SAP Business application Studio header's zid

[c_drancourt]

Hello,

I'm having trouble with Buiness application studio'c connection to my destinations.

On a brand new space created on Business application studio, I'm opening a terminal and run curl -v -i "ecc.dest" where ecc is my destination's name.

I receive a 403 result with the following message: proxy-authorization header's zid - ********-****-****-******-******must match SAP-Connectivity-Authentication header's zid - ******-*****-*****-******-*************

(I replaced the zid by stars)

My destination works fine: it is used successfully from the launchpad service. This issue only happens from Business application studio.

Thanks for your help

[RazK]

Hi,

We're sorry for your inconvenience. We are working on a resolution and we will update as soon as the fix is available. Our analysis indicates that it only affects BAS users in the EU10 (Frankfurt) region using Cloud Connector to connect to on-premise systems.

Regards - Raz

[RazK]

Hi,

The issue was resolved.

You should restart your dev space (stop + start).

Let us know if the issue persists.

Regards - Raz

[dharma214]

Connection to the destination is working now.
Thank you.

[former_member817408]

Same for us!
Thank you.

[c_drancourt]

Works for us a well, thanks

[former_member388737]

Hi Raz Korn,

1. First I got this issue
2. There is no SAP Cloud Connector (SCC) connected to your subaccount. Requested opening of a tunnel for subaccount <Subaccount_ID> and SCC location ID, with default value, that is empty string or simply not configured. Check the configuration on SCC and cloud side."
3. Second - I refreshed destination then i receive below issue
4. proxy-authorization header's zid - xxxx must match SAP-Connectivity-Authentication header's zid - yyyy
5. now after your BAS fix, i am receiving
6. Unable to generate authorization token for user <email> on system <system-cloud-connector>

Please provide the solution. thank you

Regards,

Sathriyan

[c_drancourt · Accepted solution]

Issue is solved by support thanks for your help

[ChrisSislak]

We are facing the same issue, since two days. No connections through BAS and Cloud Connector are possible at the moment, the whole development and test areas cant be used at the moment.

Are there any solutions? raz.korn

[RazK]

Hi,

The issue was resolved.

You should restart your dev space (stop + start).

Let us know if the issue persists.

Regards - Raz

[azogiani]

Hi,

I have been trying since yesterday to investigate and still cannot get it to work.

Seems that this issue is only in BAS

Provider: Amazon Web Services (AWS)

Region: Europe (Frankfurt)

I'm using local cloud connector and upgraded it to latest version 2.14.2 and still same error when trying to fetch OData from onPremise system.

Error code 403 and message below:

proxy-authorization header's zid - <ID_HERE> must match SAP-Connectivity-Authentication header's zid - <ID_HERE>

Also corporate git stopped working.

I hope this get's fixed asap.

BR,

Arianit

[markus86]

Hello,

we have the same problem.

Provider: Amazon Web Services (AWS)

Region: Europe (Frankfurt)

Have anyone a solutions?

Regards,

Markus

[former_member141441]

Hi Expert,

I am also facing the same issue.

Subaccount Region: Europe (Frankfurt)

Application: UI5

Regards,

Abdoulaye

[dharma214]

Hi colleagues,

I am also facing the same issue. We were able to connect to the destination till last Friday from BAS. Getting the below error today.

"proxy-authorization header's zid - 0776ba90-5c58-4**6-9756-65*4fec9**58 must match SAP-Connectivity-Authentication header's zid - badef997-5**1-4f36-b44a-61be5**b0a"

Subaccount Region: Europe (Frankfurt)

Application: UI5

Regards,
Dharmasish

[mahesh_jagannath]

Hi Raz Korn,

The BAS is launched from Region - Europe (Frankfurt). We are connected to an existing Destination and it was working all these days but since this morning it is behaving like this. We are facing this issue in an SAPUI5 application when accessing an OnPremise gateway service connected to BTP via cloud connector.

Earlier it used to prompt for Gateway system's credentials but now it has stopped altogether and throwing this error.

Regards,

Mahesh

[parthibaraja_vijayan3]

Hi,

We are also facing a similar kind of issue in BAS(Not able to connect a s4 destination), whereas it's working fine in the launchpad.

Application type: CAPM

Subaccount region: Europe (Frankfurt)

Regards,

Parthibaraja

[mahesh_jagannath]

Hi Christophe,

Even we are facing this issue since morning. Not sure if it is a global issue which SAP needs to address.

Regards,

Mahesh

[RazK]

Hi mahesh.jagannath ,

Can you share more details: Which region BAS is launched from, Which app are you trying to develop (SAPUI5/Fiori, MDK, CAP, ...)?

Regards - Raz

[former_member817408]

Hey Christophe,

we are facing the same issue since yesterday.
Everything was working till last friday.

we are trying to figure out the root cause, but its hard to get any usefull tracelogs.
Only BAS is affected, VS-Code is working.
Even the connection from BAS to git is not working anymore.

[RazK]

Hi adrian_abbassian_extern26 ,

Can you share more details: Which region BAS is launched from, Which app are you trying to develop (SAPUI5/Fiori, MDK, CAP, ...)?

Regards - Raz

[former_member817408]

Hi raz.korn,

i used the same curl command as Christophe and getting the same result.
I tried it with the service center and getting these errors:

{

"label": "service-center",

"level": "error",

"message": "Could not get v2 and v4 services for 'dest1'.",

"time": "2022-08-16T14:47:30.802Z"

}

{

"label": "service-center",

"level": "error",

"message": "Could not get v2 and v4 services for 'dest2'.",

"time": "2022-08-16T14:47:31.194Z"

}

{

"label": "service-center",

"level": "error",

"message": "Could not get v2 and v4 services for 'dest3'.",

"time": "2022-08-16T14:47:38.450Z"

}

{

"label": "service-center",

"level": "error",

"message": "Could not get v2 and v4 services for 'dest4'.",

"time": "2022-08-16T14:47:45.573Z"

}


{

"cause": {

"cause": {

"cause": {

"cause": null,

"code": 600,

"name": "ServiceProviderError",

"originalCause": 403

},

"code": 602,

"name": "ServiceProviderError"

},

"code": 602,

"name": "ServiceProviderError"

},

"code": 602,

"label": "service-center",

"level": "error",

"message": "Data retrieval error: Cannot get services. : Data retrieval error: Data retrieval error: Cannot retrieve services.: HTTP request failed with error code '403'.. Status code: 403. Data retrieval error: Cannot get services. : Data retrieval error: Data retrieval error: Cannot retrieve services.: HTTP request failed with error code '403'.",

"name": "ServiceProviderError",

"stack": "ServiceProviderError: Data retrieval error: Cannot get services. : Data retrieval error: Data retrieval error: Cannot retrieve services.: HTTP request failed with error code '403'.\n at t.SubaccountDestinationProviderSystem.<anonymous> (/tmp/vscode-unpacked/vscode-wing-service-center-0.15.31.vsix/extension/dist/extension.js:200:12321)\n at Generator.throw (<anonymous>)\n at s (/tmp/vscode-unpacked/vscode-wing-service-center-0.15.31.vsix/extension/dist/extension.js:200:11549)\n at runMicrotasks (<anonymous>)\n at processTicksAndRejections (internal/process/task_queues.js:95:5)",

"time": "2022-08-16T14:47:29.977Z"

}

[c_drancourt]

Dear Raz,

I'll try with ES5. Currently waiting for my account.

Let me try to add further details:

• I'm pretty sure my destination ECC works fine. As I said: it works fine from the launchpad service:

• Last time I worked on BAS, it was working fine, it stopped working today. When I test the very same app from the preview in BAS:

curl -v -i "ECC.dest/sap/opu/odata/sap/ZLS_PRODUCTION_PROCESS_SRV/$metadata?"

* Uses proxy env variable no_proxy == 'localhost,127.0.0.1,github.com,.github.com,.npmjs.org,.yarnpkg.com,npm.sap.com,.maven.apache.org'

* Uses proxy env variable http_proxy == 'http://127.0.0.1:8887'

* Trying 127.0.0.1:8887...

* Connected to 127.0.0.1 (127.0.0.1) port 8887 (#0)

> GET http://ECC.dest/sap/opu/odata/sap/ZLS_PRODUCTION_PROCESS_SRV/ HTTP/1.1

> Host: ECC.dest

> User-Agent: curl/7.72.0

> Accept: */*

> Proxy-Connection: Keep-Alive

>

* Mark bundle as not supporting multiuse

< HTTP/1.1 403 Forbidden

HTTP/1.1 403 Forbidden

< Content-Length: 166

Content-Length: 166

< Content-Type: text/plain; charset=utf-8

Content-Type: text/plain; charset=utf-8

< Date: Tue, 16 Aug 2022 14:14:41 GMT

Date: Tue, 16 Aug 2022 14:14:41 GMT

< Server: envoy

Server: envoy

< Set-Cookie: BASSESSION="5a1a6c6cd03079a4"; HttpOnly

Set-Cookie: BASSESSION="5a1a6c6cd03079a4"; HttpOnly

< Vary: Accept-Encoding

Vary: Accept-Encoding

< X-Envoy-Upstream-Service-Time: 159

X-Envoy-Upstream-Service-Time: 159

< X-Frame-Options: SAMEORIGIN

X-Frame-Options: SAMEORIGIN

< X-Request-Id: a71438cc-c8c2-4e31-be68-7001ec449fdd

X-Request-Id: a71438cc-c8c2-4e31-be68-7001ec449fdd

<

* Connection #0 to host 127.0.0.1 left intact

proxy-authorization header's zid - ***************** must match SAP-Connectivity-Authentication header's zid - ******************

[RazK]

Hi c.drancourt ,

An additional test option is to access the destination through BAS's service center.

Regards - Raz

[RazK]

Hi c.drancourt ,

Looks like this is not specific to you.

Can you share more details: Which region BAS is launched from, Which app are you trying to develop (SAPUI5/Fiori, MDK, CAP, ...)?

Please open a ticket with component: CA-BAS-AUT.

Regards - Raz

[c_drancourt]

Thanks for your help, I will.

Just in case, I'm on eu10cf and am developing a fiori app.

[c_drancourt]

Hello raz.korn,

In fact, I tried to simplify my case as much as possible so I put a simple curl to the destination and only the destination without details.

The original issue I have, is when I preview my app, all odata are returned 403 error.

So, whatever service I try to access from my desintation in Buiness application studio, it gives the sames result:

For example with "curl -v -i "ecc.dest/sap/opu/odata/iwfnd/catalogservice;v=2".

I'm not sure this is what you meant but please find below the curl I'm executing and its result.

curl -v -i "ecc.dest"

* Uses proxy env variable no_proxy == 'localhost,127.0.0.1,github.com,.github.com,.npmjs.org,.yarnpkg.com,npm.sap.com,.maven.apache.org'

* Uses proxy env variable http_proxy == 'http://127.0.0.1:8887'

* Trying 127.0.0.1:8887...

* Connected to 127.0.0.1 (127.0.0.1) port 8887 (#0)

> GET http://ecc.dest/ HTTP/1.1

> Host: ecc.dest

> User-Agent: curl/7.72.0

> Accept: */*

> Proxy-Connection: Keep-Alive

>

* Mark bundle as not supporting multiuse

< HTTP/1.1 403 Forbidden

HTTP/1.1 403 Forbidden

< Content-Length: 166

Content-Length: 166

< Content-Type: text/plain; charset=utf-8

Content-Type: text/plain; charset=utf-8

< Date: Tue, 16 Aug 2022 13:30:24 GMT

Date: Tue, 16 Aug 2022 13:30:24 GMT

< Server: envoy

Server: envoy

< Set-Cookie: BASSESSION="5a1a6c6cd03079a4"; HttpOnly

Set-Cookie: BASSESSION="5a1a6c6cd03079a4"; HttpOnly

< Vary: Accept-Encoding

Vary: Accept-Encoding

< X-Envoy-Upstream-Service-Time: 221

X-Envoy-Upstream-Service-Time: 221

< X-Frame-Options: SAMEORIGIN

X-Frame-Options: SAMEORIGIN

< X-Request-Id: b24d9280-bb32-4908-9249-48bdc40ff8de

X-Request-Id: b24d9280-bb32-4908-9249-48bdc40ff8de

<

* Connection #0 to host 127.0.0.1 left intact

proxy-authorization header's zid - 0776ba90-5c58-4976-****-********* must match SAP-Connectivity-Authentication header's zid - 6b8634db-6e71-****-846b-***********

[RazK]

Hi c.drancourt ,

You should use curl against a url that returns data, e.g. the metadata of the service.

The output of curl will provide you indications if there are connectivity issues with the backend as described in the blog that was previously shared.

You can use ES5 as a sandbox backend to test before checking with your own backend, where I believe the connectivity setup is more complex. Refer here.

Regards - Raz

[RazK]

Hi c.drancourt ,

Please provide the complete curl command that you run.

The following blog may assist in how to create the service endpoint parameter for the curl command.

Regards - Raz