Welcome to this series of hands on tutorials from the SAP HANA Academy
I'm Philip Mugglestone
in this series. We're covering the SAP Business Technology Platform
in this video tutorial, we're going to take a closer look at security.
Now from the main help page, we've seen this before in this series,
we can scroll down,
go down to the operate section and then we can see security.
Let's click on the security link.
Now security is present in many ways when you're working with
the SAP Business Technology Platform there are a couple
of things to really consider.
One is the user model. Now there are two types of user, the actual platform you
the users that you actually use when
you're managing your global accounts and subaccounts,
your administrators, your developers,
your auditors and then of course there are the business users,
they're the ones that will actually go ahead and
use the extension applications or whatever it is.
You're deploying into the SAP Business Technology Platform so
you can see for example,
at the sub account level
you can have both platform users, you'll have those
and then you'll also have your business users.
Now the second important concept is the notion of an identity provider.
Now by default you'll be using the SAP ID service.
However it is possible to use your own corporate user store.
Maybe you have Azure Active Directory then you can go ahead and do that now
you might think that you would have your
back end systems and also your SAP Business Technology Platform environment
and your client applications all using the same identity provider.
That's one way you can do it but it's also
possible to to propagate business users using identity propagation where you
can for example have maybe a corporate user store and
then you can use a different identity provider for example,
in SAP BTP and then you create shadow users there so you can pass on
the the jot or the token of a validated user from your identity provider
and then actually send that through
to be used actually with SAP Business Technology Platform
So you have quite some flexibility.
Let's have a quick look in the cockpit at some of the security options.
If we have a look at the main global account,
we can see we have a security tab and if we look in there we'll
see we've got a number of things we've got users so I can see myself here
and we can see that for users
we have role collections So while our role collections well
role collections basically a collection of different roles because
authorizations are defined at the role level,
group them together in role collections
and then you assign those role collections Two different business
users based on what is you want to do.
There are a number that already exists, for example,
global account admin global account viewer.
So that's what you can assign to a user at the global account level.
Also notice we have to trust configuration,
we can see that we are using the default identity provider at this point
and we can see it's available to do interactive user login.
Now, if we were to look at a sub account,
we'd also see that there's a security section and
here we've got the same kind of thing.
Users role collections roles trust configuration.
So again, trust configuration,
this is where at the sub account level we can actually
define what identity provider or providers we want to use.
Now by default, you're going to have the SAP default one there
it's available for user login
but if you want you can add them, there are different ways of doing that.
For example, you can use the new trust configuration
and do some pairing with your identity provider,
you can say whether it's going to be available for user log on or not,
whether it's active or inactive etcetera.
And when you're doing that pairing,
quite often you're going to need the sample
metadata of your SAP Business Technology Platform sub account and that you
can get by clicking on this link and it will download you the xml sample metadata.
Now, in terms of the roles you're gonna see a lot more.
When we're looking at the sub account level,
you'll see there are a lot of them come already.
There are things to do with connectivity, cloud, connector, admin or auditor,
there are all sorts of roles actually quite a few just out of the box
when you develop and deploy extension applications,
those roles will also get added in here.
So then you can assign them to your business users
the way you do that is what we saw before,
you would actually group up your roles into role collections So for example,
for the SAP Business SAP Business Application Studio admin,
you can see it's got one roll in it,
you might find other ones here where you've got a
role collections it's got more than one role in it.
Maybe four or five role
So you can see here,
that's how you would configure the role collections of course you can
edit them all in the cockpit or manage them via the API
or using the command line interface and then you've got your actual
users in this case you're gonna have your administrator for example,
for the sub account that's myself here so we can see that I've
got the role collections I can use SAP Business Application Studio and I'm also a sub account
administrator but if we were to deploy an application we would also be able
to assign those role collections to users who in that case my your business users
and then maybe shadow users if you're using a different identity provider
now as this sub account is using SAP BTP, Cloud Foundry runtime.
We can also go to the SAP BTP, Cloud Foundry runtime section
and we can have a look in there,
we'll see we have order members organization members.
This is where we can basically set up security for the people that will
do development of our administration of the
SAP BTP, Cloud Foundry environment So you can see here,
we've got myself set up as an organization manager and you can go
ahead and add or remove members and then if we go to the spaces
to our name spaces within
SAP BTP, Cloud Foundry runtime we've got one here called
DEV then we can also look at the members for the space
and again we can see we've got members,
I'm there and I'm a space manager and a space developer,
this is where you come and set up the people you want, for example,
the developers to work in that space will all
need to have the space developer role assigned to them
Now we can have a very quick look at
an example of an application we might want to deploy
to use SAP Business SAP Business Application Studio
and use the template wizard
and I'm going to use one of the SAP HANA Academy yeoman generators,
we have a series that covers this in much more detail.
I'm going to create a very simple app,
I'm going to deploy it to the SAP BTP, Cloud Foundry runtime
runtime as that's what we've got running here.
I'm gonna set it up for example,
just to try using the destination service and I'm going to say I want
to have authentication and authorization in this
project so I'll skip over the rest,
let's go ahead and hit next
and it's now scaffolded
as a project
and if we have a law
in those project files we'll find we've got an xs-security.json this is
where we can actually set up scopes and then role templates,
these will become roles when it's deployed to the
SAP BTP, Cloud Foundry runtime and role collections which
effectively encapsulate those role templates
These will be the role collections that will get in in SAP BTP when we've deployed
the application so we can then effectively assign them to our business users.
So let's just quickly go ahead to build
and then deploy the application to the SAP BTP, Cloud Foundry runtime.
Now whilst it's doing that I'll just mention one other thing.
We look at our MTA YAML file which is where we define the kind of plumbing
for the application of the different services and SAP BTP that are going to be used.
Notice that we've got a service called
you a a this is the user authentication authorization service
and that's something you'll need to use when you
actually want to force authentication is your application and
you can see here this is where we're specifying
that excess security without role collections and our role templates,
we can see it's
using the SAP Authorization and Trust Management Service
and the application plan that's
relevant when we're developing extension applications
so we can see the application has now been deployed. So let's go back to our cockpit
and if we go to our applications we've got our ui our
front end part and we've also got our back end service However,
before we try and use it,
as we said that we're going to be using authorization authentication.
We'll need to make sure that we assigned role collections to business
users so we'll go to the sub account level and then back
to the security if we look at the roles we see that
we have a couple of roles that relate to our application,
we called it app so we can admin and a user role.
And then if you look at our role collections
we now have app underscore admin and underscore user
which use these corresponding roles So we have two
role collections This was all defined in that xs-security.json file
and it was activated as we deployed the application
just now so then we can create business users.
This is where you would maybe set up shadow users or I'll just do it for myself here.
I'm going to go ahead and assign the
role collections maybe make myself admin and end user
now that I've done that I can go back to my SAP BTP, Cloud Foundry runtime space
and go to the front end of my application and we can launch it
as I'm already logged onto the cockpit.
It didn't explicitly asked me to log on again,
I'm using the same user but if we have a look, we should now be able to see we're able to
access the application yet and if we choose user, you can see that it knows my user,
I've been authenticated
and there are actually checks in the code to make sure that you
can only call these endpoints if you are an authorized or authenticated user,
we can just see that briefly here.
If we go to the back end server module and have a look at the server dot Js
So we can see that in our code. We're using excess security and passport.
This is basically going to ensure that we force authentication,
we can see use passport dot authenticated.
We're gonna make sure that the user is authenticated
and then for various end points we're going to actually try to enforce
that. They've got the right scopes in terms of authorizations for our app.
So we see we're checking they got the application dot user.
So that was one of the scopes which got rolled
up into a roll collection and assigned to our business user
checking that when you're actually running the app
Now, that's just a taster of what's possible.
We've got a load more video tutorials that show you all of this in much more detail.
So if you head over to the SAP HANA Academy channel,
particularly in the beat CPI core section.
We can see for example,
we've got a series on SAP BTP, Cloud Foundry runtime specific security,
he will see the end to end process of how
you can actually configure security
specific to SAP BTP, Cloud Foundry runtime applications.
We've also got a series that talks about SAP BTP security in more general details,
not specific to any one run time.
So for example,
if you want to set up that your trust configuration is
using a zero active directory as your I D P,
your identity provider, then you can see that step by step through this video series
and if you're interested more in the application side,
how you can actually make use of
different types of authorization and authentication.
There are there are many examples,
particularly in the extension generator series.
So if we take a quick look at this extension generator series, we'll see.
We have lots of video tutorials and
that includes very specific examples showing authentication,
authorization, even user based attributes in detail.
So in this video tutorial we've had an overview of some of the aspects of security.
When you're using the SAP Business Technology Platform
you can find more video tutorials on our Youtube channel
if you'd like to be informed as soon as new video tutorials are published,
then please subscribe.
Thanks for watching.