Friday, September 11, 2026

SAP Commerce Solr Search Explained: Indexing, Facets, Filters, Search & Performance

Introduction

Search is one of the most important features in an e-commerce application.

Imagine an online store containing hundreds of thousands or millions of products. When a customer searches for:

Nike Running Shoes

the application needs to quickly return relevant products and allow the customer to narrow the results using filters such as:

  • Brand
  • Category
  • Size
  • Color
  • Price
  • Availability
  • Rating

Executing a complex database query for every customer search can become expensive.

This is where Apache Solr comes into the SAP Commerce architecture.

SAP Commerce uses the solrfacetsearch functionality to provide search and faceted navigation over indexed Commerce data. SAP documentation describes it as supporting faceted search over items such as products and WCMS content.

In this article, we will understand Solr from both a developer and SAP Commerce interview perspective.


1. What Is Solr?

Apache Solr is a search platform designed for fast searching and indexing of large amounts of data.

Instead of searching the Commerce database directly for every customer request, SAP Commerce can index relevant product information into Solr.

Conceptually:

SAP Commerce Database
        |
        | Indexing
        v
      Solr
        |
        | Search
        v
Customer Search Request

For example, your database may contain:

Product
---------------------------------
code
name
description
price
brand
category
color
size
stock

During indexing, selected information is transformed into a Solr document.

Conceptually:

{
  "code": "NIKE-001",
  "name": "Nike Running Shoes",
  "brand": "Nike",
  "category": "Running Shoes",
  "color": "Black",
  "price": 5999
}

The important point is that not every database attribute automatically becomes searchable.

The attributes that should be indexed have to be configured as indexed properties.


2. Solr in SAP Commerce Architecture

A simplified architecture looks like this:

                Customer
                   |
                   v
             Storefront/OCC
                   |
                   v
             Search Service
                   |
                   v
              Solr Server
                   |
          +--------+--------+
          |                 |
          v                 v
    Search Results       Facets
          |
          v
      Product PKs
          |
          v
     SAP Commerce
       Product

The major components include:

  • SAP Commerce
  • solrfacetsearch
  • Solr server
  • Indexed Types
  • Indexed Properties
  • Search configuration
  • Indexer
  • Search services
  • Facet configuration

SAP's documentation separates search configuration, indexed types, indexed properties, and server configuration as core parts of the Search and Navigation functionality.


3. Why Does SAP Commerce Need Solr?

Consider a catalog containing:

2,000,000 Products

A customer enters:

laptop

and expects results within a fraction of a second.

A database query may have to perform complex operations involving:

Product
Category
Price
Inventory
Brand
Classification
Language
Catalog Version

and potentially large text-search operations.

Solr is optimized specifically for search workloads.

The advantages include:

Fast text search

Search terms can be matched across indexed fields efficiently.

Full-text search

For example:

running shoes

can search relevant product text.

Fuzzy search

A misspelled term such as:

nik

can potentially return:

Nike

depending on the configured query behavior.

Faceted search

Customers can narrow results by:

Brand
Color
Size
Price Range
Category

Sorting

Results can be sorted by:

Price
Name
Relevance
Rating
Stock

4. What Is Solr Indexing?

Indexing is the process of taking data from SAP Commerce and creating searchable Solr documents.

For example:

ProductModel
     |
     v
Indexer
     |
     v
Value Providers / Resolvers
     |
     v
Solr Document
     |
     v
Solr Index

Suppose we have:

ProductModel product

with:

code = IPHONE-001
name = iPhone 17
price = 79999
brand = Apple

The indexing process converts relevant information into Solr fields.

Conceptually:

ProductModel
      |
      +---- code ------> code_string
      |
      +---- name ------> name_text
      |
      +---- price -----> price_double
      |
      +---- brand -----> brand_string

5. What Is an Indexed Type?

An Indexed Type defines what type of Commerce data is going to be indexed.

A common example is:

Product

The Indexed Type identifies the Commerce item being indexed and is associated with indexer/search configuration.

You can think of it as:

Indexed Type
      |
      +---- Product
      |
      +---- Indexed Properties
      |
      +---- Indexer Configuration
      |
      +---- Search Configuration

6. What Are Indexed Properties?

An Indexed Property represents a property of the indexed type that should be available in Solr.

For example:

Product.code
Product.name
Product.description
Product.price
Product.brand
Product.color

The property configuration determines how the value should be indexed and potentially searched, filtered, faceted, or returned.

SAP Commerce documentation provides different configurations for strings, dates, numbers, enums, localized values and other types.


7. Example of an Indexed Property

A simplified ImpEx-style example might look like:

INSERT_UPDATE SolrIndexedProperty;
name[unique=true];
solrIndexedType(identifier)[unique=true];
type(code);
localized[default=false];
facet[default=false]

;name;Product;TEXT;true;false
;code;Product;TEXT;false;false
;brand;Product;STRING;false;true
;price;Product;DOUBLE;false;true

The exact configuration can vary by SAP Commerce version and project.

The important concept is:

Commerce Attribute
        |
        v
SolrIndexedProperty
        |
        v
Solr Field

8. Text vs String in Solr

This is an important interview topic.

Suppose you have:

Product Name = Nike Running Shoes

If you want full-text search behavior, the property typically needs to be configured appropriately as a text-search field.

For example:

name → text

A string field behaves differently from a text field because text processing/analyzers can be applied to searchable text.

SAP's documentation specifically notes that string indexing can behave differently with filters and may result in case-sensitive searching compared with appropriately configured text fields.


9. Free-Text Search

Free-text search allows users to enter search terms without explicitly specifying a field.

Example:

red nike shoes

The search engine attempts to identify matching indexed content.

Typical searchable properties might include:

name
description
code
brand
category

SAP Commerce search property configuration supports different query behaviors, including free-text, fuzzy, wildcard, and phrase queries.


10. Fuzzy Search

Customers frequently make spelling mistakes.

For example:

runing shoes

instead of:

running shoes

Fuzzy search can help identify terms that are similar.

Conceptually:

runing
  |
  v
running

This can improve the customer's search experience.

However, fuzzy searching should be used carefully because aggressive fuzzy queries can increase search cost and return less precise results.


11. Wildcard Search

Wildcard search allows partial matching.

Example:

nik*

could potentially match:

nike
nikon

Depending on the configured search behavior.

Wildcard queries should be used carefully, especially with leading wildcards such as:

*shoe

because they can be expensive depending on the Solr/query configuration.


12. Phrase Search

Suppose the customer enters:

running shoes

A phrase-oriented search can treat the complete phrase as a meaningful sequence rather than simply searching the individual words independently.

This can improve relevance for certain use cases.


13. What Are Facets?

Facets are filters that allow customers to narrow search results.

Suppose a customer searches:

shoes

The application might display:

Brand
----------------
Nike (120)
Adidas (90)
Puma (50)

Color
----------------
Black (100)
White (75)
Red (40)

Price
----------------
₹0 - ₹2,000
₹2,000 - ₹5,000
₹5,000+

These are facets.

The customer can select:

Brand = Nike
Color = Black

and the results become narrower.

SAP Commerce's search configuration supports facet settings on indexed properties.


14. Facet Example

Consider:

Product
-------------------
Brand
Color
Size
Price
Category

Configure:

brand → facet
color → facet
size → facet
price → facet/range

Then the search UI could display:

Brand

Nike       120
Adidas      90
Puma        50

and:

Color

Black      100
White       80
Blue        40

15. Range Facets

Some values are better represented as ranges.

Price is the most common example.

Instead of:

₹1499
₹1699
₹1899
₹1999
₹2499

the customer can see:

₹0 - ₹2,000
₹2,000 - ₹5,000
₹5,000 - ₹10,000
₹10,000+

These are range facets.

They are especially useful for:

  • Price
  • Age
  • Weight
  • Rating
  • Size
  • Numeric attributes

16. Full Index vs Incremental/Partial Updates

This is one of the most important Solr interview questions.

Full Index

A full index rebuild processes the complete dataset configured for the index.

Conceptually:

All Products
     |
     v
Indexer
     |
     v
New Solr Index

Full indexing may be used after:

  • major configuration changes
  • new indexed properties
  • catalog changes
  • initial setup
  • index corruption
  • significant data/configuration changes

Partial or Incremental Update

A partial update updates only the required information rather than rebuilding an entire document.

For example:

Product 1001

Old:
price = 5000
stock = 20

New:
stock = 5

Instead of rebuilding everything, the update process can target the necessary change.

SAP documents partial updates as a way to update a subset of Solr document attributes rather than rebuilding the entire document, which is useful for large catalogs.


17. When Should You Run a Full Index?

A common scenario:

You add a new indexed property:

material

The existing Solr index doesn't automatically contain the new field for every existing product simply because you changed the configuration.

A full indexing operation is commonly required so the existing dataset gets indexed according to the new configuration.

Typical flow:

Change Indexed Property
          |
          v
Update Configuration
          |
          v
Run Full Index
          |
          v
Validate Search

18. Solr Indexer CronJob

SAP Commerce provides indexing functionality that can be executed through CronJobs.

For example:

System
  |
  +-- Background Processes
        |
        +-- CronJobs
              |
              +-- Solr Indexer

You can configure execution schedules and indexing operations through the administration tooling. SAP documentation also describes configuring Solr index update CronJobs and their operation settings.


19. Why Is My Product Available in the Database but Not in Search?

This is one of the most common production issues.

You execute:

SELECT * FROM Product

and find:

Product exists

but searching through storefront/OCC doesn't return it.

Do not immediately assume FlexibleSearch is the problem.

The product may not be correctly represented in the Solr index.

Check:

1. Product exists
2. Correct catalog
3. Correct catalog version
4. Product is indexed
5. Indexed property configuration
6. Indexing job status
7. Solr configuration
8. Query configuration
9. Search restrictions
10. Facet/search configuration

20. Troubleshooting: Product Not Showing in Solr

A practical troubleshooting sequence is:

Step 1: Check the Product

Verify:

code
catalog
catalogVersion
approvalStatus
onlineDate
offlineDate

Step 2: Check Indexed Type

Confirm that the relevant product type is included in the indexed type configuration.


Step 3: Check Indexed Properties

If you're searching:

brand = Nike

verify that:

brand

is configured as an indexed property.


Step 4: Check Indexing Job

Look for indexing errors in:

Backoffice
HAC
logs
CronJobs

Step 5: Run a Full Index

When configuration changes or stale index data is suspected, run the appropriate full indexing operation.


Step 6: Validate Solr

Confirm that the expected Solr document exists and contains the expected fields.


21. Database Data vs Solr Data

A very important concept:

Database ≠ Solr Index

The database contains the source Commerce data.

Solr contains the indexed/search-oriented representation.

Therefore:

Product exists in DB

does not necessarily mean:

Product exists correctly in Solr

This distinction is extremely important when debugging production search problems.


22. What Is a Value Provider?

During indexing, SAP Commerce needs to determine where an indexed value comes from.

For example:

Product.price

may be directly available from the Product model.

But a complex property could require custom logic.

Conceptually:

ProductModel
     |
     v
Value Provider
     |
     v
Solr Field

A custom value provider may be appropriate when the indexed value must be calculated or assembled from multiple sources.

For example:

Product
  |
  +-- Brand
  +-- Category
  +-- Classification
  |
  v
Custom Calculated Search Value

23. Example Custom Value Provider Concept

Suppose the business wants a searchable field:

searchKeywords

generated from:

product name
brand
category
classification

A custom provider could conceptually do:

public class CustomSearchValueProvider
{
    public Object getFieldValue(ProductModel product)
    {
        StringBuilder value = new StringBuilder();

        value.append(product.getName());

        if (product.getManufacturerName() != null)
        {
            value.append(" ");
            value.append(product.getManufacturerName());
        }

        return value.toString();
    }
}

The exact SAP Commerce interface and method signature depend on the platform/version and project setup, so the implementation should follow the corresponding version's Solr indexing API.


24. Localized Indexed Properties

E-commerce applications are often multilingual.

For example:

English:
Running Shoes

German:
Laufschuhe

French:
Chaussures de course

Product names can therefore require localized indexing.

The indexing configuration needs to account for localization.

This is especially important when troubleshooting a problem such as:

Search works in English
Search fails in German

Check whether the property is configured correctly as localized and whether the required language data was indexed.

SAP's Solr property configuration explicitly supports localized properties.


25. Currency-Dependent Properties

Price is another special case.

Consider:

India   → INR 79,999
USA     → USD 999
Europe  → EUR 949

Search/index configuration needs to account for currency where relevant.

A price field should not simply be treated like an ordinary string.

This is why SAP Commerce Solr indexed properties support currency-specific configuration.


26. Search Restrictions and Solr

Another tricky area is Search Restrictions.

A product may exist in the Solr index, but additional Commerce-side restrictions can still affect what a particular user sees.

This can produce confusing behavior such as:

Solr contains product
        +
Search restriction applies
        =
Product not visible to user

SAP documentation also notes that search restrictions can affect Solr result counts in some situations.


27. Solr and OCC

In a headless SAP Commerce implementation, OCC APIs may expose search functionality.

A conceptual request might look like:

GET /occ/v2/{baseSiteId}/products/search?query=shoes

The flow can be represented as:

Mobile/Web Client
       |
       v
OCC Controller
       |
       v
Facade
       |
       v
Search Service
       |
       v
Solr
       |
       v
Search Results
       |
       v
Product Data / DTO

This is an important connection between your OCC knowledge and Solr knowledge.


28. Pagination in Solr Search

Suppose there are:

50,000 products

The API should not return all of them.

Instead:

Page 0
size = 20

returns:

Products 1 - 20

and:

Page 1
size = 20

returns:

Products 21 - 40

Pagination helps reduce:

  • response size
  • network traffic
  • memory usage
  • rendering time

29. Sorting Search Results

Customers may want:

Relevance
Price Low → High
Price High → Low
Newest
Name

Solr can support configured sorting behavior.

For example:

search=shoes
sort=price-asc

The exact OCC query parameters depend on your API/version/customization, but the important architectural concept is:

Customer Sort Selection
        |
        v
Search Query
        |
        v
Solr Sorting

30. Solr Performance Optimization

Solr performance becomes increasingly important as catalog size grows.

1. Index only required data

Do not blindly index every Product attribute.

More indexed data can mean:

larger index
more storage
more processing
more indexing time

SAP also recommends avoiding sensitive/confidential data in Solr indexing because indexed data can introduce information disclosure risks.


2. Avoid unnecessary facets

Do not make every property a facet.

For example, these may not make sense as customer-facing facets:

internalCreationTimestamp
internalERPFlag
internalProcessingStatus

Use facets where customers actually need filtering.


3. Optimize indexed properties

Only index fields that have a business/search purpose.

Ask:

Do customers search this?
Do customers filter by this?
Does sorting need this?
Does the response require this?

If the answer is no, reconsider indexing it.


4. Use pagination

Avoid returning huge result sets.

Prefer:

pageSize = 20

or another business-appropriate value instead of thousands of results.


5. Avoid unnecessary full indexing

For a large catalog:

Full Index

can be expensive.

Use the appropriate update strategy for smaller changes where supported.

SAP documents partial updates specifically as a way to avoid rebuilding complete documents for small changes.


31. A Common Production Scenario

Imagine you receive this incident:

"Customer updated the product price, but the storefront still shows the old price."

The database shows:

Product Price = ₹4,999

But storefront shows:

₹5,499

What do you check?

Step 1

Verify the database:

Product price = ₹4,999

Step 2

Check whether the price is Solr-driven for the particular storefront/search response.

Step 3

Check the relevant Solr document.

Step 4

Check the indexing/update process.

Step 5

Check whether the update job executed successfully.

Step 6

Check whether a cache is contributing to the stale result.

Step 7

If necessary, trigger the appropriate index update/full index according to the project's configuration.

The important debugging principle is:

Database
   ↓
Indexing
   ↓
Solr
   ↓
Search Service
   ↓
Cache/API
   ↓
Storefront

Find where the stale value first appears.


32. Another Real-World Scenario

Problem

The product exists in Backoffice.

FlexibleSearch returns it.

But:

/search?query=ABC

returns no result.

Investigation

Check:

Product
   ↓
Catalog Version
   ↓
Indexed Type
   ↓
Indexed Property
   ↓
Solr Index
   ↓
Search Query

Possible root causes:

Product wasn't indexed

or:

Product property isn't indexed

or:

Index is stale

or:

Search configuration doesn't use that property

or:

Search restriction/filter removes it

This type of scenario is excellent for senior SAP Commerce interviews.


33. Full Index vs Partial Update — Interview Answer

Question

What is the difference between full indexing and partial indexing/update in SAP Commerce?

Answer

Full indexing processes the complete set of configured data and creates/updates the Solr index according to the indexing configuration.

Partial updates can update only selected portions of an existing Solr document, avoiding unnecessary processing for unchanged attributes.

Use full indexing for major configuration/data changes, while partial updates can be useful for targeted changes in large catalogs.

SAP specifically documents partial updates as a way to update only a subset of document attributes.


34. Interview Question: Why Is Solr Faster Than Database Search?

Answer

Solr is specifically designed and optimized for search workloads.

It provides capabilities such as:

Inverted indexing
Full-text search
Faceting
Relevance
Fuzzy matching
Sorting
Filtering

A relational database can certainly perform search operations, but Solr is purpose-built for large-scale search and navigation use cases.


35. Interview Question: Product Exists in DB but Not in Solr. Why?

Strong Senior-Level Answer

I would check the complete indexing pipeline:

Product data
→ Indexed Type
→ Indexed Properties
→ Value Providers
→ Indexer
→ Solr document
→ Search query

Then I would check:

Catalog Version
Approval Status
Online/Offline Dates
Indexing CronJob
Indexer logs
Solr configuration
Search configuration
Search restrictions

I would also compare the Commerce database representation with the actual Solr document rather than assuming the database is the source of the search response.


36. Interview Question: What Is a Facet?

Answer

A facet is a search-navigation mechanism that allows users to filter search results based on indexed properties.

For example:

Search: Shoes

Brand:
Nike
Adidas

Color:
Black
White

Price:
₹0-₹2,000
₹2,000-₹5,000

Facets improve product discovery and allow customers to progressively narrow search results.


37. Interview Question: Why Would You Avoid Making Every Property a Facet?

Answer

Because unnecessary facets increase search complexity and can increase index/query overhead.

I would create facets only for business-relevant customer filtering requirements.

For example:

brand → Yes
color → Yes
size → Yes
internalERPCode → No
internalProcessingFlag → No

38. Interview Question: What Happens When You Add a New Indexed Property?

A good answer is:

1. Define the indexed property
2. Configure its type
3. Configure its provider/resolver if needed
4. Update search configuration if needed
5. Build/deploy changes
6. Reindex existing data
7. Validate the Solr document
8. Test search/OCC/storefront

The exact deployment/reindex procedure depends on the Commerce version and project architecture.


39. Interview Question: How Do You Troubleshoot Solr Issues?

My preferred troubleshooting flow is:

                    Issue
                      |
                      v
               Is product in DB?
                 /         \
               No           Yes
               |             |
        Fix source data   Is it indexed?
                            /      \
                          No        Yes
                          |          |
                     Check index   Check query
                     process       config
                                   |
                                   v
                         Check restrictions
                                   |
                                   v
                            Check response
                                   |
                                   v
                               Cache/API

This avoids randomly triggering full indexes without understanding the problem.


40. Important Solr Best Practices

Keep these principles in mind when working on SAP Commerce projects:

Do not index everything.

Index only what is required.

Do not make everything a facet.

Create meaningful customer-facing filters.

Understand the difference between DB and Solr.

They are different representations of the data.

Always check indexing after configuration changes.

A configuration change doesn't automatically guarantee that all existing Solr documents reflect the new structure.

Monitor indexing jobs.

An apparently successful deployment can still have failed indexing.

Be careful with custom value providers.

Poorly designed providers can make indexing expensive.

Avoid sensitive information in Solr.

SAP explicitly warns against indexing confidential data because it can create information disclosure risks.


41. SAP Commerce Solr Architecture — Quick Revision

Remember this flow:

                 SAP Commerce
                      |
                      v
                Product Data
                      |
                      v
                  Indexer
                      |
          +-----------+-----------+
          |                       |
          v                       v
 Indexed Properties          Value Providers
          |                       |
          +-----------+-----------+
                      |
                      v
                 Solr Index
                      |
                      v
                Search Query
                      |
        +-------------+-------------+
        |             |             |
        v             v             v
     Results        Facets        Sorting
        |
        v
      OCC / Storefront

This diagram is worth remembering for SAP Commerce interviews.


42. Key Terms You Should Know

TermMeaning
SolrSearch platform
Indexed TypeType of Commerce data being indexed
Indexed PropertyAttribute indexed in Solr
IndexerProcess that creates/updates index data
FacetCustomer-facing search filter
Value ProviderProvides/calculates indexed values
Full IndexIndexes the complete configured dataset
Partial UpdateUpdates part of an existing Solr document
Free-Text SearchSearch using general text terms
Fuzzy SearchSearch tolerant of spelling differences
Range FacetFacet based on numeric ranges
Search ConfigurationConfiguration controlling search behavior
Search RestrictionRestriction affecting what data a user can access

43. Final Takeaway

Solr is a fundamental part of SAP Commerce search architecture.

The most important relationship to remember is:

Commerce Database
       ↓
   Indexer
       ↓
Indexed Properties
       ↓
    Solr Index
       ↓
 Search Query
       ↓
Results + Facets
       ↓
OCC / Storefront

When debugging search issues, don't stop at FlexibleSearch.

A product can exist correctly in the Commerce database and still be missing or incorrect in Solr.

For senior SAP Commerce developers, understanding indexing, indexed properties, value providers, facets, search configuration, full vs partial updates, search restrictions, and Solr troubleshooting is essential.

Thursday, September 3, 2026

SAP Commerce OCC Error Handling: Exception Handling, Error DTOs, HTTP Status Codes & Global Error Handling

Introduction

A REST API is not complete simply because it returns a successful response.

A production-ready API must also handle failures in a predictable and meaningful way.

Consider a SAP Commerce OCC API:

GET /occ/v2/electronics/customproducts/P999

What should happen when product P999 doesn't exist?

Should the API return:

500 Internal Server Error

Probably not.

A better response would indicate that the requested resource could not be found.

Similarly, if a customer sends invalid data, the API should return a client-side error rather than a generic server exception.

This is why OCC error handling is an important part of SAP Commerce development.

In this article, we'll cover:

  • SAP Commerce OCC exception handling
  • Common exceptions
  • HTTP status codes
  • Error DTOs
  • Validation errors
  • Global error handling
  • Custom exceptions
  • Authentication and authorization errors
  • Postman testing
  • Troubleshooting strategies
  • Interview questions
  • Enterprise best practices

What is OCC Error Handling?

OCC error handling is the mechanism used by SAP Commerce to convert application exceptions into structured HTTP responses.

A simplified flow is:

Client
  ↓
OCC Controller
  ↓
Facade
  ↓
Service
  ↓
DAO
  ↓
Exception
  ↓
OCC Error Handling
  ↓
HTTP Error Response
  ↓
Client

Instead of exposing internal Java stack traces, the API should return a controlled response.

For example:

{
  "errors": [
    {
      "type": "UnknownIdentifierError",
      "message": "Product not found"
    }
  ]
}

The exact response fields depend on the SAP Commerce version and configured OCC error-handling implementation.


Why Error Handling Matters

Good error handling provides:

  • Consistent API responses
  • Easier client-side handling
  • Better debugging
  • Improved security
  • Better user experience
  • Clearer monitoring
  • Easier integration testing

Poor error handling can expose internal implementation details and make production troubleshooting much harder.


Common HTTP Status Codes

A well-designed API uses appropriate HTTP status codes.

StatusMeaningTypical OCC Scenario
200OKSuccessful GET
201CreatedSuccessful resource creation
204No ContentSuccessful operation with no response body
400Bad RequestInvalid request
401UnauthorizedAuthentication missing/invalid
403ForbiddenInsufficient permissions
404Not FoundResource doesn't exist
409ConflictBusiness/data conflict
500Internal Server ErrorUnexpected server failure

200 OK

A successful GET commonly returns:

200 OK

Example:

GET /occ/v2/electronics/products/P100

Response:

{
  "code": "P100",
  "name": "Laptop"
}

201 Created

A successful create operation can return:

201 Created

For example:

POST /occ/v2/electronics/users

after successfully creating a customer.


204 No Content

Some successful operations don't need to return a response body.

For example:

DELETE /resource/123

could return:

204 No Content

depending on the endpoint implementation.


400 Bad Request

A 400 indicates that the client sent an invalid request.

Examples:

Missing required field
Invalid JSON
Invalid parameter
Invalid value
Malformed request

Example:

{
  "email": "invalid-email"
}

if the endpoint requires a valid email address.


401 Unauthorized

A 401 generally indicates an authentication problem.

Typical causes:

  • Missing access token
  • Expired token
  • Invalid token
  • Invalid authentication configuration

Example:

GET /occ/v2/electronics/users/current/orders

without a valid access token.


403 Forbidden

A 403 generally means that authentication succeeded but authorization failed.

For example:

Authenticated customer
      ↓
Attempts admin-only API
      ↓
403 Forbidden

Remember:

401 = Authentication problem
403 = Authorization problem

This is one of the most common OCC interview questions.


404 Not Found

Use 404 when the requested resource doesn't exist.

For example:

GET /occ/v2/electronics/products/UNKNOWN

If no product exists for that code, the API should return an appropriate not-found response.


409 Conflict

409 Conflict can be useful when the request conflicts with the current state of a resource.

Examples include:

  • Duplicate business identifier
  • Invalid state transition
  • Resource already exists
  • Concurrent update conflict

Whether a particular OCC endpoint uses 409 depends on its implementation and error mapping.


500 Internal Server Error

A 500 should generally indicate an unexpected server-side failure.

Examples:

  • Unhandled exception
  • Database failure
  • External service failure
  • Programming error

Do not intentionally return 500 for normal validation or not-found conditions.


Common SAP Commerce Exceptions

During OCC execution, various SAP Commerce exceptions may occur.

Common examples include:

UnknownIdentifierException
ModelNotFoundException
InterceptorException
ValidationException
IllegalArgumentException
CommerceCartModificationException

The exact exceptions depend on the service being called.


UnknownIdentifierException

Suppose an API retrieves a product by code:

ProductModel product =
        productService.getProductForCode(code);

If the product cannot be found, the service layer can throw an appropriate identifier-related exception.

Conceptually:

if (product == null)
{
    throw new UnknownIdentifierException(
        "Product not found: " + code);
}

The OCC layer can then translate this into an appropriate REST error response.


ModelNotFoundException

This exception can occur when a requested model cannot be found in situations where the underlying API expects it to exist.

For example:

Order
Customer
Product
Cart

When exposing these resources through OCC, the exception should be transformed into a client-friendly response rather than leaking internal details.


ValidationException

Validation exceptions can occur when request data or model data fails validation.

For example:

Email missing
Invalid date
Missing mandatory field
Invalid business value

A good API should communicate clearly which input caused the failure.


InterceptorException

SAP Commerce interceptors can reject model operations.

For example:

PrepareInterceptor
ValidateInterceptor
RemoveInterceptor

Suppose an attribute is mandatory:

externalId

and the model is saved without it.

A validation or interceptor-related exception may be raised.

That exception should be handled appropriately at the application boundary.


OCC Error Response

A typical structured error response can look like:

{
  "errors": [
    {
      "type": "UnknownIdentifierError",
      "message": "Product P999 was not found"
    }
  ]
}

Depending on the version and configuration, an OCC error response can contain additional information such as:

type
message
reason
subject
subjectType
language

The exact schema should be verified against the OCC version used by the project.


Why Should We Return Structured Errors?

Imagine your frontend receives:

500 Internal Server Error

with no useful information.

The developer has no idea what happened.

Compare that with:

{
  "errors": [
    {
      "type": "UnknownIdentifierError",
      "message": "Product P999 was not found"
    }
  ]
}

Now the client can handle the error appropriately.


Exception Mapping

The OCC layer maps Java exceptions to HTTP errors.

Conceptually:

UnknownIdentifierException
        ↓
404
        ↓
UnknownIdentifierError

Another example:

AuthenticationException
        ↓
401

and:

AccessDeniedException
        ↓
403

The exact mappings depend on the configured SAP Commerce security and exception-handling infrastructure.


Error Handling in Controller

Avoid putting large amounts of exception-handling logic into every controller.

For example, don't repeat this everywhere:

try
{
    // business logic
}
catch (Exception e)
{
    // manually construct response
}

A centralized exception-handling mechanism is generally easier to maintain.


Global Exception Handling

A global exception handler can provide a central place to handle errors.

In Spring-based applications, concepts such as:

@ControllerAdvice

and:

@ExceptionHandler

are commonly used for centralized MVC exception handling.

A simplified example:

@ControllerAdvice
public class GlobalExceptionHandler
{
    @ExceptionHandler(
        UnknownIdentifierException.class)
    public ResponseEntity<?> handleNotFound(
            UnknownIdentifierException exception)
    {
        // Build appropriate response
        return ResponseEntity.notFound().build();
    }
}

However, in SAP Commerce OCC projects, you should first understand and use the platform's existing OCC exception-handling mechanisms rather than introducing a parallel error framework unnecessarily.


Custom OCC Exceptions

Sometimes a business requirement needs a specific error.

For example:

Cannot cancel an already shipped order

Instead of returning:

500

you can define appropriate business exception handling.

Conceptually:

throw new InvalidOrderStateException(
    "Order cannot be cancelled after shipment");

The OCC layer can then translate the exception into a structured error response.


Example: Cancel Order

Suppose:

Order status = SHIPPED

and the customer tries:

POST /orders/123/cancel

The service checks:

if (OrderStatus.SHIPPED.equals(order.getStatus()))
{
    throw new InvalidOrderStateException(
        "Shipped orders cannot be cancelled");
}

The API should return a meaningful client-facing error rather than a generic 500.


Validation Errors

Suppose we have:

{
  "firstName": "",
  "email": "abc"
}

If the endpoint requires:

firstName → mandatory
email → valid format

the API should identify the invalid fields.

Conceptually:

{
  "errors": [
    {
      "type": "ValidationError",
      "message": "First name is required",
      "subject": "firstName"
    },
    {
      "type": "ValidationError",
      "message": "Invalid email address",
      "subject": "email"
    }
  ]
}

The exact representation depends on the project's OCC validation configuration.


Don't Expose Stack Traces

Never return:

{
  "stackTrace": "java.lang.NullPointerException..."
}

to a customer or external client.

Stack traces can reveal:

  • Internal class names
  • File paths
  • Database details
  • Infrastructure details
  • Security-sensitive information

Log diagnostic information internally and return a controlled API response.


Logging Errors

A useful production log should capture:

Request ID
Endpoint
HTTP method
User/client
Exception type
Error message
Timestamp
Correlation ID

Example:

RequestId=REQ-10001
Endpoint=/occ/v2/electronics/products/P999
Exception=UnknownIdentifierException
Product=P999

Do not log:

Passwords
OAuth tokens
Client secrets
Sensitive customer information

Error Handling with Postman

Postman is useful for validating OCC error behaviour.

Test 1: Invalid Product

Request:

GET /occ/v2/electronics/products/P999

Expected:

404 Not Found

Test 2: No Authentication

Request:

GET /occ/v2/electronics/users/current/orders

without a token.

Expected:

401 Unauthorized

Test 3: Insufficient Permission

Use a valid authenticated user without the required permission.

Expected:

403 Forbidden

Test 4: Invalid Request

Send incomplete request data.

Expected:

400 Bad Request

Error Handling in CI/CD

Automated API tests should validate both:

Success scenarios
Failure scenarios

For example:

Product exists → 200
Product missing → 404
Invalid request → 400
Missing token → 401
Insufficient permission → 403

This prevents accidental changes to your API contract.


Error Handling Test Matrix

ScenarioExpected Status
Valid product200
Product not found404
Invalid request400
Missing token401
Invalid permissions403
Successful create201
Successful delete204
Unexpected server failure500

This table can become a useful regression checklist.


Common Mistakes

Returning 500 for Everything

Bad:

Product not found → 500
Invalid input → 500
Unauthorized → 500

This makes the API difficult to consume.


Catching Exception Too Broadly

Avoid:

catch (Exception e)
{
    throw new RuntimeException();
}

This can hide the actual business error.


Swallowing Exceptions

Avoid:

try
{
    // operation
}
catch (Exception e)
{
    // do nothing
}

Failures must be logged and handled appropriately.


Exposing Internal Messages

Avoid returning:

SQL Exception
Database table doesn't exist
NullPointerException

directly to API consumers.


Best Practices

Use Meaningful HTTP Status Codes

Don't use 500 for client errors.

Keep Error Responses Consistent

Clients should receive a predictable structure.

Centralize Common Error Handling

Use the platform's OCC mechanisms and Spring error-handling facilities appropriately.

Log Internally

Capture detailed diagnostics in server logs.

Protect Sensitive Information

Never expose credentials, tokens or internal infrastructure details.

Test Failure Scenarios

Negative scenarios are just as important as happy-path scenarios.


Enterprise Example

Imagine a checkout API:

POST /occ/v2/electronics/users/current/carts/123/payment

Possible outcomes:

Valid payment
        ↓
200 / 201

Invalid payment data
        ↓
400

Not authenticated
        ↓
401

Not authorized
        ↓
403

Cart doesn't exist
        ↓
404

Payment state conflict
        ↓
409

Payment service failure
        ↓
500

This makes the API predictable for the storefront or mobile application.


Interview Questions

What is OCC error handling?

It is the mechanism that converts backend exceptions into appropriate HTTP responses and structured OCC error information.


What is the difference between 400 and 500?

400 generally indicates that the request from the client is invalid, while 500 indicates an unexpected server-side failure.


What is the difference between 401 and 403?

401 indicates an authentication problem. 403 means the caller is authenticated but does not have sufficient permission.


What should happen when a product doesn't exist?

The API should normally return a not-found response such as:

404 Not Found

with an appropriate structured error.


Should stack traces be returned to API clients?

No. Detailed stack traces should remain on the server side.


Where should business validation occur?

Business validation generally belongs in the appropriate Service Layer/domain logic, while request-shape validation can happen at the API boundary.


Should every controller have its own try-catch?

No. Centralized exception handling is generally easier to maintain. Use SAP Commerce's existing OCC exception-handling facilities where applicable.


Real Interview Scenario

Question

Your custom OCC API returns 500 when a product code doesn't exist. How would you fix it?

Answer

I would first inspect the service and DAO flow.

Controller
   ↓
Facade
   ↓
Service
   ↓
DAO

Then determine how the missing product is represented.

Instead of allowing a generic exception or null-pointer failure to reach the web layer, the service should use an appropriate identifier-related exception.

The OCC error-handling mechanism can then map that exception to a suitable 404 response and structured error payload.

I would also add an automated regression test for the missing-product scenario.


Another Interview Scenario

Question

The API returns 401 even though Postman has a token.

What would you investigate?

Answer

I would check:

Token expiration
Token format
Authorization header
Bearer prefix
OAuth client
Scope/roles
Endpoint security configuration
Environment-specific OAuth configuration
Clock differences

Another Interview Scenario

Question

The API returns 403 after a successful login.

What does that tell you?

Answer

Authentication likely succeeded, but authorization failed.

I would investigate:

Client roles
User roles
Endpoint restrictions
Spring Security configuration
Required OCC role

Complete Error-Handling Architecture

Remember this flow:

                         CLIENT
                            |
                            ↓
                     OCC Controller
                            |
                            ↓
                         Facade
                            |
                            ↓
                         Service
                            |
                            ↓
                          DAO
                            |
                            ↓
                       Exception
                            |
                            ↓
                 OCC Error Handling
                            |
              ┌─────────────┼──────────────┐
              ↓             ↓              ↓
             400           404             500
         Bad Request    Not Found     Server Error
              |
              ↓
        Structured Error
              |
              ↓
            CLIENT

For security-related failures:

Authentication Failure → 401
Authorization Failure  → 403

Conclusion

Good error handling is a critical part of a production-ready SAP Commerce OCC API.

The most important principles are:

Correct Exception
       ↓
Correct HTTP Status
       ↓
Structured Error Response
       ↓
Useful Server Logging
       ↓
Secure Client Response

In this article, we covered:

  • OCC exception handling
  • HTTP status codes
  • 400, 401, 403, 404, 409, and 500
  • Common SAP Commerce exceptions
  • Validation errors
  • Global exception handling
  • Custom business exceptions
  • Postman testing
  • CI/CD validation
  • Security considerations
  • Production troubleshooting
  • Interview scenarios

The goal is not simply to prevent an exception from crashing an API. The goal is to make the API predictable, secure, debuggable, and easy for client applications to consume.

Tuesday, September 1, 2026

SAP Commerce OCC Authentication & OAuth 2.0 Explained: Complete Guide with Postman

Introduction

Security is one of the most important aspects of SAP Commerce OCC Web Services.

In a real-world eCommerce application, APIs cannot simply be exposed to every client.

For example, an API such as:

GET /occ/v2/electronics/users/current/orders

contains customer-specific information and must be protected.

SAP Commerce uses OAuth 2.0 as the standard authorization framework for OCC Web Services. OCC security is implemented using configurable Spring Security mechanisms, with authentication and authorization applied to determine whether a client or user can access a particular resource.

In this article, we will understand:

  • What OAuth 2.0 is
  • Authentication vs authorization
  • OCC security architecture
  • OAuth clients
  • Access tokens
  • JWT tokens
  • Client Credentials flow
  • Authorization Code flow
  • PKCE
  • Anonymous vs authenticated OCC APIs
  • 401 vs 403
  • Postman testing
  • Common OCC security problems
  • SAP Commerce interview questions

1. What is OAuth 2.0?

OAuth 2.0 is an authorization framework that allows applications to access protected resources without requiring the client application to directly handle the user's credentials.

In SAP Commerce, OAuth is used to secure OCC APIs.

A simplified flow looks like:

Client Application
       |
       | Request access token
       ↓
Authorization Server
       |
       | Access Token
       ↓
Client Application
       |
       | Authorization: Bearer <token>
       ↓
OCC API
       |
       ↓
Resource Server
       |
       ↓
Protected Resource

SAP Commerce Cloud documents OAuth as the default authorization framework for commerce-driven OCC Web Services.


2. Authentication vs Authorization

This is one of the most common interview questions.

Authentication

Authentication answers:

Who are you?

For example:

Username
Password
OAuth token

The system verifies the identity.


Authorization

Authorization answers:

What are you allowed to do?

For example:

Customer
    ↓
Can view own orders

Client
    ↓
Can access allowed APIs

Admin
    ↓
Can perform administrative operations

A simple way to remember:

Authentication = Who are you?

Authorization = What can you do?

SAP Commerce OCC security separates these concepts and uses roles and other constraints to determine access.


3. OCC Security Architecture

A simplified architecture is:

                 CLIENT
                    |
                    |
             OAuth Access Token
                    |
                    ↓
          ┌──────────────────┐
          │  OCC Web Layer   │
          └────────┬─────────┘
                   |
                   ↓
          ┌──────────────────┐
          │ Spring Security  │
          └────────┬─────────┘
                   |
             Authentication
                   |
                   ↓
             Authorization
                   |
                   ↓
          ┌──────────────────┐
          │ OCC Controller   │
          └────────┬─────────┘
                   |
                   ↓
                Facade
                   |
                   ↓
                Service
                   |
                   ↓
                 DAO

The important point is:

Security is checked before the request reaches your business logic.


4. What is an OAuth Client?

An OAuth client represents an application requesting access to protected resources.

For example:

Mobile Application
Web Application
Integration System
Third-Party Application
Backend Service

The client is normally identified using:

client_id
client_secret

For example:

client_id = mobile_app
client_secret = ********

The secret should never be exposed in client-side code.


5. What is an Access Token?

An access token represents authorization granted to a client.

After successfully authenticating with the authorization server, the client receives a token.

The client then sends:

Authorization: Bearer <access-token>

with subsequent API requests.

Conceptually:

Client
  |
  | client credentials
  ↓
Authorization Server
  |
  | access token
  ↓
Client
  |
  | Bearer token
  ↓
OCC API

6. JWT Access Tokens

For current SAP Commerce Cloud OAuth support using JDK 21, SAP documents JWT access tokens.

JWT stands for:

JSON Web Token

A JWT is a self-contained token containing claims about the authorization.

A simplified JWT looks like:

xxxxx.yyyyy.zzzzz

It consists of:

Header
.
Payload
.
Signature

For example:

{
  "sub": "customer@example.com",
  "roles": [
    "CUSTOMERGROUP"
  ],
  "exp": 1780000000
}

The actual claims depend on the SAP Commerce configuration.

SAP documents that current JDK 21 OAuth support uses JWTs for access-token management and that the resource server validates the JWT signature using public keys available through a JWKS endpoint.


7. JWT Authentication Flow

The current flow can be visualized as:

                 Client
                   |
                   | 1. Request Token
                   ↓
          Authorization Server
                   |
                   | 2. Signed JWT
                   ↓
                 Client
                   |
                   | 3. API Request
                   | Authorization: Bearer JWT
                   ↓
           OCC Resource Server
                   |
                   | 4. Verify JWT
                   ↓
              OCC Endpoint

The resource server can validate the JWT signature using the authorization server's public keys.

This means the resource server does not have to perform a database lookup for every JWT validation.


8. OAuth Grant Types

OAuth supports different authorization flows.

For SAP Commerce, the flow you should understand depends on your Commerce version and security configuration.

For modern JDK 21-based SAP Commerce Cloud OAuth, the important flows are:

Client Credentials
Authorization Code

The rebuilt OAuth implementation removed the older:

Resource Owner Password
Implicit

flows because they are deprecated/discouraged by current OAuth security practices.

This version distinction is important when working with older SAP Commerce projects.


9. Client Credentials Flow

The Client Credentials flow is useful when:

An application needs to access resources on its own behalf.

There is no end-user involved.

Example:

Integration System
       |
       ↓
SAP Commerce OCC

Possible use cases:

  • Backend integration
  • ERP integration
  • Middleware
  • Scheduled integration
  • Server-to-server communication

10. Client Credentials Flow Diagram

Integration Application
          |
          | client_id
          | client_secret
          ↓
Authorization Server
          |
          | access_token
          ↓
Integration Application
          |
          | Bearer token
          ↓
OCC API

11. Client Credentials Request

A typical token request looks conceptually like:

POST /authorizationserver/oauth/token
Content-Type: application/x-www-form-urlencoded

Request:

grant_type=client_credentials
client_id=my-client
client_secret=my-secret

The exact endpoint and configuration can vary by SAP Commerce version and deployment.

SAP's OAuth documentation provides the Client Credentials flow as the mechanism for giving a client access to resources it owns.


12. Example Token Response

A token response may look like:

{
    "access_token": "eyJhbGciOi...",
    "token_type": "Bearer",
    "expires_in": 3600
}

The client then uses:

Authorization: Bearer eyJhbGciOi...

for protected API calls.


13. Authorization Code Flow

The Authorization Code flow is designed for applications where a user is involved.

For example:

Customer
   ↓
Web Application
   ↓
SAP Commerce

The application redirects the user to the authorization server.

The user authenticates and grants access.

The authorization server returns an authorization code.

The application exchanges that code for tokens.


14. Authorization Code Flow

The simplified flow is:

User
 |
 ↓
Client Application
 |
 | Authorization Request
 ↓
Authorization Server
 |
 | Login / Consent
 ↓
User
 |
 | Authentication
 ↓
Authorization Server
 |
 | Authorization Code
 ↓
Client Application
 |
 | Exchange Code
 ↓
Authorization Server
 |
 | Access Token
 ↓
Client Application
 |
 | Bearer Token
 ↓
OCC API

SAP documents the Authorization Code flow as a secure method where the user is redirected to the authorization server and the resulting authorization code is exchanged for an access token.


15. PKCE

PKCE stands for:

Proof Key for Code Exchange

It improves the security of the Authorization Code flow, particularly for public clients such as native applications and single-page applications.

The flow uses:

code_verifier
      ↓
code_challenge

The client creates a random:

code_verifier

and derives:

code_challenge

from it.

The authorization request includes:

code_challenge
code_challenge_method=S256

The token request later includes:

code_verifier

SAP's current Authorization Code documentation states that PKCE supports the S256 code challenge method.


16. Why PKCE is Important

Imagine a malicious application intercepts an authorization code.

Without PKCE, it may attempt to exchange that code.

With PKCE:

Authorization Code
        +
Code Verifier
        ↓
Token

The attacker doesn't possess the original verifier.

Therefore, the stolen authorization code is much less useful.


17. Anonymous OCC Requests

Not every OCC API requires a customer login.

Some APIs can be accessed anonymously depending on the endpoint and configuration.

For example, public catalog information may be available without a customer token.

Conceptually:

Anonymous User
      |
      ↓
Public OCC API
      |
      ↓
Product/Catalog Data

However:

Anonymous does not automatically mean completely unsecured.

Security configuration still applies.

SAP documents different OCC roles including ANONYMOUS, client roles, customer roles and guest roles.


18. Customer Authentication

A registered customer can authenticate and receive an access token.

Then:

GET /occ/v2/electronics/users/current/orders

can use:

Authorization: Bearer <customer-token>

The special:

current

identifier represents the user associated with the OAuth token in OCC APIs.

SAP's OCC documentation explicitly describes current as representing the user associated with the OAuth token.


19. Client vs Customer

This is important.

Client

Represents an application.

Example:

Mobile Application
Integration System
Backend Service

Customer

Represents an actual shopper.

Example:

john@example.com

So:

Client
   ↓
Application identity

Customer
   ↓
User identity

20. OCC Roles

SAP Commerce OCC security uses roles to determine access.

Common conceptual roles include:

ANONYMOUS
CLIENT
TRUSTED_CLIENT
CUSTOMERGROUP
CUSTOMERMANAGERGROUP
GUEST

The exact roles and configuration depend on the Commerce version and project.

SAP documents that OAuth-authenticated clients can be assigned client roles and customer authentication can result in customer roles.


21. 401 Unauthorized

One of the most common errors when testing OCC APIs is:

401 Unauthorized

This generally indicates an authentication problem.

Possible reasons:

Missing token
Invalid token
Expired token
Invalid client credentials
Invalid authentication configuration

Example:

GET /occ/v2/electronics/users/current/orders

without a token may result in:

401 Unauthorized

22. 403 Forbidden

Now consider:

403 Forbidden

This is different.

The user/client may have been authenticated successfully, but does not have permission to perform the requested operation.

Think:

401 → Who are you?

403 → I know who you are, but you're not allowed.

This distinction is extremely important during troubleshooting.


23. 401 vs 403

HTTP StatusMeaning
400Invalid request
401Authentication failed/missing
403Authenticated but not authorized
404Resource not found
500Server-side error

A simple interview answer:

401 is primarily an authentication problem, while 403 indicates that the request has been authenticated but access is denied.


24. Testing OCC Authentication Using Postman

Postman is extremely useful for testing SAP Commerce OCC APIs.

Create a collection:

SAP Commerce OCC
│
├── Authentication
│
├── Products
│
├── Cart
│
├── Orders
│
└── Customers

25. Step 1 — Generate Token

Create:

POST

to your configured authorization server token endpoint.

For example:

https://localhost:9002/authorizationserver/oauth/token

The exact endpoint depends on your Commerce version and configuration.

Use:

Content-Type:
application/x-www-form-urlencoded

26. Step 2 — Send Credentials

For Client Credentials:

grant_type=client_credentials
client_id=<client-id>
client_secret=<client-secret>

Your configured client must have appropriate roles/access.


27. Step 3 — Copy the Token

The authorization server returns an access token.

For example:

{
    "access_token": "eyJhbGciOi...",
    "token_type": "Bearer",
    "expires_in": 3600
}

Copy:

access_token

28. Step 4 — Call OCC API

Now call:

GET /occ/v2/electronics/products/P100

Headers:

Authorization: Bearer <access-token>

Example:

Authorization:
Bearer eyJhbGciOi...

29. Postman Authorization Tab

Instead of manually creating the header, you can use:

Authorization
     ↓
Type: Bearer Token
     ↓
Token: <access-token>

Postman automatically generates:

Authorization: Bearer <token>

30. Testing an Anonymous API

For a public API, you may be able to call:

GET /occ/v2/electronics/products/P100

without:

Authorization

However, this depends on your endpoint's security configuration.

Don't assume every GET endpoint is public.


31. Securing a Custom OCC API

Suppose yesterday we created:

GET /occ/v2/electronics/customproducts/P100

Now we want only authenticated customers to access it.

The flow becomes:

Client
   |
   | OAuth token
   ↓
Spring Security
   |
   | Authentication
   ↓
Authorization
   |
   | Allowed
   ↓
CustomProductController

Security should be configured at the appropriate OCC/Spring Security layer rather than manually checking tokens inside the controller.


32. Don't Validate Tokens Manually

Avoid code like:

if (token.equals("some-token"))
{
    // allow access
}

This is completely wrong for a production application.

Authentication should be handled by the configured security framework.

Your controller should focus on business functionality.


33. Security Configuration

SAP Commerce OCC security is highly configurable through Spring Security.

Depending on the Commerce version, relevant security configuration is located in the webservices/OCC security configuration.

SAP documents security configuration for OCC through Spring Security and separate security configuration for OCC web-service versions.

The important conceptual architecture is:

HTTP Request
      ↓
Security Filter
      ↓
Authentication
      ↓
Authorization
      ↓
Controller

34. Current vs Older SAP Commerce OAuth

This is particularly important if you work on multiple SAP Commerce projects.

Older Commerce versions may use the older OAuth implementation and may document flows such as:

Password
Client Credentials
Authorization Code
Implicit

However, SAP's rebuilt OAuth capability uses current Spring Security support.

For the JDK 21 implementation, SAP documents:

Authorization Code
Client Credentials

and JWT-based access tokens.

The older Password and Implicit flows were removed from the rebuilt implementation.

Therefore, always check the exact SAP Commerce release before copying OAuth configuration from another project.


35. Why This Matters in Real Projects

Suppose you join a project using:

SAP Commerce 2211

and another developer gives you OAuth configuration from an older project.

You may see:

Password Grant

and:

Implicit Grant

You should not blindly copy it.

First check:

SAP Commerce version
JDK version
OAuth implementation
Spring Security version
Cloud vs on-premise

Security configuration is one area where version differences matter significantly.


36. Common OAuth Problems

Problem 1 — Invalid Client

You receive something similar to:

invalid_client

Check:

client_id
client_secret
client configuration
client authentication method

Problem 2 — Invalid Grant

Check:

grant_type

and verify that the configured OAuth client supports the requested flow.


Problem 3 — 401 from OCC

Check:

Authorization header
Token expiration
Token signature
Client configuration
OAuth configuration

Problem 4 — 403 from OCC

Check:

User roles
Client roles
Endpoint security
Authorization configuration

37. Security Best Practices

Never expose client secrets

Don't put:

client_secret

inside:

JavaScript
Mobile application
Git repository
Public configuration

Always use HTTPS

Tokens and credentials should never be sent over plain HTTP in production.


Use short-lived access tokens

Shorter token lifetimes reduce the impact of token leakage.


Use refresh tokens where appropriate

Authorization Code scenarios can use refresh tokens to obtain new access tokens without requiring the user to authenticate again.


Use PKCE

For public clients, PKCE provides additional protection for the Authorization Code flow.


Don't log access tokens

Avoid:

LOG.info("Token = " + token);

Tokens are sensitive credentials.


38. OAuth Flow Comparison

FlowTypical Use
Client CredentialsServer-to-server
Authorization CodeUser-facing applications
Authorization Code + PKCEPublic/mobile/browser clients
PasswordLegacy/older implementations
ImplicitLegacy/deprecated

For modern SAP Commerce Cloud, focus your learning on:

Client Credentials
Authorization Code
PKCE
JWT

39. Real-World Example

Imagine an SAP Commerce architecture:

                 React Storefront
                       |
                       ↓
               Authorization Server
                       |
                       ↓
                  Access Token
                       |
                       ↓
                OCC Web Services
                       |
          ┌────────────┴────────────┐
          ↓                         ↓
       Product                    Cart
          ↓                         ↓
       Facade                    Facade
          ↓                         ↓
       Service                   Service

The React application doesn't directly access:

ProductModel
CartModel
OrderModel

It communicates with OCC using REST APIs and OAuth-based security.


40. Interview Question: What is OAuth2 in SAP Commerce?

A good answer:

OAuth 2.0 is the authorization framework used to secure SAP Commerce OCC Web Services. A client obtains an access token from the authorization server and sends that token in the Authorization Bearer header when calling protected OCC resources. Spring Security validates the request and authorization is based on the authenticated principal and configured roles.


41. Interview Question: Authentication vs Authorization?

Answer:

Authentication verifies the identity of the client or user. Authorization determines whether that authenticated principal has permission to access a particular resource or perform an operation.


42. Interview Question: What is a JWT?

Answer:

JWT stands for JSON Web Token. It is a signed, self-contained token containing claims. In current SAP Commerce Cloud JDK 21 OAuth support, JWTs are used as access tokens. The OCC resource server validates the token signature using public keys exposed through the JWKS mechanism.


43. Interview Question: What is Client Credentials Flow?

Answer:

Client Credentials is used for machine-to-machine communication where there is no end-user involved. The client authenticates using its configured credentials and receives an access token that it can use to access authorized resources.


44. Interview Question: What is Authorization Code Flow?

Answer:

Authorization Code is used when a user is involved. The client redirects the user to the authorization server, the user authenticates and grants access, and the client receives an authorization code which is exchanged for an access token.


45. Interview Question: What is PKCE?

Answer:

PKCE stands for Proof Key for Code Exchange. It adds a code verifier/challenge mechanism to the Authorization Code flow and helps protect public clients from authorization-code interception attacks.


46. Interview Question: 401 vs 403?

Answer:

401 → Authentication problem

403 → Authorization problem

For example:

401
No/invalid/expired token

403
Valid identity but insufficient permissions

47. Interview Question: Can OCC APIs be anonymous?

Answer:

Yes. Some OCC endpoints can be accessed anonymously depending on their security configuration. However, protected APIs require appropriate authentication and authorization. Anonymous access does not mean that all security checks are bypassed.

SAP explicitly documents public OCC endpoints and notes that some operations may still require an appropriate client token even when the endpoint does not require a customer login.


48. Interview Scenario

Question

Your OCC API works in Postman without authentication, but fails with:

401 Unauthorized

when called from the storefront.

What would you check?

Answer

I would investigate:

1. Is the storefront sending the Authorization header?

2. Is the access token expired?

3. Is the token issued for the correct client?

4. Is the endpoint protected?

5. Are the storefront and OCC using the same OAuth configuration?

6. Is Spring Security configured correctly?

7. Are there environment-specific properties?

8. Is HTTPS/proxy configuration affecting the request?

49. Another Interview Scenario

Question

The token is valid, but your API returns:

403 Forbidden

What do you check?

Answer

I would check:

User/client roles
       ↓
Endpoint authorization
       ↓
Spring Security configuration
       ↓
Required OCC role
       ↓
Base site/security configuration

The key point is that authentication succeeded but authorization failed.


50. Complete OCC Security Flow

Remember this diagram:

                    CLIENT
                       |
                       |
               Request Token
                       |
                       ↓
              AUTHORIZATION
                 SERVER
                       |
                       |
                  JWT TOKEN
                       |
                       ↓
                    CLIENT
                       |
                       |
          Authorization: Bearer JWT
                       |
                       ↓
                OCC WEB LAYER
                       |
                       ↓
              SPRING SECURITY
                       |
             ┌─────────┴─────────┐
             ↓                   ↓
        Authentication      Authorization
             |                   |
             └─────────┬─────────┘
                       ↓
                OCC CONTROLLER
                       |
                       ↓
                    FACADE
                       |
                       ↓
                   SERVICE
                       |
                       ↓
                     DAO
                       |
                       ↓
                  DATABASE

Conclusion

OAuth 2.0 is a fundamental part of SAP Commerce OCC security.

The most important concepts to remember are:

OAuth 2.0
    ↓
Authorization Server
    ↓
Access Token
    ↓
Bearer Token
    ↓
Spring Security
    ↓
Authentication
    ↓
Authorization
    ↓
OCC API

For modern SAP Commerce Cloud, especially JDK 21 environments, pay particular attention to:

JWT
Client Credentials
Authorization Code
PKCE
Spring Security
Resource Server
Authorization Server

Also remember that OAuth configuration differs between older and newer Commerce releases. Don't copy OAuth configuration from an old SAP Commerce project without checking the target Commerce/JDK version first.