Hi, I am Denys van Kempen from the SAP Partner Innovation Lab and the SAP HANA Academy.
In this video tutorial series, we are going to cover the security aspects of the HANA
Academy app generator, authentication and authorization.
This video was recorded in May 2021; for the latest video tutorials on the topic, please
check the playlist.
Hi, welcome back In the first video of this tutorial we did
a quick walkthrough of the app, in this video, we are going to generate version
2, this time adding authentication.
Open Template Wizard SAP HANA Academy CAP
Same settings as before, except this time
keep authentication on (yes) but switch authorization off (no)
the rest can stay as-is of course,
let’s change the name appsec
same modules package.json of the app router is still the
same but the configuration file, xs-app.json, has
changed a bit authentication method = route
with a reference to the authentication type XS, extended services is an extension created
by SAP for the Cloud Foundry UAA service, user accounts
and authentication, the mechanism used for authentication and
authorization using scopes and JSON web tokens, JWT (jot)
the CDS definition of the database module is still the same, no changes
the CDS definiton of the service now includes the annotation @Requires authenticated-user
we also have added to types userRoles and user and a function userInfo
which we reference in the catalog-service.js file.
Again, we won’t cover all the ins and outs here of the Cloud Application Programming
model (CAP) and Core Data Services (CDS),
which is what we are looking at, for those less familiar,
we are just showing how security is implemented.
Most of the changes are found in the package.json of the business app
we are adding two packages XS env (environment) and XS sec (security).
You can look them up in the Node package manager The XS Advanced Container security API for
Node.js originally created for the SAP HANA platform,
the XS Advanced environment, which provides a customized Cloud Foundry
runtime for the in-memory platform on-premises.
typically used together with the XS env package to read application configurations for bound
services and certificates, in the Cloud Foundry environment, XS Advanced,
and Kubernetes.
Back to package.json.
CDS requires UAA For production, deployments to the platform
that is, the strategy is JWT (jot), JSON web tokens.
For development, local deployment to your computer, some mock data is used.
Works the same for the db module where we use hana for production and sqllite for our
development environment.
Final piece of evidence, the xs-security.json file.
This file is new, and this is where we configure the Cloud Foundry UAA service,
with a default scope and role template.
We covered the topic is more detail in another tutorial series
but as a quick reference, in our code we define scope and role templates
(and optionally some attributes), design-time, the UAA service will generate the corresponding
roles and role collections, runtime, which we then need to grant to the groups
(ideally) or users, defined in the user store, the identity provider.
Okay, let’s deploy our app.
With the cf mtas command we can list any previously deployed multi-target app.
I will first remove this deployment so we won’t run out of quotas on our trial environment.
Then build the app, all three modules takes a minute,
and deploy another minute or so
and we are done.
Back to the cockpit again Here we have our modules,
front-end, the app router,
and back-end, the service module
we can still access the back-end autogenerated page,
but no longer access the data 401 unauthorized
We need to go through the front door.
This browser is managed by SAP, so I will switch to Firefox and use private window.
Paste in the URL and now we are prompted to log on.
We need to authenticate before we can access the business app
Here we have our data and here we have user info
authenticated = true excellent.
In the next video, we will add some authorization See the description below of this video on
our YouTube channel for more information.
Don’t forget to subscribe.
Denys van Kempen, SAP HANA Academy / Partner Innovation Lab
Thanks for watching