User Account and Authorization Server at SAP
summary
SAP integrates Cloud Foundry UAA for enterprise apps, delegates strong 2‑factor authentication to a SAML identity provider, and uses OAuth/JWT plus identity zones for tenant isolation. A service broker auto-creates OAuth clients and enforces scope governance; an application router handles SSO redirects, CSRF checks and keeps JWTs off the browser. Practical limits appear: JWTs over 8 KB hit the CF router, so token exchange and client‑credentials flows are used for backend and technical users. Contributions include an attributes API and password‑change UI.
AI-written summary · about
chapters (9)
- 0:00Introduction to UAA
- 3:19UAA authentication mechanisms
- 8:47Multi-tenancy in UAA
- 11:00OAuth integration for apps
- 14:46SAML 2 integration
- 16:35Simplifying UAA integration
- 22:49JWT size limitations
- 24:59UAA contributions and improvements
- 26:25Summary and Q&A
related talks
39mCloud Foundry UAA as an Identity Gateway
31mCloud Foundry UAA as an Identity Proxy Product Roadmap
28mIdentity: From Legacy to Microservices
01h 26mSecuring Rest-ful Web Services with OAuth2
26mExtending Cloud Foundry UAA
28mGenAI Platform: Challenges of Authentication and Authorization in a...
15mEvolution of UAA Towards OAuth 2.1 and OpenID Foundation
44mUAA Project Updates and Roadmap - Sree Tummidi, Pivotal