Unable to call external service (sap workflow service) from CAP - destination errors

[js2]

I am trying to call the SAP workflow service from a CAP service like so:

const workflow = await cds.connect.to('workflowService')
const response = await workflow.tx(req).post('/v1/workflow-instances', {
            "definitionId": "IncidentFlow",
            "context": {
                "property": "test",
            }
        })

The package.json includes this under cds.requires:

"workflowService": {
                "kind": "rest",
                "credentials": {
                    "destination": "safetyincidentworkflow"
                }
            }

I have a destination instance called "safetyincidentworkflow" and a Destination configure as:

I have copied my mta file further below where I am linking the srv module to the uaa service and destination, etc.

These are the errors:

2020-11-20T09:56:05.28+0800 [RTR/4] OUT p-t-cee-dev-safetyincidents-srv.cfapps.ap10.hana.ondemand.com - [2020-11-20T01:56:04.819643322Z] "POST /safety-incident/$batch HTTP/1.1" 200 1329 309 "https://p-t-cee-dev-safetyincidents-ui.cfapps.ap10.hana.ondemand.com/webapp/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36" "-" "10.0.137.3:61013" x_forwarded_for:"-" x_forwarded_proto:"https" vcap_request_id:"5ce1d453-248c-4b7e-57ca-a7944a0c45bd" response_time:0.469933 gorouter_time:0.000171 app_id:"0ebc4dcc-9caf-4274-8f2b-e97b6573690d" app_index:"0" x_cf_routererror:"-" x_correlationid:"bbd74c06-1d08-42e0-7d0c-e004723a49f8" tenantid:"-" sap_passport:"-" x_scp_request_id:"a69225a6-e7ab-47a4-90a1-6ce3a647b2d6-5FB72232-5FA253" x_cf_app_instance:"-" x_b3_traceid:"3badc8d7590a890b" x_b3_spanid:"3badc8d7590a890b" x_b3_parentspanid:"-" b3:"3badc8d7590a890b-3badc8d7590a890b"
   2020-11-20T09:56:05.28+0800 [RTR/4] OUT 
   2020-11-20T10:03:02.29+0800 [APP/PROC/WEB/0] OUT POST /safety-incident/$batch
   2020-11-20T10:03:02.32+0800 [APP/PROC/WEB/0] OUT {"message":"The custom headers are provided with the keys: accept,content-type,content-length. These keys will overwrite the headers created by the SDK.","level":"warn","custom_fields":{"package":"core","messageContext":"http-client"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-20T02:03:02.327Z","msg":"The custom headers are provided with the keys: accept,content-type,content-length. These keys will overwrite the headers created by the SDK.","written_ts":1605837782327,"written_at":"2020-11-20T02:03:02.327Z"}
   2020-11-20T10:03:02.32+0800 [APP/PROC/WEB/0] OUT {"message":"Attempting to retrieve destination from environment variable.","level":"info","custom_fields":{"package":"core","messageContext":"env-destination-accessor"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-20T02:03:02.327Z","msg":"Attempting to retrieve destination from environment variable.","written_ts":1605837782327,"written_at":"2020-11-20T02:03:02.327Z"}
   2020-11-20T10:03:02.32+0800 [APP/PROC/WEB/0] OUT {"message":"No environment variable set.","level":"info","custom_fields":{"package":"core","messageContext":"env-destination-accessor"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-20T02:03:02.327Z","msg":"No environment variable set.","written_ts":1605837782327,"written_at":"2020-11-20T02:03:02.327Z"}
   2020-11-20T10:03:02.32+0800 [APP/PROC/WEB/0] OUT {"message":"Attempting to retrieve destination from service binding.","level":"info","custom_fields":{"package":"core","messageContext":"destination-accessor-vcap"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-20T02:03:02.327Z","msg":"Attempting to retrieve destination from service binding.","written_ts":1605837782327,"written_at":"2020-11-20T02:03:02.327Z"}
   2020-11-20T10:03:02.32+0800 [APP/PROC/WEB/0] OUT {"message":"Could not retrieve destination from service binding. If you are not using SAP Extension Factory, this information probably does not concern you. Service of type destination is not supported! Consider providing your own transformation function when calling destinationForServiceBinding, like this:\n  destinationServiceForBinding(yourServiceName, { serviceBindingToDestination: yourTransformationFunction });","level":"info","custom_fields":{"package":"core","messageContext":"destination-accessor-vcap"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-20T02:03:02.328Z","msg":"Could not retrieve destination from service binding. If you are not using SAP Extension Factory, this information probably does not concern you. Service of type destination is not supported! Consider providing your own transformation function when calling destinationForServiceBinding, like this:\n  destinationServiceForBinding(yourServiceName, { serviceBindingToDestination: yourTransformationFunction });","written_ts":1605837782328,"written_at":"2020-11-20T02:03:02.328Z"}
   2020-11-20T10:03:02.32+0800 [APP/PROC/WEB/0] OUT {"message":"Unable to match a specific XSUAA service instance to the given JWT. The following XSUAA instances are bound: safetyincidents!t262. The following one will be selected: safetyincidents!t262. This might produce errors in other parts of the system!","level":"warn","custom_fields":{"package":"core","messageContext":"environment-accessor"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-20T02:03:02.329Z","msg":"Unable to match a specific XSUAA service instance to the given JWT. The following XSUAA instances are bound: safetyincidents!t262. The following one will be selected: safetyincidents!t262. This might produce errors in other parts of the system!","written_ts":1605837782329,"written_at":"2020-11-20T02:03:02.329Z"}
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] OUT {"message":"Successfully retrieved destination from destination service.","level":"info","custom_fields":{"package":"core","messageContext":"destination-accessor-service"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-20T02:03:02.358Z","msg":"Successfully retrieved destination from destination service.","written_ts":1605837782358,"written_at":"2020-11-20T02:03:02.358Z"}
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] OUT {"message":"Try to fetch https_proxy or HTTPS_PROXY from the process env. Found value is undefined","level":"info","custom_fields":{"package":"core","messageContext":"proxy-util"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-20T02:03:02.358Z","msg":"Try to fetch https_proxy or HTTPS_PROXY from the process env. Found value is undefined","written_ts":1605837782358,"written_at":"2020-11-20T02:03:02.358Z"}
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] OUT {"message":"No Proxy settings for https are found in environment variables - no proxy used","level":"info","custom_fields":{"package":"core","messageContext":"proxy-util"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-20T02:03:02.358Z","msg":"No Proxy settings for https are found in environment variables - no proxy used","written_ts":1605837782358,"written_at":"2020-11-20T02:03:02.358Z"}
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR [2020-11-20T02:03:02.359Z | ERROR | 1103708]: Error: Failed to build HTTP request for destination: failed to build headers!
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at Object.errorWithCause (/home/vcap/app/node_modules/@sap-cloud-sdk/util/dist/error.js:5:20)
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at /home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/http-client/http-client.js:195:38
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at process._tickCallback (internal/process/next_tick.js:68:7)
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR Caused by:
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR Error: Failed to build authorization header for the given destination. Make sure to either correctly configure your destination for principal propagation, provide both a username and a password or select "NoAuthentication" in your destination configuration.
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at /home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/header-builder/authorization-header.js:242:27
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at step (/home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/header-builder/authorization-header.js:44:23)
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at Object.next (/home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/header-builder/authorization-header.js:25:53)
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at /home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/header-builder/authorization-header.js:19:71
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at new Promise (<anonymous>)
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at __awaiter (/home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/header-builder/authorization-header.js:15:12)
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at getAuthenticationRelatedHeaders (/home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/header-builder/authorization-header.js:223:12)
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at /home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/header-builder/authorization-header.js:256:42
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at step (/home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/header-builder/authorization-header.js:44:23)
   2020-11-20T10:03:02.35+0800 [APP/PROC/WEB/0] ERR     at Object.next (/home/vcap/app/node_modules/@sap-cloud-sdk/core/dist/header-builder/authorization-header.js:25:53)

The MTA file:

## Generated mta.yaml based on template version 0.4.0
## appName = safetyincidents
## language=nodejs; multiTenant=false
## approuter=
_schema-version: "3.1"
ID: safetyincidents
version: 1.0.0
description: "A simple CAP project."
parameters:
  enable-parallel-deployments: true

build-parameters:
  before-all:
    - builder: custom
      commands:
        - npm install --production
        - npx -p @sap/cds-dk cds build --production

modules:
  # --------------------- UI MODULE ----------------------------
  - name: safetyincidents-ui
    # ------------------------------------------------------------
    type: nodejs
    path: app
    parameters:
      memory: 256M
      disk-quota: 256M
    requires:
      - name: safetyincidents-uaa
      - name: safetyincidentworkflow
      - name: srv-api
        group: destinations
        properties:
          forwardAuthToken: true
          strictSSL: true
          name: srv-api
          url: ~{srv-url}

  # --------------------- SERVER MODULE ------------------------
  - name: safetyincidents-srv
    # ------------------------------------------------------------
    type: nodejs
    path: gen/srv
    requires:
      # Resources extracted from CAP configuration
      - name: safetyincidents-db
      # enterprise messaging
      - name: safetyincidents-em
      # Authentication
      - name: safetyincidents-uaa
      # destination to workflow api
      - name: safetyincidentworkflow
      # workflow instance
      - name: workflow_mta
    provides:
      - name: srv-api # required by consumers of CAP services (e.g. approuter)
        properties:
          srv-url: ${default-url}

  # -------------------- SIDECAR MODULE ------------------------
  - name: safetyincidents-db-deployer
    # ------------------------------------------------------------
    type: hdb
    path: gen/db
    parameters:
      buildpack: nodejs_buildpack
    requires:
      # 'hana' and 'xsuaa' resources extracted from CAP configuration
      - name: safetyincidents-db
      - name: safetyincidents-uaa

resources:
  - name: safetyincidentworkflow
    type: org.cloudfoundry.managed-service
    parameters:
      service-plan: lite
      service: destination

  - name: workflow_mta
    type: org.cloudfoundry.existing-service
    parameters:
      service: workflow
      service-plan: lite

  # services extracted from CAP configuration
  # 'service-plan' can be configured via 'cds.requires.<name>.vcap.plan'
  # ------------------------------------------------------------
  - name: safetyincidents-db
    # ------------------------------------------------------------
    type: com.sap.xs.hdi-container
    parameters:
      service: hana # or 'hanatrial' on trial landscapes
      service-plan: hdi-shared
    properties:
      hdi-service-name: ${service-name}

  - name: safetyincidents-em
    type: org.cloudfoundry.managed-service
    parameters:
      path: ./enterprisemessage.json
      service: enterprise-messaging
      service-plan: default

  - name: safetyincidents-uaa
    type: org.cloudfoundry.managed-service
    parameters:
      service: xsuaa
      service-plan: application
      path: ./xs-security.json

[Junjie]

Hi Jason,

currently, the SAP Cloud SDK does not support the authentication type "OAuth2UserTokenExchange", which is used in your case.

May I ask you to create an issue for such feature request in our repository, so that we can discuss in the refinement meeting?

Thank you very much.

[js2]

Thankyou dsfas for that info... does that mean that its not possible (now) to call the workflow rest api's from a CAP service or is it one of the other oauth based authentication mechanisms that need to be used in the destination?

[Junjie]

CAP is use the SAP Cloud SDK for destination service, and your "OAuth2UserTokenExchange" is not in this list, that is supported currently. As a quick win, are you able to switch to some other authentication types listed in the link, e.g. "OAuth2SAMLBearerAssertion" and "OAuth2ClientCredentials" as oauth based?

[former_member729305]

Dear jasonscott

could you explain how you solved that issue?

Best Regards

Max

[artemkovalov · Accepted solution]

Hi jasonscott,

Artem here, a Product Owner from Cloud SDK. As dsfas mentioned, the workaround, for now, would be to use another auth type. Will it work for you?

We've added a task to support `OAuth2UserTokenExchange` to our backlog and it will be supported soon.

We also plan to have a type-safe generated client for Workflow service out of the box soon. Would you be interested in using it?

You can always find our documentation here: https://sap.github.io/cloud-sdk/docs/js/getting-started

Or report an issue here if you need the support of identified a bug: https://github.com/SAP/cloud-sdk-js/issues/new/choose. This way supporting is much simpler than on "Answers".

Best,

Artem

[js2 · Accepted solution]

artemkovalov Most definitely interested in the client for the workflow service. Will this work just like how you can easily add messaging with enterprise-messaging?

Will try one of the other oauth mechanisms and see if that works with the workflow api. Does the mta look correct though?

[artemkovalov · Accepted solution]

jasonscott,

The thing is that you're currently using only connectivity from Cloud SDK, other things are coming from CAP if I'm not mistaking. Messaging is also done by CAP.
I think workflow service will work more or less the same way our OData client works at the moment. You can also take a look at our docs in regards to connectivity

We'll plan some Docs about using SDK with CAP to make it simpler to use together.

[js2 · Accepted solution]

Hi artemkovalov and dsfas ,

I've managed to get this to work and can now call a workflow from a CAP service - brilliant.

So the issues I had were:

1) I was trying to use 'OAuth2UserTokenExchange' which is not supported by the Cloud SDK. I would need to goto the Cloud SDK github repo to find this out.

2) When creating a workflow instance for my application to use, I must specifically create this instance with the oauth scopes required for the workflow API. In my case I simply want to start new workflows - so from the api.sap.com website I can see this requires a scope called "WORKFLOW_INSTANCE_START" - this must be set when creating the workflow instance (as json). I never saw this documented anywhere except on the cloud SDK website.

{
    "authorities": ["WORKFLOW_INSTANCE_START"]
}

3) It is very confusing how to setup a destination to use this service. Different blog posts and documentation tell you to configure it in different ways. For example the Cloud SDK documentation (https://sap.github.io/cloud-sdk/docs/java/features/rest/clients/scp-workflow-rest-api/) says that you must append "/oauth/token?grant_type=client_credentials" to the end of the service token url. This is incorrect. It must be left as it is shown in your app environment vars like: "https://pntcee.authentication.ap10.hana.ondemand.com".

Thankyou both for your kind help...

[Junjie · Accepted solution]

Hi jasonscott ,

thank you very much for your feedback.

I guess we need to clarify a bit about how you consume the SAP Cloud SDK now.

I see your application is js based, and you are using CAP service.

Actually the SAP Cloud SDK has two variants: Java and JavaScript, see the overview.

For the time being, the SAP Cloud SDK for JavaScript has not released any REST related functionality or workflow service client on the npmjs.

We are working on REST generator for generating REST client and releasing workflow service client is also our next step, which I cannot tell the timeline though.

The reason why you implicitly consumed the SDK is because CAP is using our connectivity service, which is related to the destination/authentication issue.

Therefore, for the 3 items mentioned, I would say:

1. We improved the documentation so you see the supported authentication types: https://sap.github.io/cloud-sdk/docs/js/features/connectivity/destination-js-sdk#authentication-and-...

2 and 3. The doc you found related to these two are all from the Java variant instead of JS. It is helpful if you only read some general section. Please be careful, since you are not using the workflow service client (Java version) and the SDK Java variant, the context might be different.

artemkovalov

Best regards,

Junjie

[karanbahl · Accepted solution]

Hi jasonscott , I am trying the same thing. I have posted the same question; I am able to trigger the workflow but I want to use the destination to do this; can you please help with the steps which worked for you?

How to get token using destination in CAPM based service? - SAP Q&A

Regards,

Karan

[karanbahl · Accepted solution]

Below are the logs:

2020-11-27T09:53:54.104+0000 [APP/PROC/WEB/0] OUT {"message":"The custom headers are provided with the keys: accept,content-type,content-length. These keys will overwrite the headers created by the SDK.","level":"warn","custom_fields":{"package":"core","messageContext":"http-client"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-27T09:53:54.104Z","msg":"The custom headers are provided with the keys: accept,content-type,content-length. These keys will overwrite the headers created by the SDK.","written_ts":1606470834104,"written_at":"2020-11-27T09:53:54.104Z"}
2020-11-27T09:53:54.104+0000 [APP/PROC/WEB/0] OUT {"message":"Attempting to retrieve destination from environment variable.","level":"info","custom_fields":{"package":"core","messageContext":"env-destination-accessor"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-27T09:53:54.104Z","msg":"Attempting to retrieve destination from environment variable.","written_ts":1606470834104,"written_at":"2020-11-27T09:53:54.104Z"}
2020-11-27T09:53:54.104+0000 [APP/PROC/WEB/0] OUT {"message":"No environment variable set.","level":"info","custom_fields":{"package":"core","messageContext":"env-destination-accessor"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-27T09:53:54.104Z","msg":"No environment variable set.","written_ts":1606470834104,"written_at":"2020-11-27T09:53:54.104Z"}
2020-11-27T09:53:54.104+0000 [APP/PROC/WEB/0] OUT {"message":"Attempting to retrieve destination from service binding.","level":"info","custom_fields":{"package":"core","messageContext":"destination-accessor-vcap"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-27T09:53:54.104Z","msg":"Attempting to retrieve destination from service binding.","written_ts":1606470834104,"written_at":"2020-11-27T09:53:54.104Z"}
2020-11-27T09:53:54.105+0000 [APP/PROC/WEB/0] OUT {"message":"Could not retrieve destination from service binding. If you are not using SAP Extension Factory, this information probably does not concern you. Unable to find a service binding for given name "workflowservice"! Found the following bindings: srvhana-db.n      ","level":"info","custom_fields":{"package":"core","messageContext":"destination-accessor-vcap"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-27T09:53:54.105Z","msg":"Could not retrieve destination from service binding. If you are not using SAP Extension Factory, this information probably does not concern you. Unable to find a service binding for given name "workflowservice"! Found the following bindings: srvhana-db.n      ","written_ts":1606470834105,"written_at":"2020-11-27T09:53:54.105Z"}
2020-11-27T09:53:54.105+0000 [APP/PROC/WEB/0] OUT {"message":"No services of type destination found! This might cause errors in other parts of the application.","level":"warn","custom_fields":{"package":"core","messageContext":"environment-accessor"},"logger":"sap-cloud-sdk-logger","timestamp":"2020-11-27T09:53:54.105Z","msg":"No services of type destination found! This might cause errors in other parts of the application.","written_ts":1606470834105,"written_at":"2020-11-27T09:53:54.105Z"}
2020-11-27T09:53:54.105+0000 [APP/PROC/WEB/0] ERR [2020-11-27T09:53:54.105Z | ERROR | 1093984]: { Error: 500
2020-11-27T09:53:54.105+0000 [APP/PROC/WEB/0] ERR     at ODataRequest.reject (/home/vcap/app/node_modules/@sap/cds/lib/srv/Request.js:17:39)
2020-11-27T09:53:54.105+0000 [APP/PROC/WEB/0] ERR     at ApplicationService.srv.on (/home/vcap/app/srv/installationService.js:222:14) message: '500', target: '500', numericSeverity: 4 }
2020-11-27T09:53:54.107+0000 [RTR/40] OUT ..cfapps.eu10.hana.ondemand.com - [2020-11-27T09:53:54.092607503Z] "POST /installation/captureErrors HTTP/1.1" 500 91 58 "-" "PostmanRuntime/7.26.8" "-" "10.0.137.177:61054" x_forwarded_for:"-" x_forwarded_proto:"https" vcap_request_id:"17744a0d-7feb-4a0a-7632-d05d81566071" response_time:0.014496 gorouter_time:0.000274 app_id:"f32c3802-7e0a-46d4-af6a-5ab35cf2b1a7" app_index:"0" x_cf_routererror:"-" x_correlationid:"-" tenantid:"-" sap_passport:"-" x_scp_request_id:"b9e44887-30c9-42db-b58b-e280b06941d8-5FC0CCB1-15A8A7B" x_cf_app_instance:"-" x_b3_traceid:"cf9b3a906a333b84" x_b3_spanid:"cf9b3a906a333b84" x_b3_parentspanid:"-" b3:"cf9b3a906a333b84-cf9b3a906a333b84"

[former_member729305 · Accepted solution]

Hi artemkovalov

can you tell how to initiate a workflow instance via an event handler inside the fiori element app?

Best Regards

Max

[artemkovalov · Accepted solution]

snarkway and karan.bahl1987 ,

It's notoriously difficult to provide support via the SAP Answers because of many topics mixed and no clear case tracking.

Can you please create an issue in our open source repository. Please, provide sufficient details for the investigation:
- The version of SDK in use
- Failing code snippet
- Logs (same as you did here)

We are responsive and have our support board there to track every incident separately.

As far as I see from the glance at the logs this might be a configuration issue, but without developers looking at this and having a code snippet of you destination configuration it's difficult to pinpoint the root cause of the problem.

Looking forward to helping you solve this soon!

[former_member710112 · Accepted solution]

Hi jasonscott ,

I am currently having a CAP-WF set up very similar to yours. I got passed the authentication error by using a different destination with different auth type. However, I am encountering an issue at the actual POST call where where the it returns 415 Unsupported media type.

I did no more than workflow.tx(req).post(endpoint,payload) and my payload is a serialisable JSON object.

Any chance you have come across similar issue?

Looking forward to hearing from you.

[Rsridhar · Accepted solution]

artemkovalov, Whether the Authentication type OAuth2UserTokenExchange supported now?

Thanks

[Rsridhar · Accepted solution]

I was able to use OAuth2UserTokenExchange and triggered the WF from CAP.

Thanks