Introduction
Fastest way to develop UI5 applications is for sure on local machine. In that case the XSUAA cloud instance may be used by starting a local approuter on localhost:5000 by default. This configuration is made via the default-services.json file that is auto-read by approuter on start and expands the VCAP_SERVICES which of course is found only on Cloud Foundry landscape or is set with a manual enviroment variable.
For local development, when using an existing SAP Cloud Platform XSUAA service instance, the localhost domain is not accepted by default as a valid redirect uri. For security reasons we need to add explicit permission to xsuaa for redirection after a successful login to a localhost url used for local development. (or other uri)
The error displayed after login on the
xsuaa page is :
Invalid redirect <url> did not match one of the registered values
Approuter & XSUAA
Approuter is the entry point for multi target applications that need authorization and have multiple modules (ui, backend) that need to scale and reuse the same OAuth2 token. The whole process of token check and client credentials flow to retrive the token in the UI application is handled by the approuter.
More details on npmjs
@sap/approuter
The configuration for routes of the approuter is done via the
xs-app.json file.
The
xs-security.json file is specific to the xsuaa instance !
Once deployed the instance configuration may be updated.
The xs-security.json file
Tipical xs-security.json file looks like this :
More details may be found in the
help page
{
"xsappname": "node-hello-world",
"scopes": [
{
"name": "$XSAPPNAME.Display",
"description": "display"
},
{
"name": "$XSAPPNAME.Edit",
"description": "edit"
},
{
"name": "$XSAPPNAME.Delete",
"description": "delete"
}
],
"attributes": [
{
"name": "Country",
"description": "Country",
"valueType": "string"
},
{
"name": "CostCenter",
"description": "CostCenter",
"valueType": "int"
}
],
"role-templates": [
{
"name": "Viewer",
"description": "View all books",
"scope-references": [
"$XSAPPNAME.Display"
],
"attribute-references": ["Country"]
},
{
"name": "Editor",
"description": "Edit, delete books",
"scope-references": [
"$XSAPPNAME.Edit",
"$XSAPPNAME.Delete"
],
"attribute-references": [
"Country",
"CostCenter"
]
}
]
}
Create a service instance
First check the
xsuaa plans available
cf marketplace -s xsuaa
For example purposes I will use the
application plan
cf create-service xsuaa application myappxsuaa -c xs-security.json
Update the xs-security.json file
{
"xsappname": "node-hello-world",
"scopes": [
{
"name": "$XSAPPNAME.Display",
"description": "display"
},
{
"name": "$XSAPPNAME.Edit",
"description": "edit"
},
{
"name": "$XSAPPNAME.Delete",
"description": "delete"
}
],
"attributes": [
{
"name": "Country",
"description": "Country",
"valueType": "string"
},
{
"name": "CostCenter",
"description": "CostCenter",
"valueType": "int"
}
],
"role-templates": [
{
"name": "Viewer",
"description": "View all books",
"scope-references": [
"$XSAPPNAME.Display"
],
"attribute-references": ["Country"]
},
{
"name": "Editor",
"description": "Edit, delete books",
"scope-references": [
"$XSAPPNAME.Edit",
"$XSAPPNAME.Delete"
],
"attribute-references": [
"Country",
"CostCenter"
]
}
],
"oauth2-configuration": {
"redirect-uris": [
"https://www.myappurl.com/login/callback",
"http://localhost:5000/login/callback"
]
}
}
Update the service instance
Login to CF and choose the org and space where you have created the instance.
Run the update command :
cf update-service myappxsuaa -p application -c xs-security.json
Conclusions
This article is based on personal experience.
This is a short summary of the the documentation files regarding
xsuaa and
approuter use.
Tested with SAP Cloud Platform Trial - Cloud Foundry Environment
Reference & Credits :
https://help.sap.com/viewer/4505d0bdaf4948449b7f7379d24d0f0d/2.0.03/en-US/e00eadf291424e49935b460d2f...
https://blogs.sap.com/2020/04/03/sap-application-router/
https://developers.sap.com/tutorials/cp-connectivity-consume-odata-service-approuter.html
https://blogs.sap.com/2020/05/12/set-up-cap-application-behind-sap-webdispatcher/
