Hi, Denys van Kempen, SAP Welcome back,
you are watching video number seven of a short tutorial series where are going
to take a look at how we can develop secure applications in a multi-cloud environment.
In the previous videos, we covered how we can authenticate users
using the XSUAA component and the approuter, In this video, we are going to add authorisation
We have explained the blueprint and the components before,
so let’s dive straight in We have modified our tutorial
sample a bit, the business logic, the service app now either returns
a list of users or allows us to add users, for this we use two different scopes, two
different authorisations, implemented using roles. Here we have the home page of the approuter
with a link to request a list of users and a button to add a new one.
The HTML page includes a bit of front-end JavaScript logic
Show users just contains a hyperlink reference.
The button calls the addUser function, defined here
which is another function call addNewUser inside fetchCsrfToken
CSRF, Cross-Site Request Forgery, The approuter and service app listen to
a different URL, belong to a different site, you could say, so we need to pass a cross-site token.
This is inherent to a micro service architecture, nothing specific to Cloud Foundry or XSUAA.
fetchCsrfToken gets the token from the header which serves as input to the addNewUser function
together with the name we entered: and this either returns a success message or an error.
Next, we need to update the security descriptor file, xs-security.JSON and add the scopes,
one for listing users, another to add users, then, we also add two role
templated and two role collections, and what this allows us to do is to use the SAP
Cloud Platform cockpit to add the role our user, we will see how this works in a minute,
We already created a service instance of the XSUAA service before, so
now all we need to do is to update the service description with cf update-service command
of course, if want, you can also use the SAP Cloud Platform cockpit for this.
ok Here is the business logic of our service app
The XSUAA part we covered in the previous video, same piece of code
here we define users.json as requirement
to parse the body of an HTTP REST API call we require a new package: body parser;
Then, for the HTTP GET, we set the variable isAuthorized using an authInfo.checkScope call
This is documented for the xssec package
if the user is authorised we return 200 with the contents of the users.json file
otherwise a 403, forbidden
For the HTTP POST, we perform the same check but for the update scope
and when the user is authorised we create a new user.
package.json - we have added body-parser, the rest we have already covered
our users file in JSON format
For the approuter,
no changes to the routes, xs-app.JSON and no changes to the manifest either.
Let’s deploy, fast forward
here we have our apps
Let’s switch to the SAP Cloud Platform cockpit
Get the route Open a new private window
authenticate and here have the approuter home page
Show users should return an error as we have not yet assigned the required roles to our accounts.
Forbidden add a users
an alert is returned with the error
The first forbidden came from our service app The alert from the approuter
As we bound approuter to XSUAA, we get the scopes: display user and update users
and also the role templates and the roles
this is the same of the service app, also bound to XSUAA
To assign the role collection to a user, we need to go to the source, to the identity provider,
in our case, SAP ID services
Go up to the subaccount level
recall that this is where we Cloud Foundry Org is set
The roles and role collections are also listed here,
among many others
Note that there is no user or group mapping yet for this role collection
Under Security, Trust Configuration, the trust with the IdP is configured
Here we can list our assignments
and add new ones
Let’s start with viewer
Close and open a new window to log on again, for the token to get generated
List users returns the contents of the users.JSON file
Add users, returns an alert
Here we have our code
authorised returns 200 and the contents of the file
No authorised returns 403 and forbidden, but we actually never get this far
because the 403 here comes from the approuter
ok, let’s promote ourselves to manager
Repeat the steps
Add George
ok
Add Ringo
ok
Wonderful.
That’s it Authentication and authorisation using XSUAA
I am Denys van Kempen, SAP, Thanks for watching.