Describe the Bug
When a NoAuthentication destination is configured with cloudsdk.ias-dependency-name, the Cloud SDK's IasTenantHostResolver
constructs the IAS token endpoint URL by substituting the BTP subaccount subdomain into .accounts.ondemand.com.
This is incorrect because the BTP subdomain and the IAS tenant subdomain are not the same. As a result, the token request
fails with HTTP 404 because the constructed URL does not point to a valid IAS tenant.
Steps to Reproduce
- Set up a multi-tenant SaaS application on BTP using CAP Java with Cloud SDK
- Configure a destination with Authentication: NoAuthentication and cloudsdk.ias-dependency-name property pointing to an
IAS service binding
- Subscribe a consumer tenant whose BTP subaccount subdomain (e.g. demoapp-dev-eu10-consumer1) differs from their IAS
tenant subdomain (e.g. forms3)
- Trigger a UI request (named user on thread) that causes the SDK to fetch a token for the destination
- Observe that IasTenantHostResolver constructs https://demoapp-dev-eu10-consumer1.accounts.ondemand.com/oauth2/token
instead of https://forms3.accounts.ondemand.com/oauth2/token
Expected Behavior
The Cloud SDK should resolve the IAS token endpoint URL from the consumer subaccount's trust configuration (which correctly
points to forms3.accounts.ondemand.com), not by constructing it from the BTP subaccount subdomain. The token request
should go to https://forms3.accounts.ondemand.com/oauth2/token.
Screenshots
No response
Used Versions
-
Java and Maven version via mvn --version:
Apache Maven 3.9.11 (3e54c93a704957b63ee3494413a2b544fd3d825b)
Maven home: /opt/homebrew/Cellar/maven/3.9.11/libexec
Java version: 21.0.11, vendor: SAP SE, runtime: /Library/Java/JavaVirtualMachines/sapmachine-21.jdk/Contents/Home
Default locale: en_IN, platform encoding: UTF-8
OS name: "mac os x", version: "26.4.1", arch: "aarch64", family: "Mac"
-
SAP Cloud SDK version: 5.31.0-SNAPSHOT
-
Spring Boot or CAP version: CAP Java 4.9.0, Spring Boot 3.x
Dependency tree via mvn dependency:tree
[INFO]
[INFO] --- dependency:3.7.0:tree (default-cli) @ SampleJavaApp ---
[INFO] com.sap.extensibility:SampleJavaApp:jar:1.0.0-SNAPSHOT
[INFO] +- com.sap.cds:cds-starter-spring-boot:jar:4.9.0:compile
[INFO] | +- com.sap.cds:cds-services-api:jar:4.9.0:compile
[INFO] | +- com.sap.cds:cds-services-impl:jar:4.9.0:compile
[INFO] | | +- com.sap.cds:cds-services-messaging:jar:4.9.0:compile
[INFO] | | | \- jakarta.jms:jakarta.jms-api:jar:3.1.0:compile
[INFO] | | \- com.cronutils:cron-utils:jar:9.2.1:compile
[INFO] | +- com.sap.cds:cds-feature-jdbc:jar:4.9.0:runtime
[INFO] | | +- com.sap.cds:cds4j-runtime:jar:4.9.0:compile
[INFO] | | | \- com.sap.cds:cds4j-jdbc-spi:jar:4.9.0:compile
[INFO] | | \- com.sap.cds:cds4j-tx:jar:4.9.0:runtime
[INFO] | +- com.sap.cds:cds-framework-spring-boot:jar:4.9.0:runtime
[INFO] | | \- com.sap.cloud.sdk.cloudplatform:connectivity-apache-httpclient5:jar:5.31.0-SNAPSHOT:compile
[INFO] | +- org.springframework.boot:spring-boot-starter-web:jar:3.4.0:compile
[INFO] | | +- org.springframework.boot:spring-boot-starter-json:jar:3.4.0:compile
[INFO] | | | \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.18.1:compile
[INFO] | | \- org.springframework.boot:spring-boot-starter-tomcat:jar:3.4.0:compile
[INFO] | | +- org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.33:compile
[INFO] | | \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:10.1.33:compile
[INFO] | +- org.springframework.boot:spring-boot-starter-jdbc:jar:3.4.0:compile
[INFO] | | +- com.zaxxer:HikariCP:jar:5.1.0:compile
[INFO] | | \- org.springframework:spring-jdbc:jar:6.2.0:compile
[INFO] | \- org.yaml:snakeyaml:jar:2.3:compile
[INFO] +- com.sap.cds:cds-adapter-odata-v4:jar:4.9.0:runtime
[INFO] | +- com.sap.cds:cds-adapter-api:jar:4.9.0:compile
[INFO] | +- com.sap.cds:cds-services-utils:jar:4.9.0:compile
[INFO] | | +- com.sap.cloud.sdk.cloudplatform:connectivity-oauth:jar:5.31.0-SNAPSHOT:compile
[INFO] | | | \- com.sap.cloud.security.xsuaa:token-client:jar:4.0.5:compile
[INFO] | | +- commons-io:commons-io:jar:2.22.0:compile
[INFO] | | \- io.opentelemetry:opentelemetry-api:jar:1.43.0:compile
[INFO] | | \- io.opentelemetry:opentelemetry-context:jar:1.43.0:compile
[INFO] | +- com.sap.cds:cds4j-core:jar:4.9.0:compile
[INFO] | +- com.sap.cds.repackaged:odata-v4-lib:jar:4.9.0:runtime
[INFO] | | +- commons-codec:commons-codec:jar:1.17.1:compile
[INFO] | | +- org.apache.httpcomponents:httpclient:jar:4.5.14:compile
[INFO] | | +- com.fasterxml.jackson.dataformat:jackson-dataformat-xml:jar:2.18.1:runtime
[INFO] | | | \- org.codehaus.woodstox:stax2-api:jar:4.2.2:runtime
[INFO] | | \- com.fasterxml:aalto-xml:jar:1.3.4:runtime
[INFO] | +- org.slf4j:slf4j-api:jar:2.0.18:compile
[INFO] | \- com.google.guava:guava:jar:33.6.0-jre:compile
[INFO] | +- com.google.guava:failureaccess:jar:1.0.3:compile
[INFO] | +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO] | +- org.jspecify:jspecify:jar:1.0.0:compile
[INFO] | +- com.google.errorprone:error_prone_annotations:jar:2.49.0:compile
[INFO] | \- com.google.j2objc:j2objc-annotations:jar:3.1:compile
[INFO] +- org.springframework.boot:spring-boot-devtools:jar:3.4.0:compile (optional)
[INFO] | +- org.springframework.boot:spring-boot:jar:3.4.0:compile
[INFO] | \- org.springframework.boot:spring-boot-autoconfigure:jar:3.4.0:compile
[INFO] +- org.springframework.boot:spring-boot-starter-test:jar:3.4.0:test
[INFO] | +- org.springframework.boot:spring-boot-starter:jar:3.4.0:compile
[INFO] | | \- org.springframework.boot:spring-boot-starter-logging:jar:3.4.0:compile
[INFO] | | +- ch.qos.logback:logback-classic:jar:1.5.12:compile
[INFO] | | | \- ch.qos.logback:logback-core:jar:1.5.12:compile
[INFO] | | +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.24.1:compile
[INFO] | | \- org.slf4j:jul-to-slf4j:jar:2.0.16:compile
[INFO] | +- org.springframework.boot:spring-boot-test:jar:3.4.0:test
[INFO] | +- org.springframework.boot:spring-boot-test-autoconfigure:jar:3.4.0:test
[INFO] | +- com.jayway.jsonpath:json-path:jar:2.9.0:test
[INFO] | +- jakarta.xml.bind:jakarta.xml.bind-api:jar:4.0.2:compile
[INFO] | | \- jakarta.activation:jakarta.activation-api:jar:2.1.3:compile
[INFO] | +- net.minidev:json-smart:jar:2.5.1:test
[INFO] | | \- net.minidev:accessors-smart:jar:2.5.1:test
[INFO] | | \- org.ow2.asm:asm:jar:9.6:test
[INFO] | +- org.assertj:assertj-core:jar:3.26.3:test
[INFO] | +- org.awaitility:awaitility:jar:4.2.2:test
[INFO] | +- org.hamcrest:hamcrest:jar:2.2:test
[INFO] | +- org.junit.jupiter:junit-jupiter:jar:5.11.3:test
[INFO] | | +- org.junit.jupiter:junit-jupiter-api:jar:5.11.3:test
[INFO] | | | +- org.opentest4j:opentest4j:jar:1.3.0:test
[INFO] | | | +- org.junit.platform:junit-platform-commons:jar:1.11.3:test
[INFO] | | | \- org.apiguardian:apiguardian-api:jar:1.1.2:test
[INFO] | | +- org.junit.jupiter:junit-jupiter-params:jar:5.11.3:test
[INFO] | | \- org.junit.jupiter:junit-jupiter-engine:jar:5.11.3:test
[INFO] | | \- org.junit.platform:junit-platform-engine:jar:1.11.3:test
[INFO] | +- org.mockito:mockito-core:jar:5.14.2:runtime
[INFO] | | +- net.bytebuddy:byte-buddy-agent:jar:1.15.10:runtime
[INFO] | | \- org.objenesis:objenesis:jar:3.3:runtime
[INFO] | +- org.mockito:mockito-junit-jupiter:jar:5.14.2:test
[INFO] | +- org.skyscreamer:jsonassert:jar:1.5.3:test
[INFO] | | \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test
[INFO] | +- org.springframework:spring-core:jar:6.2.0:compile
[INFO] | | \- org.springframework:spring-jcl:jar:6.2.0:compile
[INFO] | +- org.springframework:spring-test:jar:6.2.0:test
[INFO] | \- org.xmlunit:xmlunit-core:jar:2.10.0:test
[INFO] +- com.h2database:h2:jar:2.3.232:runtime
[INFO] +- com.sap.cds:cds-starter-cloudfoundry:jar:4.9.0:compile
[INFO] | +- com.sap.cds:cds-feature-cloudfoundry:jar:4.9.0:compile
[INFO] | | \- com.sap.cloud.environment.servicebinding:java-sap-vcap-services:jar:0.31.0:compile
[INFO] | +- com.sap.cds:cds-feature-identity:jar:4.9.0:compile
[INFO] | | +- com.sap.cloud.security:java-api:jar:4.0.5:compile
[INFO] | | \- com.sap.cloud.security:java-security:jar:4.0.5:compile
[INFO] | \- com.sap.cloud.security:resourceserver-security-spring-boot-starter:jar:4.0.5:compile
[INFO] | +- com.sap.cloud.security:spring-security:jar:4.0.5:compile
[INFO] | | \- io.projectreactor:reactor-core:jar:3.7.0:compile
[INFO] | | \- org.reactivestreams:reactive-streams:jar:1.0.4:compile
[INFO] | +- org.springframework.security:spring-security-oauth2-jose:jar:6.4.1:compile
[INFO] | | +- org.springframework.security:spring-security-core:jar:6.4.1:compile
[INFO] | | | \- org.springframework.security:spring-security-crypto:jar:6.4.1:compile
[INFO] | | +- org.springframework.security:spring-security-oauth2-core:jar:6.4.1:compile
[INFO] | | \- com.nimbusds:nimbus-jose-jwt:jar:9.37.3:compile
[INFO] | | \- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
[INFO] | \- org.springframework.security:spring-security-oauth2-resource-server:jar:6.4.1:compile
[INFO] | \- org.springframework.security:spring-security-web:jar:6.4.1:compile
[INFO] +- com.sap.cds:cds-feature-hana:jar:4.9.0:runtime
[INFO] | \- com.sap.cloud.db.jdbc:ngdbc:jar:2.28.6:runtime
[INFO] +- com.sap.cds:cds-feature-mt:jar:4.9.0:runtime
[INFO] | +- com.sap.cds:cds-integration-cloud-sdk:jar:4.9.0:runtime
[INFO] | | +- com.sap.cloud.sdk.cloudplatform:tenant:jar:5.31.0-SNAPSHOT:compile
[INFO] | | +- com.sap.cloud.sdk.cloudplatform:connectivity-apache-httpclient4:jar:5.31.0-SNAPSHOT:compile
[INFO] | | \- com.sap.cloud.sdk.cloudplatform:resilience:jar:5.31.0-SNAPSHOT:compile
[INFO] | | \- com.sap.cloud.sdk.cloudplatform:resilience4j:jar:5.31.0-SNAPSHOT:compile
[INFO] | | +- io.github.resilience4j:resilience4j-core:jar:2.4.0:compile
[INFO] | | +- io.github.resilience4j:resilience4j-circuitbreaker:jar:2.4.0:compile
[INFO] | | +- io.github.resilience4j:resilience4j-bulkhead:jar:2.4.0:compile
[INFO] | | +- io.github.resilience4j:resilience4j-timelimiter:jar:2.4.0:compile
[INFO] | | +- io.github.resilience4j:resilience4j-retry:jar:2.4.0:compile
[INFO] | | +- io.github.resilience4j:resilience4j-ratelimiter:jar:2.4.0:compile
[INFO] | | \- javax.cache:cache-api:jar:1.1.1:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.21.3:compile
[INFO] | +- com.github.ben-manes.caffeine:caffeine:jar:3.2.4:compile
[INFO] | \- com.google.code.gson:gson:jar:2.14.0:compile
[INFO] +- org.xerial:sqlite-jdbc:jar:3.47.0.0:runtime
[INFO] +- com.sap.cloud.sdk.cloudplatform:cloudplatform-connectivity:jar:5.31.0-SNAPSHOT:compile
[INFO] | +- com.sap.cloud.sdk.cloudplatform:cloudplatform-core:jar:5.31.0-SNAPSHOT:compile
[INFO] | +- com.sap.cloud.sdk.cloudplatform:resilience-api:jar:5.31.0-SNAPSHOT:compile
[INFO] | | \- com.sap.cloud.sdk.cloudplatform:caching:jar:5.31.0-SNAPSHOT:compile
[INFO] | +- com.sap.cloud.sdk.cloudplatform:security:jar:5.31.0-SNAPSHOT:compile
[INFO] | +- com.sap.cloud.environment.servicebinding.api:java-core-api:jar:0.31.0:compile
[INFO] | +- com.sap.cloud.environment.servicebinding.api:java-access-api:jar:0.31.0:compile
[INFO] | +- org.slf4j:jcl-over-slf4j:jar:2.0.16:runtime
[INFO] | +- io.vavr:vavr:jar:1.0.1:compile
[INFO] | | \- io.vavr:vavr-match:jar:1.0.0:compile
[INFO] | +- com.mikesamuel:json-sanitizer:jar:1.2.3:compile
[INFO] | +- org.apache.commons:commons-lang3:jar:3.20.0:compile
[INFO] | +- com.auth0:java-jwt:jar:4.5.2:compile
[INFO] | +- org.bouncycastle:bcprov-jdk18on:jar:1.84:compile
[INFO] | \- org.bouncycastle:bcpkix-jdk18on:jar:1.84:compile
[INFO] | \- org.bouncycastle:bcutil-jdk18on:jar:1.84:compile
[INFO] +- com.sap.cloud.sdk.cloudplatform:dwc-cf:jar:5.31.0-SNAPSHOT:compile
[INFO] | +- com.sap.cloud.sdk:sdk-core:jar:5.31.0-SNAPSHOT:compile
[INFO] | | \- com.sap.cloud.sdk.cloudplatform:servlet-jakarta:jar:5.31.0-SNAPSHOT:compile
[INFO] | \- com.sap.cloud.sdk.cloudplatform:connectivity-dwc:jar:5.31.0-SNAPSHOT:compile
[INFO] | \- org.apache.httpcomponents:httpcore:jar:4.4.16:compile
[INFO] +- com.sap.cloud.sjb:xs-env:jar:2.11.0:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.22:compile
[INFO] | \- com.fasterxml.jackson.core:jackson-core:jar:2.21.3:compile
[INFO] +- com.sap.procurement:master-data-integration:jar:1.3.0-20260527111229_eb0c764b8ec411bbf926eacbf90f3d12d7786487:compile
[INFO] | \- com.sap.cloud.sdk.cloudplatform:connectivity-destination-service:jar:5.31.0-SNAPSHOT:compile
[INFO] | +- org.apache.httpcomponents.core5:httpcore5:jar:5.4.2:compile
[INFO] | +- org.apache.httpcomponents.client5:httpclient5:jar:5.6.1:compile
[INFO] | | \- org.apache.httpcomponents.core5:httpcore5-h2:jar:5.3.1:compile
[INFO] | \- com.sap.cloud.environment.servicebinding.api:java-consumption-api:jar:0.31.0:compile
[INFO] +- com.amx.proxy.java:lib:jar:3.1.1:compile
[INFO] | +- org.springframework:spring-context:jar:6.2.0:compile
[INFO] | | +- org.springframework:spring-aop:jar:6.2.0:compile
[INFO] | | +- org.springframework:spring-expression:jar:6.2.0:compile
[INFO] | | \- io.micrometer:micrometer-observation:jar:1.14.1:compile
[INFO] | +- org.springframework:spring-webmvc:jar:6.2.0:compile
[INFO] | +- org.springframework:spring-web:jar:6.2.0:compile
[INFO] | +- org.springframework:spring-beans:jar:6.2.0:compile
[INFO] | +- jakarta.servlet:jakarta.servlet-api:jar:6.1.0:compile
[INFO] | +- com.sap.dwc:util-mutual-authentication:jar:2.4.1:compile
[INFO] | | +- com.sap.dwc:util-model:jar:2.4.1:compile
[INFO] | | \- com.sap.dwc.commons:commons-util:jar:2.23.0:compile
[INFO] | +- com.sap.dwc:util-cap:jar:2.4.1:compile
[INFO] | +- com.sap.dwc:util-headers:jar:2.4.1:compile
[INFO] | +- com.sap.dwc:util-routing:jar:2.4.1:compile
[INFO] | +- com.sap.dwc:util-product-config:jar:2.4.1:compile
[INFO] | +- com.sap.cloud.tenantlifecycle:euporie-dwc-integration:jar:2.2.1-20241212142547_c8d6de5b36b280f838aa5a7b8d87946572b1d982:compile
[INFO] | | +- io.pivotal.cfenv:java-cfenv-boot:jar:3.1.5:compile
[INFO] | | | +- io.pivotal.cfenv:java-cfenv:jar:3.1.5:compile
[INFO] | | | | \- com.cedarsoftware:json-io:jar:4.19.1:compile
[INFO] | | | | \- com.novell.ldap:jldap:jar:2009-10-07:compile
[INFO] | | | \- io.pivotal.cfenv:java-cfenv-jdbc:jar:3.1.5:compile
[INFO] | | +- com.sap.cloud.environment.servicebinding:java-sap-service-operator:jar:0.31.0:compile
[INFO] | | \- com.sap.cloud.tenantlifecycle:euporie-authentication:jar:2.1.0-20241203144912_907cc6ed7fd8fb26b3bb801edef607376c66b2b3:compile
[INFO] | +- com.sap.cloud.tenantlifecycle:euporie-api:jar:2.2.1-20240826062219_0c54fd7b6dce24d4d75cb8614deffe0690e06072:compile
[INFO] | | \- com.sap.cloud.tenantlifecycle:euporie-api-domain:jar:2.2.1-20240826062219_0c54fd7b6dce24d4d75cb8614deffe0690e06072:compile
[INFO] | \- com.sap.cloud.tenantlifecycle:hegemone-specs:jar:2.1.0-20240903112714_9b5425cf05cd9b6a7817f870314b630d206deb65:compile
[INFO] +- org.apache.logging.log4j:log4j-slf4j2-impl:jar:2.24.1:compile
[INFO] | +- org.apache.logging.log4j:log4j-api:jar:2.24.1:compile
[INFO] | \- org.apache.logging.log4j:log4j-core:jar:2.24.1:runtime
[INFO] +- com.squareup.okhttp3:okhttp:jar:4.12.0:compile
[INFO] | +- com.squareup.okio:okio:jar:3.6.0:compile
[INFO] | | \- com.squareup.okio:okio-jvm:jar:3.6.0:compile
[INFO] | | \- org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.9.25:compile
[INFO] | \- org.jetbrains.kotlin:kotlin-stdlib-jdk8:jar:1.9.25:compile
[INFO] | +- org.jetbrains.kotlin:kotlin-stdlib:jar:1.9.25:compile
[INFO] | | \- org.jetbrains:annotations:jar:13.0:compile
[INFO] | \- org.jetbrains.kotlin:kotlin-stdlib-jdk7:jar:1.9.25:compile
[INFO] +- com.sap.cds:cds4j-api:jar:4.9.0:compile
[INFO] +- org.projectlombok:lombok:jar:1.18.36:compile
[INFO] +- com.sap.statemachine:statemachine-lib:jar:1.0-SNAPSHOT-20241218225843_3c4974745128378a198ca8821f851f466c3ed081:compile
[INFO] | +- com.networknt:json-schema-validator:jar:1.4.0:compile
[INFO] | | +- com.ethlo.time:itu:jar:1.8.0:compile
[INFO] | | \- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.18.1:compile
[INFO] | +- org.json:json:jar:20210307:compile
[INFO] | +- jakarta.validation:jakarta.validation-api:jar:3.0.2:compile
[INFO] | +- jakarta.annotation:jakarta.annotation-api:jar:2.1.1:compile
[INFO] | +- org.hibernate.validator:hibernate-validator:jar:8.0.1.Final:compile
[INFO] | | +- org.jboss.logging:jboss-logging:jar:3.6.1.Final:compile
[INFO] | | \- com.fasterxml:classmate:jar:1.7.0:compile
[INFO] | +- com.sun.xml.bind:jaxb-impl:jar:4.0.5:compile
[INFO] | | \- com.sun.xml.bind:jaxb-core:jar:4.0.5:compile
[INFO] | | \- org.eclipse.angus:angus-activation:jar:2.0.2:runtime
[INFO] | \- org.glassfish.jaxb:jaxb-runtime:jar:4.0.5:compile
[INFO] | \- org.glassfish.jaxb:jaxb-core:jar:4.0.5:compile
[INFO] | +- org.glassfish.jaxb:txw2:jar:4.0.5:compile
[INFO] | \- com.sun.istack:istack-commons-runtime:jar:4.1.2:compile
[INFO] +- io.temporal:temporal-sdk:jar:1.22.2:compile
[INFO] | +- io.temporal:temporal-serviceclient:jar:1.22.2:compile
[INFO] | | +- io.grpc:grpc-api:jar:1.54.1:compile
[INFO] | | | +- io.grpc:grpc-context:jar:1.54.1:compile
[INFO] | | | \- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO] | | +- io.grpc:grpc-stub:jar:1.54.1:compile
[INFO] | | +- io.grpc:grpc-netty-shaded:jar:1.54.1:compile
[INFO] | | | +- io.perfmark:perfmark-api:jar:0.25.0:runtime
[INFO] | | | \- io.grpc:grpc-core:jar:1.54.1:compile
[INFO] | | | +- com.google.android:annotations:jar:4.1.1.4:runtime
[INFO] | | | \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.21:runtime
[INFO] | | +- io.grpc:grpc-services:jar:1.54.1:compile
[INFO] | | | \- io.grpc:grpc-protobuf:jar:1.54.1:compile
[INFO] | | | +- com.google.protobuf:protobuf-java:jar:3.21.7:compile
[INFO] | | | +- com.google.api.grpc:proto-google-common-protos:jar:2.9.0:compile
[INFO] | | | \- io.grpc:grpc-protobuf-lite:jar:1.54.1:compile
[INFO] | | +- com.google.protobuf:protobuf-java-util:jar:3.22.0:compile
[INFO] | | \- com.uber.m3:tally-core:jar:0.13.0:compile
[INFO] | +- io.micrometer:micrometer-core:jar:1.14.1:compile
[INFO] | | +- io.micrometer:micrometer-commons:jar:1.14.1:compile
[INFO] | | +- org.hdrhistogram:HdrHistogram:jar:2.2.2:runtime
[INFO] | | \- org.latencyutils:LatencyUtils:jar:2.0.3:runtime
[INFO] | +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.21.3:compile
[INFO] | \- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.18.1:compile
[INFO] +- com.sap.extensibility:event-listener-java-lib:jar:2.0.11:compile
[INFO] | \- org.springframework.boot:spring-boot-starter-data-redis:jar:3.4.0:compile
[INFO] | +- io.lettuce:lettuce-core:jar:6.4.1.RELEASE:compile
[INFO] | | +- io.netty:netty-common:jar:4.1.115.Final:compile
[INFO] | | +- io.netty:netty-handler:jar:4.1.115.Final:compile
[INFO] | | | +- io.netty:netty-resolver:jar:4.1.115.Final:compile
[INFO] | | | +- io.netty:netty-buffer:jar:4.1.115.Final:compile
[INFO] | | | +- io.netty:netty-transport-native-unix-common:jar:4.1.115.Final:compile
[INFO] | | | \- io.netty:netty-codec:jar:4.1.115.Final:compile
[INFO] | | \- io.netty:netty-transport:jar:4.1.115.Final:compile
[INFO] | \- org.springframework.data:spring-data-redis:jar:3.4.0:compile
[INFO] | +- org.springframework.data:spring-data-keyvalue:jar:3.4.0:compile
[INFO] | | \- org.springframework.data:spring-data-commons:jar:3.4.0:compile
[INFO] | +- org.springframework:spring-oxm:jar:6.2.0:compile
[INFO] | \- org.springframework:spring-context-support:jar:6.2.0:compile
[INFO] +- com.sap.hcp.cf.logging:cf-java-logging-support-log4j2:jar:3.8.2:compile
[INFO] | \- com.sap.hcp.cf.logging:cf-java-logging-support-core:jar:3.8.2:compile
[INFO] | \- com.fasterxml.jackson.jr:jackson-jr-objects:jar:2.18.1:compile
[INFO] +- com.sap.hcp.cf.logging:cf-java-logging-support-servlet-jakarta:jar:3.8.2:compile
[INFO] +- com.sap.cds:cds-feature-remote-odata:jar:4.9.0:runtime
[INFO] | \- com.sap.cloud.sdk.datamodel:odata-client:jar:5.31.0-SNAPSHOT:runtime
[INFO] | \- com.sap.cloud.sdk.datamodel:fluent-result:jar:5.31.0-SNAPSHOT:runtime
[INFO] +- com.sap.expressionengine:expression-engine-java:jar:1.0.2-SNAPSHOT-20260416184117_95a929eff1303a1c8dfed9d3580ec965eac34688:compile
[INFO] | +- org.apache.commons:commons-jexl3:jar:3.3:compile
[INFO] | | \- commons-logging:commons-logging:jar:1.2:compile
[INFO] | +- net.bytebuddy:byte-buddy:jar:1.15.10:compile
[INFO] | \- com.sap.cloud.ngproc:nexus-plugin-configs:jar:3.0.29:compile
[INFO] \- com.sap.cds:import-export-plugin:jar:1.4.9:compile
[INFO] +- org.springframework.boot:spring-boot-starter-validation:jar:3.4.0:compile
[INFO] | \- org.apache.tomcat.embed:tomcat-embed-el:jar:10.1.33:compile
[INFO] +- org.springframework:spring-tx:jar:6.2.0:compile
[INFO] +- org.apache.commons:commons-csv:jar:1.10.0:compile
[INFO] +- org.apache.poi:poi:jar:5.5.1:compile
[INFO] | +- org.apache.commons:commons-collections4:jar:4.5.0:compile
[INFO] | +- org.apache.commons:commons-math3:jar:3.6.1:compile
[INFO] | \- com.zaxxer:SparseBitSet:jar:1.3:compile
[INFO] +- org.apache.poi:poi-ooxml:jar:5.5.1:compile
[INFO] | +- org.apache.poi:poi-ooxml-lite:jar:5.5.1:compile
[INFO] | +- org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile
[INFO] | +- org.apache.commons:commons-compress:jar:1.28.0:compile
[INFO] | \- com.github.virtuald:curvesapi:jar:1.08:compile
[INFO] +- com.sap.cp.auditlog:audit-java-client-api:jar:2.8.8:compile
[INFO] \- com.sap.cp.auditlog:audit-java-client-impl:jar:2.8.8:compile
[INFO] +- com.sap.cloud.security:env:jar:4.0.5:compile
[INFO] \- com.sap.cp.auditlog:auditlog-common:jar:2.8.2:compile
Code Examples
CqnSelect remoteQuery = Select.from(target).columns(target).where(CQL.in(fkColumnNames, missingFks));
return context.getCdsRuntime().requestContext().modifyParameters(p -> p.setLocale(null)).run(ctx -> {return remoteMdSrv.run(remoteQuery);});Stack Trace
Caused by: com.sap.cloud.security.xsuaa.client.OAuth2ServiceException:
Error requesting access token!.
Server URI https://demoapp-dev-eu10-consumer1.accounts.ondemand.com/oauth2/token.
Http status code 404.
Response body '<title>404 Not Found</title>
404 Not Found - You did not enter a valid
URL.
'.
at com.sap.cloud.sdk.cloudplatform.connectivity.OAuth2Service.lambda$executeUserExchangeFlow$2(OAuth2Service.java:327)
at com.sap.cloud.sdk.cloudplatform.connectivity.OAuth2Service.executeUserExchangeFlow(OAuth2Service.java:327)
at com.sap.cloud.sdk.cloudplatform.connectivity.OAuth2Service.lambda$retrieveAccessToken$0(OAuth2Service.java:150)
at com.sap.cloud.sdk.cloudplatform.connectivity.HttpClient5OAuth2TokenService.executeRequest(HttpClient5OAuth2TokenService.
java:114)
at com.sap.cloud.security.xsuaa.client.AbstractOAuth2TokenService.retrieveAccessTokenViaJwtBearerTokenGrant(AbstractOAuth2T
okenService.java:178)
Log File
Log file
Key log entries showing the wrong host being used:
IasTenantHostResolver: building token URL from BTP subdomain
→ https://demoapp-dev-eu10-consumer1.accounts.ondemand.com/oauth2/token
HTTP 404 response from IAS:
"404 Not Found - You did not enter a valid URL."
DestinationAccessException: Header provider 'OAuth2HeaderProvider' threw an exception:
TokenRequestFailedException: Failed to resolve access token.
Affected Development Phase
Development
Impact
Blocked
Timeline
No response
Describe the Bug
When a NoAuthentication destination is configured with cloudsdk.ias-dependency-name, the Cloud SDK's IasTenantHostResolver
constructs the IAS token endpoint URL by substituting the BTP subaccount subdomain into .accounts.ondemand.com.
This is incorrect because the BTP subdomain and the IAS tenant subdomain are not the same. As a result, the token request
fails with HTTP 404 because the constructed URL does not point to a valid IAS tenant.
Steps to Reproduce
IAS service binding
tenant subdomain (e.g. forms3)
instead of https://forms3.accounts.ondemand.com/oauth2/token
Expected Behavior
The Cloud SDK should resolve the IAS token endpoint URL from the consumer subaccount's trust configuration (which correctly
points to forms3.accounts.ondemand.com), not by constructing it from the BTP subaccount subdomain. The token request
should go to https://forms3.accounts.ondemand.com/oauth2/token.
Screenshots
No response
Used Versions
Java and Maven version via
mvn --version:Apache Maven 3.9.11 (3e54c93a704957b63ee3494413a2b544fd3d825b)
Maven home: /opt/homebrew/Cellar/maven/3.9.11/libexec
Java version: 21.0.11, vendor: SAP SE, runtime: /Library/Java/JavaVirtualMachines/sapmachine-21.jdk/Contents/Home
Default locale: en_IN, platform encoding: UTF-8
OS name: "mac os x", version: "26.4.1", arch: "aarch64", family: "Mac"
SAP Cloud SDK version: 5.31.0-SNAPSHOT
Spring Boot or CAP version: CAP Java 4.9.0, Spring Boot 3.x
Dependency tree via
mvn dependency:treeCode Examples
Stack Trace
Caused by: com.sap.cloud.security.xsuaa.client.OAuth2ServiceException:
Error requesting access token!.
Server URI https://demoapp-dev-eu10-consumer1.accounts.ondemand.com/oauth2/token.
Http status code 404.
Response body '<title>404 Not Found</title>
404 Not Found - You did not enter a valid
URL.
'.
at com.sap.cloud.sdk.cloudplatform.connectivity.OAuth2Service.lambda$executeUserExchangeFlow$2(OAuth2Service.java:327)
at com.sap.cloud.sdk.cloudplatform.connectivity.OAuth2Service.executeUserExchangeFlow(OAuth2Service.java:327)
at com.sap.cloud.sdk.cloudplatform.connectivity.OAuth2Service.lambda$retrieveAccessToken$0(OAuth2Service.java:150)
at com.sap.cloud.sdk.cloudplatform.connectivity.HttpClient5OAuth2TokenService.executeRequest(HttpClient5OAuth2TokenService.
java:114)
at com.sap.cloud.security.xsuaa.client.AbstractOAuth2TokenService.retrieveAccessTokenViaJwtBearerTokenGrant(AbstractOAuth2T
okenService.java:178)
Log File
Log file
Key log entries showing the wrong host being used:IasTenantHostResolver: building token URL from BTP subdomain
→ https://demoapp-dev-eu10-consumer1.accounts.ondemand.com/oauth2/token
HTTP 404 response from IAS:
"404 Not Found - You did not enter a valid URL."
DestinationAccessException: Header provider 'OAuth2HeaderProvider' threw an exception:
TokenRequestFailedException: Failed to resolve access token.
Affected Development Phase
Development
Impact
Blocked
Timeline
No response