You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: tutorials/hana-cloud-cap-add-authentication/hana-cloud-cap-add-authentication.md
+74-73Lines changed: 74 additions & 73 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,34 +38,72 @@ The UAA will provide user identity, as well as assigned roles and user attribute
38
38
39
39
40
40
41
-
1.**We won't add application scopes in this tutorial**, but those can be added using the CDS syntax in your services. If you do add scopes to the services you can generate a sample xs-security.json using the following command and merge that into the basics xs-security.json file generated by the Application Router wizard.
41
+
1. To really test the impact of roles in our application, lets add some security to our services. Open the `interaction_srv.cds` from the `srv` folder. Adjust the code as follows to make `Interactions_Header` service only available to authenticated users and `Interactions_Items` only available to users with the `Admin` role and restrict the results during read operations to only those records where the language column has the value of German (DE).
42
+
43
+
```cap cds
44
+
using app.interactions from '../db/interactions';
45
+
service CatalogService {
46
+
47
+
@requires: 'authenticated-user'
48
+
entity Interactions_Header
49
+
as projection on interactions.Interactions_Header;
1. When you do add scopes to the services as we did in the previous step you can generate a sample `xs-security.json` using the following command and merge that into the basics `xs-security.json` file generated by the Application Router wizard.
42
60
43
61
```shell
44
-
cds compile srv/ --to xsuaa
62
+
cds compile srv/ --to xsuaa > xs-security.json
45
63
```
46
64
47
-
1. Since we want to test the security setup from the Business Application Studio, we are going to have add some additional configuration to the xs-security.json. You need to add another property to the xs-security.json to configure which redirect URIs are allowed. Also while editing, add an `xsappname` with the value `myhanaapp` and a `tenant-mode` of `dedicated` as well
1. Since we want to test the security setup from the Business Application Studio, we are going to have add some additional configuration to the `xs-security.json`. You need to add another property to the `xs-security.json` to configure which redirect URIs are allowed by the `OAuth` configuration. Also while editing, add an `xsappname` with the value `myhanaapp` and a `tenant-mode` of `dedicated` as well. We can also add `credential-types` as a security best practice. You can read more about the [Credential Types in this blog post](https://blogs.sap.com/2022/07/05/why-developers-should-care-about-credential-types-for-xsuaa/) by [`Dinu PAVITHRAN`](https://people.sap.com/dinu.pavithran)
48
68
49
69
```json
50
70
{
51
-
"xsappname": "myhanaapp",
52
-
"tenant-mode": "dedicated",
53
-
"scopes": [],
54
-
"attributes": [],
55
-
"role-templates": [],
56
-
"oauth2-configuration": {
57
-
"redirect-uris": [
58
-
"https://*.applicationstudio.cloud.sap/**"
59
-
]
71
+
"xsappname": "myhanaapp",
72
+
"tenant-mode": "dedicated",
73
+
"scopes": [
74
+
{
75
+
"name": "$XSAPPNAME.Admin",
76
+
"description": "Admin"
77
+
}
78
+
],
79
+
"attributes": [],
80
+
"role-templates": [
81
+
{
82
+
"name": "Admin",
83
+
"description": "generated",
84
+
"scope-references": [
85
+
"$XSAPPNAME.Admin"
86
+
],
87
+
"attribute-references": []
60
88
}
89
+
],
90
+
"oauth2-configuration": {
91
+
"credential-types": [
92
+
"binding-secret",
93
+
"x509"
94
+
],
95
+
"redirect-uris": [
96
+
"https://*.applicationstudio.cloud.sap/**"
97
+
]
98
+
}
61
99
}
62
100
```
63
101
64
102
65
103
66
104
This wild card will allow testing from the Application Studio by telling the XSUAA it should allow authentication requests from this URL. See section [Application Security Descriptor Configuration Syntax](https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/517895a9612241259d6941dbf9ad81cb.html) for more details on configuration options.
67
105
68
-
1. Open a terminal and create the XSUAA services instance with the xs-security.json configuration using the following command:
106
+
1. Open a terminal and create the XSUAA services instance with the `xs-security.json` configuration using the following command:
@@ -75,57 +113,16 @@ The UAA will provide user identity, as well as assigned roles and user attribute
75
113
76
114
### Configure the application
77
115
78
-
1. In the previous tutorial, the application router wizard created a `default-env.json` file in the root of the project, to configure the connection to the service instance when running locally fortesting. We will now extend that same file to do the same for the XSUAA instance we just createdin the previous step.
79
-
80
-
1. Open the default-env.json and add an `xsuaa` section with a placeholder for the credentials which we will fill soon:
1. From the terminal, we need to create a service key. This will give us access to the credentials for your XSUAA instance.
97
117
98
118
```shell
99
-
cf create-service-key MyHANAApp-auth default
100
-
cf service-key MyHANAApp-auth default
119
+
cf create-service-key MyHANAApp-auth default
101
120
```
102
121
103
-
104
-
105
-
1. Copy the output of the service-key command and paste it into the credentials section of the default-env.json file.
106
-
107
-
108
-
109
-
It should look something like this:
110
-
111
-
112
-
113
122
1. Change back to the root of your project in the terminal and issue the command `cds bind -2 MyHANAApp-auth:default`. This is the same command that we used to bind our running CAP application to HANA DB earlier. Now we are adding a binding to the security XSUAA service as well.
114
123
115
124
116
125
117
-
1. Open the `srv/interaction_srv.cds` file. You need to add `@requires: 'authenticated-user'` to the service definition. Authentication and scopes can also be applied at the individual entity level.
118
-
119
-
120
-
121
-
1. Finally we are going to need some additional Node.js modules forCAP to process the authentication. We can both add them to the package.json dependencies and install them allin one step from the terminal.
1. Before we can test our application, we need to create a role that includes the XSUAA instance details and grant to that our user. We will do this from the SAP Business Technology Platform cockpit. In the cockpit, you set up the roles and role collections and assign the role collections to your users. This brings the necessary authorization information into the JWT token when the user logs on to your application through XSUAA and Application Router.
@@ -150,30 +147,34 @@ The UAA will provide user identity, as well as assigned roles and user attribute
150
147
151
148
1. The `approuter` component implements the necessary handshake with XSUAA to let the user log in interactively. The resulting JWT token is sent to the application where it's used to enforce authorization.
152
149
153
-
1. Next open the xs-app.json file in the /app folder. Here want to make several adjustments. Change the `authenicationMethod` to `route`. This will turn on authentication. You can deactivate it later by switching back to `none`. Also add/update the routes. We are adding authentication to CAP service route. We are also adding the Application Router User API route (which is nice for testing the UAA connection). Finally add the route to the local directory to serve the UI5/Fiori web content.
150
+
1. Next open the xs-app.json file in the /app folder. Here want to make several adjustments. Change the `authenicationMethod` to `route`. This will turn on authentication. You can deactivate it later by switching back to `none`. Also add/update the routes. We are adding authentication to CAP service route. We are also adding the Application Router User API route (`sap-approuter-userapi`), which is nice for testing the UAA connection. We will also add the custom `logoutEndpoint` of `/app-logout`. You can add this path to your URL if you want to force logout your user; which can be helpful to pickup any changes to your role configuration during development. Finally add the route to the local directory to serve the UI5/Fiori web content.
@@ -187,19 +188,19 @@ The UAA will provide user identity, as well as assigned roles and user attribute
187
188
188
189
This means your security setup is working. Accessing the CAP service directly will always produce an error now as there is no authentication token present. We need to run via the Application Router to generate and forward the authentication token.
189
190
190
-
1. Without stopping the CAP service, open a second terminal. In this terminal change to the `/app` folder and then run `npm start` to start the Application Router.
191
+
1. Without stopping the CAP service, open a second terminal. In this terminal run `cds bind --exec -- npm start --prefix app` to start the Application Router but using the `cds bind` command to inject all the `UAA` configuration into the Application Router automatically and securely as well.
191
192
192
193
193
194
194
195
1. Open the application router in a new tab. Click on the `Interactions_Header`. Now instead of the Unauthorized error you received when testing CAP service directly, you should see the data returned normally.
195
196
196
197
197
198
198
-
1. Finally change the ULR path to `/interaction_items/webapp/index.html`. You are now testing the Fiori free style application from the previous tutorial with data from the CAP service but all with authentication.
199
+
1. Finally change the ULR path to `/interaction_items/webapp/index.html`. You are now testing the Fiori free style application from the previous tutorial with data from the CAP service but all with authentication. You should also only be seeing a single record thanks to the data restriction we placed on the service as well.
199
200
200
201
201
202
202
-
1. Add /user-api/attributes to the end of the URL and you should see your Email and other User details. This is testing that the application router is actually getting the security token from the UAA instance.
203
+
1. Add `/user-api/attributes` to the end of the URL and you should see your Email and other User details. This is testing that the application router is actually getting the security token from the UAA instance.
Copy file name to clipboardExpand all lines: tutorials/hana-cloud-cap-create-database-cds/hana-cloud-cap-create-database-cds.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -46,7 +46,7 @@ The SAP Cloud Application Programming model utilizes core data services to defin
46
46
47
47
1. Use the following content in this new file:
48
48
49
-
```CDS
49
+
```CAP CDS
50
50
namespace app.interactions;
51
51
52
52
using { Country } from '@sap/cds/common';
@@ -89,7 +89,7 @@ The SAP Cloud Application Programming model utilizes core data services to defin
89
89
90
90
1. Use the following content in this new file:
91
91
92
-
```CDS
92
+
```CAP CDS
93
93
94
94
using app.interactions from '../db/interactions';
95
95
service CatalogService {
@@ -213,7 +213,7 @@ You can now check the generated tables and views in the Database Explorer.
213
213
1. Note the name of the table matches the generated `hdbtable` artifacts. You will also see the physical schema managed by the HDI container.
214
214
215
215
> Unless a name is specified during deployment, HDI containers are automatically created with names relative to the project and user generating them. This allows developers to work on different versions of the same HDI container at the same time.
0 commit comments