SAP CPI – End to End VAT integration using OAuth 2.0 with client credentials grant to generate Access token authentication

When we are doing integration between Cloud – Cloud and Cloud to On-Premise, then we have multiple types of Authentication to access the API’s.

User Credentials:

User Id and Password

OAuth 2.0 Credentials:

Client secure url, Client ID , Client Secret and Scope

OAuth 2.0 Authorization Code:

Atheization URL, Token URL , Client ID, Client Secret and User Name and password

Client Certificate:

client certificate

SAP PO Certification Preparation Guide

In this blog post I am going to explain the end-to-end VAT return outbound interface integration between SAP to HMRC UK government portal using the OAuth 2.0 with the Client Credentials Grant to generate Access Token.

Integration Flow Chart

Step-1 : OAuth 2.0 Access Token Configuration

The Following diagram illustrates the process to get access token

Logon to your SAP Cloud Platform Integration web application
Navigate to the Monitor option then we can see overview.
Then go to Manage Security > Security Material

Here choose Create > OAuth2 Authorization Code.

Then need to maintain the Authorization URL, Token Service URL, Client ID, Client Secret, User Name and scope of the your interface (for the VAT return interface scope is write:vat)

Click on the Deploy > Authorize > then it will redirect to the Callback URL, enter the Credentials once enter the credentials it will show as below then click on Grant Authority

Now successfully deployed the OAuth2.0 Access token configuration this will access later in the VAT return interface IFlow.

Step-2 End-to-End VAT return Interface IFlow

Navigate to Design > Package > Artifacts Tab
Choose Add > Integration Flow

Step-3

From the sender Drag the connecting arrow to connect to start action, from the Adapter Type box select the SOAP/HTTPS.

SOAP: WSDL based integration then we can go for the SOAP adapter.

HTTPS: JSON based integrations then we can go for the HTTPS Adapter, and also it will work for the xml.

In Connection tab, enter the Address or URL details
Enter HRMC/VAT/returns Optionally, you can enter any value of your choice, but ensure that you use “/” symbol before specifying the endpoint name

Step-4 Groovy Script

The groovy script contains the functionality to fetch an access token from the OAuth2.0 Authorization Code credential which we have configured in the Step-1(Security Material).

import com.sap.gateway.ip.core.customdev.util.Message;
import com.sap.it.api.securestore.SecureStoreService;
import com.sap.it.api.securestore.AccessTokenAndUser;
import com.sap.it.api.securestore.exception.SecureStoreException;
import com.sap.it.api.ITApiFactory;
def Message processData(Message message) {
     
    SecureStoreService secureStoreService = ITApiFactory.getService(SecureStoreService.class, null);
 
    AccessTokenAndUser accessTokenAndUser = secureStoreService.getAccesTokenForOauth2AuthorizationCodeCredential("OAuth2.0");
    String token = accessTokenAndUser.getAccessToken();
        
    message.setHeader("Authorization", "Bearer "+token);
    
     
    
   return message;
}

By calling the method

getAccesTokenForOauth2AuthorizationCodeCredential(“OAuth2.0”),

you fetch the access token of the OAuth2 Authorization Code credential with name “OAuth2.0”.
once we get token from this method then we need to pass same Access token in the header level using the below groovy syntax.

message.setHeader(“Authorization”, “Bearer “+token);

Step-5 Content Modifier

By using content modifier, we are passing the Accept and Content-type parameters in the http header request as below.

Step-6 Request-Reply

Connect the Request Reply to Receiver by dragging the arrow icon on Request Reply to the Receiver

Select the Connection tab. In the Address field, enter the Target endpoint/Url(https://hostname/org/vrn/return)

Step-7

Click Save to persist the changes to integration Flow.
Click Deploy to deploy the integration Flow.

Navigate to the Monitor View.
Under the Mange Integration Content Section > Choose Start to access all the Started Artifacts that we have deployed.

Select the integration flow > Endpoint tab then you can notice REST API URL for the integration flow.
This URL can be used to invoke the integration flow as a REST API from any REST client like postman.