XSUAA service instance with service plan api-access is currently only valid for the subaccount its created, therefore currently you can not make a token exchange across tenant subaccounts with returning that instance as a dependency.
Let us approach the problem from a different angle.
In general you need following scopes:
- xs.authorization.read
- xs.authorization.write
- xs.idp.read
- xs.idp.write
- xs.user.read
- xs.user.write
Since you have a multitenant application I assume you already have an XSUAA Instance with application plan with tenant-mode shared option.
You can put that scopes into your xs-security.json file as foreign-scope-references.
In addition to that, when you put that scopes into a role collection in your xs-security.json file, you can assign that role collection to a user from tenant subaccount, after that user will have these scopes. Which means when that user logges in to your multitenant application, the user token will contain this scopes, therefore you can directly call the XSUAA API's with that users token.
Please see the example xs-security.json file below:
{
"xsappname": "mycoolxsappname",
"tenant-mode": "shared",
"foreign-scope-references": [
"xs_authorization.read",
"xs_authorization.write",
"xs_user.read",
"xs_user.write",
"xs_idp.read",
"xs_idp.write"
],
"scopes": [
{
"name": "$XSAPPNAME.mtcallback",
"description": "SaaS Provisioning",
"grant-as-authority-to-apps": [
"$XSAPPNAME(application,sap-provisioning,tenant-onboarding)"
]
},
{
"name": "$XSAPPNAME.mtdeployment",
"description": "SaaS Model Upgrade"
},
{
"name": "$XSAPPNAME.MtxDiagnose",
"description": "SaaS Diagnose"
},
{
"name": "uaa.user",
"description": "UAA"
},
{
"name": "$XSAPPNAME.Viewer",
"description": "Viewer"
},
{
"name": "$XSAPPNAME.Admin",
"description": "Administrator"
},
{
"name": "$XSAPPNAME.ExtendCDS",
"description": "Create Extensions"
},
{
"name": "$XSAPPNAME.ExtendCDSdelete",
"description": "Delete Extensions"
}
],
"role-templates": [
{
"name": "Token_Exchange",
"description": "UAA Token Exchange",
"scope-references": [
"uaa.user"
]
},
{
"name": "Viewer",
"description": "Viewer",
"scope-references": [
"$XSAPPNAME.Viewer"
]
},
{
"name": "Admin",
"description": "Administrator",
"scope-references": [
"$XSAPPNAME.Admin",
"xs_authorization.read",
"xs_authorization.write",
"xs_user.read",
"xs_user.write",
"xs_idp.read",
"xs_idp.write"
]
},
{
"name": "SaaSAdmin",
"description": "SaaS Administrator",
"scope-references": [
"$XSAPPNAME.mtcallback",
"$XSAPPNAME.mtdeployment",
"$XSAPPNAME.MtxDiagnose"
]
},
{
"name": "ExtendCDS",
"description": "Extension Developer",
"scope-references": [
"$XSAPPNAME.ExtendCDS"
]
},
{
"name": "ExtendCDSdelete",
"description": "Extension Developer - Delete",
"scope-references": [
"$XSAPPNAME.ExtendCDSdelete"
]
},
{
"name": "MyCoolUserManagementAdmin",
"description": "Manage authorizations, trusted identity providers, and users.",
"default-role-name": "User and Role Administrator",
"scope-references": [
"xs_authorization.read",
"xs_authorization.write",
"xs_user.read",
"xs_user.write",
"xs_idp.read",
"xs_idp.write"
]
},
{
"name": "UserManagementAuditor",
"description": "Read-only access for authorizations, trusted identity providers, and users.",
"default-role-name": "User and Role Auditor",
"scope-references": [
"xs_authorization.read",
"xs_user.read",
"xs_idp.read"
]
}
],
"role-collections": [
{
"name": "My Super Admin",
"description": "Administrator Access",
"role-template-references": [
"$XSAPPNAME.Admin",
"$XSAPPNAME.SaaSAdmin",
"$XSAPPNAME.MyCoolUserManagementAdmin",
"$XSAPPNAME.Token_Exchange"
]
}
],
"authorities": [
"$XSAPPNAME.mtcallback",
"$XSAPPNAME.mtdeployment",
"$XSAPPNAME.MtxDiagnose"
],
"oauth2-configuration": {
"token-validity": 3600,
"redirect-uris": [
"http://localhost:5000",
"http*://*.cfapps.us10.hana.ondemand.com/**",
"http*://*.cfapps.eu10.hana.ondemand.com/**"
]
}
}
As you can see above, we first have written down the foreign scopes, then we put the scopes into the MyCoolUserManagementAdmin role, then we referred that role in My Super Admin role collection. ( Other sections from example just there but not relevant for this case. )
You might already know that when you subscribe from a tenant subaccount, the role collections will be automatically generated in tenant subaccount.
After you modified your xs-security.json as given example, following steps should help:
- Assign the role which has the scopes to a user from tenant subaccount.
- Login to your application with the user from tenant subaccount
- Call a custom action or API from your application and get the logged in user token
- Put the logged in user token as bearer token and call the XSUAA API.
Very Important Warning: The user you gave this role will be really powerful. That user can assign or remove any role on that tenant subaccount to any user, can also remove and create any user as shadow user etc.
If you do not want this behaviour, you need to control it on the application level and the responsibility of limiting this authorization is also %100 on the application side.
Let me know if this helps.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.