Regarding the errors being output to the log

[Sekisui-G-one-Yasuhiro-Fujimoto]

Ask the Question

We appreciate your continued support.
Currently, our development environment is outputting the following error message from an application running on SAP BTP (Business Technology Platform).
While the application is functioning without issues at present, the message includes a warning that this will become an error in future versions, requiring resolution.
How should we proceed?

Error Message↓-----------------------------------------------
Tenant and Principal accessors are returning inconsistent results: A principal is defined, but no tenant is defined in the current context.
This is unexpected and will be changed to fail instead in a future version of Cloud SDK. Please analyze the attached stack trace and resolve the issue.

Thank you for your assistance.

[Jonas-Isr]

Hi @Sekisui-G-one-Yasuhiro-Fujimoto

this error message indicates that you are using a version of the SDK that is at least 1.5 years old. We highly recommend to update to a current version. This will make sure that the SDK behaves as expected in the current environment and that you receive all security-related features. Moreover, we do not offer support for old versions of the SDK.

That said, once you update the SDK, the logged error that you will see will turn into a thrown exception stopping your application to run as it does currently. We thus highly recommend to solve the underlying issue. In your case, this seems to be that the tenant/tenant-information is not set up correctly. Without more information from your side, it is not possible for us to know what is wrong there.

Please consider our docs first. Most problems can be solved with the information you will find there. If you still get stuck even after referring to the docs, feel free to continue here or open a new issue.

Best,
Jonas

[Sekisui-G-one-Yasuhiro-Fujimoto]

Hi @jonas

Thank you for your previous response.

Based on your warning that updating the SDK will turn this logged error into a thrown exception, we want to ensure we resolve the underlying issue as well.

We have further investigated our setup and would like to provide more context:

Application Type: Our application is an internal system and deliberately operates as a single-tenant application. It is not intended for multi-tenant usage by external consumer subaccounts.
XSUAA Configuration: In our mta.yaml and xs-security.json, the XSUAA service is explicitly configured with tenant-mode: dedicated.

What is the expected behavior of the SAP Cloud SDK (especially the latest versions) regarding tenant context when tenant-mode: dedicated is used? Should it automatically derive the tenant from the binding subaccount, or is there a specific configuration/setup that needs to be in place for single-tenant scenarios to prevent this no tenant defined error?
Should we, despite being in dedicated mode, expect TenantAccessor to return a value (e.g., the ID of the subaccount the XSUAA instance is bound to)?
Are there any specific considerations or best practices when using the SAP Cloud SDK in a single-tenant setup with tenant-mode: dedicated that might address this warning/error?
Our primary goal is to upgrade the SDK and eliminate this warning, ensuring our application runs stably without encountering a thrown exception in the future, while maintaining our single-tenant architecture.

Regards,
Fujimoto

[Jonas-Isr]

Hi @Sekisui-G-one-Yasuhiro-Fujimoto,

As far as I see it, in your case the Cloud SDK tries to derive the tenant ID from the XSUAA service binding. Please verify the XSUAA service binding contains the necessary tenant information in the credentials.

Best,
Jonas

[Sekisui-G-one-Yasuhiro-Fujimoto]

Dear @Jonas-Isr ,

Thank you for your prompt response and guidance.

Regarding your suggestion to "verify the XSUAA service binding contains the necessary tenant information in the credentials," I have checked the XSUAA service key in our SAP BTP cockpit.

I can confirm that the following tenant-related information is present and seems correctly configured within the service key:

url: Contains a URL that corresponds to our gonedev identity zone in the jp20 region.
identityzone: Clearly specifies gonedev for our tenant.
identityzoneid: Contains a valid UUID that uniquely identifies our tenant.
tenantid: Also contains the same valid UUID matching the identityzoneid.
Please note that the ext_attr definition was not found in the service key.
Based on this, the tenant information itself appears to be properly configured within the XSUAA service binding credentials.

Given this confirmation, and that the service key seems to contain the necessary tenant details, could you please advise on what other aspects we should investigate or verify to resolve the "A principal is defined, but no tenant is defined in the current context" error? Specifically, we are looking for insights into why the Cloud SDK might not be picking up this information, despite its presence in the service binding.

We are also planning to update our Cloud SDK version to the latest stable release as per your strong recommendation. We understand that this error will become an exception after the update, and we are preparing for further debugging at that stage.

Thank you for your continued assistance.

Regards,
Fujimoto