Everything in the atlas
Type
Domain: Security & Compliance
Origin
Signals
More: 3
Group by: Capability
CAP integration with the SAP Audit Log service
CAP Java plugin sending audit log events to SAP Audit Log service
SQL templates for HANA audit policies of an S/4HANA tenant
OWASP Top 10 workshop exploiting and fixing flaws in a CAP Node.js app
TechEd 2022 session on SAP BTP security recommendations
Hands-on applying SAP BTP security recommendations to a trial account
TechEd 2025 workshop on OWASP Top 10 risks in CAP applications
XSUAA authentication stack for an MCP server on SAP BTP
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
Browser login and session module for SAP MCP servers
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
OAuth2 token fetcher for a Cloud Foundry app's XSUAA binding
TypeScript library reaching ABAP service instances on Cloud Foundry
Generates signed JSON Web Tokens in ABAP
No published releases; repository quiet for 68 months.
No published releases; repository quiet for 58 months.
Checks passwords against Have I Been Pwned from ABAP
ABAP API for OAuth 2.0 authentication
No published releases; repository quiet for 97 months.
HTTP NTLM client for ABAP
OA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAP
No published releases; repository quiet for 27 months.
Azure AD and Azure AD B2C authentication strategy for CAP
Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.
JWT authentication for CAP without xsuaa or xssec
Last released April 2022 at 0.0.2, and no repository is declared on the package.
TypeScript decoder for MYSAPSSO2 logon tickets
Authenticating a CAP service against Azure AD B2C
TechEd 2022 session on SAP BTP security recommendations
Hands-on applying SAP BTP security recommendations to a trial account
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
Maps Microsoft Entra ID groups and app roles onto cds.User roles
Quiet Release and repository quiet for 25 months.
Functional boundary It performs no authentication flow of its own. The app must already be protected by Entra ID OAuth 2.0 at the App Service level; this only maps the resulting claims. It is explicitly not intended to run locally.
Authority check helper class used across SchwarzIT's USI reports
CAP microservice on XSUAA managing users and authorizations
Java apps showing policy-based authorization with AMS on SAP BTP
Node.js apps showing policy-based authorization with AMS on SAP BTP
OWASP Top 10 workshop exploiting and fixing flaws in a CAP Node.js app
CAP-based PWA for EV drivers proxying SAP E-Mobility OData APIs
Hands-on applying SAP BTP security recommendations to a trial account
TechEd 2025 workshop on OWASP Top 10 risks in CAP applications
Class-based wrapper around STRUST certificate management
Updater for root CAs in SAP NetWeaver from Mozilla's certificate store
Not where the system must not trust whatever the source trusts: the README states that you must trust the source, currently Mozilla, because the system can then reach every website holding a certificate generated by a root CA that source supplies. It installs those root CAs automatically, and the maintainer marks the tool use at own risk.
Change history for annotated CAP entities
RAP sales order using number ranges, change documents and Adobe forms
CAP integration with SAP Data Privacy Integration
OpenPGP implementation in ABAP, scoped to signing
Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.
Blowfish cipher in ABAP, ECB and CBC modes
No published releases; repository quiet for 83 months.
AES and Rijndael encryption utilities for ABAP
Postman collections for the SAP Analytics Cloud SCIM API
Postman collection for the SAP Concur User Provisioning Service APIs
Identity Provisioning jobs syncing SAP Concur users for Joule
Hands-on integrating Cloud Identity Services with Microsoft Entra
Validation library for ABAP checking dates, emails and GUIDs
No published releases; repository quiet for 40 months.
Checks field values against domain fixed values and check tables
No published releases; repository quiet for 54 months.
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
Custom messages and handler classes for CAP input validation
Zod schemas as CAP validation middleware
CAP plugin validating input against @Validator JSON Schema rules
Quiet Release and repository quiet for 30 months.
Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.
Six CAP features in one package, from replication cache to rate limits
It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.
Rate-limit pattern for CAP Node.js applications
Last released January 2024 at 0.0.6. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
Groups npm audit findings by root dependency, with failing thresholds
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.