CAPM Protect CDS Service with XSUAA

[Ben]

Hi There

When following the tutorial https://developers.sap.com/tutorials/xsa-cap-add-uaa.html the srv-Module (srv_api) is protected when called via AppRouter.

But as far as I see, the srv-Module still can be called directly (not via AppRouter) and then, the srv is not protected.

If using a CDS oData Service based on CAPM template, it would be possible to add some annotations for access restriction, for example @(requires:'authenticated-user') --> see https://answers.sap.com/questions/784681/more-info-on-cds-requires-statement-cloud-applicat.html

But if doing so, then the srv-Module can not be called directly or via AppRouter, there will be error message "Forbidden".

Therefore I would like to know how it is possible to secure an oData srv-Module by means that it is protected if called via AppRouter or called directly on the srv-Instance.

Best regards,

Ben

[Ben]

Hi gregorw christian.georgi

In the meantime I found out why the built-in oData server suddenly works with authentication.

The crucial lines of code are in package.json file. There you will have to declare the dependencies to the following libraries (be aware that there are two package.json files, add lines to both of them😞

	"@sap/xsenv": "^2.0.0",
	"@sap/xssec": "^2.2.2",
	"passport": "^0.4.0"

See here for example in your project https://github.com/gregorwolf/bookshop-nodejs/blob/master/srv/package.json#L7,L13

Without those 3 libraries, the authentication is not working. This is the final solution for my question.

As a workaround one can also use a custom Node.js server like you demonstrated in the github project.

Best regards,

Ben

[Ben]

Hi gregorw christian.georgi

Unfortunately I found an exception / strange behaviour with the above solution.

It looks like after adding the three libraries to the package.json, all services are protected! Even the services which are not annotated with @(requires)..

Means that you get "forbidden" or "unauthorized" error message for all services..

I would still be interested in a "proper" solution where authorization works exactly as defined with annotations in cds service..

Best regards,

Ben

[Ben]

Also following annotation is not working.. The oData Service now blocks all requests.

@(requires:'any')

Looks like a bug?

[Ben]

Hi gregorw and christian.georgi

Sorry for the SPAM, this will be my last comment today I promise 🙂

The above issue that all services / entities are now blocked by authentication can be reproduced in your GITHUB Repo https://github.com/gregorwolf/bookshop-nodejs

Just build / start the db and srv service, then make some GET requests to the admin and catalog service.

As you will encounter, all requests will fail with "unauthorized" error message. See log:

Application is starting
Application is running
> bookshop-nodejs-srv@1.0.0 start /home/vcap/app
> node ./node_modules/@sap/cds/bin/cds.js serve gen/csn.json
[cds] - connect to datasource - hana:gen/csn.json
[cds] - serving AdminService at /admin
[cds] - serving CatalogService at /catalog
[cds] - service definitions loaded from:
gen/csn.json
[cds] - server listens at http://localhost:59318 ... (terminate with ^C)
[cds] - launched in: 5390.165ms
GET /admin/Authors
{ user: '10.0.136.0', ip: '10.0.136.0' }
GET /catalog/Authors
{ user: '10.0.136.0', ip: '10.0.136.0' }
GET /catalog/Books
{ user: '10.0.136.0', ip: '10.0.136.0' }
GET /catalog/Currencies
{ user: '10.0.136.0', ip: '10.0.136.0' }
GET /catalog/Orders
{ user: '10.0.136.0', ip: '10.0.136.0' }

According to the service definition, the GET requests to Catalog Service Entities "Books" and "Authors" should work without authentication. Here I also added annotation "@requires: 'any'" for "Authors" entity just to point out that this not working as well.

using my.bookshop as db from '../db/data-model';

service CatalogService {

  @readonly entity Books as projection on db.Books excluding {
    createdBy, modifiedBy
  };

  @requires: 'any'
  @readonly entity Authors as projection on db.Authors excluding {
    createdBy, modifiedBy
  };

  @requires: 'authenticated-user'
  @insertonly entity Orders as projection on db.Orders;
}

I hope this will help you to analyze the issue.

Looking forward for a solution.

Best regards,

Ben

[former_member569813]

I got the solution. If you call the service via AppRouter you will have to add an additional header parameter, called x-approuter-authorization, filled with the same information as parameter Authorization, which means: "Bearer "+Token .

[gregorw]

Hi Ben,

if you're using the Java flavour of CAPM then the blog post Securing Cloud Platform Business Application by ivan.mirisola might be helpful for you.

Best regards
Gregor

[Ben]

Hi Gregor

Thanks for the link you provided but I am not using the Java flavour but the Node.js flavour of the CAPM.

Here you see my srv/cat-service.cds File:

using my as my from '../db/data-model';

service CatalogService @(impl:'../cat-service.js') @(requires:'authenticated-user') {
    entity Persons as projection on my.Persons;
}

srv/cat-service.js File (in order to write user info to log):

module.exports = srv => {
	const {
		CatalogService
	} = cds.entities('my');

	srv.before('READ', 'Persons', (req) => {
		console.log('Authentication: ' + JSON.stringify(req.user));
	})
};

srv-Logfile:

GET /catalog/Persons
{ user: 'anonymous', ip: '10.0.72.5' }

Any ideas?

Ahh and to mention, I tried running from WebIDE but also deployed whole mtar to cf trial account.

Both is not working as soon as I add following annotation to CDS service:

@(requires:'authenticated-user')

Best regards,
Ben

[gregorw]

Hi benkrencker and christian.georgi,

to make it easier to work on this issue I've created a Node.JS based project at https://github.com/gregorwolf/bookshop-nodejs. I've deployed that to my SAP CP Cloud Foundry Trial account and do face the issue that when running the UI the metadata could not be retrieved because the request reaches the backend with an anonymous user. Looking forward for some help.

Best regards
Gregor

CC: dj.adams.sap daniel.hutzel

[gregorw]

HI benkrencker,

I have how a working version using scopes in the GitHub repository at: https://github.com/gregorwolf/bookshop-nodejs.

Best regards
Gregor

[maheshpalavalli]

Hi Gregor Wolf,

The project looks really cool... I was just going through your project and found a lot of stuff related to authentication(Passport xssec jwtstrategy). Just wanted to know if there is any standard documentation available for it and if yes, could you please provide me that link for reference.

Thanks & Regards,
Mahesh

[Ben]

Hi Gregor Wolf

Thanks a lot for providing a solution on this issue! I am just wondering wheter this is a solution or a workaround? As far as I see, you created a express app.js and server.js in srv module and are not using the CAPM built-in cds server anymore. Is is supposed to only work when using custom express server? Maybe Christian Georgi can answer this question, because this was not part of his solution..?

One other question to Gregor Wolf: are you using the WebIDE to build the Project? When I clone your project to my WebIDE, I am not able to build db or srv module. Even when I try to "Build CDS" there is a build error (ESLINT Parsing error: the keyword "const" is reserved in File app.js Line 1 and server.js Line 1).

I am now going to create new WebIDE project from scratch and to create app.js and server.js file in this new project..

Best regards,
Ben

[gregorw]

Hi benkrencker,

as you can see in https://github.com/gregorwolf/bookshop-nodejs/blob/master/srv/package.json#L22 I've changed back to start the srv using the CAPM built in server.

I've used my local dev environment in VS Code on Linux. The mtar was created using mbt and then deployed using the cf cli with the mta plugin.

Best regards
Gregor

[Ben]

Hi gregorw

In the meantime I was able to build, run and deploy the project to SCP trial environment. I guess the build problems came from some WebIDE interrups (I recently had some WebIDE errors in trial environment)..

Regarding Line 22 in package.json, did you deploy the project to CF and run the example? As soon as I use the built in server (like Line 22) the authentication is not working (I get "forbidden" message in UI).

The project only works when I have following line in package.json:

	"scripts": {
		"start": "node server.js",
	},

I would be happy I you could double check if your project really works when using the built in oData server.

Best regards;

Ben

[Ben]

Hi gregorw

Please forget my last comment 🙂

I did not see that I had implemented a role restriction into my oData Service. I can confirm that it is now working also with builtin oData Server..

What is the difference to the original project, why is it working now? Was there an update of the CAPM oData server?

Best regards,

Ben

[former_member569813]

Nearby one year ago and I'm facing the same problem. As Benjamin told:

JWT token is not delivered to or recognized from the srv-Module because when I call the oData Service (srv-Module) via AppRouter, I am routed to the login page and after successful login, the oData response still is "forbidden".

Are there new ideas, solutions ? I tried a lot, but unfortunately nothing works.

[gregorw]

Hi Stefan,

maybe my debug handlers in server.js help.

Best regards
Gregor

[chgeo]

Hi Ben,

I have answered to your BCP ticket for this question.

Regards,

Christian

[Ben]

Hi Christian

I followed your recommendations (see below) but it was not working: it seems like the JWT token is not delivered to or recognized from the srv-Module because when I call the oData Service (srv-Module) via AppRouter, I am routed to the login page and after successful login, the oData response still is "forbidden".

Your recommendations:

• Create an HTML5 module, which is run as an approuter instance -> done
• In its xs-app.json, there should be one route to the service. Make sure you set the "authenticationMethod" to "xsuaa". -> done
• In mta.yaml
  • Bind the HTML5 module to the XSUAA service instance -> done
  • Require the service module from the HTML5 module in its destinations -> done

Best regards,

Ben