SAP-samples/application-vulnerability-report-scan-user-automation

BTP Technical User Assignment Script Example

Description

This script is a helper script for the Application Vulnerability Report for SAP BTP. It assigns the required technical user as SpaceAuditor to all spaces in all Cloud Foundry (CF) organizations within a BTP global account.

It should be used as an example and adapted as needed. Use it on your own risk after reviewing the code.

• Technical user: application-vulnerability-report-scanner@sap.com
• Works on macOS and Windows

Requirements

• macOS or Windows system with Python 3 installed (Python >= 3.13) (Get Python)
• Installed CLIs:
  • BTP CLI (Download)
  • Cloud Foundry (CF) CLI (Installation guide)
• Permissions:
  • Org Manager role in each relevant CF organization
  • Space Manager role in each relevant space
• Single Sign-On (SSO) access for BTP and CF

Download and Installation

Download the script file add_technical_user_to_spaces.py from the repository to your local machine. Then run the following command to start the script:

python3 add_technical_user_to_spaces.py

On start, the script asks for the BTP CLI URL. Either choose production, canary or provide a custom URL.

It then initiates BTP SSO login. For that a browser window will open.

After successful login, select the target global account.

After that it will run the btp target command so that you will be able to change the global account later if needed. If you don't want to change, just press Enter.

The script will then automatically:

• List all subaccounts in the global account.
• For each subaccount with CF environment:
  • List all CF instances (endpoints).
  • For each CF instance:
    • Log in to the CF endpoint via SSO. You need to open the link in a browser and copy the code back to the terminal. This happens for each CF endpoint you have access to.
    • List all organizations.
    • For each organization:
      • List all spaces.
      • For each space:
        • Assign the technical user as SpaceAuditor.

At the end a summary is printed with counts of processed subaccounts, CF instances, organizations, spaces, successful assignments, and any errors encountered.

Troubleshooting

• BTP login fails:
  • Check network/SSO and retry: btp login --url https://cli.btp.cloud.sap/ --sso.
• No subaccounts found / parsing errors:
  • Use the latest BTP CLI; table outputs may change.
  • Test with: btp list accounts/subaccounts and verify headers.
• "Authorization failed" for environment instances:
  • You lack subaccount permissions. The script will skip the subaccount and list it in the summary.
• CF login fails:
  • Check CF SSO and endpoint, try manually: cf login -a <api> --sso.
• No spaces listed:
  • Verify you’re Org Manager or Space Manager in the organization.

How to obtain support

Create an issue in this repository if you find a bug or have questions about the content.

For additional support, ask a question in SAP Community.

Contributing

More information about contributing can be found here.

License

Copyright (c) 2026 SAP SE or an SAP affiliate company. All rights reserved. This project is licensed under the Apache Software License, version 2.0 except as noted otherwise in the LICENSE file.