feat: [DO NOT MERGE] IAS App-To-App Auth #6185

davidkna-sap · 2025-12-02T14:28:22Z

Closes SAP/ai-sdk-js-backlog#347.

packages/connectivity/src/scp-cf/jwt/jwt.ts

packages/connectivity/src/scp-cf/identity-service.ts

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts

packages/connectivity/src/scp-cf/jwt/jwt.ts

davidkna-sap · 2025-12-19T09:37:39Z

packages/connectivity/src/scp-cf/identity-service.ts

+  const tokenOptions: IdTokenFetchOptions = {
+    token_format: 'jwt'
+  };


In the e2e multi-tenant testing with user token exchange this was required because otherwise IAS returns an opaque token.

KavithaSiva

Added few more requests to be worked on.

KavithaSiva · 2025-12-19T14:34:00Z

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts

+interface IasOptionsBase {
+  /**
+   * The target URL of the destination that the IAS token is requested for.
+   * @default to the (identity service) URL from the service binding.
+   */
+  targetUrl?: string;
+  /**
+   * The application resource(s) for which the token is requested.
+   * The token will only be usable to call the requested application(s).
+   * Either provide the app name (common case) or the provider client ID
+   * and tenant ID (optional).
+   */
+  resource?: IasResource | IasResource[];
+  /**
+   * The consumer (BTP) tenant ID of the application.
+   * May be required for multi-tenant communication.
+   */
+  appTid?: string;
+  /**
+   * Additional parameters to be sent along with the token request.
+   */
+  extraParams?: Record<string, string>;


For the App2App case, both targetUrl and resource are required.
Even if they are optional here, we have to document this. Consider adding to JSDoc and to the documentation portal.

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts

packages/connectivity/src/scp-cf/jwt/jwt.ts

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts

packages/connectivity/src/scp-cf/client-credentials-token-cache.ts

KavithaSiva · 2025-12-19T16:01:18Z

packages/connectivity/src/scp-cf/identity-service.ts

+  /**
+   * IAS API resources. Present when resource parameter is specified in the token request.
+   */
+  ias_apis?: string[];


[q] Should this be an array? Given we only pass one resource name?

Even for single items it returns an array in the jwt, and when a providerClientId is given instead of name it's possible for it's supposed to return a token for everything the providerClientId applies to (possibly multiple depencies with different API permissions on the same provider).

packages/connectivity/src/scp-cf/identity-service.ts

KavithaSiva · 2025-12-19T16:24:27Z

packages/connectivity/src/scp-cf/token-accessor.ts

+ * @param options.iasOptions - Options to change IAS token fetching (see {@link IasOptions}).
 * @returns A JWT bearer token.
 */
 export async function jwtBearerToken(


[req] The changes to this function are to support using an IAS token to fetch destinations using the destination service, and I would keep this out of this PR and do it in the the dedicated PR instead.

Should the changes to serviceToken also be reverted? It is responsible for (some of) the caching.

Yes. I think we can also revert the changes to serviceToken function for now as it also is mostly used with functions calling a service using an access token. Other usages might require more checks.

The transformServiceBindingToClientCredentialsDestination seems to be an exception, but I think we can add IAS support to this function later.

I've moved the IAS-specific parts of serviceToken to serviceTokenIas for now and marked it as experimental to keep the client credentials cache for IAS around.

packages/connectivity/src/scp-cf/identity-service.ts

- Rename IAS resource properties for clarity (clientId → providerClientId, tenantId → providerTenantId) - Move iasOptions parameter to main function signature in getDestinationFromServiceBinding for better API ergonomics - Enhance IasClientCredentialsResponse interface with additional JWT claims (scimId, custom_iss, app_tid) - Use IdentityServiceToken class from @sap/xssec for IAS-specific token decoding - Add zone_uuid fallback for legacy tenant ID resolution - Prioritize XSUAA user_id over IAS user_uuid in userId() function (aligning with priority-handling in other parts) - Remove IAS handling in jwtBearerToken() to only handle XSUAA flow - Add comprehensive test coverage for IAS token caching and resource isolation - Improve documentation for targetUrl and resource parameters

davidkna-sap · 2025-12-22T07:53:03Z

packages/connectivity/src/scp-cf/identity-service.ts

+  /**
+   * IAS API resources. Present when resource parameter is specified in the token request.
+   */
+  ias_apis?: string[];


Even for single items it returns an array in the jwt, and when a providerClientId is given instead of name it's possible for it's supposed to return a token for everything the providerClientId applies to (possibly multiple depencies with different API permissions on the same provider).

davidkna-sap · 2025-12-22T09:05:47Z

packages/connectivity/src/scp-cf/jwt/jwt.ts

+export function isIasToken(decodedJwt: JwtPayload): boolean {
+  if (!decodedJwt.iss) {
+    return false;
+  }


This could potentially check for ias_apis, ias_iss or scim_id but I'm not sure if exchanged-from-IAS XSUAA tokens could have these properties.

davidkna-sap · 2025-12-22T11:21:57Z

packages/connectivity/src/scp-cf/token-accessor.ts

+ * @param options.iasOptions - Options to change IAS token fetching (see {@link IasOptions}).
 * @returns A JWT bearer token.
 */
 export async function jwtBearerToken(


Should the changes to serviceToken also be reverted? It is responsible for (some of) the caching.

davidkna-sap · 2025-12-23T14:44:59Z

packages/connectivity/src/scp-cf/environment-accessor/ias.ts

+  if (assertion) {
+    const decodedJwt = new IdentityServiceToken(assertion);
+    const issuer = decodedJwt.issuer;
+    const issuerUrl = tryParseUrl(issuer, 'JWT assertion issuer');
+    subdomain = issuerUrl.hostname.split('.')[0];
+    // Replace subdomain in the URL from the service binding
+    // Reason: We don't want to blindly trust the URL in the assertion
+    const credentialsUrl = tryParseUrl(credentials.url, 'Identity Service');
+    const credentialsSplit = credentialsUrl.hostname.split('.');
+    credentialsUrl.hostname = [subdomain, ...credentialsSplit.slice(1)].join(
+      '.'
+    );
+    let normalizedUrl = credentialsUrl.toString();
+    if (normalizedUrl.endsWith('/')) {
+      normalizedUrl = normalizedUrl.slice(0, -1);
+    }


Instead of this it might be better to use IdentityService.getSafeUrlFromTokenIssuer(token, credentials.domains) and not rewrite the URL.

I don't understand, how does the xssec function help here? Wouldn't it just help in validation? The actual URL manipulation still needs to be done right?

xssec uses the function to also determine the issuer for token verification, so in this case it could be enough verification to use the issuer url as is in this case. Additionally it has the advantage of catching cases of accounts400 vs accounts and any potential custom domains for ias.

KavithaSiva

Mostly looks good to me, added some minor comments.
Great work!

KavithaSiva · 2025-12-30T06:51:31Z

packages/connectivity/src/scp-cf/destination/destination-accessor-types.ts

   * ATTENTION: The property is mandatory in the following cases:
   * - User-dependent authentication flow is used, e.g., `OAuth2UserTokenExchange`, `OAuth2JWTBearer`, `OAuth2SAMLBearerAssertion`, `SAMLAssertion` or `PrincipalPropagation`.
   * - Multi-tenant scenarios with destinations maintained in the subscriber account. This case is implied if the `selectionStrategy` is set to `alwaysSubscriber`.
+   * - IAS token exchange with `iasOptions.authenticationType` set to `'OAuth2JWTBearer'`. In this case, the JWT is automatically used as the assertion for IAS token exchange.


[q] Where is iasOptions.authenticationType set? It's not clear from the comment.

I tried to clarify the comment, though arguably the IAS-case is covered by "User-dependent authentication flow".

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts

KavithaSiva · 2025-12-30T07:46:50Z

packages/connectivity/src/scp-cf/environment-accessor/ias.ts

+  if (assertion) {
+    const decodedJwt = new IdentityServiceToken(assertion);
+    const issuer = decodedJwt.issuer;
+    const issuerUrl = tryParseUrl(issuer, 'JWT assertion issuer');
+    subdomain = issuerUrl.hostname.split('.')[0];
+    // Replace subdomain in the URL from the service binding
+    // Reason: We don't want to blindly trust the URL in the assertion
+    const credentialsUrl = tryParseUrl(credentials.url, 'Identity Service');
+    const credentialsSplit = credentialsUrl.hostname.split('.');
+    credentialsUrl.hostname = [subdomain, ...credentialsSplit.slice(1)].join(
+      '.'
+    );
+    let normalizedUrl = credentialsUrl.toString();
+    if (normalizedUrl.endsWith('/')) {
+      normalizedUrl = normalizedUrl.slice(0, -1);
+    }


I don't understand, how does the xssec function help here? Wouldn't it just help in validation? The actual URL manipulation still needs to be done right?

KavithaSiva · 2025-12-30T08:09:19Z

packages/connectivity/src/scp-cf/identity-service.ts

+      `Could not fetch IAS client credentials token for service of type ${resolvedService.label}: ${err.message}`
+    );
+  });
+  return token;


I checked the usages of this function, and right now we use ClientCredentialsResponse base interface during caching. So, we would also have to change the caching function.

We can consider migrating to token classes available from xssec, with caching changes in a follow-up.

packages/connectivity/src/scp-cf/token-accessor.ts

KavithaSiva · 2025-12-30T08:30:56Z

packages/connectivity/src/scp-cf/token-accessor.ts

+ * @param options.iasOptions - Options to change IAS token fetching (see {@link IasOptions}).
 * @returns A JWT bearer token.
 */
 export async function jwtBearerToken(


Yes. I think we can also revert the changes to serviceToken function for now as it also is mostly used with functions calling a service using an access token. Other usages might require more checks.

The transformServiceBindingToClientCredentialsDestination seems to be an exception, but I think we can add IAS support to this function later.

.changeset/slow-cars-lie.md

packages/connectivity/src/scp-cf/destination/destination-from-vcap.spec.ts

packages/connectivity/src/scp-cf/token-accessor.ts

.changeset/slow-cars-lie.md

packages/connectivity/src/scp-cf/destination/ias-types.ts

KavithaSiva · 2025-12-30T14:45:53Z

packages/connectivity/src/scp-cf/identity-service.ts

+  if (arg.appTid) {
+    tokenOptions.app_tid = arg.appTid;
+  }


[req] I would use the suggested bool flag above in IasOptionsTechnical to determine if the provider tenant id(app_tid from the ias credentials) or the tenant id(from incoming jwt) needs to be supplied here.

Done, but it still needs unit-tests.

Co-authored-by: KavithaSiva <32287936+KavithaSiva@users.noreply.github.com>

davidkna-sap and others added 4 commits December 1, 2025 16:28

wip

90a2f9a

support reading user_uuid from jwtPayload

b2d80f4

add extraParams option field

0ed94aa

Changes from lint:fix

5ec4657

davidkna-sap changed the title ~~feat: IAS App-To-App Auth~~ feat: [DO NOT MERGE] IAS App-To-App Auth Dec 2, 2025

davidkna-sap added the don't merge Don't merge label Dec 2, 2025

add workaround

a541e18

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from c0cc0e8 to a541e18 Compare December 4, 2025 15:00

davidkna-sap added 5 commits December 4, 2025 16:14

chore: add targetURL option to iasBindingToDestination

24cd0a7

chore: fix clientsecret auth

1348182

rename options & forward mtls creds to destination

2f2cbf6

chore: add changeset

f9ce3a5

chore: update changeset msg

9990c6f

davidkna-sap commented Dec 8, 2025

View reviewed changes

packages/connectivity/src/scp-cf/jwt/jwt.ts Outdated Show resolved Hide resolved

davidkna-sap commented Dec 8, 2025

View reviewed changes

packages/connectivity/src/scp-cf/identity-service.ts Outdated Show resolved Hide resolved

davidkna-sap and others added 6 commits December 9, 2025 11:52

chore: print warning if both mtls and mtlsKeyPair provided

a146af2

Merge branch 'main' into davidkna-sap_poc-ias

6ab8a1f

move ias-specific opts to iasOptions & refactor parameter handling

e5e67eb

increase resource name flexibility

cd8e736

chore: try to fix lint error

34b83be

support user-token exchange

fdb3d35

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from 0165671 to fdb3d35 Compare December 12, 2025 14:07

davidkna-sap added 2 commits December 12, 2025 15:11

add experimental to changelog note

af1d0bd

add initial cache implementation

62d4023

davidkna-sap commented Dec 15, 2025

View reviewed changes

packages/connectivity/src/scp-cf/destination/destination-from-vcap.ts Outdated Show resolved Hide resolved

davidkna-sap added 3 commits December 15, 2025 11:10

harmonize towards AuthenticationType and allow disabling cache

437fd87

harmonize ias/xsuaa caching

de930e4

use xssec as the base implementation

fbcca4b

github-advanced-security bot found potential problems Dec 16, 2025

View reviewed changes

packages/connectivity/src/scp-cf/jwt/jwt.ts Fixed Show fixed Hide fixed

packages/connectivity/src/scp-cf/jwt/jwt.ts Fixed Show fixed Hide fixed

make codeql happy

e71c268

fix ias option forwarding

714623c

davidkna-sap mentioned this pull request Dec 17, 2025

docs: [JS] add IAS App-to-App SAP/cloud-sdk#2335

Draft

davidkna-sap and others added 5 commits December 17, 2025 17:09

forward resolved tenantId in serviceToken

5fdc97e

always set token_format: 'jwt'

08313ba

remove iasResource list support & fix tests

5cda06c

Merge branch 'main' into davidkna-sap_poc-ias

51129d6

fix test again

67e7d13

davidkna-sap commented Dec 19, 2025

View reviewed changes

davidkna-sap and others added 2 commits December 19, 2025 13:15

Merge branch 'main' into davidkna-sap_poc-ias

7778cd0

Changes from lint:fix

41cac51

KavithaSiva requested changes Dec 19, 2025

View reviewed changes

KavithaSiva and others added 2 commits December 22, 2025 09:21

Merge branch 'main' into davidkna-sap_poc-ias

6514dcd

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from 1becf29 to 87c7a9f Compare December 22, 2025 11:31

davidkna-sap commented Dec 22, 2025

View reviewed changes

davidkna-sap added 2 commits December 22, 2025 16:07

fix convertResourceToUrn providerTenantId handling

ac48d3a

extract subdomain from user assertion

8dbc043

davidkna-sap requested a review from KavithaSiva December 23, 2025 10:54

davidkna-sap commented Dec 23, 2025

View reviewed changes

KavithaSiva added 2 commits December 29, 2025 10:01

Merge branch 'main' into davidkna-sap_poc-ias

83ff890

Merge branch 'main' into davidkna-sap_poc-ias

0a0d661

KavithaSiva reviewed Dec 30, 2025

View reviewed changes

Merge branch 'main' into davidkna-sap_poc-ias

651882b

davidkna-sap force-pushed the davidkna-sap_poc-ias branch 2 times, most recently from 04e7de2 to 91a9927 Compare December 30, 2025 13:30

address review comments

005e875

davidkna-sap force-pushed the davidkna-sap_poc-ias branch from 91a9927 to 005e875 Compare December 30, 2025 13:34

KavithaSiva reviewed Dec 30, 2025

View reviewed changes

davidkna-sap and others added 2 commits December 30, 2025 17:17

update changelog

5418c33

Co-authored-by: KavithaSiva <32287936+KavithaSiva@users.noreply.github.com>

address most recent review comments

0c67544

feat: [DO NOT MERGE] IAS App-To-App Auth #6185

Are you sure you want to change the base?

feat: [DO NOT MERGE] IAS App-To-App Auth #6185

Uh oh!

Conversation

davidkna-sap commented Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

davidkna-sap Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

KavithaSiva left a comment

Choose a reason for hiding this comment

Uh oh!

KavithaSiva Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

KavithaSiva Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

KavithaSiva left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

davidkna-sap Dec 19, 2025 •

edited

Loading

KavithaSiva Dec 19, 2025 •

edited

Loading

KavithaSiva Dec 19, 2025 •

edited

Loading