{"ref":"content:xsuaa-attribute-based-vs-authority-based-configuration","page":"/content/xsuaa-attribute-based-vs-authority-based-configuration","json":"/content/xsuaa-attribute-based-vs-authority-based-configuration.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"xsuaa-attribute-based-vs-authority-based-configuration","title":"SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based Approaches","url":"https://community.sap.com/t5/technology-blog-posts-by-sap/sap-btp-xsuaa-security-configuration-comparison-attribute-based-vs/ba-p/14330535","content_type":"blog","explains":[{"ref":"capability:authorization","applies_to":{"ecosystems":["btp","cap"]}}],"summary":"Two shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads `req.user.attr.department`, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.","short":"Attribute-based and authority-based xs-security.json compared","author":"rajeshkputumbaka","published":"2026-02-18","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-sap/sap-btp-xsuaa-security-configuration-comparison-attribute-based-vs/ba-p/14330535","title":"SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based Approaches — SAP Community","checked":"2026-09-08"}],"provenance":{"discovered_via":[{"source":"source:sap-community","channel":"cap-tag"}],"first_seen":"2026-09-08"},"drafted_with_ai":true,"published_on":"source:sap-community","history":[{"date":"2026-10-17","field":"explains","from":null,"to":"applies_to on capability:authorization (cap, btp)","reason":"Door scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md)."}]},"readings":{"liveness":[{"label":"Checked against the source","tier":"unknown","evidence":"nobody has checked it"},{"label":"Source reachable","tier":"unknown","evidence":"not crawled"},{"label":"Age","tier":"good","evidence":"published 8 months ago"}],"compatibility":[{"label":"Version","tier":"unknown","evidence":"no version declared"},{"label":"Moved since?","tier":"good","evidence":"no recorded change after 2026-02-18"},{"label":"Findings","tier":"good","evidence":"none flagged"}],"reach":[{"value":2502,"unit":"views"},{"value":3,"unit":"comments"},{"value":2,"unit":"likes"}]},"signals":{"views":2502,"likes":2,"comments":3,"metrics_at":"2026-10-25"},"series":null,"edges":{"authors":[]}}