Security to Cloud SDK Java application

[NagaPrakashT]

Hi team,,

I am following this link to apply security settings to cloud sdk java application. This tutorials seems to be a outdated one.

https://developers.sap.com/tutorials/s4sdk-secure-cloudfoundry.html

I dint see the file path mentioned - application/src/main/webapp/WEB-INF/web.xml

In my project i can see only these folders -

application/src/main/java

application/src/main/resources

application/src/main/resources/static

Thanks,

Naga

[NagaPrakashT · Accepted solution]

This document helps for adding security for SAP Cloud SDK 3.25 version applications

https://github.com/SAP/cloud-security-xsuaa-integration/tree/master/samples/sap-java-buildpack-api-u...

Thanks,

Naga

[NagaPrakashT]

Hi mkuhr-test,

Thanks, i was exactly looking at this.

https://github.com/SAP/cloud-security-xsuaa-integration/tree/master/samples/sap-java-buildpack-api-u...

On CAP, is CAP built on SAP Cloud SDK ?

Thanks,

Naga

[mkuhr-test]

Yes CAP uses the Cloud SDK for some functionality. But I don't think that is particularly relevant for security related aspects. When it comes to securing access to your application the Cloud SDK doesn't do anything special.

So probably you are good to go with the documentation from CAP 🙂

[NagaPrakashT]

Hi mkuhr-test,

Thanks for the information, but IMHO an OUTDATED tutorial may cause too much confusion. Building a great product like SAP Cloud SDK may also need tutorials to be updated along with product updates.

Could you please let me know which is the latest version of security libraries to be downloaded

https://launchpad.support.sap.com/#/softwarecenter/search/XS_JAVA

Thanks,

Naga

[mkuhr-test]

Well it's for a different archetype but not out of date. But you can actually use a more recent version of the security libs which are public on Maven Central: https://github.com/SAP/cloud-security-xsuaa-integration/tree/master/samples/sap-java-buildpack-api-u...

When using the SAP Java Buildpack you don't even have to add any dependencies AFAIK. Also check out the documentation by CAP which is based on Spring: https://cap.cloud.sap/docs/java/advanced#authentication

[mkuhr-test]

Hi Naga, the tutorial is part of a mission where a TomEE based application is used. But from the structure you describe I assume you have a Spring based project. The tutorial doesn't cover that case yet. Did you start with an SDK archetype?

Anyhow, I'll do some digging and get back to you with a bit of information on how to change the Spring security config. Thanks for raising this!

Update:

Okay so I couldn't find an up-to-date guide on Spring security in our Cloud SDK material. There is a blog post by Philipp but that is quite outdated already and the details are not correct anymore. It may still give you a general idea. But I came across this documentation on the XS spring security libs. I recommend checking that out.

In general AFAIK there is nothing really special about the Cloud SDK in this case. You would configure security as you would with any other Spring application running on e.g. Cloud Foundry. So I think you will have to look at the documentation as we don't have dedicated material on the topic yet.

[NagaPrakashT]

Hi Matthias Kuhr,

Yes, I created project based on SAP Cloud SDK archetype https://sap.github.io/cloud-sdk/docs/java/getting-started

Thanks,

Naga

[mkuhr-test]

I expanded my answer above

[NagaPrakashT]

Thank you Gregor Wolf and submitted the feedback, but still looking for help from SAP Cloud SDK community.

[gregorw]

I would suggest that you use the "Provide Feedback" link in the tutorial and open an issue on GitHub. That is directly monitored by the SAP Developers team.