SAP CAP - Could not work with on-premise remote odata service via destination - 401 authentication

[AnkurGokhale]

Hi all,

I have a CAP framework based application which is intended to connect to a remote service via destination (on-premise odata v2 service).

The name of the destination is MyDest1.

The contents of the package.json are as below:

"cds": {
    "requires": {
      "ZGW_MY_SRV": {
        "kind": "odata-v2",
        "model": "srv/my-service",
        "[sandbox]": {
          "credentials": {
            "path": "/sap/opu/odata/sap/ZGW_MY_SRV",
            "destination": "MyDest1"
          }
        },
        "[production]": {
          "credentials": {
            "path": "/sap/opu/odata/sap/ZGW_MY_SRV",
            "destination": "MyDest1"
          }
        }
      },
      "auth": "xsuaa",
      "destinations": true,
      "connectivity": true,
      "[production]": {
        "connectivity": true,
        "auth": "xsuaa",
        "destinations": true
      }
    }
  }

The mta.yaml:

_schema-version: '3.1'
ID: MyCAP-nodejs
version: 1.0.0
description: "MyCAP-CAPM-NodeJS"
parameters:
  enable-parallel-deployments: true
build-parameters:
  before-all:
    - builder: custom
      commands:
        - npm ci
        - npx cds build --production
modules:
  - name: MyCAP-nodejs-srv
    type: nodejs
    path: gen/srv
    parameters:
      buildpack: nodejs_buildpack
      readiness-health-check-type: http
      readiness-health-check-http-endpoint: /health
      enable-ssh: true
    build-parameters:
      builder: npm
    provides:
      - name: srv-api # required by consumers of CAP services (e.g. approuter)
        properties:
          srv-url: ${default-url}
    requires:
      - name: MyCAPnodejs-connectivity
      - name: MyCAPnodejs-destination
      - name: MyCAPnodejs-auth

  - name: MyCAP-nodejs
    type: approuter.nodejs
    path: app/router
    parameters:
      enable-ssh: true
      keep-existing-routes: true
      disk-quota: 256M
      memory: 256M
    requires:
      - name: srv-api
        group: destinations
        properties:
          name: srv-api # must be used in xs-app.json as well
          url: ~{srv-url}
          forwardAuthToken: true
      - name: MyCAPnodejs-auth

resources:
  - name: MyCAPnodejs-connectivity
    type: org.cloudfoundry.managed-service
    parameters:
      service: connectivity
      service-plan: lite
  - name: MyCAPnodejs-destination
    type: org.cloudfoundry.managed-service
    parameters:
      service: destination
      service-plan: lite
  - name: MyCAPnodejs-auth
    type: org.cloudfoundry.managed-service
    parameters:
      service: xsuaa
      service-plan: application
      path: ./xs-security.json
      config:
        xsappname: MyCAP-nodejs-${org}-${space}
        tenant-mode: dedicated

.env file contains a destinations as a variable:

destinations=[{ "name": "MyDest1", "url": "http://MyDest1.dest", "proxyConfiguration":{ "host": "127.0.0.1", "port": 8887, "protocol":"http" } }]

.cdsrc-private.json:

{
  "requires": {
    "[hybrid]": {
      "auth": {
        "binding": {
          "type": "cf",
          "apiEndpoint": "https://api.cf.eu10.hana.ondemand.com",
          "org": "MyOrg-fiori",
          "space": "DevSpace",
          "instance": "MyCAPnodejs-auth",
          "key": "default",
          "resolved": false
        },
        "kind": "xsuaa-auth",
        "vcap": {
          "name": "auth"
        }
      },
      "ZGW_DevSpace_SRV": {
        "credentials": {
          "path": "/sap/opu/odata/sap/ZGW_MY_SRV",
          "destination": "MyDest1"
        }
      },
      "destinations": {
        "binding": {
          "type": "cf",
          "apiEndpoint": "https://api.cf.eu10.hana.ondemand.com",
          "org": "MyOrg-fiori",
          "space": "DevSpace",
          "instance": "MyCAPnodejs-destination",
          "key": "MyCAPnodejs-destination-key",
          "resolved": false
        },
        "kind": "destinations",
        "vcap": {
          "name": "destinations"
        }
      },
      "custom-service:MyCAPnodejs-connectivity": {
        "binding": {
          "type": "cf",
          "apiEndpoint": "https://api.cf.eu10.hana.ondemand.com",
          "org": "MyOrg-fiori",
          "space": "DevSpace",
          "instance": "MyCAPnodejs-connectivity",
          "key": "default",
          "resolved": false
        },
        "vcap": {
          "name": "custom-service:MyCAPnodejs-connectivity"
        }
      }
    }
  }
}

my-service.js:

const cds = require('@sap/cds');
module.exports = cds.service.impl(async function() {
    const bupa = await cds.connect.to('ZGW_MY_SRV');
  
    this.on('READ', ['EntityA', 'EntityB'], async (req) => {
        try {
            const result = await bupa.run(req.query);
            return result
        } catch(error) {
            console.error("Error accessing destination:", error);
            // throw new Error("Failed to access data from destination.");
            req.error(502, `Gateway error: ${error.message}`);
        }
    });
});

If I run the application in Business Application Studio (BAS) using commands:

cf login -a https://api.cf.eu10.hana.ondemand.com/ --sso and cds watch --profile hybrid,

it works as in if I click on the entity from the previewed services in the new tab, I get the data from the on premise system via destination and the same gets logged to the BAS terminal:

[2024-05-11T10:48:58.004Z] INFO     (env-destination-accessor): Successfully retrieved destination 'MyDest1' from environment variable.

However once deployment to the BTP cloud foundry space, it throws an error message as 401 Unauthorized.

In the apps that I access via cf logs <myapp-srv> --recent, I could see the URL I am maintaining in the destination in axios error logs.

I believe the CAP library is able to get the URL but not performing the authentication based on the method, username and password provided in the destination.

Need help.