Secure Your Application on SAP Business Technology Platform Cloud Foundry

[imirisola]

Tutorials: https://developers.sap.com/tutorials/s4sdk-secure-cloudfoundry.html

On step 5 (Spring Boot) the instructions and code are not the same as the ones that come with the maven template (commented vs tutorial). I couldn't make the code work provided by the tutorial work. The one on the template on the other hand, does work. Also, there is a MD typo on the tutorial in which the code is formatted as plain text.

Best regards, Ivan

[jmmargo]

Karsten, can you please respond to this user's feedback? Thank you.

[CharlesDuboisSAP]

Hello @imirisola,

We are fixing the plain test code snippets. Could you also precise which class and code samples we different and provide the diff please?

Best, Charles

[imirisola]

Hi @CharlesDuboisSAP,

I've checked the code today vs the tutorial and they seem to be equal now. Maybe the mvn template or the tutorial got updated. Nevertheless, the way it is setup, the application doesn't run locally. It throws the following exception:

Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'securityConfiguration': Unsatisfied dependency expressed through field 'authConverter': No qualifying bean of type 'org.springframework.core.convert.converter.Converter<org.springframework.security.oauth2.jwt.Jwt, org.springframework.security.authentication.AbstractAuthenticationToken>' available: expected at least 1 bean which qualifies as autowire candidate.

As I recall, the main difference in the Java Class "SecurityConfiguration.java" is related to the JWT Converter. On the template and on the Tuturial, the class is using an autowired annotation for field authConverter - which cannot be solved to a bean by Spring Boot. Hence the exception get thrown. My understanding is that it will also be thrown on BTP when you try to start this spring boot application. Last time I checked this it was not working on BTP either - so it is not a local error only.

Therefore, I wasn't able to test this SecurityConfiguration class at all - be it locally or on BTP.

Besides this, the "Display" validation on this class comes commented from the mvn template. Whereas the tutorial never tells you to uncomment it.

On the other hand, at the tutorial page I can still see the a typo, where a code snippet is formatted as pain text. If you search for the word "RegisterExtension" on the tutorial page you will see the difference between the page and the GitHub MD file:

https://developers.sap.com/tutorials/s4sdk-secure-cloudfoundry.html#ce6a4b97-788c-45a8-b0a8-8f124061ba0f vs https://github.com/sap-tutorials/Tutorials/blob/master/tutorials/s4sdk-secure-cloudfoundry/s4sdk-secure-cloudfoundry.md

That same part of the Java Unit Testing has some differences. The mvn template comes with most of new code commented out already. So it is only a matter of uncommenting that code or make sure that the code is not commented.

Best regards, Ivan

[CharlesDuboisSAP]

I generated the artifact, uncommented the SecurityConfiguration class and the HelloWorldControllerTest class and everything starts correctly. I cannot reproduce the error. I suggest you make sure everything is uncommented and try again the tutorial. If it really doesn't fix the issue you could send the SecurityConfiguration source code and HelloWorldControllerTest

[imirisola]

Which Java Runtime are you using to run it? Since Spring Boot requires Java 17 at least to run it, I am running it locally with version 17.0.10 Here's the whole project which include the mentioned classes. application.zip

[imirisola]

I just regenerated the project via mvn command line using the latest template and uncommented the lines related to security and I was still getting the same error.

I've noticed that when I do not specify any profiles I'm getting the bean exception. When I added the profile 'local', it started to run locally. If I use the profile 'cloud' the logging of the application changes and I start to get the bean exception.

So I suppose the cloud sdk does interpret some default profiles like 'local' and 'cloud' - because I've never defined any profile on my code. It would be nice to have a 'default' profile that would be the same as 'local' to avoid such types of errors.

Thanks, Ivan

[CharlesDuboisSAP]

I generated the project using

mvn archetype:generate "-DarchetypeGroupId=com.sap.cloud.sdk.archetypes" "-DarchetypeArtifactId=spring-boot3" "-DarchetypeVersion=RELEASE"

I find many differences with your project:

• SecurityConfiguration.filterChain() bean is not public
• MyCustomIasTokenAuthenticationConverter is static and convert is not annotated @Override.
• There are also extra xsuaa dependencies in the pom.

Hopefully that fixes it.

[CharlesDuboisSAP]

Closed for inactivity