Overview

The goal of this article is to set up the MS Graph API so that we can use the demo program provided by the ABAP SDK for Azure. The high level steps that we will go through are:

• Install ABAP SDK for Azure
• Understand the flow of the demo program
• Understand the configuration needed
• Setting up the Application in Azure Active Directory
• Setting up the configuration in SAP
• Testing the Graph API Demo program

Installing the ABAP SDK for Azure

You can clone a copy of the SDK to you SAP system using the following GitHub repository: https://github.com/microsoft/ABAP-SDK-for-Azure

If you need to add ABAPGit to your SAP system you can do so by following these directions to install the standalone version.

Reviewing the Demo Program

Once installed, navigate to the package that you installed the SDK in.

Open up the Graph API Demo program:

• Open up the ZADF_DEMO sub package -> Programs -> ZADF_DEMO_AZURE_GRAPH

The basic flow of the program is:

• Get the Azure Active Directory Access Token
• Get the Graph API Instance
• Perform the action on the Graph API

There is some initial configuration that needs to be set up in order for this seemingly basic process to work.

Understanding the Configuration Needed

Overview:

• Azure Active Directory Configuration
• SAP Destinations
• Azure SAP Configuration Tables

Azure AD Application Configuration

• {client-id} - This is the Azure Active Directory application ID
• {tenant-id} - This is the ID for the system
• {client-secret} - This is a generated secret to help secure communication between Azure and SAP

Two RFC Destinations Need to Be Established

1. AZURE_ACTIVE_DIRECTORY_{app-name} - This is the destination to allow authentication with Azure
2. AZURE_GRAPH_API - This is the destination to communicate with the Graph API

The three configuration tables we need to be concerned with are:

1. ZREST_CONFIG - Set up the initial IDs to be referenced in the program and related them to a previously created destination.
2. ZREST_CONF_MISC - Additional configuration for the IDs created in the ZREST_CONFIG table (HTTP Method, Retry Tolerances, Error Instructions).
3. ZADF_CONFIG - Add the relationship between the IDs created in the ZREST_CONFIG table and the API to be used. Additionally add the Secret from the Azure Active Directory application creation.

ABAP SDK for Azure Configuration Landscape

Setting Up the Application in Azure Active Directory

Before we get started it’s important to note, that an Azure application can be accessed programmatically from two different perspectives, and because of that you’re able to manage two different sets of permissions:

Application Permissions

Application permissions always need an admin to grant the permissions. You can add the permission you need, but will have to reach out to your company’s Azure admin to finalize the “granting” of them.

Application permissions are different than User permissions and can be limited in areas. For example, an Application cannot create a Team’s message, as that requires a User to do for reasons that are out of scope for this article.

User Permissions

User permissions come in all shapes and sizes, most Read permissions are open for you to be able to grant the permissions to yourself. Others, like Write permission require an Azure admin to grant the permission.

In this walkthrough we are mainly focusing on Application permissions, as the demo program is set up for that kind of authentication flow. The various user authentication flows are more complex and the work of that is out of scope for this article.

Granting Access via Azure Key Vault

The SDK has some pretty good documentation to walk you through this step. It will walk you through the following:

• Creating the application in Azure Active Directory
• Registering the Application
• Generating Keys for the Application using Azure Key Vault
• This only allows permission for a user, Application permissions are not considered for the Key Vault — I understand this contradicts what was said earlier

Important keys and IDs to note down through this process are:

• Client ID
• Tenant ID
• Client Secret

We will be using this in later steps so it’s important to keep these readily available yet secured. Next we need to grant access to the Microsoft Graph API.

See How to setup Azure Active Directory in Azure to complete this step.

Granting Access to the Microsoft Graph API

In a similar fashion to adding Azure Key Vault, let’s add the Microsoft Graph API to our Application.

If you are not in your Azure Active Directory Application

• Go to your Azure Portal
• Go to Active Directory
• Select “App Registrations”
• Select the name of your Application
• Select “API Permissions”

Once you are in the “API Permissions” section of your Active Directory Application:

• Select “Add a Permission”
• Select “Microsoft Graph”
• Select “Application Permissions”
• Scroll down to “User”
• Select User.Read.All and User.ReadBasic.All
• Select the “Add Permission” button to save
• Contact your Azure admin so they can finalize the granting of these permissions

Setting Up the SAP Destinations

We need to create two destinations in order to get the Graph API calls to work:

• An Azure Active Directory destination
• A Microsoft Graph API destination.

For detailed instructions on setting up a destination in your SAP system, use the properties listed in this section and follow the details in this article - How to: Creating a Destination in SAP for making requests to HTTPS secured APIs .

Azure Active Directory Destination

Below are the properties you will need to set up in the destination

Basic Settings

• RFC Destination name: AZURE_ACTIVE_DIRECTORY_{app-name} or something else meaningful to you

Technical Settings

• Host: login.microsoftonline.com
• Path Prefix: /{tenant-id}/oauth2/token ({tenant-id} can be found from your Azure Active Directory Configuration)
• Port 443

Logon & Security

• Security Options
• SSL: Active
• SSL Certificate: ANONYM SSL Client (Anonymous)

After these parameters have been configured and saved for the destination, you will need to make sure the SSL certificates are set up in STRUST if they have not been previously.

You can get the certificates from your browser by going to the endpoint of the destination. In this case:
https://login.microsoftonline.com/{tenant-id}/oauth2/token

Azure Graph API Destination

Below are the properties you will need to set up in the destination

Basic Settings

• RFC Destination name: AZURE_MS_GRAPH_API or something else meaningful to you

Technical Settings

• Host: graph.microsoft.com
• Path Prefix: /V1.0
• Port 443

Logon & Security

• Security Options
• SSL: Active
• SSL Certificate: ANONYM SSL Client (Anonymous)

After these parameters have been configured and saved for the destination, you will need to make sure the SSL certificates are set up in STRUST if they have not been previously.

You can get the certificates from your browser by going to the endpoint of the destination. In this case:
https://graph.microsoft.com/V1.0

Configuring the ABAP SDK for Azure Configuration Tables

Let’s take a look at the demo program ZADF_DEMO_AZURE_GRAPH. If you notice the CONSTANTS at the top, those are going to be the IDs that we need to configure, as those are the values that the demo is expecting to use. We will actually be focusing on the first two ADB2CTOKEN and ADB2CGR_GE as those are the only two that we need to make the demo run successfully.

CONSTANTS: gc_token_interface TYPE zinterface_id VALUE 'ADB2CTOKEN',
           gc_graph_get       TYPE zinterface_id VALUE 'ADB2CGR_GE',
           gc_graph_post      TYPE zinterface_id VALUE 'ADB2CGR_PO',
           gc_graph_patch     TYPE zinterface_id VALUE 'ADB2CGR_PA'.

Active Directory Token

ADB2CTOKEN is the interface_id used to make the request to Azure Active Directory to get the authroization token in order to make requests to the Graph API

Configure ZREST_CONFIG

• Navigate to SE11
• Enter table ZREST_CONFIG and Display
• Utilities -> Table Content -> Create Entries

Enter the following properties:

• Inter ID: ADB2CTOKEN
• RFC Destination: The Azure Active Directory destination created earlier
• Save

Configure ZREST_CONF_MISC

• Navigate to SE11
• Enter table ZREST_CONF_MISC and Display
• Utilities -> Table Content -> Create Entries

Enter the following properties:

• Inter ID: ADB2CTOKEN
• Method: GET
• Save

Configure ZADF_CONFIG

• Navigate to SE11
• Enter table ZADF_CONFIG and Display
• Utilities -> Table Content -> Create Entries

Enter the following properties:

• Inter ID: ADB2CTOKEN
• Interface Type: Azure Active Directory
• SAS Key: Enter the {client_secret} from earlier
• Save

Depending on the authorization flow, the token to be returned could be for an Application or for a User. In the case of this article, an Application authorization token should be returned.

Graph API GET

ADB2CGR_GE is the interface_id used to make GET requests to the Graph API

Configure ZREST_CONFIG

• Navigate to SE11
• Enter table ZREST_CONFIG and Display
• Utilities -> Table Content -> Create Entries

Enter the following properties:

• Inter ID: ADB2CGR_GE
• RFC Destination: The Microsoft Graph API destination created earlier
• Save

Configure ZREST_CONF_MISC

• Navigate to SE11
• Enter table ZREST_CONF_MISC and Display
• Utilities -> Table Content -> Create Entries

Enter the following properties:

• Inter ID: ADB2CGR_GE
• Method: GET
• Save

Configure ZADF_CONFIG

• Navigate to SE11
• Enter table ZADF_CONFIG and Display
• Utilities -> Table Content -> Create Entries

Enter the following properties:

• Inter ID: ADB2CGR_GE
• Interface Type: Microsoft Graph
• SAS Key: Enter the {client_secret} from earlier
• Save

Note: If you previously ran the demo program, there is a chance that the previous values in these configuration tables have been buffered. Therefore, running the demo program may cause errors if the buffer cannot be refreshed. Just to ensure a smooth test, I recommend logging off the system and then logging back in just to refresh any buffering that may have occurred so that we can avoid any misleading errors.

Testing the Graph API Demo Program

Now lets go to the demo program and test everything out.

For both of these test cases you will have to copy the {client-id} from your Azure Active Directory Application and paste it into the Azure Client ID parameter on the selection screen.

Request Token

Select the Request Token radio button and ensure your azure active directory’s {client-id} is populated. Then execute. You should see the program write out the authorization token to the GUI.

Read Users

Select the Read Users radio button and ensure your azure active directory’s {client-id} is populated. Then execute. You should see the program pop-up a window. This window should show a JSON payload of users within your organization. If the window shows a payload of an empty array [], then there was probably an error in the process and you will see an http status code in the 400s.

Conclusion

There you have it! You should have the Microsoft Graph API connected and useable within your ABAP programs now. Depending on what you would like to do with it, would will have to adjust the permissions and possibly extend the ZCL_ADF_SERVICE_GRAPH class to call to the end points and handle the entities used in each end point!