{"ref":"content:sap-business-technology-platform-authorization-and-trust-management-service","page":"/content/sap-business-technology-platform-authorization-and-trust-management-service","json":"/content/sap-business-technology-platform-authorization-and-trust-management-service.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"sap-business-technology-platform-authorization-and-trust-management-service","title":"SAP Business Technology Platform: Authorization and Trust Management Service","url":"https://community.sap.com/t5/technology-blog-posts-by-members/sap-business-technology-platform-authorization-and-trust-management-service/ba-p/13538899","content_type":"blog","published_on":"source:sap-community","explains":[{"ref":"capability:authorization","applies_to":{"ecosystems":["btp","cap"]}},{"ref":"capability:authentication","applies_to":{"ecosystems":["btp","cap"]}},"artifact:btp-authorization-and-trust-management","artifact:sap-approuter"],"summary":"Walks through how the [SAP Authorization and Trust Management service](artifact:btp-authorization-and-trust-management) secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the [App Router](artifact:sap-approuter)'s place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.","short":"Scopes, role templates and OAuth flows of XSUAA on BTP","author":"SekhuteTK","published":"2022-09-09","provenance":{"discovered_via":[{"source":"source:sap-community","channel":"cap-tag"}],"first_seen":"2026-10-13"},"drafted_with_ai":true,"history":[{"date":"2026-10-17","field":"explains","from":null,"to":"applies_to on capability:authentication, capability:authorization","reason":"Door scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md)."}]},"readings":{"liveness":[{"label":"Checked against the source","tier":"unknown","evidence":"nobody has checked it"},{"label":"Source reachable","tier":"unknown","evidence":"not crawled"},{"label":"Age","tier":"poor","evidence":"published 49 months ago"}],"compatibility":[{"label":"Version","tier":"unknown","evidence":"no version declared"},{"label":"Moved since?","tier":"poor","evidence":"@sap/approuter 12.0, 13.0, 14.0, 15.0, 16.0, 17.0, 18.0, 19.0, 20.0, 21.0, 22.0, 23.0 since publication"},{"label":"Findings","tier":"good","evidence":"none flagged"}],"reach":[{"value":2586,"unit":"views"},{"value":0,"unit":"comments"},{"value":3,"unit":"likes"}]},"signals":{"views":2586,"likes":3,"comments":0,"metrics_at":"2026-10-25"},"series":null,"edges":{"authors":[]}}