Enable redirect URL in bot and allow the user to give consent

Forum|Forum|2 years ago
September 11, 2024
2 replies
173 views

We are working on a use case for SAP Approval. There is a Approval API in SAP ECC System, and the approver name should be on the actual user who approves it.

To achieve the SSO we have configured Microsoft Azure AD as Identity Provider and SAP as Service Provider.

Below is the end-to-end process of a user authentication:

The user is redirected to the Azure AD tenant’s authorization endpoint (https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/authorize) in order to authenticate and to acquire an access token for the API. The user has to enter their credentials and give consent to the requested permissions to access the API.
Once the user is successfully authenticated, the redirect URI receives an access token for the API in response from the authorization endpoint. To allow the Azure AD authorization endpoint to issue an access token the OAuth2 implicit grant flow must be used.
The user is now authenticated and the front-end has acquired an access token that can be used to call the API on behalf of the logged-on user. This token cannot be used to authorize the call to the backend service in SAP NetWeaver. Services in SAP only accept access tokens issued by their trusted OAuth Authorization Server. The SAP OAuth Authorization Server accepts the SAML Bearer Grant type, which allows the API in Microsoft Azure to request an OAuth access token from SAP with a SAML 2.0 assertion. Azure AD provides a SAML assertion by receiving an OAuth access token (issued by the Azure AD tenant to the authenticated user before) in exchange.
The API App is using the SAML 2.0 assertion by sending a POST request to the SAP OAuth Authorization Server to receive Bearer token from SAP.
Once the SAML assertion is exchanged with an access token, the final POST request can be sent to SAP e.g., service from SAP using the access token to authorize the call on behalf of the logged-in user in Azure.

How can we implement this flow through Moveworks creator studio, with the current capabilities how can we allow user to open a browser link from the bot and give the consent?

dluckadoo

Employee

Hello @navya.kandi! Broadly, I think your outline could work. I think what I see as the biggest issue is whether or not curating an authentication flow within the bot meaningfully saves time. For example, let’s say you build out this use case, then this would be the end-user experience:

User is notified by bot of a new SAP Approval.
User decides to approve notification and clicks approval button.
User is redirected to a browser where they must log in.
User goes back into the chat to see confirmation that their approval has been submitted.

If instead you built the use case to deliver a link, then you would have:

User is notified by bot of a new SAP Approval.
User clicks link.
User is redirected to a browser where they must log in.
User can then directly indicate their approval on the SAP page.

The later version of this use case is also much easier to build since it doesn’t require building an OAuth flow using Paths and an iPaaS tool (or other middle layer).

It’s worth noting that there have been reasons to build OAuth flows in the way you’ve outlined before, though different tools and different precise workflows were used. In summary, I think your use case outline can work (with the addition of an iPaaS tool or other automation middle layer), but I would caution that there may be a better way to provide this functionality.

Dray

kyril.remillard

Community Manager

1. New→3. Existing Functionality/Native Skill

Sign up

If you're a Moveworks customer, you can click the SSO button below to login-even if it's your first time. Everyone else can use email or click create an account above to register.

Login or create an account

If you're a Moveworks customer, you can click the SSO button below to login-even if it's your first time. Everyone else can use email or click create an account above to register.