owner Client ID. This will cause the client_id twice in the query string.
	none	Use value none and the fields Authorization Server Username and Authorization Server Password will be ignored and no Basic Authorization HTTP Header will be sent (Additional feature requested to SAP)

Note: When you use a value query do not use the field Resource Owner Client ID. This will cause the client_id twice in the query string.

Result: Now using the above Parameter name as ‘’Oauth20AutorizationServerRequestType’ and Parameter value as ‘none’ in the module configuration. Basic Authentication is now ignored from the HTTP header and dispatched as part of the HTTP body only as ‘username’ and ‘password’ appropriately to get the access_token.

Important Note: As per SAP note 2878625 which denotes that in order to send ‘OAuth 2.0 additional query or header parameter; with the request.Patch needs to be applied which matches the respective Support Package version(as per SAP Note 952402).It works only with >SAP PO 7.5 SPS 16 Patch 000014. With out patch upgrade below is the error:

Error while obtaining authorization code - response code: 400 response:

{"error_description": "Client authentication failed","error": "invalid_request"}

6. OAuth Token Caching:

PI REST receiver channel with configure OAuth 2.0 Authentication and grants type flow allows the generated Token to be reused depending on the value of the 'expires_in' parameter.

The access token is usable from the moment it is generated until the number of seconds defined by expire_in elapses.

'Expires_in' parameter is described in https://tools.ietf.org/html/rfc6749#section-4.2.2

To enable the OAuth 2.0 Token Caching, in the "General" tab, under "OAuth" section, check the new "Use OAuth Token Caching" checkbox*.

* Please, note that this checkbox is enabled by default.

Token caching behavior with respect to server node and parallel call as per SAP implementation and reply from technical team,

Token Caching is implemented completely in-memory without any persistence, thus the fact that on each server node there will be separate cache instance. When the token is expired on the first call will remove it from cache.

Latest token value is to be stored, thus the expiration time will be the maximum offset in the future. There is no problem update or removal expired token when there is parallel calls to the adapter to use existing tokens or update new token.

Access token is extracted and added to ‘OAuth20TokenCache’ with

Key: authorizationUrl_client_id

Value: *access_token* expiresIn: 2020-01-31T09:18:09.542 (yyyy-MM-ddTHH:mm:ss.SSS).

This expiry is based upon the field "expires_in" from the HTTP response json payload.

Say 1799 seconds it exactly calls a new token. Token is searched in ‘OAuth20Token’ Cache and uses the access token for the next consecutive and Concurrent calls till its expiry.After the access Token expiry, Authentication API is immediately called and retrieves a fresh access token and update in Cache(OAuth20Token).Access Token expire exactly after 30 minutes and the expiry timestamp format used is 'yyyy-MM-ddTHH:mm:ss.SSS'.

7. Troubleshooting:

1. Goto PI Message monitoring, check for the message logs.'Authorization' will not be visible in audit logs and secured.

2. Goto to NWA log viewer for a detailed debug traces.

3. Enable XPI inspector log with corresponding REST adapter channel and check the HTTP client log, we can see the HTTP request header, body of adapter configuration and response header and body message Authorization server.

Note: Please Ensure SPS or Patch upgrade are applied on Sandbox environment and smoke tested thoroughly and then implemented in other environments.

Happy Reading!?

How to Deploy External JMS and JDBC drivers in SAP PO 7.5

2020-05-05T16:14:25+02:00

Introduction: -

While migrating to SAP PO 7.5, I came across a situation, where I need to deploy external JDBC and JMS drivers to SAP PO system. Generally this activity done by BASIS team. In this blog, I will describe step-by-step process, which can be done by SAP PI/PO developers.

There might be many different cases for creating SDA file. But I thought of two cases as below.

You have current deployed SDA file and you want to add new external JDBC or JMS drivers.

You are going to deploy from scratch or you don't have current deployed SDA .

Case One:-

You can get current deployed SDA file with help of BASIS team.

Once you got the already deployed SDA file, you need to download SDA Maker Tool (you can download from attachment of sap note 1028961).

Execute SDA tool and follow as below for creating new SDA file.

Netweaver Version --> 7.5 (in my case)

JDBC and JMS drivers --> com.sap.aii.adapter.lib.sda (select from drop-down)

Check Add additional jar files.

Select SDA file (you got from BASIS) .

Select folder, where all additional .jar files need to be added to SDA file.

Select an empty folder, where newly created SDA file will be place.

Click Start.

Initial .SDA file: -

After adding new .jar files : -

You can see two new .jar files added to provider file and also under lib folder.

lib --> This folder contains all the .jar files for drivers

server --> Contain provider.xml file

Once the new SDA file is created, its ready to deploy in SAP PO system ( we will see later in this blog).

Case Two:-

If SAP PO system already deployed "SAP-XI3RDPARTY", then you need to identify the correct version, before creating new SDA file.

If version of SAP-XI3RDPARTY and "com.sap.aii.adapter.lib" are different, then go with version of "com.sap.aii.adapter.lib".

If "SAP-XI3RDPARTY" is not deployed, then you can refer "SAP_XIAF" version and download corresponding SCA file.

In my case, its already deployed and version is SAP 7.5 SP0 Patch 0 (highlights in yellow color).

You can find version in two different ways, through NetWeaver Administrator or NWDS.

Go to Your SAP PO System --> NWA --> Configuration --> Infrastructure --> System Information --> Components Info.

Search for "SAP-XI3RDPARTY" as shown below.

Open NWDS and Go to Deployment Prospective.

Update your SAP PO system details in SAP AS Java.

Search for "SAP-XI3RDPARTY" as shown below and click on, to see the version (highlights in yellow color)

Download SAP-XI3RDPARTY SCA file from below path.

https://launchpad.support.sap.com/#/softwarecenter/support/index --> Give your S-user credentials

Search as below and choose your SCA file version and download.

XI 3RD PARTY --> XI 3RD PARTY 7.50

You will see below folders after unzipping SCA file ( I use 7-Zip ti unzip).

com.sap.aii.adapter.lib.sda --> JMS or JDBC deployment. (we will considering this in our blog)

com.sap.aii.af.axisproviderlib.sda --> Axis adapter deployment

Finally, create your new SDA file as described above in case one.

Deployment of SDA File: -

I am using NWDS for deployment and you need Administrator Role for this.

Open NWDS --> Go to Deployment perspective --> Import --> Start

Before deployment update your system details in "SAP As Java" in Preferences of NWDS.

Once deployment finished. you can see in SAP PO NWA.

SAP PO NWA --> Java Class Loader Viewer --> Search for "com.sap.aii.adapter.lib"

Remark: -

We can choose different way to deploy newly created SDA file to SAP PO system.

If you have already few external drivers and you want to add more, then create new SDA file will all .jar files (exiting and new). If not then new SDA file will overwrite existing one.

You might find few different sap notes related to this, but I try to cover all in one.

Any suggestion , always welcome.

Connect LinkedIn REST API to SAP SuccessFactors in SAP PO 7.5

2022-04-01T16:10:53+02:00

Introduction:

The company uses email authentication of staff to Linked Learning using Azure. There was a requirement to use the User ID (BizX ID) to update the course completion status from linkedin Learning into company LMS. So I had built interface to integrate LinkedIn Learning with LMS , do the necessary field mappings from Linkedin EmailID to UserID and LinkedIn content ID to LMS Item ID and record the Learning history.

In this Blog I will provide the steps to connect LinkedIn REST API to SAP SuccessFactors using SAP PO 7.5.

The following activities were performed:

Configure the LinkedIn Learning Reporting API (please refer link for details Reporting APIs in LinkedIn Learning - LinkedIn | Microsoft Docs).

Use the API string below: https://api.linkedin.com/v2/learningActivityReports?aggregationCriteria.primary=INDIVIDUAL&aggregationCriteria.secondary=CONTENT&q=criteria&start=0&count=1&contentSource=EXTERNAL&assetType=COURSE&startedAt=1562699900247&timeOffset.duration=1&timeOffset.unit=DAY'. For more details on the query parameters please refer link LinkedIn Learning API - Retrieve Learning Activity Reports - LinkedIn | Microsoft Docs

Developed the PO interface to integrate LinkedIn application with SAP Success Factors. REST sender adapter has been configured to fetch data form LinkedIn REST API and developed java mapping to implement the business logic..

REST Sender Adapter configuration

REST Sender Adapter Config

4. The API provides the output below. I need the data from the 3 columns in yellow

LinkedIn Output

5. The following SFTPlookup mapping were done.

Lookup for Email id was done to fetch the user and lookup for contentID was done to fetch the ItemID.

a. Email to UserID: Used the integration center to output the email and userID fields from SuccessFactors. This mapping file is placed in PO.

b. LinkedIn Learning ContentID to LMS ItemID: Ran the ‘Open Content Network’ report in SuccessFactors Learning to fetch the data for mapping. This mapping file is placed in PO server.

SFTP Lookup

c. Filtered the LinkedIn Learning to use only the records that had 100% completion and calculate the Completion date using the data ‘lastEngagedAt’ field value under COMPLETIONS. The time is in milliseconds. So the above divide by 86400000 and then add to date 1/1/1970 to get the completion date.

Java Mapping

d. Developed mapping to transform the source structure to target structure in PO.

Operation mapping

Operation Mapping

6. The output for the ‘Learning History’ connector in SuccessFactors to import the data was prepared in the format below and placed in the SuccessFactors SFTP server.

Final Output

7.Receiver SFTP adapter configured to connect PO with SAP SuccessFactors to create the file.

Receiver channel

8.The learning history connectors was scheduled to import the data.

9.Please note I have used below tools.

SAP NetWeaver Developer Studio 7.3 SP25 PAT0003

SAP PO 7.5 SPS 22

SAP SuccessFactors Cloud

This blog helps you to configure the interface from LinkedIn API to SAP SuccessFactors and build SFTP lookup, create java mapping for transforming from source structure to target structure. .

Other References

https://blogs.sap.com/2015/02/08/how-to-create-java-mapping-in-sap-pi-po/

Message Mapping as Artifact and Creating Resource Schemas

2023-01-27T10:52:30+01:00

Introduction:-

As per new feature in CPI, we can create Message Mapping as Artifact and deploy before using in any integration flow. There are already few blogs , where you can see how to create Message Mapping as Artifact and the limitations.

SAP Cloud Integration – Message Mapping as Artifact | SAP Blogs

In this blog, I will cover alternative step-by-step process to create Resource Schemas for IDoc and any other XML structure, which we use to create easily in SAP PI/PO. But if we don't have SAP PI/PO instance and we are using only SAP Cloud Integration, then we can follow below process to Create any XML Schemas and generate IDoc Schemas.

Creating XSD using Eclipse:-

Create JAVA project using Eclipse (JAVA perspective).

Change Perspective to XML and refer any folder in your local machine to create XML Schema.

Create XML Schema File and give any name and click Finish.

You can see below Schema created. Then right click and add element.

Click on the newly created element and Set Type to "Complex Type" and "anonymous".

Remove Prefix and Target Namespace form the element and add prefix for attributes.

This we are doing as per SAP PI/PO External definition.

Click of the element and add element and change to your required field names with occurrence.

Now you can find the newly created Schema in your local machine (path which you already provided earlier during creating XML Schema file) and you can use this directly in SAP Cloud Integration Message mapping as source or Target Resource.

Generating IDoc Schemas:-

Go to transaction WE60 and provide the IDoc Type , which you want to generate Schema.

Click of Documentation --> XML Schema

XML Schema created and you can download to local machine.

Using created Schemas in Cloud Integration Message Mapping:-

Open Cloud Integration and create Message Mapping as Artifact.

Import both the structure to message mapping.

Save and click Simulate to test the Message Mapping.

While Importing IDoc Schema, you will get below pop up to change Occurrence.

You can change Occurrence to "unbounded" from all those have like "99999" or "999999".

Working with RFC:-

I don't find any way to create RFC structure, but generally we can create input structure Manually while calling any RFC There is already few blogs which describe in details, we can refer below one.

https://blogs.sap.com/2022/11/03/cloud-integration-creating-xml-structure-for-remote-function-call-rfc-that-requires-tables-and-structures/

https://blogs.sap.com/2022/11/03/cloud-integration-creating-xml-structure-for-remote-function-call-rfc-that-requires-tables-and-structures/

Conclusion:-

There might be different way of doing this , but I really like this.

I hope this will help as we are all moving forward towards SAP Integration Suite.

Any suggestion and easy why of doing , always welcome.