s4sdk - 使用 App-To-App SSO 将主体传播到 S/4

Question

当来自 App-To-App SSO 请求时，我无法使用主体传播调用 S/4。 SDK支持这种场景吗？

我们在 SCP Neo 中有一个 HTML5 应用程序，在同一个子账户中有一个 Java 应用程序。我们的目的是让 HTML5 应用程序获取 SAML2 token (从外部 IdP)，然后使用 App-To-App SSO 将 token 转发到 Java 应用程序，并最终使用原始 SAML2 token 使用主体传播调用 S/4(来自 IdP)。

总结一下，请求流程如下:

1. HTML5 应用从外部 IdP 获取 SAML2 token
2. HTML5 应用通过应用到应用 SSO 通过目的地调用 Java 应用
3. Java 应用通过主体传播通过目的地调用 S/4

我们的预期是，在第 3 步，对 S/4 的请求将使用第 1 步中的 SAML2 token 。相反，SCP 在使用 App-To-App SSO 调用目标时似乎会创建另一个 SAML2 token 。

使用此配置，S/4 SDK 无法获取元数据，甚至无法到达云连接器。相反，它无法构建 Principal Propagation header ，引发异常，如下面的堆栈跟踪所示:

2019 06 13 14:21:05#+00#ERROR#com.sap.cloud.sdk.odatav2.connectivity.internal.ODataConnectivityUtil##anonymous#hystrix-***OMITTED***.persistence.CreateChangeMasterCommand\#t=\#u=-1#na#***OMITTED***#***OMITTED***#web#***OMITTED***#na#na#na#na#Error occurred during create operation of Type : com.sap.cloud.sdk.odatav2.connectivity.ODataException: Unable to fetch the metadata : Error fetching the metadata |

2019 06 13 14:21:05#+00#ERROR#com.sap.cloud.sdk.odatav2.connectivity.cache.metadata.GuavaMetadataCache##anonymous#hystrix-***OMITTED***.changemaster.persistence.CreateChangeMasterCommand\#t=\#u=-1#na#***OMITTED***#***OMITTED***#web#***OMITTED***#na#na#na#na#Error occurred while populating metadata :  com.sap.cloud.sdk.cloudplatform.connectivity.exception.DestinationAccessException: Failed to get the request headers for destination 'srv_Fiori_PP' (request URI: http://fiorisrvpp:8200/sap/opu/odata/sap/API_CHANGEMASTER;v=2/$metadata).
    at com.sap.cloud.sdk.cloudplatform.connectivity.ScpNeoDestination.getAuthenticationHeaders(ScpNeoDestination.java:317)
    at com.sap.cloud.sdk.cloudplatform.connectivity.ScpNeoDestination.getHeaders(ScpNeoDestination.java:388)
    at com.sap.cloud.sdk.cloudplatform.connectivity.HttpClientWrapper.wrapRequest(HttpClientWrapper.java:88)
    at com.sap.cloud.sdk.cloudplatform.connectivity.HttpClientWrapper.execute(HttpClientWrapper.java:99)
    at com.sap.cloud.sdk.odatav2.connectivity.cache.metadata.GuavaMetadataCache.getEdm(GuavaMetadataCache.java:236)
    at com.sap.cloud.sdk.odatav2.connectivity.cache.metadata.GuavaMetadataCache.getEdm(GuavaMetadataCache.java:155)
    at com.sap.cloud.sdk.odatav2.connectivity.internal.ODataConnectivityUtil.readMetadataWithCSRF(ODataConnectivityUtil.java:65)
    at com.sap.cloud.sdk.odatav2.connectivity.impl.ODataCreateRequestImpl.create(ODataCreateRequestImpl.java:193)
    at com.sap.cloud.sdk.odatav2.connectivity.impl.ODataCreateRequestImpl.handleExecute(ODataCreateRequestImpl.java:391)
    at com.sap.cloud.sdk.odatav2.connectivity.impl.ODataCreateRequestImpl.execute(ODataCreateRequestImpl.java:140)
    at com.sap.cloud.sdk.odatav2.connectivity.impl.ODataCreateRequestImpl.execute(ODataCreateRequestImpl.java:361)
    at com.sap.cloud.sdk.s4hana.datamodel.odata.helper.FluentHelperCreate.execute(FluentHelperCreate.java:163)
    at ***OMITTED***.changemaster.persistence.CreateChangeMasterCommand.run(CreateChangeMasterCommand.java:42)
    at ***OMITTED***.changemaster.persistence.CreateChangeMasterCommand.run(CreateChangeMasterCommand.java:14)
    at com.netflix.hystrix.HystrixCommand$2.call(HystrixCommand.java:302)
    at com.netflix.hystrix.HystrixCommand$2.call(HystrixCommand.java:298)
    at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:46)
    at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:35)
    at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:48)
    at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:30)
    at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:48)
    at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:30)
    at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:48)
    at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:30)
    at rx.Observable.unsafeSubscribe(Observable.java:10327)
    at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:51)
    at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:35)
    at rx.Observable.unsafeSubscribe(Observable.java:10327)
    at rx.internal.operators.OnSubscribeDoOnEach.call(OnSubscribeDoOnEach.java:41)
    at rx.internal.operators.OnSubscribeDoOnEach.call(OnSubscribeDoOnEach.java:30)
    at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:48)
    at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:30)
    at rx.Observable.unsafeSubscribe(Observable.java:10327)
    at rx.internal.operators.OperatorSubscribeOn$SubscribeOnSubscriber.call(OperatorSubscribeOn.java:100)
    at com.netflix.hystrix.strategy.concurrency.HystrixContexSchedulerAction$1.call(HystrixContexSchedulerAction.java:56)
    at com.netflix.hystrix.strategy.concurrency.HystrixContexSchedulerAction$1.call(HystrixContexSchedulerAction.java:47)
    at com.sap.cloud.sdk.cloudplatform.concurrency.ScpNeoUserSessionCallable.call(ScpNeoUserSessionCallable.java:78)
    at com.sap.core.tenant.service.impl.TenantServiceImpl.execute(TenantServiceImpl.java:126)
    at com.sap.cloud.account.impl.TenantContextImpl.execute(TenantContextImpl.java:49)
    at com.sap.cloud.sdk.cloudplatform.concurrency.ScpNeoTenantCallable.call(ScpNeoTenantCallable.java:98)
    at com.netflix.hystrix.strategy.concurrency.HystrixContexSchedulerAction.call(HystrixContexSchedulerAction.java:69)
    at rx.internal.schedulers.ScheduledAction.run(ScheduledAction.java:55)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:836)
Caused by: com.netflix.hystrix.exception.HystrixRuntimeException: com.sap.cloud.sdk.cloudplatform.connectivity.GetAuthHeadersCommand\#t=d1055fe8-b703-4672-aaf8-e84fd0456508\#u=\#srv_Fiori_PP failed and fallback disabled.
    at com.netflix.hystrix.AbstractCommand.handleFallbackDisabledByEmittingError(AbstractCommand.java:1052)
    at com.netflix.hystrix.AbstractCommand.getFallbackOrThrowException(AbstractCommand.java:878)
    at com.netflix.hystrix.AbstractCommand.handleFailureViaFallback(AbstractCommand.java:1034)
    at com.netflix.hystrix.AbstractCommand.access$700(AbstractCommand.java:60)
    at com.netflix.hystrix.AbstractCommand$12.call(AbstractCommand.java:621)
    at com.netflix.hystrix.AbstractCommand$12.call(AbstractCommand.java:601)
    at rx.internal.operators.OperatorOnErrorResumeNextViaFunction$4.onError(OperatorOnErrorResumeNextViaFunction.java:140)
    at rx.internal.operators.OnSubscribeDoOnEach$DoOnEachSubscriber.onError(OnSubscribeDoOnEach.java:87)
    at rx.internal.operators.OnSubscribeDoOnEach$DoOnEachSubscriber.onError(OnSubscribeDoOnEach.java:87)
    at com.netflix.hystrix.AbstractCommand$HystrixObservableTimeoutOperator$3.onError(AbstractCommand.java:1194)
    at rx.internal.operators.OperatorSubscribeOn$SubscribeOnSubscriber.onError(OperatorSubscribeOn.java:80)
    at rx.observers.Subscribers$5.onError(Subscribers.java:230)
    at rx.internal.operators.OnSubscribeDoOnEach$DoOnEachSubscriber.onError(OnSubscribeDoOnEach.java:87)
    at rx.observers.Subscribers$5.onError(Subscribers.java:230)
    at com.netflix.hystrix.AbstractCommand$DeprecatedOnRunHookApplication$1.onError(AbstractCommand.java:1431)
    at com.netflix.hystrix.AbstractCommand$ExecutionHookApplication$1.onError(AbstractCommand.java:1362)
    at rx.observers.Subscribers$5.onError(Subscribers.java:230)
    at rx.observers.Subscribers$5.onError(Subscribers.java:230)
    at rx.internal.operators.OnSubscribeThrow.call(OnSubscribeThrow.java:44)
    at rx.internal.operators.OnSubscribeThrow.call(OnSubscribeThrow.java:28)
    at rx.Observable.unsafeSubscribe(Observable.java:10327)
    at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:51)
    ... 30 common frames omitted
Caused by: com.sap.cloud.sdk.cloudplatform.connectivity.exception.DestinationAccessException: java.lang.IllegalArgumentException: No logged-in user
    at com.sap.cloud.sdk.cloudplatform.connectivity.GetAuthHeadersCommand.getAuthenticationHeaders(GetAuthHeadersCommand.java:242)
    at com.sap.cloud.sdk.cloudplatform.connectivity.GetAuthHeadersCommand.run(GetAuthHeadersCommand.java:125)
    at com.sap.cloud.sdk.cloudplatform.connectivity.GetAuthHeadersCommand.run(GetAuthHeadersCommand.java:41)
    at com.netflix.hystrix.HystrixCommand$2.call(HystrixCommand.java:302)
    at com.netflix.hystrix.HystrixCommand$2.call(HystrixCommand.java:298)
    at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:46)
    ... 30 common frames omitted
Caused by: java.lang.IllegalArgumentException: No logged-in user
    at com.sap.core.connectivity.apiext.impl.authentication.PrincipalInformationProvider.getGenericCredentials(PrincipalInformationProvider.java:125)
    at com.sap.core.connectivity.apiext.impl.authentication.PrincipalInformationProvider.getPrincipalCredentials(PrincipalInformationProvider.java:51)
    at com.sap.core.connectivity.apiext.impl.authentication.AuthenticationHeaderProviderImpl.getPrincipalPropagationHeader(AuthenticationHeaderProviderImpl.java:53)
    at com.sap.cloud.sdk.cloudplatform.connectivity.GetAuthHeadersCommand.getAuthenticationHeaders(GetAuthHeadersCommand.java:198)
    ... 35 common frames omitted

我确定云连接器配置(包括信任配置)是正确的，因为如果我直接调用 Java 应用程序，委托(delegate)人传播可以完美运行。仅当请求来自 HTML5 应用程序时才会出现此问题。

您能帮我理解为什么这种情况不起作用吗？谢谢。

Answer 1

在咨询了 SAP Cloud Platform 团队后，我确认此行为是预期的。

以下资源应提供更多见解:

• https://cloudplatform.sap.com/scenarios/usecases/principal-propagation.html
• https://blogs.sap.com/2018/11/07/principal-propagation-setup-between-cloud-platform-and-on-premise-backend-system-part-2/
• https://help.sap.com/viewer/cca91383641e40ffbe03bdc78f00f681/Cloud/en-US/c84d4d0b12d34890b334998185f49e88.html