fix: pass OAuth 2.0 scope parameter in AAD token retrieval

[Martin Roschitz (mrMRosch)]

fix: pass OAuth 2.0 scope parameter in AAD token retrieval

Problem

The Azure ABAP SDK's AAD token retrieval was failing against Microsoft Entra ID with error:

HTTP 400 - {"error":"invalid_request","error_description":"AADSTS90014: The required field 'scope' is missing from the credential..."}

Root Cause

method ZCL_ADF_SERVICE_AAD->get_aad_token() accepts an iv_scope parameter but does not pass it to the internal get_aad_token_clnt_cred() call.
get_aad_token_clnt_cred() has already full support for scope parameter.

Changes:

before:

CALL METHOD me->get_aad_token_clnt_cred
  EXPORTING
    iv_client_id = iv_client_id
    iv_resource  = iv_resource
  IMPORTING

after

CALL METHOD me->get_aad_token_clnt_cred
  EXPORTING
    iv_client_id = iv_client_id
    iv_resource  = iv_resource
    iv_scope     = iv_scope      "addition
  IMPORTING

Tested with SharePoint Online via Entra ID. Token retrieval now succeeds.

[Martin Roschitz (mrMRosch)]

while exploring the SDK further, the implementation of passing scope from all classes using this method would require significant rework. it works but will not add a plus to the sdk.
-> moved to draft state

However here are my findings in what places need also an implementation of the scope parameter, which i haven't the knowledge of (right now):

ZCL_ADF_SERVICE_REPROCESS

has method to get aad token which in turn calls get_aad_token of class ZCL_ADF_SERVICE_AAD:

        CALL METHOD lo_ref_aad->get_aad_token
          EXPORTING
            iv_client_id = iv_client_id
            iv_resource  = CONV #( iv_resource )
          IMPORTING
            ev_aad_token = DATA(lv_aad_token)
            ev_response  = DATA(lv_response).

further implementation would need changes to

1. class ZCL_REST_UTILITY_CLASS -> METHOD retry and added scope in DB Table zadf_sdk_retry
2. class ZCL_SERVICE_REPROCESS -> METHOD sdk_rest_retry

ZCL_O365_SERVICE_SHAREPOINT

calling the get_aad_token method with global variables

* gv_client_id ----> ClientID@TenantID
* gv_resource  ----> resource/SiteDomain@TenantID
      CALL METHOD lo_ref_aad->get_aad_token
        EXPORTING
          iv_client_id = gv_client_id
          iv_resource  = gv_resource
        IMPORTING
          ev_aad_token = ev_aad_token
          ev_response  = ev_response.

which would need further changes in:
0) protected variable data GV_SCOPE type STRING . in class class ZCL_O365_SERVICE

1. class ZCL_O365_SERVICE_SHAREPOINT -> METHOD set_file_parameters retrieving a scope value from DB Table zo365_config
2. class ZCL_O365_SERVICE -> METHOD get_interface_details retriving a scope value also from DB Table zo365_config
3. class ZCL_O365_SERVICE -> METHOD constructor

[Martin Pankraz (MartinPankraz)]

Nice Martin! Please let us know when ready for review