Add Authentication and Authorization to the Application

In this tutorial you add authentication to your application by adding the cds-starter-cloudfoundry dependency, which enables CAP Java’s secure-by-default behavior based on Spring Security.

1. Edit the pom.xml in the srv directory (not the pom.xml file located in the root project folder) and under the <dependencies> tag add the cds-starter-cloudfoundry dependency. Make sure you Save the file.

   XML Copy

   <dependency>
       <groupId>com.sap.cds</groupId>
       <artifactId>cds-starter-cloudfoundry</artifactId>
   </dependency>

You will now demonstrate this secure-by-default behavior using the OrdersService. For now, you only require that the user who wants to create the order must be authenticated. CAP provides built-in users that represent common authentication scenarios for local development.

1. Start the application with the command mvn spring-boot:run.

2. Open the requests.http file and execute the first Create Order request by choosing Send Request above it.

3. Observe that the response contains status HTTP/1.1 401.

   

4. To create an order, you need to provide credentials. For local development CAP has built-in mock users. Modify the request like follows:

   HTTP Copy

   ### Create Order
   
   POST http://localhost:8080/odata/v4/OrdersService/Orders
   Content-Type: application/json
   Authorization: Basic authenticated:
   
   {
     "items": [
       {
         "book_ID": "abed2f7a-c50e-4bc5-89fd-9a00a54b4b16",
         "amount": 2
       }
     ]
   }

   Here you have added the Authorization HTTP header to the request and provided the credentials for the built-in authenticated mock user. This user has an empty password.

5. Execute the request again and see that the order is now created.

6. When choosing entities of the OrdersService on the welcome page you will also have to provide credentials now. You can use authenticated user and empty password there as well.

Built-in mock users are good for initial local testing, but you may need separate different users for your application to test it further. You will now add some custom mock users to the application:

1. Add the security section to the application.yaml file under srv/src/main/resources as follows:

   YAML Copy

   ---
   spring:
     config.activate.on-profile: default
     sql.init.schema-locations: classpath:schema-h2.sql
   cds:
     datasource:
       auto-config.enabled: false
     security:
       mock:
         users:
           - name: klaus
             password: pass_klaus
             additional:
               firstName: Klaus
               lastName: Sussard
               email: Klaus.Sussard@mail.com
           - name: mia
             password: pass_mia
             additional:
               firstName: Mia
               lastName: Bonnellac
               email: Mia.Bonnellac@mail.com

   Here you defined two users that have no explicit role assignment and will implicitly belong to the authenticated-user pseudo-role.

2. Restart your application with the command mvn spring-boot:run. In the startup logs you can observe the created mock users with their user names, roles, and passwords. They are added in addition to the built-in mock users.

   

3. Modify the HTTP request, you have used earlier to include credentials to one of the mock users:

   HTTP Copy

   ### Create Order
   
   POST http://localhost:8080/odata/v4/OrdersService/Orders
   Content-Type: application/json
   Authorization: Basic klaus:pass_klaus
   
   {
     "items": [
       {
         "book_ID": "abed2f7a-c50e-4bc5-89fd-9a00a54b4b16",
         "amount": 2
       }
     ]
   }

4. Choose Send Request above it and see that a new order is created.

The payload of the response contains the name of your user in fields createdBy and modifiedBy, provided by the managed aspect that you added to your domain model earlier.

You will now add a user role Administrators to your application.

1. Add a new mock user to the application.yaml file after the existing users as follows:

   YAML Copy

   ---
   spring:
     config.activate.on-profile: default
     sql.init.schema-locations: classpath:schema-h2.sql
   cds:
     datasource:
       auto-config.enabled: false
     security:
       mock:
         users:
           - name: klaus
             password: pass_klaus
             additional:
               firstName: Klaus
               lastName: Sussard
               email: Klaus.Sussard@mail.com
           - name: mia
             password: pass_mia
             additional:
               firstName: Mia
               lastName: Bonnellac
               email: Mia.Bonnellac@mail.com
           - name: sabine
             password: pass_sabine
             roles:
               - Administrators
             additional:
               firstName: Sabine
               lastName: Autumnpike
               email: Sabine.Autumnpike@mail.com

   Show all 30 lines Show less

   You used the attribute roles to add the Administrators role to that user.

2. Add the annotate definition at the end of the services.cds file in the srv directory to make the AdminService available only to users with an Administrators role:

   CDS Copy

   annotate AdminService @(requires: 'Administrators');