3297146 - Fiori Launchpad Service Blank Screen - status 401 Authentication Required

• SAP Standard application or Custom Applicatioin shows a blank screen after clicking the Fiori Tile
  
  See sample:
  
  
• The application is on a SAP Cloud application landscape (NOT On-Premise)
• The following HTTP Trace (HAR) file errors are shown when the Fiori Application tile was clicked:
• Error 1:  HEAD request to /cp.portal/requestCSRFToken completed with status 401 Authentication required 
• First error shows that some sort of requestCSRFToken failed when the Cloud navigated to the service and due to the authentication issue, the cloud to the portal failed to get the value from the service
• Error 2: {    "error": "insufficient_scope",    "error_description": "Insufficient scope for this resource",    "scope": "xs_tenant.read xs_authorization.read"}
• This second error is also showing stating that the authentication read failed
• At this point the user will need to make sure that the authentication check or whitelisting is all setup
• Error 3: Status Code: 500 - GET request to /dynamic_dest/XXXX/sap/opu/odata/sap/XXXX_SRV/$metadata?sap-documentation=heading%2Cquickinfo&sap-value-list=none completed with status 500

  Destination XXXX is not defined as a dynamic destination in destination service, configure additional property HTML5.DynamicDestination true

• This 3rd error is seen after all the authentication is setup as Error 1 and 2 are now resolved. This 3rd error could also be the root cause of the issue. 

S/4HANA CLOUD 2208 or later

• For Error 1 and 2:
• Solution 1: Follow SAP Note 2760424 - API Access to XSUAA Configuration Data, to create an Authorization and Trust Management (XSUAA) Service instance with "apiaccess" plan in your domain space
• Solution 2: If using Convesational AI, check this link: https://help.sap.com/docs/SAP_CONVERSATIONAL_AI/eafc53387d0d46a887611a1f48ca6d23/e409c11690474c9ea5b9e35f29d4e9c9.html?version=1911#loio82285888d0f0473e95b19f29c27d5f12
• For Error 3:
• Solution 1: Set HTML5.DynamicDestination as true
• Solution 2: If DESTINATION XXXX is missed then this may mean that the Mobile Enabled NOTIF_SERVICEPATH parameter may be missed.

• MobileEnabled is required for SAP Mobile Start.
  NOTIF_SERVICEPATH is used in combination with sap-sysid and sap-client by the Notification Service to perform callbacks.
  Please add above parameters for destination in case you need to enable the relevant service.

• Setting up SAP Launchpad Service and SAP Mobile Start with Content Federation (For pictures tied to the parameters)

"Fiori Launchpad Service blank","401 Error Fiori","Cloud BTP service not working","Custom Application shows blank screen","Fiori Blank Screen","Whitelisting issue", "xs_authorization.read", "Insufficient scope for this resource", "requestCSRFToken" , KBA , BC-CP-CF-SEC-IAM , UAA, Authentication, Authorization, Trust Mgmnt , Problem