Question Re: Seeking Advice on Custom Authentication for CAPM Serv... in Technology Q&A

Seeking Advice on Custom Authentication for CAPM Services with HANA Cloud Database

rahuljain257 — Sat, 13 Jul 2024 19:35:34 GMT

Good day to everyone,

I'm new to the CAPM world and have recently started learning its concepts. We've developed CAP services and now need to secure them by implementing authorization and authentication.

SAP provides XSUAA, which ensures that only authorized users can access endpoints by establishing a trusted connection with identity providers for user authentication. This concept works well from SAP's perspective.

However, in our scenario, we have developed CAPM services that are bound to a HANA Cloud Database (HDI Containers). Our database/schema contains a users table (ID, Name, Username, Password). We want to implement a system where authorization and authentication occur only if the user exists in our user table.

Instead of authenticating users against identity providers, I want to validate users against the records in our tables and generate a token if the records exist.

Is this approach correct? In ASP.NET Web API, we usually follow this practice.

Looking forward to your suggestions.

Best regards,
Rahul Jain

Re: Seeking Advice on Custom Authentication for CAPM Serv...

Willem_Pardaens — Mon, 15 Jul 2024 07:12:39 GMT

I would suggest to rethink this approach. The CAP framework relies on best practices for a lot of topics, including security. It uses BTP roles and HDI users to establish/govern access and connectivity to the service layer and database layer, and 'outsources' token handling to the XSUAA service.

If you want to use a custom list of users, I suggest to look at importing them to IAS so you can assign roles to them to access your application: https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/import-or-update-users-for-specific-application

Re: Seeking Advice on Custom Authentication for CAPM Serv...

rahuljain257 — Sun, 20 Oct 2024 08:56:33 GMT

William_Pardaens - I am new to BTP World and learning. Can you please let me know where should I start to integrate User Authentication in CAP ? ?

Re: Seeking Advice on Custom Authentication for CAPM Serv...

Willem_Pardaens — Mon, 21 Oct 2024 08:43:20 GMT

Hi Rahul, Security is embedded in the CAP framework. Running 'cds add xsuaa' will do the trick. To read more about it, I suggest the CAP documentation here: https://cap.cloud.sap/docs/guides/security/