Understanding Authorization in OData

[Ravikumar_H]

Introduction:

Authorization refers to controlling access to resources and operations within an OData service. OData is a protocol that standardizes the way data is exposed and consumed over the web, typically using RESTful APIs.

OData(Open Data Protocol) is a widely adopted standard for building and consuming RESTful APIs. It simplifies data sharing across disparate systems, making it easier for developers to expose and consume data in a standardized manner. However, with great power comes great responsibility, and securing OData services is paramount to protect sensitive information. In this blog post, we'll delve into the intricacies of authorization in OData and explore best practices for securing your OData services.

Role-based authorization is a common practice in securing OData services. Assigning specific roles to users and granting permissions based on these roles helps control access to different resources. This approach ensures that users only have the necessary privileges required for their tasks.

Authentication vs. Authorization

Before delving into OData authorization, it's crucial to distinguish between authentication and authorization:

Authentication: Verifying the identity of users or systems making requests. Common methods include OAuth, API keys, or username/password.

Authorization: Determining the actions and data access permissions granted to authenticated users or systems.

Here I am creating a Odata project in Tcode SEGW by providing Project name and Description.  Import the Database table to the project by following the below steps   Provide the name of Database table in ABAP Structure.   Here Check out the Required fields for your Requirement and Click on Next.   Here Check on the Key fields present in the Table and click on finish. Then Generate the OData Service, After Generating Components and methods will get Generated.   Here in Get Entityset I'm writing select Query to fetch the data.

To Provide Authorization to OData we need to follow below Steps. Step 1: Go to Tcode :- SU20, Create Authorization field as shown below Then Create Authorization Object in Tcode SU21 and Assign Authorization field to the Authorization Object. Step 2: Create authorization for the role Tcode : PFCG we'll see how to Provide Authorization to ODATA by Assigning roles. Go to Tcode : PFCG and Provide Role and Description. Then  Select the Role as per your Requirement, Here i am Selecting Single Role. After selecting Single Role New Page will get displayed, Here click On Menu Tab.   In Transaction Arrow symbol, choose Authorization default.  Choose the SAP Gateway Business Suite Enablement - Service  Then choose your service   Here we can see that our Service is Added to the role.  Then Click on Authorization Tab   Then Click on Change Authorization Data. Click on Manually and provide your Authorization Name and select the Action and Click on Generate. After Generating will get the Message 'Profiles were Updated'. Then Go to Transaction Code ‘SU01’ to set role for the User.  Enter your Role name and click enter. Then in Profiles click on generate which is located next to the Role name. By Performing this we can Provide Authorization to ODATA Service. Output for the HANAUSER18(My user). When Authorized user try to access.

Output for HANAUSER24 (Other user) When Non authorized user try to Access it will throw error.

[chholzermsg]

Hi @Ravikumar_H ,

thank you very much for this blog.

And how would it be the other way around? i.e. I have an OData service and I want to know, which role I need to access it?

Regards

Christian