►
From YouTube: User Account and Authorization Server at SAP - Martijn de Boer & Mathias Essenpreis, SAP
Description
User Account and Authorization Server at SAP - Martijn de Boer & Mathias Essenpreis, SAP
Cloud Foundry's User Account and Authorization (UAA) server is a great tool that offers many possibilities and usage options. In this session we will deep dive on how we at SAP leveraged the features of the UAA. In particular we will show how we and our enterprise customers manage platform as well as business users including an enforced a 2-Factor Authentication. Furthermore we strive on our development model and demonstrate how developers can easily integrate authentication and authorization checks into their application. Last but not least we also share our planned UAA contributions which we want to fine-tune with you.
About Martijn De Boer
Martijn de Boer is Product Owner for the Security & Crypto topics in SAP HANA XS Advanced and SAP AS ABAP. | He is working on integration of CF UAA in business applications.
About Mathias Essenpreis
Mathias Essenpreis is the head of the platform security department inside SAP. His team is providing elementary security functions to the SAP HANA Cloud Platform based on Cloud Foundry. Previously he worked 10+ years as a software developer for SAP NetWeaver security functions. He is co-author of the book "Single Sign-on mit SAP" and a regular speaker at SAP Teched conferences.
A
So
good
afternoon,
five
minutes
fast
sour.
Let's
get
started
my
session
I'm
going
to
talk
about
user
account,
an
authorization
server
and
the
experiences
we
made
that
SCP.
My
name
is
Martin
Lieber
I'm
working
as
a
product
owner
in
a
secure
encrypted
topic
for
s
AP
little
bit
closer.
We
have
been
working
as
a
platform
security
team
for
many
years,
and
since
one
and
a
half
years
we
are
looking
into
the
top
a
QA
a,
and
how
can
we
make
it
usable
for
applications.
A
So
let
me
shortly
introduce
s
AP,
so
s
AP
has
helped
hundreds
of
thousands
of
businesses
to
take
advantage
of
technology.
We
started
in
the
1970s,
starting
with
r1.
Evolving
over
r2
are
free
to
the
cloud
business
and
one
of
the
pieces
of
cloud
business
is
HCP
cloud
foundry,
which
is
using
cloud
foundry
as
a
baseline.
A
So
what
I'm
going
to
talk
about
today?
I
have
three
topics
for
you.
First
of
all,
for
those
who
don't
know
the
details
of
given
introduced,
introduction
about
cloud,
foundry
user
account
and
authorization
server
then
talk
about.
How
can
you
make
it
useful
for
applications?
So
what
mechanisms
do
we
have
to
integrate
UA
into
business
applications
and
at
the
firt
topic,
or
to
explain
what
we
have
done
at
ACP
to
simplify
integration
and
make
using
the
UA
a
really
easy.
A
So
that
means,
if
a
user,
for
instance,
locks
into
the
platform
using
the
CF
lock
in
command.
What's
happening?
Is
its
users
prompted
for
credentials
usually
using
password,
and
then
these
credentials
set
are
sent
to
the
UA?
A
the
UA
validate
will
issue
a
token,
which
then
can
be
used
to
call
different
Cloud
Foundry
components.
A
The
UA
is
very
strong
when
it
comes
to
rest
api's.
So
there
are
lots
of
API.
As
for
managing
the
different
entities
known
inside
the
UA,
a
it
is
rather
restricted
when
it
comes
to
user
user
API,
so
the
UA
a
it
has
a
P.
It
has
an
admin
UI
for
logging
in,
but
otherwise
it
doesn't
really
have
a
rich
set
of
admin.
Your
eyes,
one
of
the
aspects
that
makes
it
very
interesting
for
application
development
is
the
support
of
multi-tenancy.
A
So,
let's
start
at
authentication
the
UA
a
has
different
kind
of
mechanisms
for
authentication.
So
the
first
thing
it
has
is
an
internal
user
store.
That
means
using
this
in
turn
on
a
user
store,
you
can
authenticate
with
password
against
that
store
and
the
users
in
that
users
store
can
be
grouped
hierarchically
to
assign
authorizations
to
that
user
as
a
management
API.
There
is
a
skin
API,
which
is
an
internet
standard
for
managing
users
in
groups
and
that's
also
supported
by
the
UAE.
A
But
the
UAE
is
also
pretty
good
when
it
comes
to
integration
in
common
enterprise
standards,
for
instance,
there's
the
support
of
LDAP.
So
LDAP
is
a
common
protocol,
for
instance
supported
by
Microsoft
Active
Directory.
So
if
you
have
Microsoft
Active
Directory,
you
can
authenticate
your
users
using
username
password
against
Active
Directory.
A
You
can
do
a
mapping
of
LDAP
groups
to
the
ua8
groups
again
and
as
manage
API
management.
Api
would
directly
use
the
LDAP
protocol
so
when,
when
it
comes
to
enterprise
requirements,
the
uaa
sometimes
has
some
challenges
for
you.
So,
for
instance,
when
authenticating
with
the
internal
UAA
users,
you
can
put
the
password
policy,
but
the
UAA,
for
instance,
has
no
first
change
of
a
password
to
assume
you
have
a
password
policy
that
requires
to
change
password
every
30
days.
A
Then,
after
30
days,
the
users
will
get
locked
and
the
user
need
to
get
the
the
email
password
reset
flow
to
get
going
again.
Another
protocol
that
supported
by
the
UAA
is
sasame
protocol,
also
very
well
known
in
the
enterprise
environment,
with
the
psalm
of
2
protocol.
If
you
hit
the
UAA,
you
can
select
a
link.
I
want
to
look
on
with
my
favorite
sama
identity
provider.
Then
the
browser
would
get
redirected
to
the
sama
identity
provider
and
then
authenticate
using
the
methods
supported
by
the
sama
identity
provider,
similar
so
with
authorization.
A
A
A
What
does
it
mean
when
you
have
enterprise
requirements
like
strong
authentication,
so
the
UA
itself?
It
doesn't
have
something
like
pluggable
authentication.
That
means,
if
you
have
requirement
to
support
a
certain
kind
of
authentication,
then
you
need
to
delegate
it
to
one
of
these
standard
mechanisms
supported
by
the
UA
a
so
in
our
environment.
A
We
have
the
requirement
for
strong
authentication,
and
luckily
we
have
a
psalm
of
your
identity
provider
that
supports
a
strong
authentication,
and
so
what
we
do
is
any
kind
of
authentication
needs
to
be
delegated
to
that
some
identity
provider
for
web
applications.
This
is
rather
easy
because
it's
just
redirect
my
Asama
identity
provider.
However,
when
it
comes
to
integration
with
the
command
line
option,
then
you
need
to
go
through
CF,
login
SSO.
A
This
will
write
a
URL
to
the
UA,
a
where
you
can
then
authenticate,
and
if
this
is
configured
to
support
authentication
using
your
samel
identity
provider,
sam'l
to
identify
des
can
prompt,
two-factor
authentication.
Then
you
get
a
passcode
which
copy
into
your
command
line
and
are
then
authenticated
to
us.
Cloud
Foundry.
A
So
multi-tenancy,
so
in
application
development
multi-tenancy
frequently,
is
a
very
important
feature
if
you
want
to
share
a
certain
set
of
resources.
So
assuming
you
have
back-end
services
which
are
tenant
aware,
then
you
can
make
use
of
you
can
share
these
resources
across
multiple
tenants.
So
the
UAE
it
has
a
concept
of
identity
zones
and
an
identity
zone
is
something
that
has
own
users,
owner
or
clients
or
groups
on
identity
providers,
and
it
is
addressed
using
zone
dot,
login
dot,
your
CF
domain.
A
So
now
explained
what
about
what
functionalities
offered
by
the
UAE?
How
do
we
integrate
that
into
an
application
and
for
application
integration?
There
are
essentially
two
protocols
that
are
supported
by
the
UAE.
The
first
protocol
is
using
the
OAuth
protocol
and
JSON
web
tokens,
and
the
second
protocol
is
using
sama
2.
A
So,
let's
look
at
all
out
and
how
to
use
that
for
integration
into
web
application,
so
with
our
two
I
have
different
entities.
So
if
a
resource
owner
this
is
the
one
who's
owning
access
to
a
certain
set
of
resources,
usually
it's
a
user
and
then
I
have
an
OAuth
client.
Usually
this
is
my
application
that
does
something
on
behalf
of
a
user.
A
A
This
application
is
then
redirecting
the
user
to
the
authorization
server,
which
is
the
UA,
a
the
authorization
server.
It's
the
certain
checks
and
it
will
authenticate
the
user
and
also
in
alt
there's
a
term
of
a
scope.
The
scope
is
a
permission
for
a
user
to
access
one
or
more
resources.
So,
assuming
everything
went
wine
went
fine.
Then
the
UAE
is
redirecting
the
browser
to
the
application
and
the
application
will
now
take
the
client,
ID
and
client
secret.
A
It
has
registered
as
an
OAuth
client
will
talk
to
the
UAE
and
the
UAE
is
going
to
issue
an
access
token.
Now
the
application
received
this
access
token,
and
this
access
token
can
then
be
used
to
access
back-end
services
and
sending
this
access
token
as
an
HTTP
header.
So
in
our
world
this
is
usually
an
odious
or
a
java.
Application
could
also
be
other
kind
of
applications.
A
Okay,
the
other
option
of
integrating
is
by
using
the
sum
of
two
protocols.
So
what
has
recently
be
added
to
the
UAE
is
the
capability
to
act
as
an
identity
provider
and
when
acting
as
an
identity
provider
user
would
access
application,
it
would
get
redirected
using
the
sama
service
provider
protocols
to
the
UAE.
The
UAE
would
authenticate
the
user
issue,
Asama
assertion
and
the
samel
assertion
would
then
be
sent
back
to
the
application
and
the
application
validates
the
samel
assertion.
Assuming
everything
is
fine,
authenticates
the
user.
A
A
Developers
should
be
should
have
the
permission
to
create
all
out
clients,
but
when
it
comes
to
access
to
the
UAA,
you
need
to
be
very
careful
not
to
give
developers
to
matter
too
much
person
permissions.
So
if
you
grant
them
the
permission,
for
instance,
to
create
or
out
clients,
then
they
also
could
great
an
alt
client
having
the
admin
permission
which
you
probably
don't
want
to
do,
and
therefore
we
need
to
be
very
restrictive
on
the
permissions
we're
giving
to
developers.
A
A
A
So
what
does
the
service
broker
do?
Essentially,
applications
need
to
define
their
artifacts,
so
they
need
to
define
what
are
the
scopes
were
using
for
functional
authorization
checks?
What
are
the
attributes
were
using,
for
instance,
based
authorizations,
and
then
this
is
what
needs
to
be
passed
to
the
service
broker
and
the
mechanism
we
are
using
for
that
is
to
use
the
service
broker
parameters,
so
it
means
or
applications.
They
generate
a
service
instance,
and
then
they
pass
a
so-called
exit
security
Jason,
which
contains
information
about
scopes,
attributes,
etc.
A
A
So
does
it
look
from
development
perspective
assuming
of
my
developer,
and
this
developer
wants
to
develop
an
events,
application
and
she
says:
ok,
I-
want
to
have
something
like
an
event.
Reader
I
want
to
have
an
event
manager,
and
so
he
defines
the
role
templates
in
this
exit
security
Jason.
You
will
define
I
need
to
have
a
scope
to
read
events
and
have
scoped
comment.
Events
similar
event
manager
gets
these
events.
A
Additionally,
the
event
manager
gets
a
scope
for
managing
an
events
and
because
the
event
manager
that
one
needs
to
be
able
to
differentiate
between
different
countries
therefore
will
define
an
attribute
country.
Then
we
can
define
an
roll
event
reader,
which
is
similar
to
the
road
template,
because
it
doesn't
have
any
attributes
and
for
the
event
manager,
I
have
an
event
manager
D
for
Germany,
which
has
a
country
attribute
EE
similar.
We
have
an
event
meant
for
us
with
a
country
value
us.
A
A
Application,
router
probably
could
also
be
implement
that
using
the
routing
services,
but
we
didn't
have
a
closer
look
into
that
yet
so,
essentially,
what
the
application
router
does
is.
This
is
the
component
that
X's
ro
out
client.
So
that
means
it
very
well
integrates
with
our
service
broker,
taking
the
service
binding,
taking
the
the
data
from
the
credentials
of
the
service
binding,
and
then
it
requests
its
application
router.
The
application
router
will
check,
as
this
user
have
been
authenticated.
A
A
To
enforce
authentication
what
the
application
router
additionally
does
is
it
will
act
as
a
reverse
proxy,
sending
the
request
to
our
resource
servers
and
we
have
put
some
additional
security
functionalities
inside
the
application.
Router
one
is
CSF
protection,
so
requests
that
comes
from
the
browser
needs
to
have
a
certain
HTTP
header
set.
Otherwise
it
will
not
pass
the
application
router
and
also
what
we
do
is.
A
Good
advance
topics,
so
these
JSON
web
tokens
they're
nice,
but
sometimes
you
get
to
the
limits.
One
of
the
limit
is
if
an
application
is
using
a
lot
of
functional
authorizations,
then
this
job
token
will
grow
in
size
and
we
have
experience
in
our
cloud
foundry
environment.
Is
that
there's
a
limit
of
8
kilobyte?
So
as
soon
as
you,
beyond
that
limits,
the
job
token
is
being
blocked
by
the
CF
router
I
mean
you
can
work
around
that,
but
still
at
some
point
in
time
you
will
get
beyond
that
size
and.
A
Therefore,
what
we
are
looking
into
currently
is
two
ways.
So
if
you
have
one
one
application
calling
another
micro
service,
then
what
you'll
see
as
a
requirement
is
either
this
service
requires
a
different
set
of
scopes.
I
don't
want
to
forward
my
tokens
so
I
need
you
have
the
functionality
to
to
request
new
tokens,
and
for
that
there
is
a
it's
called
the
non-standard
or
out
of
relation
code
supported
by
you,
AAA,
which
allows
you
doing
so
thing
is.
A
Sometimes
you
have
applications
that
need
to
do
something
in
the
background
they
somehow
Scouse
holding
activities,
for
instance,
and
for
that
you
need
to
have
a
technically
user,
and
what
we're
using
for
that
is.
The
OAuth
client
can
either
do
something
on
behalf
of
the
user.
This
is
how
you
usually
know
it,
but
also
there's
a
thing
called
client
credential
flow,
where
the
OAuth
client
can
act
on
on
its
own
behalf.
A
So
we
started
with
you
a
a
one
and
a
half
years
ago.
So,
first
looking
into
trying
to
understand
it,
having
the
feeling
we
find
something
new
every
day
and
the
meantime,
we
we
start
contributing
back.
So
what
we
already
did
is
contribute
an
attribute
API,
forgetting
attributes
into
the
ua8
and
their
contributions
about
vulnerable
library
versions.
We're
currently
working
on
is
is
autumn
a
bearer
flow.
This
is,
if
you
have
server-to-server
communication,
and
you
need
to
authenticate
the
user
with
sam'l
assertion
without
using
a
browser
and
in
the
SP
area.
A
A
Coming
to
the
summary,
so
what
we
found
is
UA
can
also
be
used
for
authentication
authorization
of
business
applications,
especially
when
making
use
of
the
identity
zone
multi-tenancy
features
of
the
UA,
a
authentication
authorization.
If
you
know
the
boundary
conditions,
this
is
all
included
inside
the
UA
a,
but
to
make
it
really
usable
for
application
integration.
You
need
to
have
a
service
broker,
otherwise
it's
very
difficult
to
maintain
all
the
entities
inside
the
UAE.