SAP Commissions(K8s) API Authentication 🔑& Other Endpoints – Part 2

Previous blog : SAP Commissions(K8s) – OpenId Connect(OIDC) Setup – Part 1

In this blog, you will come to know how to authenticate OAuth token from SAP IAS (Identity Authentication Service) tenant as explained in step by step process. This process is mainly required for API Authentication to get some data out of SAP Commissions using Rest APIs.

SAP Commissions Help Documentation for K8 APIs

Step 1 : Prepare Basic authorization header for calling IAS oauth2 token API endpoint.

From the previous blog, you have already generated client id and client secret, so by using that you need to follow the Base64 encoding for Authorization.

Go to https://www.base64encode.org/ enter your clientid:clientsceret and press encode.

Grant Type should be passed in header as Client Credentials Authentication

POST https://<IAS tenant>/oauth2/token?grant_type=client_credentials
Content-Type: application/x-www-form-urlencoded
Authorization: Basic <clientid>:<clientsecret>

client_id=<clientid>

Step 2

Internal API Documentation for Service Account

###
POST https://<ias>.accounts.ondemand.com/oauth2/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic <clientid>:<clientsecret>

grant_type=password&client_id=<clientId>&username=<userName>&password=<password>

Assign your Client Id (which is already generated from previous blog) to your Service Account, which will be Authorized for API calls

POST https://<SAP Commissions K8 tenant>/usersvc/CallidusPortal/services/serviceAccount/Add
Content-Type: application/json
Authorization: Bearer <id_token>

{
  "clientId": "301c7823-7ecd-X23X4-9669-d0XX998628",
  "name": "Yoga",
  "description": "Yoga is going to test something for SAP BTP"
}

Step 3

Assign Commissions group to the service account. If you want your service account to have all Commissions permissions assigned, use ‘Administrator’ as the group name.

POST https://<SAP Commissions K8 tenant>/usersvc/CallidusPortal/services/serviceAccount/assignGroup
Content-Type: application/json
Authorization: Bearer <id_token>

{
  "clientId": "301c7823-7ecd-X23X4-9669-d0XX998628",
  "groupName": "Administrator"
}

SAP Commissions Kubernetes APIs Documentation

Try out now one sample endpoint to get your results using access token from step 1

GET https://<SAP Commissions K8 tenant>/mtsvc/tcmp/rest/v2/calendars
Content-Type: application/json
Authorization: Bearer <access_token>