Secure a CAP Application with SAP Cloud Identity Services

This step includes creating an application in SAP Build Lobby.

1. In the SAP Build Lobby, click Create > Create to start the creation process.

   

2. Click the Application tile.

   

3. Select the Full-Stack category.

   

4. Select Full-Stack Node.JS to develop your full-stack application, based on the SAP Cloud Application Programming Model (CAP), in SAP Business Application Studio.

   

5. Enter the project name, add a description (optional), select the dev space where you want the project to reside, and then click Review.

   

6. Review the inputs under the Summary tab. If everything looks correct, click Create to proceed with creating your project.

7. Your project is created in the Project table of the lobby. The creation of the project may take a few moments. After the project has been created successfully, click the project to open it.

   

8. The project opens in SAP Business Application Studio.

   

The bookshop application is initiated. You will now add sample files.

1. Find the hamburger icon in the menu on the left side of the screen. Select Terminal, and then select New Terminal.

   

2. In the Terminal, enter cds add sample.

   This adds the sample Node.js application.

   

You have to add the package.json file and its relevant dependencies.

1. Enter cds add ams --for production

   The dependencies and devDependencies are added and the authorization type is set to ias.

   

   Note that it is good practice to test the policies and integration before deploying the application.

   You can directly assign policies to CAP mock users in the cds environment. See policies test for more information.

   Then, write a standard unit test against the CAP service to verify that the role assignment by the policy works as expected. See admin test for more information.

2. Enter npm i to install the dependencies defined in the package.json file. This adds the node_modules folder.

3. Enter cds build --for ams to create the ams folder, with all the required roles.

   

   See Configuring Authorization Policies for more information about authorization policies.

1. Enter cds add approuter to add the approuter, which will enable you to create a secure route to your application.

2. Enter npm i again to have the right dependencies defined and fixed for the build.

To enable SAP Fiori preview, add the following configuration in the package.json file of your bookshop project in VS Code:

    "cds": {
      "fiori": {
        "preview": true
      },
      "server": {
        "index": true
      },
    }

This updates the file with the Fiori and server parameters.

Before you can deploy, you have to log in with your credentials and also ensure that you have an SAP HANA Cloud database running in your subaccount.

1. Log on to your subaccount with its appropriate API Endpoint; you can find that here:

   

   cf l -a api.cf.us10-001.hana.ondemand.com --sso

2. Learn more about starting the SAP HANA database in this tutorial.

3. Enter cds up to deploy the application.

To test your application and make sure it’s reachable, open your application from your subaccount’s space in SAP BTP cockpit.

1. Go to Subaccount > Cloud Foundry > Spaces.

   

2. Choose your Space and click on bookshop.

   

3. Choose the displayed application router link.

   

4. The bookshop application is displayed. Under /odata/v4/catalog, choose ListOfBooks.

   

   The following list is displayed.

   

5. Go back to the application by using the back button on the browser. Now, under /odata/v4/admin, choose Books to see some information about each book.

   

   You see the following error message. This is because of missing authorizations.

   

1. As the admin of your SAP Cloud Identity Services tenant, open the admin console.

2. Under Applications & Resources > Applications, find the bookshop application.

3. Then, under the Authorization Policies tab, open the admin policy.

   

4. Add your user to the admin policy.

   

   Note that it takes a few minutes for the policy to apply.

Choose the link again to log on to the bookshop application once more and under /odata/v4/admin, choose Books again. This time, you see the information about each book.