Unauthorized: Bad credentials error while accessing Springboot app running on SAP Cloud Foundry

Question

I am getting below error while trying to use sapjco3 in my Springboot application. I am deploying my application to SAP Cloud foundry environment packaging as war file with tomee7 TARGET_RUNTIME.

com.sap.cloud.sdk.cloudplatform.security.exception.TokenRequestFailedException: Failed to resolve access token.","\tat com.sap.cloud.sdk.cloudplatform.connectivity.OAuth2ServiceImpl.lambda$executeClientCredentialsFlow$1(OAuth2ServiceImpl.java:119)"

Error requesting technical user token vvith grant_type 'client_credentials': Error retrieving JWT token. Server URI https: xxxxxxxxxxxxxx
dev.authentication.eu20.hana.ondemand.com/oauth/token. Http status code 401. Response body '{"error":"unauthorized","error_description":"Bad credentials"}"',"\tat com.sap.cloud.security.xsuaa.tokenflows.ClientCredentialsTokenFIow.requestTechnicalUserToken(ClientCredentialsTokenFlow.java:188)","\tat com.sap.cloud.security.xsuaa.tokenflows.ClientCredentialsTokenFlow.execute(ClientCredentialsTokenFlow.java:141)","\tat ...

I am trying to call a BAPI using SAP Cloud SDK as specified in the below documents.

• SAP Cloud SDK for Java > Call a BAPI/RFC Module
• Invoking ABAP Function Modules via RFC > Invoke ABAP Function Modules in On-Premise ABAP Systems > Develop a Sample Web Application > Include JCo Dependencies

Answer 1

Judging from the displayed error message, it seems like your application is not able to access the bound authentication service (most commonly an instance of the XSUAA service). This is not directly related to either JCo or BAPI but instead seems to indicate a configuration issue of your application.

You can validate whether the credentials in your Service Binding (found in VCAP_SERVICES environment variable of your deployed application) are actually valid by performing the authentication manually with a REST client of your choice. For that, use the URL you masked in your screenshot, select the authentication type OAuth2 - Client Credentials and provide the clientid and clientsecret from said Service Binding.

You should be able to reproduce the issue you are seeing (e.g. the 401) with that setup. In this case, I'd recommend re-binding the service in question so that a new clientid and clientsecret pair is getting generated.