Cloud Foundry, UAA, XSUAA
Hi, thanks for tuning in I am Denys van Kempen from SAP and in this
short video tutorial series we will be looking at developing secure applications in a multi-cloud
environment.
Here we have a graphic that shows what we will be covering in this series.
The business application is not a monolith, as the terminology goes, a big black box,
but it is built up from a number of micro services.
Now, you may or may not be familiar with micro services architecture.
In short, today, most applications are built up as shown here, where we have the business
logic contained in a number of services.
Functionality that is generic, not specific to our app, will be consumed as service.
This is the plumbing.
Most apps need a database to store data.
Need security to authenticate users.
But we are not going to write a new database for every new application.
We are just going to use one that is already out there.
These are the service instances we see here.
In our example, we will bind our app to an SAP HANA Cloud database,
but this could be any database, NoSQL key/value store, not all that relevant for our story
here.
What is important is the XSUAA service here, and this we are going to cover in much detail
because this service is performing UAA services, which stands for user accounts and authentication,
also runs as a micro service.
We will be building one ourselves in this tutorial, but it also connect to the XSUAA
service of the platform.
Why is that?
Well again, plumbing.
These user accounts, where do they live?
Where are they defined?
Well, we do not want to create user accounts for every app we build.
We like to store this centrally somewhere.
Plug into a location where these accounts already exist, ideally.
And this is what an identity provider services does, an IdP.
No surprise, the SAP Cloud Platform uses as default IdP SAP ID Services.
If you have ever downloaded a white paper from the website, worked with SAP as a partner,
or create a support request, you already have an SAP ID account, and this is the service
we will be using.
This is not required, of course, you could use any other identity provider, Microsoft
Active Directory, or any other IdP that supports SAML, of which there are quite a few.
SAML stands for Security Assertion Markup Language
So it is a markup language, like HT-ML or X-ML, not the latest technology.
We will be looking at OAuth, and JSON web tokens, jot, too in this series (more recent
stuff).
But SAML is the standard protocol used by identity providers.
Here is another view of the same picture.
The browser is now labeled User Interface, UI/User Agent.
When we connect to the Cloud Foundry environment of the SAP Cloud Platform, our entry point
is the Cloud Foundry router.
The outer shell is the XSUAA service of the platform, which is an OAuth 2.0 authorization
server.
This will send the request back to the browser to get some information from the identify
provider; user name / password, maybe a certificate.
This is then passed to our business application running inside a Cloud Foundry runtime container.
Again, we will be covering this in much detail, and this will all make perfect sense at the
end Just retain that our business application
uses a gateway, an approuter as micro service, and implements a security library in the business
logic as well.
We are going to see this in action.
We have some sample code in Node.js and Python.
All very basic.
Node.js, JavaScript, and Python are scripting languages, of course.
We do not have to compile anything.
The code is directly executed.
We could have used Java but if you are not a Java programmer, this will be a little harder
to grasp.
Ok, back to the first picture.
Cloud Foundry, micro services, that is what we will be working with.
In the next video, we are going to start with the business logic app.
This is usually where are our efforts are focussed.
What makes us stand out from the competition.
However, in this series we will be looking at the infrastructure, at the plumbing, to
show you how our business app can take advantage of Cloud Foundry service instances and its
security infrastructure.
No need to re-invent the wheel.
In subsequent videos we will also cover the application router, acting as reverse proxy,
and entry point for authentication and authorization and for this we are going to need a service
instance of the XSUAA service.
So much for this brief introduction, Denys van Kempen, SAP
Thanks for watching.