Bridging SAP

ABAP and APIs

Part 1 - Decoding Bearer Token for Secure Connection

Author: Zubair Ahmed Khan

 Connect with me!

Introduction:
SAP, as a leader in enterprise solutions, has embraced modern authentication methods to ensure secure and
efficient connectivity between systems. Bearer tokens, a cornerstone of contemporary authentication, play
a vital role in this framework. In this blog, we'll explore the implementation of Bearer Token connectivity
in SAP through code snippets and example.

What are Bearer Tokens?

Bearer tokens are a form of access token commonly used in OAuth 2.0 authentication protocols. They act
as digital keys, granting access to resources without the need for additional credentials with each request.
SAP leverages bearer tokens to enhance security and streamline connectivity.

POSTMAN
Test the API in Postman using a POST call and verify the response.

• Utilize NoAuth as the Authorization type.

• Use default headers for the request.

Author: Zubair Ahmed Khan

Email: zubair.ahmed.khan@outlook.com
 Connect with me!

• Pass the username and password in the JSON-formatted body.

• Upon successful execution, retrieve the Bearer token from the response.

After obtaining a successful response, we proceed to consume this API URL in our ABAP program.

Author: Zubair Ahmed Khan

Email: zubair.ahmed.khan@outlook.com
 Connect with me!

Utilizing Bearer Tokens in SAP Requests:

Ensure that the designated API URL is whitelisted within the SAP system configuration and network
settings. This action is crucial for facilitating seamless consumption of data and services, promoting
uninterrupted communication between the systems.

We generate a JSON body using our username and password, adhering to the API parameters. It's essential
to note that these parameters are case-sensitive; ensure they are formatted according to the API
specifications.

To initiate the API call, it is essential to configure the header fields initially set by default in Postman's call.
Moreover, ensure the logon popup is disabled by passing zero (0) as a parameter, and set the method to
POST.

Author: Zubair Ahmed Khan

Email: zubair.ahmed.khan@outlook.com
 Connect with me!

After setting up the header and body of the API URL, proceed to send the request. Upon successfully
receiving a response, denoted by a Status 200, proceed with extracting the Bearer Token.

If the response is unsuccessful, we display the returned message for further resolution.

Conclusion:
Bearer token connectivity in SAP represents modern authentication at its finest. Empowered by these code
snippets and a deep understanding of the process, developers seamlessly integrate applications with SAP,
ensuring robust security and efficiency. As we navigate the enterprise technology landscape, bearer tokens
emerge as a pivotal component in nurturing secure SAP connectivity.
This marks the start of our exploration into accessing bearer tokens in SAP, part 1 where we obtain the
token. Stay tuned for upcoming segments where we'll delve into pushing data into the API URL, providing
more scenarios and practical examples.

Author: Zubair Ahmed Khan

Email: zubair.ahmed.khan@outlook.com
 Connect with me!

Code:

Author: Zubair Ahmed Khan

Email: zubair.ahmed.khan@outlook.com
 Connect with me!

REPORT ZZACCESS_BEARER_TOKEN.

TYPES : BEGIN OF TY_REQUESTBODY,

USERNAMEOREMAILADDRESS TYPE STRING,
PASSWORD TYPE STRING,
END OF TY_REQUESTBODY.

DATA: LS_REQBODY TYPE TY_REQUESTBODY,

LS_JSONBODY TYPE STRING.

DATA : LO_HTTP_REQUEST TYPE REF TO IF_HTTP_ENTITY,

LT_HDR_FIELDS TYPE TIHTTPNVP,
LS_RETURN TYPE REF TO DATA,
BEARER_TOKEN TYPE STRING.

PARAMETERS: URL TYPE STRING LOWER CASE, "https://xyzconsole-api-

test.azurewebsites.net/api/TokenAuth/Authenticate
CLNTID TYPE STRING LOWER CASE, "fmcg-api@xyzconsole.ai
CLNTPWD TYPE STRING LOWER CASE. "api_password1234

START-OF-SELECTION.

LS_REQBODY-USERNAMEOREMAILADDRESS = CLNTID.
LS_REQBODY-PASSWORD = CLNTPWD.

" Converting our request body into JSON format

/UI2/CL_JSON=>SERIALIZE( EXPORTING DATA = LS_REQBODY " Data to serialize
RECEIVING R_JSON = LS_JSONBODY ). " JSON string

" Note: request body parameters are case-sensitive

REPLACE ALL OCCURRENCES OF 'USERNAMEOREMAILADDRESS' IN LS_JSONBODY WITH 'userNam
eOrEmailAddress'.
REPLACE ALL OCCURRENCES OF 'PASSWORD' IN LS_JSONBODY WITH 'password'.

" Call to get Token

CL_HTTP_CLIENT=>CREATE_BY_URL( EXPORTING URL = URL SSL_ID = 'ANONYM'
IMPORTING CLIENT = DATA(LO_HTTP_CLIENT_TOKEN) ) .
"adding headers with API Key for API
" for hiding logon popup
LO_HTTP_CLIENT_TOKEN->PROPERTYTYPE_LOGON_POPUP = 0.
" using POST method to get bearer token in return
LO_HTTP_CLIENT_TOKEN->REQUEST->SET_METHOD( 'POST' ).
" adding relevant header fields as per postman console
LO_HTTP_CLIENT_TOKEN->REQUEST->SET_HEADER_FIELDS( VALUE #(
( NAME = 'Accept' VALUE = '*/*' )
( NAME = 'Content-Type' VALUE = 'application/json; charset=utf-8' )
( NAME = 'Content-Length' VALUE = STRLEN( LS_JSONBODY ) )
( NAME = 'Host' VALUE = 'spendconsole-api-test.azurewebsites.net' )
( NAME = 'Accept-Encoding' VALUE = 'gzip, deflate, br' )

Author: Zubair Ahmed Khan

Email: zubair.ahmed.khan@outlook.com
 Connect with me!

( NAME = 'Connection' VALUE = 'keep-alive' )

)).
LO_HTTP_CLIENT_TOKEN->REQUEST->APPEND_CDATA( DATA = LS_JSONBODY ).

" Sending Request

LO_HTTP_CLIENT_TOKEN->SEND( EXCEPTIONS OTHERS = 1 ).
IF SY-SUBRC NE 0.
MESSAGE ID SY-MSGID TYPE SY-MSGTY NUMBER SY-MSGNO WITH SY-MSGV1 SY-MSGV2 SY-
MSGV3 SY-MSGV4.
ELSE.
" Receiving Response
LO_HTTP_CLIENT_TOKEN->RECEIVE( EXCEPTIONS OTHERS = 1 ).
IF SY-SUBRC NE 0.
MESSAGE ID SY-MSGID TYPE SY-MSGTY NUMBER SY-MSGNO WITH SY-MSGV1 SY-MSGV2 SY-
MSGV3 SY-MSGV4.
ELSE.
" Getting Response Code
LO_HTTP_CLIENT_TOKEN->RESPONSE-
>GET_STATUS( IMPORTING CODE = DATA(L_STATUS_CODE) ).

" Checking HTTP Response Status Code

IF L_STATUS_CODE = 200. "HTTPS Status is OK
DATA(RV_RESPONSE) = LO_HTTP_CLIENT_TOKEN->RESPONSE->GET_CDATA( ) .
" Extracting Response Body
/UI2/CL_JSON=>DESERIALIZE( EXPORTING JSON = RV_RESPONSE CHANGING DATA = LS_RETU
RN ) .

" Getting Bearer Token String

/UI2/CL_DATA_ACCESS=>CREATE( IR_DATA = LS_RETURN IV_COMPONENT = 'RESULT-
ACCESSTOKEN')->VALUE( IMPORTING EV_DATA = BEARER_TOKEN ).
" Displaying Bearer Token
WRITE: BEARER_TOKEN.

ELSE. "Displaying Error Message

LO_HTTP_CLIENT_TOKEN->RESPONSE-
>GET_HEADER_FIELDS( CHANGING FIELDS = LT_HDR_FIELDS ).
CL_DEMO_OUTPUT=>DISPLAY_DATA( LT_HDR_FIELDS ).
ENDIF.
ENDIF.
ENDIF.

Author: Zubair Ahmed Khan

Email: zubair.ahmed.khan@outlook.com