OpenSAP Hcp1 Week2 All Slides

7/25/2019 OpenSAP Hcp1 Week2 All Slides

1/47

Week 2 Unit 1:

Security Concept


2/47

2016 SAP SE or an SAP affiliate company. All rights reserved.

Security ConceptTopics

Authentication & Single Sign-On

Authorization Management

Web API Protection

Identity Propagation


3/47


Security ConceptAuthentication & single sign-on

User

Web

browser

SAP H

Cloud Pl

Identity Provider (IdP)

Access-protected

Web resources

Delegate

authentication &

identity management

Authenticate /single sign-on

Your SAP HANA Cloud

Web application(s

XS

App


4/47


Security ConceptIdentity provider options on SAP HANA Cloud Platform

SAPs public identity provider on the Internet

Free service

Default identity provider for HCP trial accounts

Cloud solution for identity lifecycle

management

Pay-per-logon requests

Preconfigured identity provider for productive

HCP accounts

Integration with a corporate Identity and Access

Management solution

Prerequisite: SAML 2.0 compliance

SAP ID service

SAP Cloud Identity

Bring your own

identity provider


5/47 2016 SAP SE or an SAP affiliate company. All rights reserved.

XS

Security ConceptAuthorization management

User Role

is assigned to

(static assignment)

Group

is assigned to

(static OR federated

assignment)

is assigned to

(static assignment)

App



Security ConceptWeb API protection

SAP HANACloud Platfor

Your REST API on

SAP HANA Cloud Platfor

XS

API

Web browser

Native mobile app

Desktop / server application



Security ConceptIdentity propagation

SAP HANA

Cloud Platform

XS

Initial login

XSAPI

Corporate Network

SAP/Non-SAPBack-End System(s)

SAP HANA Cloud Connector

API

SAP /

Non-SAP Clo

API

App



Security ConceptOutlook for this week

Unit 2: Securing HTML5 Apps

Authenticating users via SAML Managing permissions and roles

Unit 3: Securing Java Apps

Authenticating users via SAML

Managing groups and roles

Unit 4: Securing Web APIs Protecting an API using OAuth 2.0

Testing with a REST client

Units 5 & 6: Securing SAP HANA Native Services

Configuring identity propagation between an HTML5 app

and an SAP HANA XS service


9/47

Thank you

Contact information:

[email protected]



2016 SAP SE or an SAP affiliate company. All rights

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an

SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAcompany) in Germany and other countries. Please see http://global12.sap.com/corporate-en/legal/copyright/index.epx for additional tradema

Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors.

National product specifications may vary.

These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of a

affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or SAP affiliate c

services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein sho

constituting an additional warranty.

In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related

or release any functionality mentioned therein. This document, or any related presentation, and SAP SEs or its affiliated companies strategydevelopments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated

for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, cod

looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Reader

undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purcha
http://global12.sap.com/corporate-en/legal/copyright/index.epxhttp://global12.sap.com/corporate-en/legal/copyright/index.epx


11/47

Week 2 Unit 2:

Securing HTML5 Apps


12/47


Securing HTML5 AppsAuthentication: SAML 2.0

neo-app.json{

"authenticationMethod": "saml",

"logoutPage": "logout.html",

...

"routes": [

...

],

"securityConstraints": [...

],

...

}


13/47


Securing HTML5 AppsAuthorization: Roles and permissions

neo-app.json

{

...

"securityConstraints": [

"permission": "accessPr

"description": "Protecte

"protectedPaths": [

"/projects"

],

],

...

}HTML5 App

Public

Resources

Protected

Resources/projects

User

Employee

(Custom Role)

accessProjectData

(Permission)

SAP HANA

Cloud Platform


14/47

Thank you


[email protected]


15/47




SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SA

company) in Germany and other countries. Please see http://global12.sap.com/corporate-en/legal/copyright/index.epx for additional tradema













16/47

Week 2 Unit 3:

Securing Java Apps


17/47


Securing Java Apps

Authentication

SAP HANA

Cloud Platform

X.509

jdoe

Username/Password

Client Certificate

SAML 2.0

web.xml


18/47


Securing Java AppsAuthorization

SAP HANA

Cloud Platform

web.xml

...

ProjectManage

User

ProjectManager

(Predefined Role)


19/47

Thank you


[email protected]


20/47


















21/47

Week 2 Unit 4:

Securing Web APIs


22/47


REST Client

(e.g. native mobile app)

Your REST API onSAP HANA Cloud Platfo

Securing Web APIsOAuth access token

SAP HANA

Cloud Platfo

API

poai3-36d24fdwq59


23/47


Securing Web APIsOAuth 2.0


24/47


SAP

Cloud

API

Securing Web APIsEnd-to-end flow

1. HCP administrator registers OAuth

client for the native mobile app

2. App requests an access token

from the OAuth authorization

server. This requires the user to

authenticate via SAML.

3. App stores the access token and

uses it to send an authorized APIcall

4. The API can verify the token with

the OAuth authorization server and

returns the response to the app

1

2

3

4

2

3

4OAuth

REST Client(e.g. native mobile app)

Your REST

SAP HANA

Platfor

poawq59

S i W b API


25/47


Securing Web APIsUsing OAuth on SAP HANA Cloud Platform

web.xml

OAuth Filter to view sales dataOAuthViewSalesDataFilter

com.sap.cloud.security.oauth2.OAuthAuthorizationFilter

http-method

get

OAuthViewSalesDataFilter

SalesDataServlet

...

API

OAuth


26/47

Thank you


[email protected]


27/47


















28/47

Week 2 Unit 5: Securing SA

HANA Native Services P

Securing SAP HANA Native Services Part 1


29/47


Your HCP Account

Securing SAP HANA Native Services Part 1Using SAP HANA XS on SAP HANA Cloud Platform

SAP HANA

Cloud Platform

DedicatedSAP

REST/

ODATA

User

API



30/47


Securing SAP HANA Native Services Part 1User authentication and propagation

SAP HANA

Cloud Platform

Dedi

S

Your HCP Account

User

Identity Provider(IdP)

Authentication & SSO

SAML Login Identity

PropagationAPI



31/47


Securing SAP HANA Native Services Part 1Focus of Units 5 and 6

User



SAML Login

SAP HANA

Cloud Platform

Dedi

S

Your HCP Account

Identity

PropagationAPI



32/47


Securing SAP HANA Native Services Part 1Identity propagation between HTML5/Java and SAP HANA XS

SAP HANA

Cloud Platform

Dedicated or shared

SAP HANA

Your HCP Account

XSHTTP

Destination

(App2AppSSO*)

* Application-to-Application SSO Authentication

API

(SAML)



33/47


Securing SAP HANA Native Services Part 1Trust setup

SAP HANA

Cloud Platform

Your HCP Account

HTTP

Destination

(App2AppSSO*)

API

(SAML)

Local

Service

Provider

SAML

Identity

Provider

TRUST

XS




34/47


Securing SAP HANA Native Services Part 1User management

SAP HANA

Cloud Platform

Your HCP Account

HTTP

Destination

(App2AppSSO*)


API

(SAML)

SAML

Identity

Provider

DB Us

DynamCrea

XS



35/47


Securing SAP HANA Native Services Part 1Configuration steps of the end-to-end scenario

Unit 5 Part 1

Configure the local service provider for HTML5 apps

Set up trust in XS to the HTML5 local service provider

Enable dynamic user creation in XS

Unit 6 Part 2

Configure HTTP destination for application-to-applicationSSO

Configure SAML in XS

Test the scenario



36/47


Securing SAP HANA Native Services Part 1What youve learned in this unit

How to build SAP HANA Cloud Platform

applications using HTML5 and SAP HANA XS

The difference between authentication and

propagation of a users identity

Configuration of trust between HTML5 and

SAP HANA XS as a prerequisite for secure

identity propagation



37/47


Securing SAP HANA Native Services Part 1Further reading

http://scn.sap.com/community/developer-center/cloud-

platform/blog/2016/03/21/principal-propagation-between-

html5-and-sap-hana-xs-on-sap-hana-cloud-platform
http://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platformhttp://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platformhttp://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platformhttp://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platformhttp://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platform


38/47

Thank you


[email protected]

2016 SAP SE SAP ffili t All i ht


39/47













or release any functionality mentioned therein. This document, or any related presentation, and SAP SEs or its affiliated companies strategy

developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated




Week 2 Unit 6 Sec ring SA


40/47

Week 2 Unit 6: Securing SA

HANA Native Services P



41/47


gIdentity propagation scenario

SAP HANA

Cloud Platform

Dedi

S

Your HCP Account

User



SAML Login

API

Identity

Propagation



42/47


gWhat we did in Part 1

SAP HANA

Cloud Platform

Your HCP Account

TRUSTSAML

Identity

Provider

DB Us

DynamCrea

XS

Local

Service

Provider



43/47


gWhat we will do in Part 2

SAP HANA

Cloud Platform

Your HCP Account

Local

Service

Provider

TRUST


SAML

Identity

Provider

DB

DynamCrea

XS

HTTP

Destination

(App2AppSSO*)

API

(SAML)



44/47


What youve learned in this unit

How to configure a destination to propagate

the users identity from HTML5 to

SAP HANA XS

How to configure SAML in SAP HANA XS to

support identity propagation from HTML5

How to test the scenario end-to-end



45/47


Further reading

http://scn.sap.com/community/developer-center/cloud-

platform/blog/2016/03/21/principal-propagation-between-

html5-and-sap-hana-xs-on-sap-hana-cloud-platform
http://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platformhttp://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platformhttp://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platformhttp://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platformhttp://scn.sap.com/community/developer-center/cloud-platform/blog/2016/03/21/principal-propagation-between-html5-and-sap-hana-xs-on-sap-hana-cloud-platform


46/47

Thank you


[email protected]

2016 SAP SE or an SAP affiliate company All rights


47/47













or release any functionality mentioned therein. This document, or any related presentation, and SAP SEs or its affiliated companies strategy

developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliatedfor any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, cod



OpenSAP Hcp1 Week2 All Slides

Documents

Transcript of OpenSAP Hcp1 Week2 All Slides