com.sap.cds:cds-feature-xsuaa
The CAP Java feature that validated XSUAA-issued JWTs, published up to 2.10.7 before CAP Java 3.0 removed it in favour of com.sap.cds:cds-feature-identity.
Validated XSUAA-issued OAuth2 tokens and built the security context for a CAP Java application built on com.sap.cds:cds-services-bomcom.sap.cds:cds-services-bomThe Maven bill of materials for CAP Java, pinning every com.sap.cds module in a release, from the API and core runtime to the Spring Boot starters and the CQN engine, to the same version.sap official, cap, as its own Maven POM described it: an API implementation to handle OAuth2 tokens (JWT) in XSUAA format. Capire's migration guide records it as a removed feature: support for XSUAA and IAS was unified under com.sap.cds:cds-feature-identitycom.sap.cds:cds-feature-identityThe CAP Java feature that validates OAuth2 tokens from XSUAA and SAP Cloud Identity Services and builds the request's security context from them.sap official, cap with the CAP Java 3.0 release. Its last published version was 2.10.7, on 2025-02-20. Applications relying on the standard security configuration and one of the CAP starter bundles were not expected to need code changes to move across; a customised security configuration had to adapt to SAP's spring-security library instead.
Facts
Where it sits
What it declares
Every artifact
- Type
- Package
- Origin
- By SAP
- Runtime
- Java
As a package
- Where it runs
- does not say
- Distributed through
- does not say
Connections
Establishing who is calling and making that identity available
Download
Others providing
Compare all 8 on the Authentication page →- SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btpOAuth server issuing JWTs and holding scopes for BTP apps
- Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btpIdentity Authentication and Identity Provisioning as one tenant
- com.sap.cds:cds-feature-identitycom.sap.cds:cds-feature-identityThe CAP Java feature that validates OAuth2 tokens from XSUAA and SAP Cloud Identity Services and builds the request's security context from them.sap official, capOAuth2 token validation from XSUAA and SAP Cloud Identity Services
- @sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, capCAP Node.js runtime
- @sap/xssec@sap/xssecToken validation and security context for XSUAA and IAS.sap official, capToken validation and security context for XSUAA and IAS
- cds-azure-adcds-azure-adAzure AD and Azure AD B2C as a custom-defined authentication strategy for CAP through passport-azure-ad, implementing the hook capire documents so the application does not validate tokens itself.independent, capAzure AD and Azure AD B2C authentication strategy for CAP
- cds-common-jwt-supportcds-common-jwt-supportJWT authentication for CAP without xsuaa or xssec, validating tokens with jose instead, for a service that authenticates against an identity provider other than XSUAA; last released in April 2022.independent, capJWT authentication for CAP without xsuaa or xssec
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
Flavors
“If your application relies on the standard security configuration by CAP Java and depend on one of the CAP starter bundles, it is expected that you won't need to adapt code.” — Migration Guides — capire
History in the atlas
- Validated XSUAA-issued JWTs and built the security context for a CAP Java application before CAP Java 3.0 removed it; applications on the standard security configuration and a CAP starter bundle needed no code changes to move to its replacement.
- First seen.
For your agent
- Ref
artifact:cap-java-cds-feature-xsuaa- JSON
- /artifacts/cap-java-cds-feature-xsuaa.json
- MCP
- Connecting an agent