Default scope for service key

[martinstenzig]

I am building a cloud foundry app that uses XSUAA authentication via IAS. The application runs well through the browser (when I authenticate myself with a username and password), but when I create a service key to perform remote calls I only get one scope (uaa.user) assigned and not the necessary authorization.

I tried setting the scope in the token request, but can only assign set uaa.user as valid scope.

Here are the questions:

1. When I issue a service key, which scope(s) or role templates are automatically assigned?

2. When requesting my token, should I be able to select any of the scopes defined in xs-security.json?

3. Is there a way to create a service key with a specific scope?

4. Is the first scope in the array always assigned to the service key request?

--- sample .http request to retrieve token

POST {{authentication_server}}/oauth/token HTTP/1.1
Authorization: Basic {{client_id}}:{{client_secret}}
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials
&client_id={{client_id}}
≻ope={{requested_scope}} 

--- my xs-security.json

{
 "xsappname" : "riz-inno-unit-base",
 "tenant-mode" : "dedicated",
 "description": "Security profile of Unit Base Modules",
 "scopes": [
 {
 "name": "uaa.user",
 "description": "UAA"
 },
 {
 "name": "$XSAPPNAME.standard",
 "description": "Standard User"
 }, {
 "name": "$XSAPPNAME.admin",
 "description": "Administrator"
 }, {
 "name": "$XSAPPNAME.noaccess",
 "description": "No access"
 }
 ],
 "role-templates": [
 {
 "name": "Token_Exchange",
 "description": "UAA",
 "scope-references": [
 "uaa.user", "$XSAPPNAME.standard"
 ]
 },
 {
 "name": "riz_inno_unit_base_role_user",
 "description": "Standard Role for Unit Base",
 "scope-references": [
 "uaa.user", "$XSAPPNAME.standard"
 ]
 },
 {
 "name": "riz_inno_unit_base_role_admin",
 "description": "Admin Role for Unit Base",
 "scope-references": [
 "uaa.user", "$XSAPPNAME.standard", "$XSAPPNAME.admin"
 ]
 }
 ]
}

[theits]

Hello Martin,

I found a blog which may help you with your third question.

First of all the blog which explains a solution to your problem very detailed: https://community.sap.com/t5/technology-blogs-by-sap/how-to-call-protected-app-from-external-app-as-...

I recreated the steps from the blog and I was able to issue a token with the client-id and secret from a service key which has a specific scope.

I created an xsuaa-instance with the following json-configuration:

{
    "xsappname" : "test-provider-xsuaa",
    "tenant-mode": "dedicated",
    "oauth2-configuration": {
        "credential-types": ["binding-secret"]
    },
    "scopes": [{
        "name": "$XSAPPNAME.testscope",
        "grant-as-authority-to-apps" : ["$XSAPPNAME(application,test-client-xsuaa)"]
    }],
	"role-templates": [ { 
      "name"                : "TestProviderRoleTemplate", 
      "default-role-name"   : "TestProviderRoleTemplate",
      "scope-references"    : ["$XSAPPNAME.testscope"]
  }]
}

In the scope "testscope" you need to refer to another xsuaa-instance via "grant-as-authority-to-apps". "application" is the service plan and "test-client-xsuaa" is the name of the service-instance. 

Then I created a xsuaa service-instance with the name "test-client-xsuaa":

{
    "xsappname" : "test-client-xsuaa",
    "tenant-mode": "dedicated",
    "oauth2-configuration": {
        "credential-types": ["binding-secret"]
    },
    "authorities" : ["$XSAPPNAME(application,test-provider-xsuaa).testscope"]
}

In "authorities" you need to refer to the service-instance created before and define the scope "testscope". I then created a service key for the instance "test-client-xsuaa", issued a token with it's client-secret and client-id and checked the token on jwt.io. The token contains the scope "testscope".

Using this pattern you can issue tokens from a service key containg a specific scope by creating new xsuaa-instances for each scope.

Best regards

Torben