Content is not allowed in prolog SOAP 403 error

[RajeshA]

Environment set up  Saviynt is acting as a ticketing tool to create tickets in SAPGRC as mentioned in https://forums.saviynt.com/t5/saviynt-knowledge-base/using-saviynt-as-a-ticketing-system-for-sap-grc...

Slight difference is Saviynt is not connected to SAPGRC directly, Saviynt is connected to middleware called SAP Integration Suite and SAP integration suite is connected to GRC. So all the communications between Saviynt and SAPGRC happens through SAP integration suite.

Middleware team had provided two urls as below

• GRAC_USER_ACCES_WS: User Access Request Service - https://****-sap-cloud ****/http/GRC/UserAccess
• GRAC_REQUEST_STATUS_WS: Polling the status access request submitted by Saviynt  - https://****-sap-cloud****/http/GRC/UserAccessStatus

Issue

I am trying to create a account (you can see the xml being used in the logs) with one SAP role and seeing an error while provisioning. After researching multiple forums I am able to conclude there is no way we can see evaluated SOAP payload in logs. And I am seeing 403 error in logs.

How can troubleshoot this issue without seeing what is being sent to the server. 

2024-05-15/20:05:01.451 [{}] [quartzScheduler_Worker-9] ERROR provisoning.SoapProvisioningService - Error while creating account RAJEAVUL:
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; Content is not allowed in prolog.

[This message has been edited by moderator to mask url]

[rushikeshvartak]

• You can access issue with service account.
• does api works in postman if yes provide screenshot
• share jsons

[RajeshA]

• You can access issue with service account.
  I didn't understand what you meant by this statement. If you are asking me to log in with that service account into the actual target application and collect the logs from there, then I have tried this. However, the SAP Integration Suite engineer mentioned that they are not seeing any requests happening from Saviynt to provide those logs. I am checking with them to understand if we need to check anywhere else, since 403 is something that the Integration Suite is reporting, and I am currently working on gathering the logs.
• does api works in postman if yes provide screenshot
  Yes it works, and below is the screenshot and also attaching the complete postman request body
  
  
• share jsons
  Attaching the connectionjson, createaccountjson and addaccessjson
  
  
• Before you respond, there are a few things I want to mention.
  • Based on postman headers, i also tried with with "application/xml" in content-type in request params and seeing the same error log 403. So changing that is not helping.
  • In the connection JSON, I provided a dummy test_url (as per https://forums.saviynt.com/t5/saviynt-knowledge-base/how-to-perform-save-and-test-connection-in-soap...) in order to make the save and test connection successful. The reason I did this is that the URLs provided by the integration suite team don't accept requests with empty payloads. When attempted, we receive a 404 error while saving. I tried all the URLs provided, and all of them resulted in the same error. Therefore, I proceeded to use a dummy URL to make it work.
    

    https://sap-cloud-preprod.it-cpi013-rt.cfapps.us21.hana.ondemand.com/http/GRC/UserAccess
    https://sap-cloud-preprod.it-cpi013-rt.cfapps.us21.hana.ondemand.com/http/GRC/
    https://sap-cloud-preprod.it-cpi013-rt.cfapps.us21.hana.ondemand.com/http/
    https://sap-cloud-preprod.it-cpi013-rt.cfapps.us21.hana.ondemand.com/

    https://sap-cloud-preprod.it-cpi013-rt.cfapps.us21.hana.ondemand.com/http/GRC/UserAccessStatus
    https://sap-cloud-preprod.it-cpi013-rt.cfapps.us21.hana.ondemand.com/http/GRC/
    https://sap-cloud-preprod.it-cpi013-rt.cfapps.us21.hana.ondemand.com/http/
    https://sap-cloud-preprod.it-cpi013-rt.cfapps.us21.hana.ondemand.com/

    
    

[rushikeshvartak]

Please remove hostname Keep company-specific private information masked on public forums, such as the name and URL.

[rushikeshvartak]

Looks like this is issue with network connectivity.

Steps to Resolve the HTTP 403 Forbidden Error

1. Check Authentication Credentials:

   • Ensure that the credentials (username and password or API keys) used for the SOAP web service call are correct.
   • Verify that the credentials have the necessary permissions to access the web service.

2. Verify Endpoint URL:

   • Confirm that the URL https://XXXXXXXX/http/GRC/UserAccess is correct and accessible.
   • Make sure there are no typos or incorrect paths in the URL.

3. Network and Firewall Settings:

   • Ensure that there are no network issues or firewall settings blocking access to the web service.
   • Check if there are any IP restrictions or whitelisting requirements for accessing the endpoint.

4. SOAP Action Header:

   • Verify that the correct SOAP action is being used in the request header. Some web services require a specific SOAP action header to authorize the request.

5. Access Control on Web Service:

   • Confirm that the web service itself is configured to accept requests from the client making the call. This could involve checking web service access control lists (ACLs) or settings on the web service provider.