Adding XSUAA Security to a CAP Service on the BTP Trial

[[{“value”:”

A CAP service on Cloud Foundry with "auth": "none", locked down with XSUAA, an approuter, and two role collections.

Setup

Logistics service from the C_CPE exam: Shipments and Packages, HANA Cloud HDI container, deployed to the trial dev space (us10). CAP 9.6. Anyone could call it.

Goal: two roles. Viewer reads, Admin does everything.

Logging on to the right landscape

First cf login landed on eu10 and showed no orgs. The trial is on us10.

cf login -a https://api.cf.us10-001.hana.ondemand.com --sso
cf target -o 0313f983trial -s dev

Adding XSUAA

cds add xsuaa

Three changes: an empty xs-security.json, an xsuaa resource in mta.yaml, and a production profile in package.json:

"[production]": { "auth": "xsuaa" }

Local cds watch still runs without a login. On CF, NODE_ENV=production switches on token checks.

Roles in the CDS

srv/logistics-service.cds:

service LogisticsService @(path: '/logistics') {

    // Viewer can read, Admin can do anything
    @restrict: [
        { grant: 'READ', to: 'Viewer' },
        { grant: '*',    to: 'Admin'  }
    ]
    entity Shipments as projection on my.Shipments;

    // read-only entity, either role can see it
    @readonly
    @requires: ['Viewer', 'Admin']
    entity Packages as projection on my.Packages;
}

Then generate the role templates from the model:

cds compile srv --to xsuaa > xs-security.json

Two scopes ($XSAPPNAME.Viewer, $XSAPPNAME.Admin), two role templates. $XSAPPNAME is replaced at deploy time.

Approuter

cds add approuter

Creates app/router/. Without it a browser just gets 401 – the service only accepts requests that already carry a token. The approuter does the login and passes the token on (forwardAuthToken: true).

Deploying with cf push

Without mta.yaml, the app name and redirect URIs have to go in xs-security.json itself. Added at the top:

"xsappname": "c-cpe-dev",
"tenant-mode": "dedicated",
"oauth2-configuration": {
  "redirect-uris": ["https://*.cfapps.us10-001.hana.ondemand.com/**"]
},

XSUAA instance:

cf create-service xsuaa application c-cpe-auth -c xs-security.json

Service – build, bind, push over the existing app (keeps its route and HDI binding):

npx cds build --production
cf bind-service dev-c_cpe_submission-srv c-cpe-auth
cf push dev-c_cpe_submission-srv -p gen/srv -b nodejs_buildpack -m 256M

Straight call with no token:

curl -s -o /dev/null -w "%{http_code}n" https://0313f983trial-cpe-submission.cfapps.us10-001.hana.ondemand.com/logistics/Shipments
401

Approuter. app/router/default-env.json points at localhost:4004 for local runs, so it’s kept out of the upload:

cd app/router
printf 'default-env.jsonnnode_modulesn' > .cfignore
cf push cpe-router -b nodejs_buildpack -m 256M --random-route --no-start
cf bind-service cpe-router c-cpe-auth
# destination the approuter forwards to - the CAP service route
cf set-env cpe-router destinations '[{"name":"srv-api","url":"https://0313f983trial-cpe-submission.cfapps.us10-001.hana.ondemand.com","forwardAuthToken":true}]'
cf start cpe-router

Roles and role collections in the cockpit

Subaccount > Security > Roles, search c-cpe. Admin and Viewer under application c-cpe-dev, description “generated” from CAP.

Security > Role Collections > Create. Two collections: CPE Viewer, CPE Admin.

Open the collection, Edit. In Roles, value help, filter Application Identifier to c-cpe-dev!t707024 (BTP adds the !t suffix). Tick the role, Add.

In Users, enter the email in ID and E-Mail, Default identity provider, Save.

CPE Viewer got the Viewer role and one user, CPE Admin the Admin role and another.

First login: 500

{"error":{"message":"Internal Server Error","code":"500"}}

cf logs dev-c_cpe_submission-srv --recent:

500 - TimeoutError: ResourceRequest timed out

The request had come through with a token and passed the role check – it failed on the DB connection. Trial HANA stops every night. Started it in HANA Cloud Central, waited for Running (several minutes; still timing out until then), then:

cf restart dev-c_cpe_submission-srv

Working

Logged in through the approuter as the CPE Admin user:

Same figures as the exam: AA-123 15.5 / 232.5, BB-456 100 / 500.

“}]] 

  Read More Technology Blog Posts by Members articles 

#abap