AppAppAn application you deploy and use, installed into a system or loaded into an application as a component, rather than a library whose functions you call.See every one →What this type is →independently maintainedindependently maintainedPublished by one person or a small company outside SAP. Says nothing about quality; the readings say that.See every one →Starting point
auth-transport
A UI5 app and a CAP service that copy custom role collections from one SAP BTP subaccount to another over the Authorization and Trust Management API, published by its author as a proof of concept rather than for productive use.
A UI5 app and a CAP service behind a standalone approuter call the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp API through destinations registered for a source and a target subaccount: the definition of the named role collections is read from the source, the application identifier suffix in each role reference is swapped for the target's, and the result is posted, creating the role collection there or updating one already present. That suffix is also the boundary, because standard roles such as WorkflowAdmin get their own application identifiers and those vary by service, so role collections built from them cannot be transported this way; the role collections in the source subaccount also have to have been maintained by hand. Setting it up means a deploy to Cloud Foundry, xsuaa instances on the apiaccess plan in both subaccounts, and an SAP HANA CloudSAP HANA CloudThe managed database under most of this: CAP's default target, the store Datasphere and Analytics Cloud sit on, and a service with plans and components.sap official, btp instance in the source. The repository's own README is the one cds init writes, so Transporting role collections between BTP subaccounts Part1 : Custom tool is where the tool and its setup are described.
Facts
Last push
Where it sits
Lives in
Provides
Account provisioningBTPAccount provisioningSetting up cloud accounts, their organisational structure, resource entitlements, subscriptions and access assignments so the setup can be repeated from code. [Deployment](capability:deployment) puts an application onto a runtime that this account structure makes available.
Requires
SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe API the tool calls in both subaccounts, to read a role collection's definition in the source and to create or update it in the target. Its apiaccess plan is what the calls are made with.@sap/approuter@sap/approuterThe entry point the UI5 app and the CAP service are served behind, and the URL a user opens the tool at.SAP Destination serviceSAP Destination serviceThe source and the target subaccount are each reached through a destination that points at the Authorization and Trust Management API and carries the client credentials of that subaccount's service key.SAP HANA CloudSAP HANA CloudAn instance in the source subaccount is one of the prerequisites the setup lists, before the tool is deployed.
Who is behind it
Mio YasutakeMio YasutakeMaintains this
In the atlas: maintains 47, contributes to 47, wrote 10@miyasutamaintainer
In the atlas: maintains 47, contributes to 47, wrote 10@miyasutamaintainer
Before choosing this
Signals
ActivityQuietNo published releases; repository quiet for 54 months
It publishes no releases, and its repository has been quiet for at least 24 full months. This may be normal for stable software; check whether its current state still fits your use.
LicenceNo licenseNeither the package manifest nor the repository tree declares a licence
Without a licence the default is all rights reserved. Ask the maintainer, or check for terms stated elsewhere, before depending on it.
What it declares
Every artifact
- Type
- App
- Origin
- Independently maintained
As an app
- Where it runs
- On SAP BTP
- Distributed through
- does not say
Connections
Group by
NodeRelationBasis
Functional
auth-transport2auth-transport2MTA projects sharing a role collection across role templatesindependent, btp
alternative to
derived
alternative to auth-transport2
MTA projects sharing a role collection across role templates
Account provisioningAccount provisioningSetting up cloud accounts, entitlements and access from codeSAP and community, unassessed
provides
stated
provides Account provisioning
Reads a custom role collection's definition from one subaccount over the Authorization and Trust Management API, replaces the application identifier suffix in each role reference with the target subaccount's, and creates or updates the role collection there.
“The idea is to use Authorization and Trust management Service API to create and update role collections in a target subaccount. Based on the role collection settings of the source subaccount, the tool will create or update a role collection with the same settings in the target subaccount.”
Setting up cloud accounts, entitlements and access from code
Technical
SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceOAuth server issuing JWTs and holding scopes for BTP appssap official, btp
connects to
stated
connects to SAP Authorization and Trust Management service
Reads the definition of the role collections to be transported from the source subaccount and posts them to the target subaccount.
“CAP calls
- the API in the source subaccount to extract the definition of role collections to be transported
- the API in the target subaccount to create or update role collections there”“Destinations pointing to Authorization and Trust Management API in source and target subaccounts are registered”
OAuth server issuing JWTs and holding scopes for BTP apps
@sap/approuter@sap/approuterSAP's Node.js application router in front of business applicationssap official, btp
needs
stated
needs @sap/approuter
The entry point the UI5 app and the CAP service are served behind, and the URL a user opens the tool at.
“UI5 app and CAP are running behind a standalone approuter”
SAP's Node.js application router in front of business applications
SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceOAuth server issuing JWTs and holding scopes for BTP appssap official, btp
needs
stated
needs SAP Authorization and Trust Management service
The API the tool calls in both subaccounts, to read a role collection's definition in the source and to create or update it in the target. Its apiaccess plan is what the calls are made with.
“The idea is to use Authorization and Trust management Service API to create and update role collections in a target subaccount.”“2. Create xsuaa service instances with plan "apiaccess" in source and target subaccounts”
OAuth server issuing JWTs and holding scopes for BTP apps
SAP Destination serviceSAP Destination serviceNamed, credentialed addresses of other systems resolved at runtimesap official, btp
needs
stated
needs SAP Destination service
The source and the target subaccount are each reached through a destination that points at the Authorization and Trust Management API and carries the client credentials of that subaccount's service key.
“4. Create destinations pointing to Authorization and Trust Management API referencing the service keys”
Named, credentialed addresses of other systems resolved at runtime
SAP HANA CloudSAP HANA CloudManaged SAP HANA database service on BTPsap official, btp
needs
stated
needs SAP HANA Cloud
An instance in the source subaccount is one of the prerequisites the setup lists, before the tool is deployed.
“HANA Cloud instance has been created in the source subaccount.”
Managed SAP HANA database service on BTP
Download
Where it sits in your app
Download
auth-transportA UI5 app and a CAP service that copy custom role collections from one SAP BTP subaccount to another over the Authorization and Trust Management API, published by its author as a proof of concept rather than for productive use.independent, btp
@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btp
SAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp
SAP Destination serviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp
SAP HANA CloudThe managed database under most of this: CAP's default target, the store Datasphere and Analytics Cloud sit on, and a service with plans and components.sap official, btp
auth-transport → SAP Authorization and Trust Management serviceStated in the document, data, outbound, via SAP Destination serviceReads the definition of the role collections to be transported from the source subaccount and posts them to the target subaccount.
auth-transport → @sap/approuterDocumented onlyThe entry point the UI5 app and the CAP service are served behind, and the URL a user opens the tool at.
auth-transport → SAP Destination serviceDocumented onlyThe source and the target subaccount are each reached through a destination that points at the Authorization and Trust Management API and carries the client credentials of that subaccount's service key.
auth-transport → SAP HANA CloudDocumented onlyAn instance in the source subaccount is one of the prerequisites the setup lists, before the tool is deployed.
@sap/approuter → SAP Authorization and Trust Management serviceDocumented only, authentication, OAuth 2.0, outboundLogging a user in on the routes that require it: the router runs the OAuth2 authorization code flow against the UAA and takes the redirect back at its login callback endpoint.
@sap/approuter → SAP Destination serviceDocumented only, data, outboundReading the configuration of the destination a route forwards to, where the router's own environment does not define it.
SAPnot SAP's, or the project's ownauthenticationstated in the documentdocumented only
README
quoted from miyasuta/auth-transport, readmiyasuta/auth-transport/README.mdthe maintainer’s wordsOn GitHub
Getting Started
Welcome to your new project.
It contains these folders and files, following our recommended project layout:
| File or Folder | Purpose |
|---|---|
app/ | content for UI frontends goes here |
db/ | your domain models and data go here |
srv/ | your service models and code go here |
package.json | project metadata and configuration |
readme.md | this getting started guide |
Others providing
Compare all 7 on the Account provisioning page →Declared alternative
- auth-transport2auth-transport2Three MTA projects that declare a role collection in one xs-security.json out of role templates owned by the other two, so it can be transported rather than recreated in each subaccount.independent, btpMTA projects sharing a role collection across role templates
Account provisioningAccount provisioningSetting up cloud accounts, their organisational structure, resource entitlements, subscriptions and access assignments so the setup can be repeated from code. Deployment puts an application onto a runtime that this account structure makes available.SAP and community, unassessed
- SAP Cloud Management Service for SAP BTPSAP Cloud Management Service for SAP BTPREST APIs for the administration of a BTP account: directories and subaccounts, entitlements and quotas, subscriptions to multitenant applications, environment instances, and the events those operations raise.sap official, btpREST APIs for administering a BTP accountfrom BTP/BAIP
- SAP Service ManagerSAP Service ManagerThe BTP registry for service brokers and environments: consumes SAP BTP services from any connected runtime environment, tracks the service instances created, and shares them between environments.sap official, btpRegistry for service brokers, instances and environments on SAP BTPfrom BTP/BAIP
- BTP MCP ServerBTP MCP ServerBTP Core Services as MCP tools, and the only server in this corner that renders dashboards inside the chat — a subaccount overview with drill-down, a geomap of data-centre locations, consumption and users.independent, btpBTP Core Services as MCP tools with in-chat dashboardsfrom BTP/BAIP
- MCP Server for SAP BTP AdministrationMCP Server for SAP BTP AdministrationSAP-hosted MCP endpoint that exposes BTP account administration — accounts, security, services and connectivity — as tools an AI client discovers and calls on your behalf.sap official, btpSAP-hosted MCP endpoint for BTP account administrationfrom BTP/BAIP
- btp-setup-automatorbtp-setup-automatorA containerised script that sets up an SAP BTP account from JSON configuration files: entitlements, subscriptions, service instances, administrators and role collections, instead of clicking through the cockpit.sap official, btpContainerised script setting up an SAP BTP account from JSON configfrom BTP/BAIP
- Terraform Provider for SAP BTPTerraform Provider for SAP BTPThe plugin that lets a Terraform or OpenTofu configuration manage the resources of an SAP BTP global account, from directories and subaccounts to entitlements, role collections and subscriptions.sap official, btpTerraform and OpenTofu provider for SAP BTP global accountsfrom BTP/BAIP
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
discovered viaGitHub organisations and accounts · miyasuta
first seen in the atlas
ecosystem and domainbtp, operations-and-runtime
History in the atlas
- First seen.
For your agent
- Ref
artifact:miyasuta-auth-transport- JSON
- /artifacts/miyasuta-auth-transport.json
- MCP
- Connecting an agent