{"ref":"artifact:miyasuta-auth-transport","page":"/artifacts/miyasuta-auth-transport","json":"/artifacts/miyasuta-auth-transport.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"miyasuta-auth-transport","name":"auth-transport","artifact_type":"app","ecosystem":"btp","domain":"operations-and-runtime","origin_ring":"independent","use_as":"starting-point","description":{"one_line":"A UI5 app and a CAP service that copy custom role collections from one SAP BTP subaccount to another over the Authorization and Trust Management API, published by its author as a proof of concept rather than for productive use.","short":"UI5 app and CAP service copying role collections between subaccounts","what_it_solves":"A UI5 app and a CAP service behind a standalone approuter call the [SAP Authorization and Trust Management service](artifact:btp-authorization-and-trust-management) API through destinations registered for a source and a target subaccount: the definition of the named role collections is read from the source, the application identifier suffix in each role reference is swapped for the target's, and the result is posted, creating the role collection there or updating one already present. That suffix is also the boundary, because standard roles such as WorkflowAdmin get their own application identifiers and those vary by service, so role collections built from them cannot be transported this way; the role collections in the source subaccount also have to have been maintained by hand. Setting it up means a deploy to Cloud Foundry, xsuaa instances on the apiaccess plan in both subaccounts, and an [SAP HANA Cloud](artifact:btp-hana-cloud) instance in the source. The repository's own README is the one cds init writes, so [Transporting role collections between BTP subaccounts Part1 : Custom tool](https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208) is where the tool and its setup are described.","to_build_on_it":"[Mio Yasutake](actor:mio-yasutake) calls the state of it a minimum viable product and names what is missing: transport logs, authentication and authorisation checks, validation that the destinations exist in the source subaccount and that the roles behind an entered role collection exist in the target, and choosing role collections from a list rather than typing them."},"links":{"repo":"https://github.com/miyasuta/auth-transport"},"type_properties":{"placement":{"value":"on-btp","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"Clone the code from GitHub , build and deploy to Cloud Foundry"}]}},"interfaces":[{"key":"web-ui","kind":"ui","direction":"in","for":"Maintaining the pairs of destination and application identifier suffix, and selecting the source, the target and the role collections of a transport.","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"1. Open the approuter URL\nYou will see below screen."},{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"Go to Settings>Maintain Destinations. Here you register combinations of destination and suffix."}]}],"provides":[{"capability":"capability:account-provisioning","what_it_does":"Reads a custom role collection's definition from one subaccount over the Authorization and Trust Management API, replaces the application identifier suffix in each role reference with the target subaccount's, and creates or updates the role collection there.","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"The idea is to use Authorization and Trust management Service API to create and update role collections in a target subaccount. Based on the role collection settings of the source subaccount, the tool will create or update a role collection with the same settings in the target subaccount."}]}],"requires":[{"ref":"artifact:btp-authorization-and-trust-management","for":"The API the tool calls in both subaccounts, to read a role collection's definition in the source and to create or update it in the target. Its apiaccess plan is what the calls are made with.","requirement":"required","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"The idea is to use Authorization and Trust management Service API to create and update role collections in a target subaccount."},{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"2. Create xsuaa service instances with plan \"apiaccess\" in source and target subaccounts"}]},{"ref":"artifact:sap-approuter","for":"The entry point the UI5 app and the CAP service are served behind, and the URL a user opens the tool at.","requirement":"required","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"UI5 app and CAP are running behind a standalone approuter"}]},{"ref":"artifact:btp-destination","for":"The source and the target subaccount are each reached through a destination that points at the Authorization and Trust Management API and carries the client credentials of that subaccount's service key.","requirement":"required","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"4. Create destinations pointing to Authorization and Trust Management API referencing the service keys"}]},{"ref":"artifact:btp-hana-cloud","for":"An instance in the source subaccount is one of the prerequisites the setup lists, before the tool is deployed.","requirement":"required","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"HANA Cloud instance has been created in the source subaccount."}]}],"connects":[{"ref":"artifact:btp-authorization-and-trust-management","kind":"data","direction":"outbound","via":"artifact:btp-destination","for":"Reads the definition of the role collections to be transported from the source subaccount and posts them to the target subaccount.","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"CAP calls\n- the API in the source subaccount to extract the definition of role collections to be transported\n- the API in the target subaccount to create or update role collections there"},{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208","title":"Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community","checked":"2026-10-19","quote":"Destinations pointing to Authorization and Trust Management API in source and target subaccounts are registered"}]}],"maintainers":["actor:mio-yasutake"],"contributors":["actor:mio-yasutake"],"provenance":{"discovered_via":[{"source":"source:github-orgs","channel":"miyasuta"}],"first_seen":"2026-10-08"},"drafted_with_ai":true},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"unknown","evidence":"no release data"},{"label":"Continuity","tier":"fair","evidence":"one contributor, personally owned"},{"label":"Repository","tier":"poor","evidence":"pushed 2022-03, not archived"}],"compatibility":[{"label":"Declared for","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Survived majors","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Maintainer's CI","tier":"fair","evidence":"no CI configured"}],"practice":[{"label":"Tests","tier":"good","evidence":"1 test file"},{"label":"Docs","tier":"poor","evidence":"README 1 KB"},{"label":"Changelog","tier":"fair","evidence":"none in the repo"}],"reach":[{"value":null,"unit":"installs/week"},{"value":4,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-25","npm":"not published under this name","stars":4,"forks":2,"open_issues":0,"archived":false,"pushed_at":"2022-03-29","license_spdx":null,"org_owned":false,"default_branch":"master","created_at":"2022-03-06T20:06:29Z","open_prs":0,"tree_truncated":false,"test_files":1,"workflows":0,"other_ci":false,"readme_bytes":675,"docs_files":0,"changelog":false,"license_file":false,"dts_files":0,"first_commit":"2022-02-22","last_commit":"2022-03-29","commits":10,"contributors":1,"readme_path":"README.md","readme_sha":"d18474235339ae351787f5d911596633cb257612","repo_read":"2026-10-25"},"edges":{"maintainers":[{"ref":"actor:mio-yasutake","name":"Mio Yasutake","json":"/actors/mio-yasutake.json"}],"contributors":[{"ref":"actor:mio-yasutake","name":"Mio Yasutake","json":"/actors/mio-yasutake.json"}],"explained_by":[],"alternative_to_this":[{"ref":"artifact:miyasuta-auth-transport2","name":"auth-transport2","json":"/artifacts/miyasuta-auth-transport2.json"}],"needed_by":[],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}