CAP Security & Authorization — XSUAA, @restrict & Multi-Tenant Auth

Lesson 3.2 — CAP Security, Authorization & Authentication Table of Contents 1. Authentication Architecture 2. CDS-Based Authorization 3. Programmatic Authorization 4. Multi-Tenant Security 5. Testing with Mock Users Top 5 Pitfalls What to Learn Next Summary: CAP Java integrates with SAP XSUAA and IAS for authentication and provides a declarative authorization model via CDS annotations (@requires, @restrict). This lesson covers the authentication flow, CDS-based authorization, instance-based authorization, programmatic security, multi-tenant security concerns, and testing with mock users. 1. Authentication Architecture Authentication Flow Browser/Client Approuter XSUAA CAP Java │ │ │ │ │ GET /app │ │ │ │────────────────────→│ │ │ │ │ redirect to login│ │ │←────────────────────│ │ │ │ │ │ │ │ Login credentials │ │ │ │─────────────────────┼─────────────────→│ │ │ │ │ Authenticate │ │ │ │ Issue JWT │ │ JWT token │ │ │ │←────────────────────┼──────────────────│ │ │ │ │ │ │ GET /odata/v4