Establishing who is calling — validating a token, resolving the user and their roles, and making that available for the rest of the request. Taking SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the identity interface for everything SAP makes it SAML 2 or OIDC against Identity Authentication rather than XSUAA alone, with the user lifecycle carried by SCIM 2 replication into each service. AuthorizationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed is still designed per system after that, since an S/4HANA role and a BTP role collection are different objects.
@sap/cds Validates tokens and builds the security context for XSUAA and IAS, exposing the authenticated user to handlers as req.user.
com.sap.cds:cds-feature-identity The CAP Java feature that validates OAuth2 tokens from XSUAA and SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp and builds the request's security context from them.
com.sap.cds:cds-feature-xsuaa The CAP Java feature that validated XSUAA-issued JWTs, published up to 2.10.7 before CAP Java 3.0 removed it in favour of com.sap.cds:cds-feature-identity.
Not covered: It stops at the platform identity providers. Anything else — custom IdPs, API keys, machine-to-machine patterns outside BTP — is yours to build. capire's own overview says CAP cannot guarantee end-to-end product security across all application layers by default; the platform's transport security and the application's own code are outside it.
Neither the package manifest nor the repository tree declares a licence.
Neither the package manifest nor the repository tree declares a licence.
Before CAP Java 3.0, XSUAA token validation lived in its own cds-feature-xsuaa module, separate from IAS support. The 3.0 release removed cds-feature-xsuaa and unified XSUAA and IAS behind cds-feature-identity, the module that now provides both.
Guidance to add cds-feature-xsuaa as a Maven dependency for authentication in a CAP Java project. It was removed in the 3.0 line, mid-2024 — cds-feature-identity is the replacement for XSUAA as well as IAS.
capability:authentication