com.sap.cds:cds-feature-identity
The CAP Java feature that validates OAuth2 tokens from XSUAA and SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp and builds the request's security context from them.
Adds authentication to a CAP Java application built on com.sap.cds:cds-services-bomcom.sap.cds:cds-services-bomThe Maven bill of materials for CAP Java, pinning every com.sap.cds module in a release, from the API and core runtime to the Spring Boot starters and the CQN engine, to the same version.sap official, cap: with this dependency, org.springframework.boot:spring-boot-starter-security and the SAP BTP Spring Security Client on the classpath, and a bound XSUAA or Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp instance at runtime, the CAP Java SDK activates a Spring Security configuration that enforces authentication on every endpoint automatically. Additionally, the application must be bound to corresponding service instances depending on the scenario: XSUAA only, IAS only, or both from the same application. It stops at the token and the caller it resolves; what an authenticated caller may then do is authorizationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed, configured separately. It is what capire now names in place of com.sap.cds:cds-feature-xsuaacom.sap.cds:cds-feature-xsuaaThe CAP Java feature that validated XSUAA-issued JWTs, published up to 2.10.7 before CAP Java 3.0 removed it in favour of com.sap.cds:cds-feature-identity.sap official, cap, removed in CAP Java 3.0.
Facts
Where it sits
What it declares
Every artifact
- Type
- Package
- Origin
- By SAP
- Runtime
- Java
As a package
- Where it runs
- does not say
- Distributed through
- does not say
Connections
Establishing who is calling and making that identity available
Identity Authentication and Identity Provisioning as one tenant
OAuth server issuing JWTs and holding scopes for BTP apps
Download
Where it sits in your app
Download
Others providing
Compare all 8 on the Authentication page →- SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btpOAuth server issuing JWTs and holding scopes for BTP apps
- Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btpIdentity Authentication and Identity Provisioning as one tenant
- com.sap.cds:cds-feature-xsuaacom.sap.cds:cds-feature-xsuaaThe CAP Java feature that validated XSUAA-issued JWTs, published up to 2.10.7 before CAP Java 3.0 removed it in favour of com.sap.cds:cds-feature-identity.sap official, capFormer XSUAA JWT validation for CAP Java, removed in CAP Java 3.0
- @sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, capCAP Node.js runtime
- @sap/xssec@sap/xssecToken validation and security context for XSUAA and IAS.sap official, capToken validation and security context for XSUAA and IAS
- cds-azure-adcds-azure-adAzure AD and Azure AD B2C as a custom-defined authentication strategy for CAP through passport-azure-ad, implementing the hook capire documents so the application does not validate tokens itself.independent, capAzure AD and Azure AD B2C authentication strategy for CAP
- cds-common-jwt-supportcds-common-jwt-supportJWT authentication for CAP without xsuaa or xssec, validating tokens with jose instead, for a service that authenticates against an identity provider other than XSUAA; last released in April 2022.independent, capJWT authentication for CAP without xsuaa or xssec
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
Flavors
“CAP Java comes with a rich set of prepared modules for all different layers of the stack:” — Building Applications — capire
History in the atlas
- Activates a Spring Security configuration that enforces authentication on every endpoint once the required libraries are on the classpath and an XSUAA or Cloud Identity Services instance is bound; accepts either, or both from the same application.
- First seen.
For your agent
- Ref
artifact:cap-java-cds-feature-identity- JSON
- /artifacts/cap-java-cds-feature-identity.json
- MCP
- Connecting an agent