Configure SAP for OAuth 2.0
Overview
Before creating an SAP connection in IB-X using OAuth authentication, configure the SAP system to allow OAuth 2.0 Client Credentials authentication for the required OData services.
The configuration involves:
- Creating or identifying a technical SAP user.
- Activating the required OData services.
- Creating an OAuth client.
- Assigning the required OData service scopes.
- Using the OAuth configuration details when creating the SAP connection in IB-X.
SAP configuration requires appropriate administrative privileges.
If you do not administer the SAP system, work with your SAP administrator to obtain the connection and OAuth information required by IB-X.
Prerequisites
Before configuring OAuth, identify the SAP OData services that your IB-X Agents need to access.
For example:
API_BILLING_DOCUMENT_SRV
The technical user and OAuth client must have the roles, authorizations, and OAuth scopes required to access these services.
1. Create or Identify a Technical User
Use SAP transaction:
SU01
Create or identify a technical user that IB-X will use for OAuth-based API access.
Assign the business and API roles required for the OData services that the IB-X Agents will use.
Assign only the roles and authorizations required for the intended SAP operations.
Administrative roles such as SAP_ALL are not required for the IB-X technical user and should not be assigned for normal API access.
2. Activate the Required OData Services
Use SAP transaction:
/IWFND/MAINT_SERVICE
Add and activate the OData services required by your IB-X Agents.
For each required service:
- Add the OData service.
- Select the appropriate System Alias.
- Activate the service.
- Ensure that OAuth access is enabled for the service.
For example:
API_BILLING_DOCUMENT_SRV
Only OData services that are activated and accessible to the configured technical user can be used by IB-X.
3. Configure the OAuth Client
Use SAP transaction:
SOAUTH2
Create an OAuth client for IB-X.
Configure the client as a Confidential OAuth Client and enable the Client Credentials grant.
The OAuth client should be associated with the technical user created for API access.
Configure:
- Client ID
- Technical User
- Client Credentials grant
- Required OAuth scopes
The exact configuration options available may depend on your SAP environment.
4. Assign OAuth Scopes
Assign the OAuth scopes corresponding to the OData services that IB-X needs to access.
For example, a scope may resemble:
ZAPI_BILLING_DOCUMENT_SRV_0001
The scope determines which SAP OData services the OAuth client is authorized to access.
If IB-X needs to access multiple services, assign the scopes required for those services to the OAuth client.
The OAuth scope is required when configuring the SAP connection in IB-X.
Having a valid Client ID and Client Secret alone does not guarantee access to the required OData APIs. The OAuth client must also be authorized for the appropriate service scopes.
5. Identify the OAuth Token Endpoint
For an SAP ABAP system using the standard OAuth token service, the token endpoint uses the following path:
/sap/bc/sec/oauth2/token
For example:
https://sap.example.com/sap/bc/sec/oauth2/token
The SAP client may also need to be included when requesting the token.
The actual token endpoint depends on your SAP OAuth configuration.
Use the token endpoint provided or confirmed by your SAP administrator.
6. Verify OAuth Configuration
Before creating the connection in IB-X, verify that the OAuth client can obtain an access token.
The token request uses the Client Credentials grant:
POST /sap/bc/sec/oauth2/token
The request requires:
grant_type=client_credentials
and the required OAuth scope, for example:
scope=ZAPI_BILLING_DOCUMENT_SRV_0001
The OAuth client credentials are used to authenticate the token request.
A successful request returns an access token that can be used to call the authorized SAP OData services.
7. Verify OData API Access
After obtaining an access token, verify that it can access the required OData service.
For example, you can access the service metadata:
GET /sap/opu/odata/sap/API_BILLING_DOCUMENT_SRV/$metadata
using:
Authorization: Bearer <access-token>
A successful response confirms that the OAuth client can authenticate and access the configured OData service.
Successfully obtaining an OAuth token does not by itself confirm access to an OData service.
The OAuth client must have the appropriate scope and the associated technical user must have the required SAP authorizations.
Information Required by IB-X
After completing the SAP OAuth configuration, collect the following information for creating the SAP connection in IB-X:
| IB-X Property | SAP Configuration |
|---|---|
| Base URL | Base URL of the SAP OData environment. |
| SAP Client | SAP client associated with the connection, such as 100. |
| OAuth Client ID | Client ID configured in SOAUTH2. |
| OAuth Client Secret | Client secret associated with the OAuth client. |
| Token Endpoint | OAuth token endpoint configured for the SAP system. |
| Scope | OAuth scope or scopes assigned to the client for the required OData services. |
If multiple scopes are required, specify them as space-separated values when configuring the SAP connection in IB-X.
Once you have this information, create an SAP connection in IB-X and select OAuth as the authentication type.
Troubleshooting
The following issues typically indicate problems with the SAP OAuth or OData configuration:
| Issue | Possible Cause |
|---|---|
| invalid_scope | The requested OAuth scope is not assigned or is incorrect. |
| 403 Forbidden | Verify the OAuth scope and the roles assigned to the technical user. |
| 500 Internal Server Error | Verify that the required OData service is activated and correctly configured. |
| Token obtained but API cannot be accessed | Verify that the token contains the required scope and that the technical user has the necessary SAP authorizations. |
When troubleshooting OAuth access, verify the configuration in this order:
Token acquisition → OAuth scope → Technical user authorization → OData service activation
This helps distinguish authentication problems from SAP service authorization or configuration problems.
Security Considerations
When configuring SAP OAuth access for IB-X:
- Use a dedicated technical user for API access.
- Assign only the business and API roles required by the intended automations.
- Assign only the OAuth scopes required by the OData services being used.
- Protect the OAuth Client Secret from unauthorized access.
- Do not use administrative accounts for normal IB-X API operations.
- Follow your organization's SAP security and credential-management policies.