const httpclient = require('@sap-cloud-sdk/http-client');​

The object thus obtained follows the axios HTTP client API with an added first object parameter (second parameter is compatible to RawAxiosRequestConfig), eg to make a POST call to an onpremise destination use this code

await httpclient.executeHttpRequest(
        {
            destinationName: 'MYDESTINATION'
        },
        { 
            method: 'POST',
            url: "/sap/opu/odata/sap/ZMY_SERV_SRV/MyEntitySet",
            headers: {
                "Content-Type":"application/json; charset=utf-8",
                "Accept":"application/json"
            },
            data: body
        }
    ).then(response => {
        // use eg response.status and response.data 
    }).catch(err => {
        // use eg err.code or message
    });​

(Note: All code examples in this blog are just examples, do not use in your productive code, eg consider adding logging and a more robust coding)

CSRF handling is done by default.

      "express": "^4.17.3",
      "body-parser": "^1.20.2",
      "passport": "^0.6.0",
      "passport-http": "^0.3.0"

Preperation in the JavaScript file

const express = require('express');
const bodyParser = require('body-parser')
const passport = require('passport');
const passportHTTP = require('passport-http');

const auth_env = {login: process.env['AUTH_LOGIN'], password: process.env['AUTH_PASSWORD']};
const app = express();
passport.use(new passportHTTP.BasicStrategy(
    function(username, password, done) {
        if (username === auth_env.login && password === auth_env.password) {
            return done(null, username);
        } else {
            return done(null, false);
        }
    }
));
app.use(passport.initialize());
app.use(passport.authenticate('basic', { session: false }));
app.use(bodyParser.text({ type: 'application/json' }));
...
app.listen(process.env.PORT || 5000, function () {
    console.log('Proxy app started');
});

and code for proxying a POST call

app.post('/MyEntitySet', async (req, res) => {
    if (!req.user) { res.sendStatus(403); return; }
    await httpclient.executeHttpRequest(
        {
            destinationName: 'MY_DESTINATION'
        },
        { 
            method: 'POST',
            url: "/sap/opu/odata/sap/ZMY_SERV_SRV/MyEntitySet",
            headers: {
                "Content-Type":"application/json; charset=utf-8",
                "Accept":"application/json"
            },
            data: req.body
        }
    ).then(response => {
        res.send(response.data);
    }).catch(err => {
        res.status(500).send('Backend Error');
    });    
});

(in real life you might want to use wildcards and parse req.url)

Principal Propagation means the client needs to authenticate the user aka principal against the BTP and obtain tokens which need to be stored securely. When accessing the proxy the token needs to be presented. The token is then forwared to the cloud connector which generates authorization info using the principal for the onpremise system (configuring cloud connector and onpremise systems to achieve this is beyond the scope of this blog).

In this example the native client needs to obtain a JWT token and send it along with request to the proxy. The JWT token will eg be obtained and renewed by utilizing SAML 2.0 and OAuth 2 protocols with the XSUAA service, cf. https://sap.github.io/cloud-sdk/docs/java/guides/cloud-foundry-xsuaa-service . The native client should use libraries for this tasks (this is however beyond the scope of this blog). After deploying the proxy app to the BTP go to the deployed app in the BTP cockpit, select “Service Bindings” on the left and click on “Show sensitive data” to obtain the data for the libraries. You need

• token_service_url : Add /oauth/authorize for the SAML 2.0 login endpoint, /oauth/token for the OAuth 2.0 endpoint and /logout.do for the SAML 2.0 logout endpoint
• clientid and clientsecret for the OAuth 2 protocol

Also go to “Scopes” on the left and use the displayed scope name in the OAuth 2 protocol.

The configuration for xsuaa in the xs-security.json file is needed (add scopes and role-templates as needed):

{
    "scopes": [
      {
        "name": "$XSAPPNAME.access",
        "description": "Access"
      }
    ],
    "role-templates": [
      {
        "name": "Access",
        "default-role-name": "My Proxy Access Authorization",
        "scope-references": [
          "$XSAPPNAME.access"
        ]
      }
    ],
    "oauth2-configuration": {
        "redirect-uris": [
            "http://localhost:9999/success"
        ]
    }
  }

Use Redirect-URIs as needed by the native libraries (can also use different schemes than http oder https as commonly used on mobile OS).

  requires:
  - name: my_proxy-uaa
...
resources:
- name: my_proxy-uaa
  type: org.cloudfoundry.managed-service
  parameters:
    path: ./xs-security.json
    service-plan: application
    service: xsuaa
    config:
      xsappname: my_proxy-${space}
      tenant-mode: dedicated
      role-collections:
        - name: 'my_proxy-Access-${space}'
          role-template-references:
            - $XSAPPNAME.Access

The xsappname and the role collections name thus contains the space name in order to be able to deploy the proxy app to multiple spaces in the same subacount (eg for three-tier development, test, production spaces). In this case the destination need to be defined at app-level in the respective destination service instance instead of subaccount level to have identical named destinations pointing to development, test, production onpremise systems respectivly (destination can’t be defined at space level). Assign the role collection to users, either individually or via groups or via IdP configuration.

The destination is defined with Principal Propagation:

In the package.json we need now additional dependencies to xsenv and xssec:

       "@sap/xsenv": "^4.2.0",
       "@sap/xssec": "^3.6.0",

(Use at least version 3.6.0 of xssec because of mentioned security issue)

In the JavaScript file the preperation now includes verification of the JWT token with the xsuaa service:

const httpclient = require('@sap-cloud-sdk/http-client');
const express = require('express');
const bodyParser = require('body-parser')
const xsenv = require('@sap/xsenv');
const passport = require('passport');
const xssec = require('@sap/xssec');

xsenv.loadEnv();
const app = express();
const services = xsenv.getServices({ uaa: 'my_proxy-uaa' });
passport.use(new xssec.JWTStrategy(services.uaa));
app.use(passport.initialize());
app.use(passport.authenticate('JWT', { session: false }));
app.use(bodyParser.text({ type: 'application/json' }));

The code for proxying a call now contains code for checking the scope and for fowarding the JWT token for principal propagation:

app.post('/MyEntitySet', async (req, res) => {
    if (!req.authInfo.checkLocalScope('access')) {
        return res.status(403).send('Forbidden');
    }
    await httpclient.executeHttpRequest( 
        {
            destinationName: 'MY_DESTINATION'
            jwt: req.authInfo.getAppToken()
        },
        { 
            method: 'POST',
            url: "/sap/opu/odata/sap/ZMY_SERV_SRV/MyEntitySet",
            headers: {
                "Content-Type":"application/json; charset=utf-8",
                "Accept":"application/json"
            },
            data: req.body
        }
    )

The SAP Cloud SDK for JavaScript makes it easy to use onpremise destiation with principal propagation in a BTP proxy and hides the complexity in dealing with the destination, connectivity and xsuaa service.