Hi, Denys van Kempen, SAP Welcome back,
you are watching video number six of a short tutorial series where are going to take a look
at how we can develop secure applications in a multi-cloud environment.
By now, you should be fairly familiar with this blue print of our business application.
We covered the core piece, the business logic of our service app, microservices architecture,
we showed some examples in JavaScript, Python, Java,
and showed how we can work with the native Cloud Foundry Diego containers,
build and deploy using buildpacks, the cf push command,
and the deployment manifest file, manifest.yaml For all functionality that supports the business
logic but is not part of it, we can make use of services;
no need to reinvent the wheel, and we showed how the service app can connect
to a database service using application binding, which provides access to environment variables,
using middleware utility packages like xsenv or cfenv,
for Node, and for Python, in the previous video we introduced the approuter,
another piece of middleware, we could say, for routing and above all to implement
authentication and authorization, with the XSUAA service component,
the approuter is bound to the service app and the XSUAA service,
and configured using the xs-app.JSON file, where we define the routes.
the XSUAA service itself is configured using the xs-security.JSON file,
and more information about this coming up. Ok
To explain the OAuth flow, we used the hotel room analogy.
Our service is the hotel room, that’s the core piece
The approuter is the reception, the endpoint or rather entry point,
where we check authentication (passport) and configure authorization (credit card),
what services are you allowed to consume once you have identified yourself?
The result is a token, the jot, JWT, JSON Web Token, in JavaScript Object Notation,
and from this point on you will interact with the service app with a token and not with your
credentials or any other personal information. The same as with a keycard.
Web tokens are also typically valid for a number of minutes or hours,
after which we need to refresh the token.
That’s OAuth And we could use the token, for example,
to authorisate the user to consume certain services,
Imagine our HANA Cloud database service, here as the mini bar,
which we can access with our keycard, and will be charged afterwards,
OK - enough talk, let’s get hands-on
In the previous video we added the approuter
but we made no changes yet to the business logic, as a result, we could still access the app
service directly, not what we want,
so in this video we will cover how we can fix this.
Let’s start with the Service app, with the business logic.
We are going to add two more packages, one generic passport,
described as express-compatible authentication middleware for Node.js,
and another SAP developed package, XSSEC, xs security
you can install them locally, or just update the dependencies entry in the
application descriptor file package.JSON We covered this in a previous video, so
we’ll assume this is nothing new Here we have the code
The first two lines, we covered when we wired our app service to connect to SAP HANA Cloud,
using xsenv, another SAP-developed package
Here we only add a getServices on the XSUAA service instance.
So we get the environment variables of both HANA Cloud and XSUAA
Then we define passport, use xssec to set the JWTStrategy
use the environment variables of the XSUAA service instance to populate the passport,
initialise, and authenticate It is a bit of boilerplate code, really, or, as
documented “a ready-made authentication strategy” Two more lines, where we return the user names
from the parsed environment, the application user and the HANA user
and the rest is as before dependencies in the application configuration
No changes to the app router, or the route, No changes to the security configuration
No changes to the deployment manifest So let’s deploy the app, we seen this before
fast forward Here we have our apps
as we are already connected to the SAP Cloud Platform cockpit,
we will need to access the app in a new private window,
when we access the service app directly, we get an unauthorised message from the
password middleware package we effectively closed the
back door to the service app you can only get to room when you
first go by the reception, the approuter,
to get your room key, the JWT token
So, let’s access the approuter, the endpoint of our app,
we are prompted to log on, using the identify provider of the XSUAA service,
The approuter home page, we added a line for the /xsuaa URL
get / returns the message get hana returns the database query
and xsuaa the application and HANA user from the environment variables.
Here is the code again, where this is defined.
Works as advertised, using passport and xssec. So much for authentication
In the next video, we will show you how we can also add some authorization to the app
I am Denys van Kempen, SAP, Thanks for watching.