CDS pluginCDS plugintypeInstalls into a CAP project and extends the runtime. CAP loads it through cds.requires or the plugin hook.See every one →What this type is →independently maintainedindependently maintainedoriginPublished by one person or a small company outside SAP. Says nothing about quality; the readings say that.See every one →
cds-common-jwt-support
JWT authentication for CAP without xsuaa or xssec, validating tokens with jose instead, for a service that authenticates against an identity provider other than XSUAA; last released in April 2022.
For a CAP service authenticating against an identity provider that is not XSUAA — the same ground as cds-azure-adcds-azure-adcds-pluginAzure AD and Azure AD B2C as a custom-defined authentication strategy for CAP through passport-azure-ad, implementing the hook capire documents so the application does not validate tokens itself.independent, cap, reached generically through jose rather than a provider SDK.
Retired2026-10the GitHub accountThis account was archived due to Github is not good for open source anymoreSoontao, GitHub profile
AuthenticationCAPAuthenticationcapabilityEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.
Theo SunTheo SunPersonMaintains this In the atlas: maintains 8, contributes to 3@Soontaomaintainer
Before choosing this
crawled
Conditions
LicenceSAP Developer License Agreement 3.2 CAP§ 1, 2, 3A cds-plugin is used with SAP CAP materials, or an artifact is explicitly identified as a CAP plugin or application.
Derived: the instrument's applicability matches this artifact, checked
§ 1License. Productive customer applications are limited to SAP BTP or another SAP-licensed platform, and mass extraction to a non-SAP product is restricted except where solely required for SAP interoperability.
§ 2Intellectual Property. The agreement retains SAP's rights in the covered materials and limits making APIs, tools or software available to third parties, while preserving ownership of customer applications subject to SAP's underlying rights.
§ 3Artificial Intelligence Training. The agreement prohibits use of the covered materials and customer applications for training artificial-intelligence models or systems.
Last released April 2022 at 0.0.2, and no repository is declared on the package.
What it declares
Every artifact
Type
CDS plugin
Origin
Independently maintained
Runtime
Node.js
declared
As a CDS plugin
Distributed through
npm
declared, How the plugin is installed into a CAP project, as its documentation says., read npm i -S cds-common-jwt-support jose — cds-common-jwt-support — README, 2026-10-18
Connections1
Group by
NodeRelationConditionBasis
Functional1
AuthenticationAuthenticationcapabilityEstablishing who is calling and making that identity availableSAP and community, narrow by design
→provides
none
authored
provides Authentication
Functional, authored
Establishing who is calling and making that identity available
AuthenticationAuthenticationcapabilityEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design
abap_jwt_generatorabap_jwt_generatorpackageGenerates a signed JSON Web Token in ABAP from an explicit header and claim, a stored profile in table ZJWT_PROFILE, or a shared secret, signing through a PSE profile or with the secret.independent, abapGenerates signed JSON Web Tokens in ABAPfrom ABAP
@arc-mcp/xsuaa-auth@arc-mcp/xsuaa-authpackageThe client-to-server authentication stack for an MCP server on SAP BTP: an XSUAA OAuth proxy, dynamic client registration, a chained bearer verifier, and a separate entrypoint for per-user principal propagation.independent, btpXSUAA authentication stack for an MCP server on SAP BTPfrom BTP/BAIP
abap-pwnedpasswordsabap-pwnedpasswordspackageChecks from ABAP whether a password appears in the Have I Been Pwned breached-password list, wrapping the Pwned Passwords API V3 in one call that answers with a boolean.independent, abapChecks passwords against Have I Been Pwned from ABAPfrom ABAP
SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceserviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btpOAuth server issuing JWTs and holding scopes for BTP appsfrom BTP/BAIP
Cloud Identity ServicesCloud Identity ServicesserviceIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btpIdentity Authentication and Identity Provisioning as one tenantfrom BTP/BAIP
SAP Customer Identity and Access Management for B2CSAP Customer Identity and Access Management for B2CserviceSAP's customer identity service: registration, login and consent for the users of a company's websites and apps, kept in one profile per customer, with regional data storage and risk-based authentication as options.sap official, btpRegistration, login and consent for customer-facing sitesfrom BTP/BAIP
OAuth 2.0 on SAP BTPOAuth 2.0 on SAP BTPserviceOAuth 2.0 protection for applications and APIs on SAP BTP, listed in Neo regions: the authorization code grant for web applications and the client credentials grant for API and IoT scenarios.sap official, btpOAuth 2.0 grant flows for applications and APIs in Neo regionsfrom BTP/BAIP
com.sap.cds:cds-feature-identitycom.sap.cds:cds-feature-identitypackageThe CAP Java feature that validates OAuth2 tokens from XSUAA and SAP Cloud Identity Services and builds the request's security context from them.sap official, capOAuth2 token validation from XSUAA and SAP Cloud Identity Servicesfrom CAP
com.sap.cds:cds-feature-xsuaacom.sap.cds:cds-feature-xsuaapackageThe CAP Java feature that validated XSUAA-issued JWTs, published up to 2.10.7 before CAP Java 3.0 removed it in favour of com.sap.cds:cds-feature-identity.sap official, capFormer XSUAA JWT validation for CAP Java, removed in CAP Java 3.0from CAP
abapOAuthAzureabapOAuthAzurepackageAn Enhancement Spot OA2C_SPECIFICS implementation for Microsoft Azure, written against ABAP's OAuth 2.0 Client API, with a one-sentence README that leaves configuration to SAP's help page.independent, abapOA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAPfrom ABAP
abap2oauth2abap2oauth2packageAn ABAP API for OAuth 2.0 authentication that registers a provider's client ID and secret as a named consumer and implements signature method 3, the one Google uses.independent, abapABAP API for OAuth 2.0 authenticationfrom ABAP
abapNTLMabapNTLMpackageAn HTTP NTLM client for ABAP, with the RC4, MD4 and DES algorithms the protocol needs implemented in ABAP, which its maintainer says seems to work only some of the time.independent, abapHTTP NTLM client for ABAPfrom ABAP
abap_cloud_platformabap_cloud_platformpackageA TypeScript library of the Cloud Foundry calls that walk down to an ABAP service instance, read its SAP_ADT service key and log a user in, so a tool outside the system can reach it.independent, btpTypeScript library reaching ABAP service instances on Cloud Foundryfrom BTP/BAIP
decodesapsso2decodesapsso2packageA TypeScript library that decodes a MYSAPSSO2 logon ticket into its user, client, system and validity fields, and returns the signature without validating it, so it never shows a ticket is genuine.independent, abapTypeScript decoder for MYSAPSSO2 logon ticketsfrom ABAP
@marianfoo/sap-mcp-auth@marianfoo/sap-mcp-authpackageA shared browser-login and session module for SAP MCP servers: it drives a Playwright browser through SAP Identity Authentication, caches the session cookies and returns a cookie header an HTTP client can send.independent, btpBrowser login and session module for SAP MCP serversfrom BTP/BAIP
@sap/approuter@sap/approuterappSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btpSAP's Node.js application router in front of business applicationsfrom BTP/BAIP
@sap/cds@sap/cdspackageThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, capCAP Node.js runtimefrom CAP
Cloud ConnectorCloud ConnectorappSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btpSAP's on-premises agent linking SAP BTP to customer-network systemsfrom BTP/BAIP
@sap/xssec@sap/xssecpackageToken validation and security context for XSUAA and IAS.sap official, capToken validation and security context for XSUAA and IASfrom CAP
cds-azure-adcds-azure-adcds-pluginAzure AD and Azure AD B2C as a custom-defined authentication strategy for CAP through passport-azure-ad, implementing the hook capire documents so the application does not validate tokens itself.independent, capAzure AD and Azure AD B2C authentication strategy for CAPfrom CAP
@saptools/cf-xsuaa@saptools/cf-xsuaacliA command line and Node.js API that reads the XSUAA binding of a Cloud Foundry app and prints an OAuth2 client_credentials token for it, cached until it expires.independent, btpOAuth2 token fetcher for a Cloud Foundry app's XSUAA bindingfrom BTP/BAIP
abap-aws-sigv4abap-aws-sigv4packageSigns outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.independent, abapSigns outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.from ABAP
README.mdquoted, and what the entry declareschecked
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
runtimesnode
latestv0.0.2
first release
releases and cadence2
discovered vianpm registry · keywords:cds
first seen in the atlas
ecosystem and domaincap, security-and-compliance
History in the atlas2
The maintainer's GitHub profile states that the account was archived (profile changed 2026-10-11); the repositories are gone and the package stays published on npm. His words, quoted and dated, in the field made for a maker's statement about an end; nothing written about the person.
