search

SAP / spartacus

Spartacus is a lean, Angular-based JavaScript storefront for SAP Commerce Cloud that communicates exclusively through the Commerce REST API.
Apache License 2.0
738 stars 383 forks source link

B2B - Early login breaks OCC webservices #16906

Closed nicolabeghin closed 1 year ago

nicolabeghin commented 1 year ago

Describe the bug If BaseSite.requiresAuthentication (early login) is enabled,

image

the OCC webservices are broken and return UnknownResourceError - this happens for endpoints requiring authentication, even if authentication is provided (ref. Swagger below)

image image

Tell us the version of Spartacus

Tell us the version of SAP Commerce Cloud

To Reproduce Steps to reproduce the behavior:

  1. Install recipe cx-for-spa
  2. Enable early login for B2B site powertools-spa: BaseSite.requiresAuthentication=true
  3. Access powertools-spa site
  4. See error

Expected behavior B2B powertools-spa site should work when early login is enabled.

Desktop:

Smartphone:

Additional context OSS incident 139294 / 2023 has been raised

SAP note 0003254341 suggests to add annotation on top of standard to disable authentication or something similar (!!!) for this:

  • Requires authentication must be disabled for {baseSiteId}, or
  • annotation @SecurePortalUnauthenticatedAccess must be added to the endpoint: OOTB class de.hybris.platform.*webservices.something.controller.SomethingController from a *webservices extension must be overridden in order to configure its methods with SecurePortalUnauthenticatedAccess annotation
nicolabeghin commented 1 year ago

For anyone encountering this: with latest Commerce patches if BaseSite.requiresAuthentication=true OCC is not allowed anymore to be used by admin or Employee. B2BCustomer with b2bcustomergroup can.