Hi, Denys van Kempen here from SAP Digital Partner Engineering
Thanks for tuning in In this short video tutorial series we cover
a security topic, authentication and authorisation for apps
and services in the SAP Cloud Platform Cloud Foundry environment.
This video will be hands-on: we show the code and configuration and explains how this works.
It also end-to-end: we start from scratch with an empty file and at the end we will
have a business application up and running in the cloud, with security in place.
With the app we will be able to retrieve the JSON Web Token that gets passed around between
the apps and services, so you can see for yourself what’s inside.
The app also enables us to check the security scope of the connected user; the roles have
been assigned.
Of course, security is broad domain and also the SAP Cloud Platform is a big place so we
need to draw the line somewhere.
Let’s first briefly cover the prerequisites.
Here we have the domain model of the SAP Cloud Platform and we are going to assume that you
are familiar with the building blocks.
Platform versus business users, global and subaccounts, environments, services and applications.
If not, no problem, but you may want to take a look at our SAP Cloud Platform Onboarding
tutorial series first, for the big picture.
As mentioned, our focus is on the Cloud Foundry environment.
We won’t be covering Kyma, Kubernetes, ABAP, or the original Neo environment.
However, for those considering a migration from Neo to Cloud Foundry, you may find this
security tutorial series of particular interest.
Concerning tools we can be short: a terminal (command prompt) and a code editor suffices:
Notepad, vi, your choice.
Of course, we can work with tools like SAP Business Application Studio,
a tool for building cloud applications launched earlier this year, in 2020, or in case you
prefer a local development tool, you can use Visual Studio Code, for example,
to name a popular one, and very similar in look and feel to the business app studio.
Part of the onboarding is setting up your Cloud Foundry environment, installing the
Cloud Foundry CLI (command line interface), and log on,
and we are going to assume this has been done and that you are familiar with this
if not, this is all covered in the onboarding series.
Here we have a blueprint for a business application hosted on the SAP Cloud Platform and we need
to familiarise ourselves with the standard components.
Cloud Foundry proposes a microservices architecture so we have one or more apps with business
logic, covering the core functionality combined with a number of platform services
taking care of the infrastructure, the generic part
we can think about application logging, for example,
there is no need to write that code yourself, just instantiate a service and associate or
bind it to your application, we will see how this works
below we have the platform services, one of which is the XSUAA Service
of which we create a service instance services together with apps make up the business
application, the entry point,
or when viewed from the browser perspective, the endpoint
is the application router, another microservice
the approuter routes the requests, is configurable,
and also plays a key part in the configuration, which is why we bind the approuter to the
business logic apps and to the XSUAA service instance.
XSUAA is an extension of the generic Cloud Foundry UAA service: User Account and Authentication.
Developed by SAP specifically for the SAP Cloud Platform
XS stands for extended application services.
For more information about the XSUAA service, we can visit the SAP Discovery Center,
shown here, Authorization and Trust Management is the
full name, shows the available service plans,
some are paid, some are free, and additional resources.
On our YouTube channel, see the description of this video below for the link and references.
OK, so what we need to do is create two microservice applications,
one as application router and another for the business logic,
and instantiate a service for our app
We could use the SAP Cloud Platform cockpit web administration tool to create service
instances select your org,
and your space go to the marketplace,
look for authorization and trust management, and create an instance,
pick the plan give it a name
and provide the configuration but this is just one/off
and ideally, of course, we want to do this in code, in a repeatable fashion.
Now, with the Cloud Foundry CLI we can create and manage services,
and deploy apps, but not both,
not at the same time, that is.
And when we have a lot of apps and services, with dependencies,
and we want to do an update, a canary or blue-green deployment, that gets really complicated.
For this reason, SAP has architected the MTA concept,
to manage the lifecycle of multi-target applications.
multi-target, because we may have a UI, a user interface, in JavaScript,
the business logic in Java, or maybe Python, a database backend (all microservices).
WIth MTA we can configure and manage them as a single unit.
Again, no special tool is required to work with MTAs
but SAP provides a plugin for the Cloud Foundry CLI called multiapps
and also a Cloud MTA Build tool or MBT. we will see this in action later on, when
we deploy the application
Here we have the code or rather the configuration
defined in a file called mta.yaml.
In the mta we define two modules, myapp-server for the business logic,
and myapp-approuter and one resource: myapp-uaa,
a cloud foundry managed service, xsuaa, service plan application
the same information we have to provide when using the Cloud Platform cockpit
or when using the Cloud Foundry CLI command “cf create-service”.
out-of-the-box the XSUAA service only provides authentication
and the default identify provider of the SAP Cloud Platform is SAP Identity service
It is used for both platform and business users
same technology we can configure an alternative identify providers,
say Microsoft Azure Active Directory, for example,
but this we may cover in a future tutorial, for now we stick with SAP ID service
If you have ever signed up at sap.com to download a white paper or attend a webinar,
you already have an SAP ID service account it also use for support, you may be familiar
with the term S-users, That’s authentication, works out-of-the-box
when we bind our app to an XSUAA service instance, it is a generic service
Authorization is about roles and privileges and that’s unique to a business application,
it is specific.
Who gets to do what?
Typically, this will be referenced in the business logic
before you can access a particular function, we first need to check whether you have got
the privilege, the right role For this reason, we need provide the UAA service
with metadata: scopes and role templates the UAA will map this to roles and role collections,
which in turn we can map to user groups defined at the identify provider.
We are using the term UAA here and not XSUAA as this concerns a Cloud Foundry concept,
nothing specifically SAP here, You can look this up in the Cloud Foundry
documentation,
ok- in the next video, we tackle authorization configuration for business applications
See the description blow on our YouTube channel for more information
Don’t forget to subscribe Denys van Kempen, SAP HANA Academy / Digital
partner engineering Thanks for watching.