Add Scopes and Create Role Collection Mapping

1. Open SAP Web IDE and your project ROOM_MTA_XXX and add scope to xs-security.json.

   JSON Copy

        {  
   
            "name": "$XSAPPNAME.Room-maintain",
            "description": "View data"
   
        }          

2. Add role template to xs-security.json

```JSON
      {
            "name": "RoomTemplate",
            "description": "Role for viewing data",
            "scope-references": ["$XSAPPNAME.Room-maintain"]
      }   
```

3. Add required scope to webapp/manifest.json.

```JSON
      {
          "sap.platform.cf":
                            {		
                              "oAuthScopes": ["$XSAPPNAME.Room-maintain"]
                            }
      }   
```

1. Right click on ROOM_MTA_XXX file and choose Deploy > Deploy to SAP Cloud Platform.

   

2. Choose again the API Endpoint, Organization and Space. Now click on Deploy.

   

1. Switch to your SAP Cloud Platform Cockpit, select your appRouter, click Roles and New Role

   

2. Create a new role.

   • Name: MyRoomTemplate_XXX
   • Template: RoomTemplate

   Click Save.

   

3. Select your subaccount, click Role Collections in the security area and click New Role Collection.

   

4. Create a new role collection.

   • Name: MyCollection_XXX

   Click Save.

   

5. Select your created role collection.

   

6. Add a role to your role collection in Cloud Foundry subaccount.

   

1. In your SAP Cloud Platform Cockpit, select your Role Collection Mappings and click New Role Collection Mapping

   

   Hint: Groups attribute and assignment to business user needs to be provided in identity provider!

2. Create a new role collection mapping.

   • Role collection: MyCollection_XXX
   • Value: BR_ROOM_XXX

   Click Save.

   

1. Select your trust configuration in your SAP Cloud Platform Cockpit. Select Role Collection Assignment, enter your e-mail address, click Show Assignments and Assign Role Collection.

   

2. Select RoomsRole and click Assign Role Collection.

   

3. Select your subaccount and your application route will be shown.

   

   Hint: <route-on-cf> = <your_url>.sap.hana.ondemand.com