Configuring Authorization and Trust Management for Production

Update the XSUAA-Service Configuration.

1. Recompile your service definition.

   Code snippet

   Copy code

   cds compile srv/ --to xsuaa > xs-security.json 

   Copy code

   This will update the xs-security.json file:

   Code snippet

   Copy code

   
   {
     "scopes": [
      {
       "name": "$XSAPPNAME.RiskViewer",
       "description": "RiskViewer"
      },
      {
       "name": "$XSAPPNAME.RiskManager",
       "description": "RiskManager"
      }
     ],
     "attributes": [],
     "role-templates": [
     {
       "name": "RiskViewer",
       "description": "generated",
       "scope-references": [
       "$XSAPPNAME.RiskViewer"
     ],
     "attribute-references": []
     },
     {
       "name": "RiskManager",
       "description": "generated",
       "scope-references": [
       "$XSAPPNAME.RiskManager"
     ],
     "attribute-references": []
      }
    ]
   }
   
   
   

   Copy code

   This only defines the role templates and its scopes. Currently, there are no role collections defined.

   Note

   We put the definition of the role collections into the mta.yaml file. We don't want to lose them when we recompile the xs-security.json file.

2. Define the role collections in the mta.yaml file in the resource definition of the risk-management-uaa instance.

   Code snippet

   Copy code

   
   role-collections:
   - name: 'RiskManager-${space}'
     description: Manage Risks
     role-template-references:
     - $XSAPPNAME.RiskManager
   - name: 'RiskViewer-${space}'
     description: View Risks
     role-template-references:
     - $XSAPPNAME.RiskViewer

   Copy code

   The entire definition should look like the following:

   Code snippet

   Copy code

   
   resources:
     - name: risk-management-uaa
       type: org.cloudfoundry.managed-service
       parameters:
         service: xsuaa
         service-plan: application
         path: ./xs-security.json
         config:
           xsappname: risk-management-${org}-${space}
           tenant-mode: dedicated
           role-collections:
           - name: 'RiskManager-${space}'
             description: Manage Risks
             role-template-references:
             - $XSAPPNAME.RiskManager
           - name: 'RiskViewer-${space}'
             description: View Risks
             role-template-references:
             - $XSAPPNAME.RiskViewer
   

   Copy code

   Note

   Note, that you also have to add the oauth2 configuration. This is required.

   For more information, take a look into the SAP Note SAP Note 2864831.

Re-Build and Re-Deploy the .mtar File.

1. Build your project with the MTA Build Tool (MBT):

   Code snippet

   Copy code

    mbt build -t gen --mtar mta.tar

   Copy code

   Make sure you're in the root folder of your project.

2. Deploy your project to SAP BTP:

   Code snippet

   Copy code

   cf deploy gen/mta.tar 

   Copy code

   Additional Documentation: How to build an MTA archive from the project sources¹.

3. When the deployment is finished, check the deployment log for a line saying:

   Application "risk-management" started and available at "<some_URL>"

   For example, like in the following screenshot:

   

   This is the URL of the Approuter that will take care of all the requests to your application.

4. Copy the URL and open it in a new browser tab. In the background, the approuter authenticates your user and provides it with the authorizations that have been assigned to the user. Open the Risks application tile and try to retrieve data by selecting the Go button.

   As your user does not have the required application roles yet, the result should look like the following:

   

Platform Simulation

Click on the Start button below to open a simulation of the platform. Then follow the step-by-step instructions to assign role collection to users.

ExerciseStart Exercise