Skip to content

Create Web Portal Shares With Subfolders

Authenticate via Password Grant

You can use the API to create Web Portal shares. When outputting order data from SAP it might be required to automatically create subfolders within the share.

The workflow follows these steps:

  1. Discover the token endpoint from the identity provider (IDP), then request an access token via the password grant. Send the token as Authorization: Bearer <token> header on every following call.
  2. Create the share with a POST to the repo endpoint. The response links.self.href is the share's address for the next steps.
  3. Create a subfolder inside the share with a POST to the share's href, body {"name":"<name>","type":"collection"}.
  4. Create a document inside the subfolder with a POST to the subfolder's href, body {"name":"<name>","type":"document"}.
  5. Upload the file content with a PUT to the document's href plus /content.

Repeat steps 3 to 5 for each subfolder or document to add.

Authenticate via Client Credentials for MFA-Enforced Identity Providers

The steps above use the password grant to retrieve the access token. Some identity providers reject the password grant when multi-factor authentication (MFA) is enforced for the whole tenant. Azure AD (Microsoft Entra ID) returns error AADSTS50158: External security challenge not satisfied (error code 50158) in that case.

For such tenants, use the client credentials grant instead of the password grant. Request the token from the same token endpoint, with grant_type=client_credentials, client_id, and client_secret instead of the username and password.

Caution - client credentials grant has no user identity

The client credentials grant returns an access token for the OIDC client itself, not for a specific user.

Hint - seal-dpf-workingunit-webportal

The DPF working unit seal-dpf-workingunit-webportal implements this flow through its own input parameters WEBPORTAL_AUTH_GRANT_TYPE, WEBPORTAL_X_USER_AUTH, and WEBPORTAL_X_USER_AUTH_FILE. These are parameters of the working unit, not of SEAL Operator. For their exact usage, refer to the working unit's own documentation.

---

Back to top