CAP: XSUAA and IAS

[kammaje_cis]

I am asking this question in the context of a CAP application.

Obviously even after reading lots of documentation about XSUAA and IAS, I am confused. Apologies for a newbie question here.

It will be great if you can validate my below understanding.

• XSUAA is a service available on SCP (only on CF) for authentication and authorization management. You can plugin your own Identity Provider (IDP) in SCP. When you deploy the CAP MTA, it creates an instance of XSUAA service and binds this instance to app/srv/db applications.
• IAS is a service available on SCP (both CF and Neo) for authentication and authorization management. You can plugin your own Identity Provider (IDP) in SCP. This service can be used by any app deployed on SCP.

So I am confused on

• What is the difference between these two services (XSUAA & IAS)?
• Do I need a subscription of both XSUAA and IAS service once I deploy my CAP app?

Any comments are useful.

[matthias_buehl · Accepted solution]

Hi Krishna,

from a technical perspective the IAS is doing user authentication and issues SAML Tokens.

XSUAA is not only issuing JWT tokens for users that are needed for within CF but also is used as OAuth Server and issues tokens for the communication between different CF micro services.

Best regards

Matthias

[kammaje_cis · Accepted solution]

Thanks, Matthias. That helped.
So if I have to deploy a CAP service to SCP, subscribing to SCP's XSUAA service is mandatory isn't it?

[gregorw · Accepted solution]

If you want to have authentication for your app, yes.

But it isn't necessary to have IAS in the game as you can configure also directly your own SAML2 compatible IdP i.e. Azure AD or Azure AD B2C with the SAP CP Cloud Foundry subaccount.

[gregorw]

Dear Krishna,

IAS as an Identity Provider (IdP) does execute the authentication of the user and can provide group membership information and other attributes. For an explanation of XSUAA please check out the Cloud Foundry documentation on User Account and Authentication (UAA) Server.

Best regards
Gregor

[kammaje_cis]

Thanks, Gregor. So you are saying SCP IAS == SAP IDP?

[gregorw]

Don't mix it up with SAP ID. SAP ID (https://accounts.sap.com/) is an instance/tenant of SAP CP Identity Authentication Service (IAS). And IAS is acting in the SAML authentication flow as the Identity Provider (IdP).