CAP Consuming Services - Reuse Service calling Destination with Client Credentials Flow fails #5205
Comments
|
A Reuse Service is called with the context of the Consumer Application (Clone of xsuaa-instance) In this context, subscriber tenant level destination lookup within reuse service runtime always fails |
|
We still don't fully understand your issue here. Our guess would be that you are trying to get a destination registered in a provider subaccount from a subscriber context right? It feels like you are trying to manually fetch provider client credential and use that to get a provider destination from subscriber. In this case, we would recommend not doing so because subscriber should never have access to the provider destinations. Instead, subscriber should delegate the call to provider and let provider call the destination or remote service. In subscriber context, subscriber can only get destinations from subscriber subaccount. If our understanding is correct, then please review your architecture for multi-tenancy. |
REUSE SERVICE USE CASE IS FAILING IN CLOUD SDK JSIn reuse service scenario, we use service broker @sap/sbf, In my case I use xsuaa as credentials provider. for my multi-tenant reuse Service B deployment, xsuaa credentilas are
My multi-tenant SaaS app A calls reuse service B For my Multi-tenant SaaS App A deployment,
|
Describe the bug
SAP internal CAP issue 17326
Scenario
Breuse-service-breuse-b!b400638sb-reuse-b!b400638Aa!t400638sb-a!t400638reuse-service-breuse-service-b-service-instance2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8!b400638|reuse-b!b400638sb-2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8!b400638|reuse-b!b400638service instance
reuse-service-b-service-instanceservice binding credentials{ "url": "https://reuse-service-b-srv.cert.cfapps.eu12.hana.ondemand.com/", "uaa": { "tenantmode": "shared", "sburl": "https://internal-xsuaa.authentication.eu12.hana.ondemand.com", "subaccountid": "SUB_ACCOUNT_ID", "credential-type": "binding-secret", "clientid": "sb-2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8!b400638|reuse-service-b!b400638", "xsappname": "2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8!b400638|reuse-service-b!b400638", "clientsecret": "67eafdfc-4563-4a52-ae85-b193c5133953$NPUmM9akxtuq5t8JO_Sw4A-QNOX_gCWpYQ3tkkif71A=", "serviceInstanceId": "2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8", "url": "https://reference-data-access-lfci5awt.authentication.eu12.hana.ondemand.com", "uaadomain": "authentication.eu12.hana.ondemand.com", "verificationkey": "-----BEGIN PUBLIC KEY-----\nSECRET\n-----END PUBLIC KEY-----", "apiurl": "https://api.authentication.eu12.hana.ondemand.com", "identityzone": "PROV_SUB_DOMAIN", "identityzoneid": "SUB_ACCOUNT_ID", "tenantid": "SUB_ACCOUNT_ID", "zoneid": "SUB_ACCOUNT_ID" } }How to Test Scenario:
Aclient-credentials JWT token usingAtoken-Anowtoken-Aclient-id,client-secret... fromBservice binding in ApplicationAAtoBtoken-Btoken B- the client credentials tokenCallstack
The runtime still tries to use user-jwt token and terminates;
The consumer call corresponds to
consumer-A-clone-of-reuse-service-b-xsappnameIn the runtime of service VCAP has xsappname of
reuse-bThe cloud SDK is matching clone-xsappname of the clone against the environment variable xsappname
No match and call fails at retrieveUserTOken() below
reuse service B xsuaa credentails in memory
xsuaa
credentialsfrom environment[ { "tenantmode": "shared", "sburl": "https://internal-xsuaa.authentication.eu12.hana.ondemand.com", "subaccountid": "SUB_ACCOUNT_ID", "credential-type": "binding-secret", "clientid": "sb-reuse-b!b400638", "xsappname": "reuse-b!b400638", "clientsecret": "SECRET", "serviceInstanceId": "8efa7eca-938e-49f8-975e-458459376f18", "url": "https://PROV_SUB_DOMAIN.authentication.eu12.hana.ondemand.com", "uaadomain": "authentication.eu12.hana.ondemand.com", "trustedclientidsuffix": "|reuse-b!b400638", "verificationkey": "-----BEGIN PUBLIC KEY-----\\nSECRET\\nRQIDAQAB\\n-----END PUBLIC KEY-----", "apiurl": "https://api.authentication.eu12.hana.ondemand.com", "identityzone": "PROV_SUB_DOMAIN", "identityzoneid": "SUB_ACCOUNT_ID", "tenantid": "SUB_ACCOUNT_ID", "zoneid": "SUB_ACCOUNT_ID" } ]incoming client-credentials
tokenof the reuse service contains JWT clone of the service-instance of the reuse-service xsuaa client id{ "jti": "b83ebb17d12c455598c9263927089b78", "ext_attr": { "enhancer": "XSUAA", "subaccountid": "CONSUMER_SUB_ACCOUNT", "zdn": "CONSUMER_SUB_DOMAIN", "serviceinstanceid": "2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8" }, "sub": "sb-2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8!b400638|reuse-b!b400638", "authorities": [ "uaa.resource" ], "scope": [ "uaa.resource" ], "client_id": "sb-2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8!b400638|reuse-b!b400638", "cid": "sb-2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8!b400638|reuse-b!b400638", "azp": "sb-2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8!b400638|reuse-b!b400638", "grant_type": "client_credentials", "rev_sig": "3270fa3b", "iat": 1732515725, "exp": 1732558925, "iss": "https://PROV_SUB_DOMAIN.authentication.eu12.hana.ondemand.com/oauth/token", "zid": "CONSUMER_TENANT_ID", "aud": [ "uaa", "sb-2cffb32b-3ebf-44b1-ad60-88af2d3ff2a8!b400638|reuse-b!b400638" ] }obviously there is no match of client-id of the jwt to the rda-service-srv bound xsuaa service instance's client-id
getCredentialsWithJwt returns undefined
getServiceCredentials returns undefined
getXsuaaServiceCredentials throws error 'Could not find XSUAA service binding matching the token.'
The text was updated successfully, but these errors were encountered: