feat: [DO NOT MERGE] IAS App-To-App Auth #6185

davidkna-sap · 2025-12-02T14:28:22Z

Closes SAP/ai-sdk-js-backlog#347.

packages/connectivity/src/scp-cf/jwt/jwt.ts

packages/connectivity/src/scp-cf/identity-service.ts

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts

packages/connectivity/src/scp-cf/jwt/jwt.ts

- Rename IAS resource properties for clarity (clientId → providerClientId, tenantId → providerTenantId) - Move iasOptions parameter to main function signature in getDestinationFromServiceBinding for better API ergonomics - Enhance IasClientCredentialsResponse interface with additional JWT claims (scimId, custom_iss, app_tid) - Use IdentityServiceToken class from @sap/xssec for IAS-specific token decoding - Add zone_uuid fallback for legacy tenant ID resolution - Prioritize XSUAA user_id over IAS user_uuid in userId() function (aligning with priority-handling in other parts) - Remove IAS handling in jwtBearerToken() to only handle XSUAA flow - Add comprehensive test coverage for IAS token caching and resource isolation - Improve documentation for targetUrl and resource parameters

davidkna-sap · 2025-12-22T07:53:03Z

packages/connectivity/src/scp-cf/identity-service.ts

+  /**
+   * IAS API resources. Present when resource parameter is specified in the token request.
+   */
+  ias_apis?: string[];


Even for single items it returns an array in the jwt, and when a providerClientId is given instead of name it's possible for it's supposed to return a token for everything the providerClientId applies to (possibly multiple depencies with different API permissions on the same provider).

davidkna-sap · 2025-12-22T09:05:47Z

packages/connectivity/src/scp-cf/jwt/jwt.ts

+export function isIasToken(decodedJwt: JwtPayload): boolean {
+  if (!decodedJwt.iss) {
+    return false;
+  }


This could potentially check for ias_apis, ias_iss or scim_id but I'm not sure if exchanged-from-IAS XSUAA tokens could have these properties.

packages/connectivity/src/scp-cf/token-accessor.ts

davidkna-sap · 2025-12-23T14:44:59Z

packages/connectivity/src/scp-cf/environment-accessor/ias.ts

+  if (assertion) {
+    const decodedJwt = new IdentityServiceToken(assertion);
+    const issuer = decodedJwt.issuer;
+    const issuerUrl = tryParseUrl(issuer, 'JWT assertion issuer');
+    subdomain = issuerUrl.hostname.split('.')[0];
+    // Replace subdomain in the URL from the service binding
+    // Reason: We don't want to blindly trust the URL in the assertion
+    const credentialsUrl = tryParseUrl(credentials.url, 'Identity Service');
+    const credentialsSplit = credentialsUrl.hostname.split('.');
+    credentialsUrl.hostname = [subdomain, ...credentialsSplit.slice(1)].join(
+      '.'
+    );
+    let normalizedUrl = credentialsUrl.toString();
+    if (normalizedUrl.endsWith('/')) {
+      normalizedUrl = normalizedUrl.slice(0, -1);
+    }


Instead of this it might be better to use IdentityService.getSafeUrlFromTokenIssuer(token, credentials.domains) and not rewrite the URL.

I don't understand, how does the xssec function help here? Wouldn't it just help in validation? The actual URL manipulation still needs to be done right?

xssec uses the function to also determine the issuer for token verification, so in this case it could be enough verification to use the issuer url as is in this case. Additionally it has the advantage of catching cases of accounts400 vs accounts and any potential custom domains for ias.

@davidkna-sap Are you aware of this module? => packages/connectivity/src/scp-cf/subdomain-replacer.ts

I migrated the code to use packages/connectivity/src/scp-cf/subdomain-replacer.ts with some IAS-specific changes.

xssec uses the function to also determine the issuer for token verification, so in this case it could be enough verification to use the issuer url as is in this case. Additionally it has the advantage of catching cases of accounts400 vs accounts and any potential custom domains for ias.

Why don't we use it then? is there a downside to it?

I didn't use it because for better consistency with the handling in XSUAA and the Java-SDK (where it seems to work well).

Agreed, let's avoid scope creep. 👍

KavithaSiva

Mostly looks good to me, added some minor comments.
Great work!

KavithaSiva · 2025-12-30T06:51:31Z

packages/connectivity/src/scp-cf/destination/destination-accessor-types.ts

   * ATTENTION: The property is mandatory in the following cases:
   * - User-dependent authentication flow is used, e.g., `OAuth2UserTokenExchange`, `OAuth2JWTBearer`, `OAuth2SAMLBearerAssertion`, `SAMLAssertion` or `PrincipalPropagation`.
   * - Multi-tenant scenarios with destinations maintained in the subscriber account. This case is implied if the `selectionStrategy` is set to `alwaysSubscriber`.
+   * - IAS token exchange with `iasOptions.authenticationType` set to `'OAuth2JWTBearer'`. In this case, the JWT is automatically used as the assertion for IAS token exchange.


[q] Where is iasOptions.authenticationType set? It's not clear from the comment.

I tried to clarify the comment, though arguably the IAS-case is covered by "User-dependent authentication flow".

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts

KavithaSiva · 2025-12-30T07:46:50Z

packages/connectivity/src/scp-cf/environment-accessor/ias.ts

+  if (assertion) {
+    const decodedJwt = new IdentityServiceToken(assertion);
+    const issuer = decodedJwt.issuer;
+    const issuerUrl = tryParseUrl(issuer, 'JWT assertion issuer');
+    subdomain = issuerUrl.hostname.split('.')[0];
+    // Replace subdomain in the URL from the service binding
+    // Reason: We don't want to blindly trust the URL in the assertion
+    const credentialsUrl = tryParseUrl(credentials.url, 'Identity Service');
+    const credentialsSplit = credentialsUrl.hostname.split('.');
+    credentialsUrl.hostname = [subdomain, ...credentialsSplit.slice(1)].join(
+      '.'
+    );
+    let normalizedUrl = credentialsUrl.toString();
+    if (normalizedUrl.endsWith('/')) {
+      normalizedUrl = normalizedUrl.slice(0, -1);
+    }


I don't understand, how does the xssec function help here? Wouldn't it just help in validation? The actual URL manipulation still needs to be done right?

KavithaSiva · 2025-12-30T08:09:19Z

packages/connectivity/src/scp-cf/identity-service.ts

+      `Could not fetch IAS client credentials token for service of type ${resolvedService.label}: ${err.message}`
+    );
+  });
+  return token;


I checked the usages of this function, and right now we use ClientCredentialsResponse base interface during caching. So, we would also have to change the caching function.

We can consider migrating to token classes available from xssec, with caching changes in a follow-up.

packages/connectivity/src/scp-cf/token-accessor.ts

.changeset/slow-cars-lie.md

packages/connectivity/src/scp-cf/destination/destination-from-vcap.spec.ts

packages/connectivity/src/scp-cf/token-accessor.ts

.changeset/slow-cars-lie.md

packages/connectivity/src/scp-cf/destination/ias-types.ts

KavithaSiva · 2025-12-30T14:45:53Z

packages/connectivity/src/scp-cf/identity-service.ts

+  if (arg.appTid) {
+    tokenOptions.app_tid = arg.appTid;
+  }


[req] I would use the suggested bool flag above in IasOptionsTechnical to determine if the provider tenant id(app_tid from the ias credentials) or the tenant id(from incoming jwt) needs to be supplied here.

Done, but it still needs unit-tests.

Co-authored-by: KavithaSiva <32287936+KavithaSiva@users.noreply.github.com>

marikaner

LGTM API-wise, I left quite a lot of comments (many minor things) and I didn't look at the tests for now. If there is anything you would like to have reviewed specifically, let me know.

packages/connectivity/src/scp-cf/client-credentials-token-cache.ts

packages/connectivity/src/scp-cf/destination/destination-accessor-types.ts

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts

packages/connectivity/src/scp-cf/environment-accessor/ias.ts

marikaner · 2026-01-05T09:10:29Z

packages/connectivity/src/scp-cf/environment-accessor/ias.ts

+  if (assertion) {
+    const decodedJwt = new IdentityServiceToken(assertion);
+    const issuer = decodedJwt.issuer;
+    const issuerUrl = tryParseUrl(issuer, 'JWT assertion issuer');
+    subdomain = issuerUrl.hostname.split('.')[0];
+    // Replace subdomain in the URL from the service binding
+    // Reason: We don't want to blindly trust the URL in the assertion
+    const credentialsUrl = tryParseUrl(credentials.url, 'Identity Service');
+    const credentialsSplit = credentialsUrl.hostname.split('.');
+    credentialsUrl.hostname = [subdomain, ...credentialsSplit.slice(1)].join(
+      '.'
+    );
+    let normalizedUrl = credentialsUrl.toString();
+    if (normalizedUrl.endsWith('/')) {
+      normalizedUrl = normalizedUrl.slice(0, -1);
+    }


@davidkna-sap Are you aware of this module? => packages/connectivity/src/scp-cf/subdomain-replacer.ts

packages/connectivity/src/scp-cf/identity-service.ts

packages/connectivity/src/scp-cf/token-accessor.ts

Co-authored-by: Marika Marszalkowski <marika.marszalkowski@sap.com>

packages/connectivity/src/scp-cf/environment-accessor/ias.ts

marikaner

I left one question. Good work!

marikaner · 2026-01-06T06:41:05Z

packages/connectivity/src/scp-cf/environment-accessor/ias.ts

+  if (assertion) {
+    const decodedJwt = new IdentityServiceToken(assertion);
+    const issuer = decodedJwt.issuer;
+    const issuerUrl = tryParseUrl(issuer, 'JWT assertion issuer');
+    subdomain = issuerUrl.hostname.split('.')[0];
+    // Replace subdomain in the URL from the service binding
+    // Reason: We don't want to blindly trust the URL in the assertion
+    const credentialsUrl = tryParseUrl(credentials.url, 'Identity Service');
+    const credentialsSplit = credentialsUrl.hostname.split('.');
+    credentialsUrl.hostname = [subdomain, ...credentialsSplit.slice(1)].join(
+      '.'
+    );
+    let normalizedUrl = credentialsUrl.toString();
+    if (normalizedUrl.endsWith('/')) {
+      normalizedUrl = normalizedUrl.slice(0, -1);
+    }


xssec uses the function to also determine the issuer for token verification, so in this case it could be enough verification to use the issuer url as is in this case. Additionally it has the advantage of catching cases of accounts400 vs accounts and any potential custom domains for ias.

Why don't we use it then? is there a downside to it?

marikaner · 2026-01-06T06:43:32Z

packages/eslint-config/index.js

+          'experimental',
+          'defaultValue'
+        ],
+        // The other default-allowed tags are not supported by tsdoc


davidkna-sap and others added 4 commits December 1, 2025 16:28

wip

90a2f9a

support reading user_uuid from jwtPayload

b2d80f4

add extraParams option field

0ed94aa

Changes from lint:fix

5ec4657

davidkna-sap changed the title ~~feat: IAS App-To-App Auth~~ feat: [DO NOT MERGE] IAS App-To-App Auth Dec 2, 2025

davidkna-sap added the don't merge Don't merge label Dec 2, 2025

add workaround

a541e18

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from c0cc0e8 to a541e18 Compare December 4, 2025 15:00

davidkna-sap added 5 commits December 4, 2025 16:14

chore: add targetURL option to iasBindingToDestination

24cd0a7

chore: fix clientsecret auth

1348182

rename options & forward mtls creds to destination

2f2cbf6

chore: add changeset

f9ce3a5

chore: update changeset msg

9990c6f

davidkna-sap commented Dec 8, 2025

View reviewed changes

packages/connectivity/src/scp-cf/jwt/jwt.ts Outdated Show resolved Hide resolved

davidkna-sap commented Dec 8, 2025

View reviewed changes

packages/connectivity/src/scp-cf/identity-service.ts Outdated Show resolved Hide resolved

davidkna-sap and others added 6 commits December 9, 2025 11:52

chore: print warning if both mtls and mtlsKeyPair provided

a146af2

Merge branch 'main' into davidkna-sap_poc-ias

6ab8a1f

move ias-specific opts to iasOptions & refactor parameter handling

e5e67eb

increase resource name flexibility

cd8e736

chore: try to fix lint error

34b83be

support user-token exchange

fdb3d35

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from 0165671 to fdb3d35 Compare December 12, 2025 14:07

davidkna-sap added 2 commits December 12, 2025 15:11

add experimental to changelog note

af1d0bd

add initial cache implementation

62d4023

davidkna-sap commented Dec 15, 2025

View reviewed changes

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts Outdated Show resolved Hide resolved

davidkna-sap added 3 commits December 15, 2025 11:10

harmonize towards AuthenticationType and allow disabling cache

437fd87

harmonize ias/xsuaa caching

de930e4

use xssec as the base implementation

fbcca4b

github-advanced-security bot found potential problems Dec 16, 2025

View reviewed changes

packages/connectivity/src/scp-cf/jwt/jwt.ts Fixed Show fixed Hide fixed

packages/connectivity/src/scp-cf/jwt/jwt.ts Fixed Show fixed Hide fixed

make codeql happy

e71c268

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from 1becf29 to 87c7a9f Compare December 22, 2025 11:31

davidkna-sap commented Dec 22, 2025

View reviewed changes

davidkna-sap added 2 commits December 22, 2025 16:07

fix convertResourceToUrn providerTenantId handling

ac48d3a

extract subdomain from user assertion

8dbc043

davidkna-sap requested a review from KavithaSiva December 23, 2025 10:54

davidkna-sap commented Dec 23, 2025

View reviewed changes

KavithaSiva added 2 commits December 29, 2025 10:01

Merge branch 'main' into davidkna-sap_poc-ias

83ff890

Merge branch 'main' into davidkna-sap_poc-ias

0a0d661

KavithaSiva reviewed Dec 30, 2025

View reviewed changes

Merge branch 'main' into davidkna-sap_poc-ias

651882b

davidkna-sap force-pushed the davidkna-sap_poc-ias branch 2 times, most recently from 04e7de2 to 91a9927 Compare December 30, 2025 13:30

address review comments

005e875

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from 91a9927 to 005e875 Compare December 30, 2025 13:34

KavithaSiva reviewed Dec 30, 2025

View reviewed changes

davidkna-sap and others added 2 commits December 30, 2025 17:17

update changelog

5418c33

Co-authored-by: KavithaSiva <32287936+KavithaSiva@users.noreply.github.com>

address most recent review comments

0c67544

marikaner requested changes Jan 5, 2026

View reviewed changes

Apply suggestions from code review

189a529

Co-authored-by: Marika Marszalkowski <marika.marszalkowski@sap.com>

davidkna-sap requested a review from marikaner January 5, 2026 15:58

address review comments

74e8bbf

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from 86a3237 to 74e8bbf Compare January 5, 2026 16:38

marikaner reviewed Jan 6, 2026

View reviewed changes

packages/connectivity/src/scp-cf/environment-accessor/ias.ts Outdated Show resolved Hide resolved

marikaner reviewed Jan 6, 2026

View reviewed changes

davidkna-sap added 2 commits January 6, 2026 08:40

chore: improve identityServicesCache comment

63d8074

chore: add requestAs tests & minor changes

9fb61ee

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from 0cd1c55 to 9fb61ee Compare January 6, 2026 09:10

davidkna-sap added 2 commits January 6, 2026 16:03

yarn generate

60105f1

Merge branch 'main' into davidkna-sap_poc-ias

08071e4

feat: [DO NOT MERGE] IAS App-To-App Auth #6185

Are you sure you want to change the base?

feat: [DO NOT MERGE] IAS App-To-App Auth #6185

Uh oh!

Conversation

davidkna-sap commented Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

KavithaSiva left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marikaner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

marikaner left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!