REST Lookup UDF with signed and encypted request payload. Descrypt response after

[joel_langoyan]

Hi Experts,

This is related to my other question. For our scenario, for every API calls we need to get a token and the request for token have to be signed and encrypted as well. We're given a sample of the expected encrypted request as below.

PLAIN
<oAuthToken xmlns="some URL">
	<grantType>client_credentials</grantType>
	<scope>value</scope>
	<sourceApplication>value</sourceApplication>
</oAuthToken>

SIGNED and ENCRYPTED
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element">
	<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
	<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
		<xenc:EncryptedKey>
			<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
			<xenc:CipherData>
				<xenc:CipherValue>SOME VALUE</xenc:CipherValue>
			</xenc:CipherData>
		</xenc:EncryptedKey>
	</ds:KeyInfo>
	<xenc:CipherData>
		<xenc:CipherValue>SOME VALUE</xenc:CipherValue>
	</xenc:CipherData>
</xenc:EncryptedData><br>

I have referenced below blogs but not sure if encrypted request payload is achievable.

OAuth 2.0 authentication within a UDF mapping to be included in REST receiver channel | SAP Blogs

REST Look Up using UDF in SAP PO | SAP Blogs

SAP PI/PO XML X509 signature by certificate | SAP Blogs - this did not include resulting payload

How to do RSA signature and Base64 by UDF for SAP PO | SAP Blogs

The response later on would have to be decrypted.

If anyone have encountered similar requirement. Please advise. Thank you.

[fprokopiuk]

Hi Joel, just from curiosity, have you tried the security profile approach I've described in your first post? I wonder if it's useful in such cases.

[joel_langoyan]

Hi Filip,

I have looked into that it might but only for sending the actual API request. Right now, the roadblock is to get a proper signed and encrypted payload for the token request in which it has to be via lookup channel as per references.

[fprokopiuk]

OK I understand,maybe you can call API to get token seperately and later just use the token for further calls.

[joel_langoyan · Accepted solution]

Posted a blog for the solution