3708599 - Troubleshooting Guide for scenarios in BTP where Destination service is involved

•  There is a need to troubleshoot the scenario where Applications in SAP BTP consuming an OAuth2SAMLBearerAssertion destination fail to successfully call an OAuth2-protected remote system or API when propagating the user identity.
  
  
  • Despite the Destination service handling automatic SAML assertion creation, OAuth token retrieval, and token caching, the remote call fails. As a result, the user identity is not propagated as expected to the target system, or the access token cannot be retrieved or reused. Below are some examples of errors.
    
    404 – Not Found - Configuration with the specified name was not found
    401 Unauthorized - User authentication failed 
    401 Unauthorized - User authentication failed: Unauthorized        

• • There is a need to understand the end-to-end flow of how the Destination service is consumed by a Cloud Foundry application to connect to an OAuth2-protected target system using the OAuth2SAMLBearerAssertion authentication type in the SAP BTP Cloud Foundry environment. 
    
    
• Troubleshooting a destination type such as: OAuth2ClientCredentials, OAuthUserTokenExchange, OAuth2JWTBearer, OAuth2Password, SAMLAssertion, OAuth2RefreshToken, OAuth2AuthorizationCode, OAuth2TechnicalUserPropagation, OAuth2TokenExchange.

SAP Business Technology Platform

OAuth2SAMLBearerAssertion ,  destination  REST calls , REST API, OAuth2ClientCredentials, OAuthUserTokenExchange, OAuth2JWTBearer, OAuth2Password, SAMLAssertion, OAuth2RefreshToken, OAuth2AuthorizationCode, OAuth2TechnicalUserPropagation, OAuth2TokenExchange , JWT, jSON Web token , KBA , BC-CP-DEST , Destination service , LOD-SF-INT , Integrations , Problem