Error with SAP Cloud Identity Services

[jonashillen]

Hi!

I deployed the FinOps-Application and observed an error. It may be related to the issue #63 because this problem was solved with the Identity Provider.

Working Case:
Using Cloud Identity Services for WorkZone and having an user inside CIS. Everything works fine.

Error Case:
Connecting the WorkZone with CIS in proxy-mode towards an Corporate IdP. I get 500-errors and can not see any data inside the app.

2025-09-16 12:42:04.631300 The issue is most likely caused by application btprcreport. Please create a support incident and assign it to the support component of the respective application. - Failed to load UI5 component with properties: '{ "name": "btprcreport", "url": "/1aa3e08f-327b-43bd-9845-0d7fa0e9a448.sapbtpresourceconsumption.btprcreport/~52a263a2-863a-487c-ad97-704a565771bf~/", "manifest": true, "asyncHints": { "libs": [ { "name": "sap.m", "lazy": false }, { "name": "sap.fe.templates", "lazy": false }, { "name": "sap.ui.fl", "lazy": false } ], "components": [], "waitFor": [] }, "messages": [], "version": "2.1.0", "id": "application-services-display-component", "componentData": { "startupParameters": {} } }'. Error likely caused by: Error: Could not load metadata: 500 error at Object.createError (_Helper-dbg.js:617:15) at Object.<anonymous> (_MetadataRequestor-dbg.js:119:21) at Object.<anonymous> (jquery-compat-dbg.js:725:30) at u (jquery-dbg.js:3500:31) at Object.fireWith [as rejectWith] (jquery-dbg.js:3630:7) at k (jquery-dbg.js:9913:14) at XMLHttpRequest.<anonymous> (https://sapui5.hana.ondemand.com/1.139.0/resources/sap/fiori/appruntime-min-1.js:620:86804) btprcreport

The application inside CF does not log any errors. Everything is the same way configured, just the IdP changed.

I can provide more data/logs when requested :)

[willempardaens]

@jonashillen thank you for the provided information.

Could you please check the following:

In the BTP Cockpit in the section of HTML5 Apps, there should be about 8 apps relating to the installed BTPRC app. Take one of the apps you tried to load with the error. One of the icons on the right-hand side is an error log. Is it correct this contains (somewhere) an entry about "[...]completed with status 500 Retrieval of OAuthToken failed due to: Unable to fetch refresh token from the specified token service URL. Response was: Insufficient scope for this resource"?

I don't have a direct solution, but this would confirm the same issue in another customer's installation.

[jonashillen]

@willempardaens I can confirm that this entry is found inside the logs:

completed with status 500 Retrieval of OAuthToken failed due to: Unable to fetch refresh token from the specified token service URL. Response was: Insufficient scope for this resource

[willempardaens]

I just configured an external corporate IdP (using OIDC) and set CIS as proxy, yet I can't seem to replicate the error. When you have time, please reach out to me on MSTeams so we can discuss your setup in more detail?

[jonashillen]

I just configured an external corporate IdP (using OIDC) and set CIS as proxy, yet I can't seem to replicate the error. When you have time, please reach out to me on MSTeams so we can discuss your setup in more detail?

I will reach out to you after my vacation.

But I can say that we connected the CIS to corporate IdP using SAML 2.0. The connection between CIS and Subaccounts is OIDC.