Add Authorization

The authorization checks that you added to the CAP model apply not only when deployed in the cloud but also when testing locally. Therefore, you need a way to log in to the application locally.

CAP offers a possibility to add local users for testing as part of the cds configuration. In this tutorial, you use the development profile in the package.json file to add the users.

1. Open the package.json file in your project directory.

2. In the package.json file, add the cds.requires section:

   JSON Copy

   ...  
   "dependencies": {
     ...
   },
   "scripts": {
     ...
   },  
   "cds": {
     "requires": {
       "[development]": {
         "auth": {
           "kind": "mocked",
           "users": {}
         }
       }
     }
   },
   ...

   The code creates the cds.requires section that didn’t exist so far in the package.json file. Also, the code defines which configuration to use when running with the [development] profile. You define some general parameters for the authentication behavior. Notice that the users object is empty, in the next step, you’ll define some test users.

3. In the package.json file, replace the empty users object with the users object from following code:

   JSON Copy

   ...
   "cds": {
       "requires": {
         "[development]": {
           "auth": {
             "kind": "mocked",
             "users": {
               "alice": {
                 "roles": ["support"]
               },
               "bob": {
                 "roles": ["support"]
               }
             }
           }
         }
       }
     },

   Each user entry is part of the users object. The key is the id of the user and they can have different properties. For this scenario, you define a password and an array of roles.

   You’ve added two users:

   • alice with the support role and no password
   • bob with the support role and no password

   Keep in mind that the CAP roles and the Cloud Foundry roles and scopes aren’t the same thing. See Authentication in the CAP documentation.

The authorization checks that you added to the CAP model apply not only when deployed in the cloud but also when testing locally. Therefore, you need a way to log in to the application locally.

1. Add the cds-starter-cloudfoundry dependency to your srv module. This dependency is needed to enable authorization and authentication at runtime. Without that dependency, any call to a service annotated with @requires results in an authentication failure. Open your srv/pom.xml file and add the following snippet as a child node to the <dependencies> node:

   XML Copy

   <dependency>
     <groupId>com.sap.cds</groupId>
     <artifactId>cds-starter-cloudfoundry</artifactId>
   </dependency>

2. Now, we can add the mock users to the application’s configuration. As with any other Spring Boot application, the configuration can be done in the application’s application.yaml file. In our case, it’s the file srv/src/main/resources/application.yaml. Add the following content to this file:

   YAML Copy

   ...    
   cds:
     security:
       mock.users:
         alice:
           roles: [ admin, support ]
         bob:
           roles: [ support ]

   You’ve added two users:

   • alice with the support and admin roles and no password
   • bob with the support role and no password

   Keep in mind that the CAP roles and the Cloud Foundry roles and scopes aren’t the same thing. See Authentication in the CAP documentation.

When accessing the Incidents service of the Incident Management application in your browser, you get a basic auth popup now, asking for your user and password. You can use the users to log in and see how it works.

1. Make sure that the SAP Fiori application is running. If you closed it, choose the Preview Application option in the Application Info - incidents tab and select the watch-incidents npm script.

   To open the Application Info - incidents tab:

   1. Invoke the Command Palette - View → Command Palette or Command + Shift + P for macOS / Ctrl + Shift + P for Windows.
   2. Choose Fiori: Open Application Info.

2. In the Username field of the auth popup, enter alice.

3. Leave the Password field empty.

   

   You can now access the Incident Management application.

   

When accessing the Incidents service of the Incident Management application in your browser, you get a basic auth popup now, asking for your user and password. You can use the users to log in and see how it works.

1. Make sure that the SAP Fiori application is running. If you closed it, navigate to the srv folder in the terminal and run mvn cds:watch.

2. In the Username field of the auth popup, enter alice.

3. Leave the Password field empty.

   

   You can now access the Incident Management application.