SAP Knowledge Base Article - Preview

3777412 - OIDC_only access via permissions groups: consent signature fails with 'invalid userkey' when full API access is disabled

Symptom

  • Users want to create custom privileges to restrict applications to OIDC-only APIs without granting full API access.
  • When using a new application key/secret with read-only data access and Full API Access disabled, the consent signature flow fails.
  • Error: errorCode: invalid_request; errorMessage: Invalid UserKey.
  • Error: errorCode: invalid_request; Message: Consent is not in a valid format, make sure it is a valid JSON object.


Read more...

Environment

  • SAP Customer Data Cloud
  • Admin Console (Settings, Administration, Queries / Reports)

Product

SAP Customer Data Cloud all versions

Keywords

oidc, permissions groups, acl, invalid_userkey, invalid_request, consent signature, afterConsent, full api access disabled, read-only access, least privilege, application key, client secret, userkey, accounts.setPolicies, customer data cloud , KBA , CEC-PRO-CON , Admin Console (Settings, Administration, Queries / Reports) , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.