Send JWT Bearer token in Authorization when consuming services

[gregorwolf]

Hello CAP Team,

in my sample project controller-api I try to consume the SAP HANA XSA Controller REST API with CAP. @jung-thomas has described how to access the API in the blogpost SAP HANA XSA Controller API Interaction. There you find also his GitHub project: controllerAPI and links to the API documentation.

In my project I've tried several approaches to get to the goal. First I've tried my luck with the approach documented in Consuming Services - Sending Requests:

      const controllerAPI = cds.connect.to('controller-config')
      console.log("JWT: " + req.attr.token)
      const tx = controllerAPI.transaction(req)
      response = await tx.get('/v2/users')

as the API endpoint expects authentication with a JWT sent in the Authorization header as a Bearer token as this header isn't sent.

My next try was the executeHttpRequest method of the SAP Cloud SDK for JavaScript that @sacnl described in the post New Versions of SAP Cloud SDK: 2.19.1 for Java, 1.6.1 for JavaScript, and v22 of Continuous Delivery Toolkit:

      const destinationNameAndJwt = { destinationName: 'controller-config', jwt: req.attr.token};
      const httpRequest = {
          method: HttpMethod.GET,
          url: "/v2/users"
      };
      response = await executeHttpRequest(destinationNameAndJwt, httpRequest)

But also here the JWT wasn't sent to the backend. So I finally used:

      const destinationNameAndJwt = { destinationName: 'controller-config', jwt: req.attr.token};
      const httpRequest = {
        method: HttpMethod.GET,
        url: "/v2/users"
      };

      var config = await addDestinationToRequestConfig(destinationNameAndJwt, httpRequest)
      // Providing the destinationNameAndJwt does not have the effect to send the token so we add it manually
      config.headers = {"Authorization": "Bearer " + req.attr.token}
      response = await axios(config)

where I manually add the token to the Authorization header.

I hope the handling of service requests that don't use basic authentication will be improved.

Best regards
Gregor

[yevgentrukhin]

Was this fixed?

[HeneryHawk]

Hi @gregorwolf
did you get your first example working?

      const controllerAPI = cds.connect.to('controller-config')
      console.log("JWT: " + req.attr.token)
      const tx = controllerAPI.transaction(req)
      response = await tx.get('/v2/users')

Did you manage to get the JWT passed to the external service?

Regards
Simon

[sreehari-pillai-atom]

Hi @gregorwolf did you get your first example working?

      const controllerAPI = cds.connect.to('controller-config')
      console.log("JWT: " + req.attr.token)
      const tx = controllerAPI.transaction(req)
      response = await tx.get('/v2/users')

Did you manage to get the JWT passed to the external service?

Regards Simon

I was trying the same and stuck at the same point. Any luck ?