Edit

Set up OAuth 2.0 authentication for the SAP OData connector

Note

The OAuth 2.0 authentication method for the SAP OData connector is in preview.

This article walks you through how to set up the OAuth 2.0 authentication method in the SAP OData connector for Power Platform. By using this method, the connector authenticates by using the authorization code flow against a generic OAuth 2.0 identity provider. Users sign in interactively, and the connector uses the resulting access token as a bearer token on OData calls to SAP.

This method is a good fit when you want to broker sign-in through SAP Cloud Identity Services – Identity Authentication (also known as SAP IAS), which can federate the actual user sign-in to your corporate identity provider, such as Microsoft Entra ID. Unlike the Microsoft Entra ID with Azure API Management method, this method doesn't require Azure API Management (APIM) or a SAML token exchange policy. You provide the identity provider's authorization URL, token URL, client ID, and client secret directly in the connection.

This method is available for cloud (non-gateway) connections.

Prerequisites

Before you begin the setup process, make sure you have the following resources in place:

  • SAP OData connector set up.
  • An SAP OData service that accepts OAuth 2.0 bearer tokens issued by your identity provider.
  • An OAuth 2.0 identity provider that supports the authorization code flow. This article uses SAP Cloud Identity Services – Identity Authentication (SAP IAS) as the example provider.
  • Admin access to the identity provider so you can register an OAuth 2.0 client application. For SAP IAS, this access is the SAP Cloud Identity Services administration console.
  • (Optional) Admin access to Microsoft Entra ID if you want to federate sign-in from SAP IAS to Microsoft Entra ID.

Tip

For a video walkthrough of the SAP-side configuration, see Single sign-on with Power Platform and SAP OData using OAuth by Holger Bruchelt.

Named values

This section lists named values to make the examples easier to follow. You reuse these values throughout the article and reference them in later sections. When you follow the examples in this article, replace the named values with your own values.

Name Sample value Description
OData Base URI https://\<sap-host\>/sap/opu/odata/sap/API_BUSINESS_PARTNER The base URI (service root) of your SAP OData service.
Authorization URL https://\<tenant\>.accounts.ondemand.com/oauth2/authorize The OAuth 2.0 authorization endpoint of your identity provider.
Token URL https://\<tenant\>.accounts.ondemand.com/oauth2/token The OAuth 2.0 token endpoint of your identity provider. Also used to refresh the token.
Client ID A GUID The client ID of the OAuth 2.0 application registered with your identity provider.
Client secret The client secret of the OAuth 2.0 application registered with your identity provider.
Redirect URI https://global.consent.azure-apim.net/redirect/sapodata The Power Platform per-connector consent (callback) URL. Confirm the exact value shown during connection creation for your cloud.

Important

The named values in this guide are essential for setting up the connection. Ensure your values match your specific identity provider and SAP configurations.

High-level overview

You enable users to access SAP data through Power Platform by using OAuth 2.0 and interactive sign-in. The process involves:

  1. Registering an OAuth 2.0 client application in your identity provider (SAP IAS).
  2. Adding the connector's redirect URI to the allowed redirect URIs on the OAuth 2.0 client application.
  3. Creating the connection in Power Platform by using the OAuth 2.0 authentication method.

In short, you register the client, add the redirect URI to the allow list, and enter the identity provider's endpoints and credentials in the connection.

Step 1: Register an OAuth 2.0 client application in SAP Cloud Identity Services

Register an application in SAP IAS that represents the SAP OData connector. As an SAP Cloud Identity Services administrator, take these steps in the SAP Cloud Identity Services administration console:

  1. Sign in to the administration console at https://\<tenant\>.accounts.ondemand.com/admin.
  2. Go to Applications & Resources > Applications.
  3. Select Create, enter a name (for example, Power Platform SAP OData), and select Save.

Step 2: Configure client authentication and grant types

Configure the application as a confidential client with a secret, and enable the grant types the authorization code flow requires. In the application you created in Step 1:

  1. Under Application APIs, select Client Authentication.
  2. Confirm that Enable Public Client Flows is off. A confidential client authenticates by using a secret.
  3. Under Secrets, select Add, enter a description, and select the openid scope. Save the generated Client ID as Client ID and the generated secret as Client secret in the named values table.
  4. Under Grant Types, enable Authorization Code and Refresh Token. Don't enforce PKCE (Proof Key for Code Exchange), because the connector uses a confidential client.

Step 3: Get the connector redirect URI and add it to the allow list

The connector uses a standard Power Platform per-connector consent (callback) URL as its OAuth redirect URI. You must register this exact URI on the OAuth 2.0 client application so the identity provider returns the authorization code to Power Platform.

  1. The redirect URI has the form https://global.consent.azure-apim.net/redirect/sapodata. Confirm the exact value for your cloud on the connection's sign-in page or on the connector's security page. Save it as Redirect URI in the named values table.
  2. In the SAP IAS application, go to Single Sign-On > OpenID Connect Configuration (or the application's Redirect URIs setting), add the Redirect URI, and save it.

Important

The redirect URI must match exactly, including scheme, host, and path, with no trailing slash or extra path segments. A mismatch causes the token exchange to fail and the connection to report that it isn't authenticated.

Step 4: Create the connection in Power Platform

Create a connection that uses the OAuth 2.0 authentication method.

  1. Open Power Automate in your browser.

  2. Create a new manual-trigger flow.

  3. Add an SAP OData action and select Sign in to create a new connection.

  4. Select OAuth 2.0 as the authentication type.

  5. Enter the following values from the named values table:

    • OData Base URI: OData Base URI
    • OAuth authorization URL: Authorization URL
    • OAuth token URL: Token URL
    • OAuth client ID: Client ID
    • OAuth client secret: Client secret

  6. Select Sign in. Complete the interactive sign-in as the user you want to authorize. If SAP IAS federates to Microsoft Entra ID, you sign in with your Microsoft Entra ID account.

Tip

To sign in as a specific user rather than reusing the current Power Platform user, use a private or incognito browser window when you create the connection.

Step 5: Test the connection

  1. In your flow, select the SAP OData action.
  2. Choose an Entity from the dropdown to test.
  3. Save your flow.
  4. Run your flow to test the connection.
  5. Verify the run history for successful authentication and data retrieval.

Tip

  • If the connection reports that it isn't authenticated, confirm that you added the redirect URI to the allow list exactly, entered the client secret in full, and configured the OAuth client as a confidential client with the authorization code and refresh token grant types enabled.
  • If the Entity dropdown doesn't populate, recheck your connection parameters and the OAuth 2.0 client configuration in your identity provider.

Related content

  • Last updated on