Typical UI5 applications consist of a server providing the HTML content and one or more application serving REST APIs used by the application. Web application use the OAuth Authorization Code Flow for interactive authentication:
OAuth resource servers (as the one in step 4) require libraries for validating access tokens.
The SAP Java Buildpack integrates token validation into the tomcat server. Application developers requiring authentication and authorization information in their application use the interfaces defined in api to obtain information like user name and scopes.
sap_java_buildpack(e.g. in your
SAP Java Buildpacks makes use of deprecated (Spring) Security libraries and needs to be updated. The new SAP Java Buildpack version will use the
java-security library. Please expect little migration efforts in the api for accessing token information. A Migration Guide will be provided.
See sap-java-builpack-api-usage for an example.
Applications requiring access tokens (Jwt) use the Token Flows API defined in token-client to obtain Jwt tokens for their clients (applications) or for their users.
Application developers requiring authentication and authorization information in their application use the libraries defined in java-security to obtain token information like user name.
See java-security-usage for an example.
Spring Boot provides OAuth resource servers. Application developers requiring authentication and authorization information in their application use the libraries defined in spring-xsuaa to obtain token information like user name and scopes.
See spring-security-xsuaa-usage for an example.
Find here a more sophisticated sample.
Build results are published to maven central: https://search.maven.org/search?q=com.sap.cloud.security
To download and install this project clone this repository via:
git clone https://github.com/SAP/cloud-security-xsuaa-integration cd cloud-security-xsuaa-integration mvn clean install
Note: Use this if you want to enhance this xsuaa integration libraries. The build results are also available on maven central.
Libraries and information provided here is around the topic of integrating with the xsuaa service. General integration into other OAuth authorization servers is not the primary focus.
Open an issue in GitHub
Copyright (c) 2018-2020 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file [LICENSE.md].