SampleSampleA worked example you read or clone. Evidence: it demonstrates, it never provides.See every one →What this type is →independently maintainedindependently maintainedPublished by one person or a small company outside SAP. Says nothing about quality; the readings say that.See every one →
cap-ams-a2a
Four app-to-app configurations between CAP Java and CAP Node.js under AMS and IAS, each recording which destination setup makes user propagation and token validation hold.
Consumer and provider are swapped across runtimes and run twice — once with separate IAS applications and a declared dependency, once sharing a single IAS application with none. Each run has its own log and sequence diagram under docs/. Written in Japanese.
Facts
Last push
Where it sits
Lives in
Demonstrates
AuthenticationCAPAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.AuthorizationCAPAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.DestinationsCAPDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.
Who is behind it
Mio YasutakeMio YasutakeMaintains this
In the atlas: maintains 47, contributes to 47, wrote 10@miyasutamaintainer
In the atlas: maintains 47, contributes to 47, wrote 10@miyasutamaintainer
Before choosing this
Signals
LicenceNo licenseNeither the package manifest nor the repository tree declares a licence
Without a licence the default is all rights reserved. Ask the maintainer, or check for terms stated elsewhere, before depending on it.
What it declares
Every artifact
- Type
- Sample
- Origin
- Independently maintained
As a sample
- Form
- does not say
Connections
Group by
NodeRelationBasis
Functional
AuthenticationAuthenticationEstablishing who is calling and making that identity availableSAP and community, narrow by design
demonstrates
authored
demonstrates Authentication
Establishing who is calling and making that identity available
AuthorizationAuthorizationDeciding who may read or change what, down to instance levelSAP and community, unassessed
demonstrates
authored
demonstrates Authorization
Deciding who may read or change what, down to instance level
DestinationsDestinationsReaching remote systems without addresses or credentials in the codeSAP and community, unassessed
demonstrates
authored
demonstrates Destinations
Reaching remote systems without addresses or credentials in the code
Download
Architecture
as 2 deployment descriptors state it at ce64033, readcap-ams-javacap-ams-java/mta.yaml
Download
Cloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp
SAP Destination serviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp
cap-ams-java → Cloud Identity ServicesStated in the descriptor, authentication, outbound, under a conditionLogging a user in against Identity Authentication: a route whose authenticationType is
ias redirects to the IAS login.If A route sets authenticationType to ias.cap-ams-java → cap-ams-java-srvStated in the descriptor, datamta.yaml, module cap-ams-java, requires srv-api
cap-ams-java → SAP Destination serviceStated in the descriptor, data, outboundReading the configuration of the destination a route forwards to, where the router's own environment does not define it.
SAPnot SAP's, or the project's ownauthenticationstated in the document
Bound, and not drawn
- cap-ams-java-srvCloud Identity Services, SAP Destination service
- cap-ams-java-ams-policies-deployerCloud Identity Services
Documented, with no instance in the document
- @sap/approuter requires SAP Authorization and Trust Management servicecap-ams-javaAuthenticating the user on the routes configured to require it: the router binds to it as the UAA server, or to Cloud Identity Services instead.@sap/approuter 23.0.0 — README, user authentication
The User Account and Authentication (UAA) server is responsible for user authentication.
- @sap/approuter requires SAP Connectivity servicecap-ams-javaForwarding to an on-premise backend: the binding is required once a destination sets its ProxyType to on-premise.@sap/approuter 23.0.0 — README, destination ProxyType
if ProxyType set to `on-premise`, binding to SAP Cloud Platform connectivity service is required.
- @sap/approuter requires SAP HTML5 Application Repository service for SAP BTPcap-ams-javaServing static content from the repository rather than from the router's own folder. Bound, both the files and the xs-app.json routes come from there.@sap/approuter 23.0.0 — README, Integration with HTML5 Application Repository
When the application router interacts with HTML5 Application Repository to serve HTML5 Applications, all static content and routes (xs-app.json) are retrieved from HTML5 Application Repository.
cap-ams-nodecap-ams-node/mta.yaml
Download
Cloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp
SAP Destination serviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp
cap-ams-node-srv → Cloud Identity ServicesStated in the descriptor, authentication, OpenID Connect, HTTP, outboundValidating the JWT a request carries against Identity Authentication: the module reads the OIDC configuration from the tenant's
.well-known endpoint and then its JWKS.cap-ams-node → Cloud Identity ServicesStated in the descriptor, authentication, outbound, under a conditionLogging a user in against Identity Authentication: a route whose authenticationType is
ias redirects to the IAS login.If A route sets authenticationType to ias.cap-ams-node → cap-ams-node-srvStated in the descriptor, datamta.yaml, module cap-ams-node, requires srv-api
cap-ams-node → SAP Destination serviceStated in the descriptor, data, outboundReading the configuration of the destination a route forwards to, where the router's own environment does not define it.
SAPnot SAP's, or the project's ownauthenticationstated in the document
Bound, and not drawn
- cap-ams-node-srvSAP Destination service
- cap-ams-node-ams-policies-deployerCloud Identity Services
Documented, with no instance in the document
- @sap/xssec requires SAP Authorization and Trust Management servicecap-ams-node-srv
- @sap-cloud-sdk/connectivity requires SAP Connectivity servicecap-ams-node-srv
- @sap/approuter requires SAP Authorization and Trust Management servicecap-ams-nodeAuthenticating the user on the routes configured to require it: the router binds to it as the UAA server, or to Cloud Identity Services instead.@sap/approuter 23.0.0 — README, user authentication
The User Account and Authentication (UAA) server is responsible for user authentication.
- @sap/approuter requires SAP Connectivity servicecap-ams-nodeForwarding to an on-premise backend: the binding is required once a destination sets its ProxyType to on-premise.@sap/approuter 23.0.0 — README, destination ProxyType
if ProxyType set to `on-premise`, binding to SAP Cloud Platform connectivity service is required.
- @sap/approuter requires SAP HTML5 Application Repository service for SAP BTPcap-ams-nodeServing static content from the repository rather than from the router's own folder. Bound, both the files and the xs-app.json routes come from there.@sap/approuter 23.0.0 — README, Integration with HTML5 Application Repository
When the application router interacts with HTML5 Application Repository to serve HTML5 Applications, all static content and routes (xs-app.json) are retrieved from HTML5 Application Repository.
README
quoted from miyasuta/cap-ams-a2a, readDetails
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
discovered viaGitHub API · miyasuta
first seen in the atlas
ecosystem and domaincap, security-and-compliance
Flavors
Node.js
“├── cap-ams-node # CAP Node.js アプリ（Consumer/Provider 両方の役割を持つ）” — miyasuta/cap-ams-a2a — README
Java
“├── cap-ams-java # CAP Java アプリ（Consumer/Provider 両方の役割を持つ）” — miyasuta/cap-ams-a2a — README
History in the atlas
- First seen.
For your agent
- Ref
artifact:miyasuta-cap-ams-a2a- JSON
- /artifacts/miyasuta-cap-ams-a2a.json
- MCP
- Connecting an agent