on 09-27-2021 9:54 AM
Hi,
I am using SAP BTP Portal service to display SAP UI5 applications on SAP Fiori launchpad sites.
External users (no access to SAP GUI) are accessing launchpad through P-user id (P00000) which comes from a custom IDP.
I fetch logged in external user's uid from userapi (/services/userapi/attributes).
External user (P-user ID) details are already loaded in a customizing table on SAP system.
Following is the OData service request parameters:
How do i hide the user id parameter for security reason in both Neo and Cloud foundry environment?
Kindly suggest a way to handle the above mentioned scenario.
Thank you.
I would suggest using a CAP layer as the middleware.
Within the CAP layer, get the external user's ID and add it as a query parameter or better as an HTTP header when you call the backend.
This is a very common scenario and hope SAP provides a better solution, like adding the user context as an HTTP header via the destination. If anyone has a better/lighter solution, please share.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
When you can't create the users also in the backend and use principal propagation you have to create a middleware on SAP BTP so that the filter based on the User ID is added there and hidden from the user.
With a basic auth destination acessible from a UI5 app you give every authenticated user the option to read all data because they can modify the filter options.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
User | Count |
---|---|
67 | |
8 | |
7 | |
6 | |
6 | |
5 | |
5 | |
5 | |
4 | |
4 |
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.