Skip to content

Library version 4.4.0 #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
finkmanAtSap wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Library version 4.4.0 #83

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
12e03a6
comment-in AMS route security lines for SB compatibility testing
finkmanAtSap Jul 2, 2026
f3c3930
remove test scope from spring-boot-starter-ams-test
finkmanAtSap Jul 6, 2026
6319d1a
Lib Version 4.4.0
finkmanAtSap Jul 6, 2026
f68d293
use sap.ams.test.enabled: true
finkmanAtSap Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ams-cap-bookshop/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@

<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<sap.cloud.security.ams.version>4.2.1</sap.cloud.security.ams.version>
<sap.cloud.security.ams.version>4.4.0</sap.cloud.security.ams.version>
<sap.cloud.security.ams.dcl-compiler.version>1.4.0</sap.cloud.security.ams.dcl-compiler.version>
<sap.cloud.security.version>4.0.7</sap.cloud.security.version>
</properties>
Expand Down
1 change: 0 additions & 1 deletion ams-cap-bookshop/srv/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,6 @@
<dependency>
<groupId>com.sap.cloud.security.ams</groupId>
<artifactId>spring-boot-starter-cap-ams-test</artifactId>
<scope>test</scope>

@finkmanAtSap finkmanAtSap Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed, so that the app can be started via mvn spring-boot:run with mock users as intended by CAP.

</dependency>

<dependency>
Expand Down
1 change: 1 addition & 0 deletions ams-cap-bookshop/srv/src/test/resources/application-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ spring:
sql:
init:
platform: h2
sap.ams.test.enabled: true

@finkmanAtSap finkmanAtSap Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Necessary because the CAP sample now includes spring-boot-starter-cap-ams-test as compile-scoped dependency, so that the app can be started via mvn spring-boot:run with mock users as intended by CAP.

Since the CAP sample tests include mocked identity and xsuaa bindings on the class path, the new back-off mechanism in the test starter thinks we're in production, so we must enforce its auto-configuration with this property in the test profile.

logging.level:
com.sap.cds.security.authorization: TRACE
com.sap.cloud.security.ams: TRACE
Expand Down
2 changes: 1 addition & 1 deletion ams-javalin-shopping/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
<properties>
<jdk.version>17</jdk.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<sap.cloud.security.ams.version>4.3.0</sap.cloud.security.ams.version>
<sap.cloud.security.ams.version>4.4.0</sap.cloud.security.ams.version>
<sap.cloud.security.ams.dcl-compiler.version>1.4.0</sap.cloud.security.ams.dcl-compiler.version>
<sap.cloud.environment.servicebinding.version>0.31.0</sap.cloud.environment.servicebinding.version>
<javalin.version>7.2.2</javalin.version>
Expand Down
2 changes: 1 addition & 1 deletion ams-spring-boot-shopping/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
<jdk.version>17</jdk.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<spring.boot.version>3.5.10</spring.boot.version>
<sap.cloud.security.ams.version>4.3.0</sap.cloud.security.ams.version>
<sap.cloud.security.ams.version>4.4.0</sap.cloud.security.ams.version>
<sap.cloud.security.ams.dcl-compiler.version>1.4.0</sap.cloud.security.ams.dcl-compiler.version>
<sap.cloud.security.version>4.0.8</sap.cloud.security.version>
<sap.cloud.sdk.version>5.32.0</sap.cloud.sdk.version>
Expand Down
17 changes: 10 additions & 7 deletions ...opping/src/main/java/com/sap/cloud/security/ams/samples/config/SecurityConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

import static com.sap.cloud.security.ams.samples.config.Privileges.*;
import static org.springframework.http.HttpMethod.*;

/**
Expand All @@ -29,7 +30,7 @@
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
@PropertySource(factory = IdentityServicesPropertySourceFactory.class, ignoreResourceNotFound = true, value = { "" })
@PropertySource(factory = IdentityServicesPropertySourceFactory.class, ignoreResourceNotFound = true, value = {""})
public class SecurityConfiguration {

@Bean
Expand All @@ -41,17 +42,19 @@ public SecurityFilterChain filterChain(HttpSecurity http, AmsRouteSecurity via)
// Authenticated endpoints without authorization checks
authz.requestMatchers(GET, "/privileges").authenticated();

// Endpoints protected with AMS method-level security
// CHOOSE ONE idiom below (route-level authorization + service-level filtering vs. full service-level authorization

// Idiom 1 (Full service-level authorization): these endpoints are protected with AMS method-level security
authz.requestMatchers(GET, "/products").authenticated();
authz.requestMatchers(GET, "/orders").authenticated();
authz.requestMatchers(POST, "/orders").authenticated();
authz.requestMatchers(DELETE, "/orders/**").authenticated();

// Showcases alternative endpoint protection via AMS route-level security
// authz.requestMatchers(GET, "/products").access(via.checkPrivilege(READ_PRODUCTS));
// authz.requestMatchers(GET, "/orders").access(via.precheckPrivilege(READ_ORDERS));
// authz.requestMatchers(POST, "/orders").access(via.precheckPrivilege(CREATE_ORDERS));
// authz.requestMatchers(DELETE, "/orders/**").access(via.checkPrivilege(DELETE_ORDERS));
// Idiom 2 (route-level authorization + service-level filtering) Showcases alternative endpoint protection via AMS route-level security (+ service-level filtering)
authz.requestMatchers(GET, "/products").access(via.checkPrivilege(READ_PRODUCTS));

@finkmanAtSap finkmanAtSap Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these lines are now commented-in, so we can test with the samples both SB3 and SB4 support for the route check bean.

authz.requestMatchers(GET, "/orders").access(via.precheckPrivilege(READ_ORDERS));
authz.requestMatchers(POST, "/orders").access(via.precheckPrivilege(CREATE_ORDERS));
authz.requestMatchers(DELETE, "/orders/**").access(via.checkPrivilege(DELETE_ORDERS));

// Deny all other requests
authz.anyRequest().denyAll();
Expand Down
Loading