add learnings after cli testing with xsuaa for node

Author: patricebender

guides/security/authentication.md

@@ -725,12 +725,6 @@ In addition, activate SQLite to serve as in-memory DB (**not** recommended for p
 cds add sqlite --for production
 ```
 
-make sure to run:
-
-```sh
-npm install
-```
-
 </div>
 
 ### Adding XSUAA { #adding-xsuaa }
@@ -878,10 +872,24 @@ If you modify the _xs-security.json_ manually, make sure that the scope names in
 #### Start and Check the Deployment
 
 Now let's pack and deploy the application with
+
+<div class="impl node">
+
+```sh
+npm install
+cds up
+```
+
+</div>
+
+<div class="impl java">
+
 ```sh
 cds up
 ```
 
+</div>
+
 and wait until the application is up and running. 
 You can test the status with `cf apps` or in BTP Cockpit, alternatively.
 
@@ -960,7 +968,8 @@ cf service-key bookshop-auth bookshop-auth-key
 ❗ **Never share service keys or tokens** ❗
 :::
 
-As second step, assign the generated role collection with name `admin (bookshop cdsruntime-cap-zone-bookshop-xsuaa)` to your **test user** by following instructions from [Assign Roles in SAP BTP Cockpit](./cap-users#xsuaa-assign).
+As second step, assign the generated role collection with name `admin (bookshop ${org}-${space})` to your **test user**.
+Follow the instructions from step 4 onwards of [Assign Roles in SAP BTP Cockpit Step](./cap-users#xsuaa-assign).
 
 With the credentials, you can send an HTTP request to fetch the token from XSUAA `/oauth/token` endpoint: 
 
@@ -993,13 +1002,45 @@ The request returns with a valid XSUAA token which is suitable to pass authentic
 {"access_token":"<the token>", "token_type":"bearer","expires_in":43199, [...]}
 ```
 
+
+<div class="java">
 The final test request needs to provide the token being send to the application's route:
 
 ```sh
 curl -H "Authorization: Bearer <access_token>" \
   https://<org>-<space>-bookshop-srv.<landscape-domain>/odata/v4/CatalogService/Books
 ```
 
+</div>
+
+<div class="node">
+
+With the token for the technical user, you should be able to access any endpoint, which has no specific role requirements:
+
+```sh
+curl -H "Authorization: Bearer <access_token>" \
+  https://<org>-<space>-bookshop-srv.<landscape-domain>/odata/v4/catalog/Books
+```
+
+If you also want to access the `AdminService` which requires the role `admin`, you need to fetch the token for the named user instead.
+Then, the following request should succeed:
+
+```sh
+curl -H "Authorization: Bearer <access_token>" \
+  https://<org>-<space>-bookshop-srv.<landscape-domain>/odata/v4/admin/Books
+```
+
+::: tip
+Try out sending a request to the `admin` endpoint with the technical user token to see the expected `403 Forbidden` response:
+
+```sh
+{ "error": { "message":"Forbidden","code":"403", … } }
+```
+
+:::
+
+</div>
+
 Don't forget to delete the service key after your tests:
 ```sh
 cf delete-service-key bookshop-auth bookshop-auth-key

guides/security/foo.json

@@ -0,0 +1,9 @@
+{
+  "access_token": "eyJ0eXAiOiJKV1QiLCJqaWQiOiJNckMxRWF0RXNZNGM5M0xxSnJ4WW5uc2loLytGdWVGYzk1cVRaMGhJNEFnPSIsImFsZyI6IlJTMjU2Iiwiamt1IjoiaHR0cHM6Ly9jYXAtc2FuZGJveC5hdXRoZW50aWNhdGlvbi5ldTEyLmhhbmEub25kZW1hbmQuY29tL3Rva2VuX2tleXMiLCJraWQiOiJkZWZhdWx0LWp3dC1rZXktMTQ5NjU0NDk4NCJ9.eyJzdWIiOiJjZWIwNGY5Yi1mMTNiLTQ5MDItYTQ2NS0yYTllMmNmOTE4N2IiLCJ4cy51c2VyLmF0dHJpYnV0ZXMiOnt9LCJ1c2VyX25hbWUiOiJwYXRyaWNlLmJlbmRlckBzYXAuY29tIiwib3JpZ2luIjoic2FwLmRlZmF1bHQiLCJpc3MiOiJodHRwczovL2NhcC1zYW5kYm94LmF1dGhlbnRpY2F0aW9uLmV1MTIuaGFuYS5vbmRlbWFuZC5jb20vb2F1dGgvdG9rZW4iLCJ4cy5zeXN0ZW0uYXR0cmlidXRlcyI6eyJ4cy5yb2xlY29sbGVjdGlvbnMiOlsiV29ya3pvbmVfRXh0ZXJuYWxfVXNlciIsInN1YiIsIldvcmtmbG93X0FkbWluIiwiU0FQIEhBTkEgQ2xvdWQgQWRtaW5pc3RyYXRvciIsIlNBUCBIQU5BIENsb3VkIERhdGEgUHVibGlzaGVyIFZpZXdlciIsIlNBUCBIQU5BIENsb3VkIERhdGEgUHVibGlzaGVyIEFkbWluaXN0cmF0b3IiLCJDbG91ZCBDb25uZWN0b3IgQWRtaW5pc3RyYXRvciIsIkxhdW5jaHBhZF9BZG1pbl9SZWFkX09ubHkiLCJXb3Jrem9uZV9BZG1pbiIsIkxhdW5jaHBhZF9FeHRlcm5hbF9Vc2VyIiwiTVRYIiwiRGVzdGluYXRpb24gQWRtaW5pc3RyYXRvciIsIlN1YmFjY291bnQgQWRtaW5pc3RyYXRvciIsIkNvbm5lY3Rpdml0eSBhbmQgRGVzdGluYXRpb24gQWRtaW5pc3RyYXRvciIsIlN1YnNjcmlwdGlvbiBNYW5hZ2VtZW50IERhc2hib2FyZCIsIlNBUCBIQU5BIENsb3VkIFNlY3VyaXR5IEFkbWluaXN0cmF0b3IiLCJXb3Jrem9uZV9BZG1pbl9SZWFkX09ubHkiLCJTdWJhY2NvdW50IFNlcnZpY2UgQWRtaW5pc3RyYXRvciIsInNmbGlnaHQtYWRtaW4tY2hyaXN0aWFuIiwiU0FQIEhBTkEgQ2xvdWQgVmlld2VyIiwiYWRtaW4gKGJvb2tzaG9wIGNhcC1zYW5kYm94LXBhdHJpY2UpIiwic2ZsaWdodC1yZXZpZXdlci1jaHJpc3RpYW4iLCJTdWJhY2NvdW50IFZpZXdlciIsInNlc3Npb24tbWFuYWdlbWVudC1tb2RlcmF0b3IiLCJTdWJzY3JpcHRpb24gTWFuYWdlbWVudCBEYXNoYm9hcmQgVmlld2VyIiwiV29ya3pvbmVfQWR2YW5jZWRfVGhlbWluZyIsIldvcmt6b25lX0FyZWFfQWRtaW4iLCJMYXVuY2hwYWRfQWRtaW4iLCJMYXVuY2hwYWRfQWR2YW5jZWRfVGhlbWluZyIsIldvcmtmbG93X0VuZF9Vc2VyIiwic2FwX3N1YmFjY291bnRfZXZlcnlvbmUiLCJXb3Jrem9uZV9FbmRfVXNlciIsInNmbGlnaHQtcHJvY2Vzc29yLWNocmlzdGlhbiIsIlN1YnNjcmlwdGlvbiBNYW5hZ2VtZW50IERhc2hib2FyZCBBZG1pbmlzdHJhdG9yIl19LCJnaXZlbl9uYW1lIjoiUGF0cmljZSIsImNsaWVudF9pZCI6InNiLWJvb2tzaG9wLWNhcC1zYW5kYm94LXBhdHJpY2UhdDUwMDE1IiwiYXVkIjpbInNiLWJvb2tzaG9wLWNhcC1zYW5kYm94LXBhdHJpY2UhdDUwMDE1Iiwib3BlbmlkIiwiYm9va3Nob3AtY2FwLXNhbmRib3gtcGF0cmljZSF0NTAwMTUiXSwiZXh0X2F0dHIiOnsiZW5oYW5jZXIiOiJYU1VBQSIsInN1YmFjY291bnRpZCI6IjEyN2M2ZjM3LTQ2MmQtNDE1Ny1hNDFiLWEyNDI3ZTJmNGI2YSIsInpkbiI6ImNhcC1zYW5kYm94In0sInVzZXJfdXVpZCI6IkQwNzIxMzAiLCJ6aWQiOiJhNmQ4NWU3YS1jNGNiLTQ5ZTAtYWZlYy0yNDQ5YTU5ZGRlODciLCJncmFudF90eXBlIjoicGFzc3dvcmQiLCJ1c2VyX2lkIjoiY2ViMDRmOWItZjEzYi00OTAyLWE0NjUtMmE5ZTJjZjkxODdiIiwiYXpwIjoic2ItYm9va3Nob3AtY2FwLXNhbmRib3gtcGF0cmljZSF0NTAwMTUiLCJzY29wZSI6WyJvcGVuaWQiLCJib29rc2hvcC1jYXAtc2FuZGJveC1wYXRyaWNlIXQ1MDAxNS5hZG1pbiJdLCJhdXRoX3RpbWUiOjE3NjU0NTA3ODUsImV4cCI6MTc2NTQ5Mzk4NSwiZmFtaWx5X25hbWUiOiJCZW5kZXIiLCJpYXQiOjE3NjU0NTA3ODUsImp0aSI6IjE4MDg1M2YxNGMxZjQ3MDU5ZjY2YTg0YTRiOTYyMjIxIiwiZW1haWwiOiJwYXRyaWNlLmJlbmRlckBzYXAuY29tIiwicmV2X3NpZyI6IjkzY2U2ZmI3IiwiY2lkIjoic2ItYm9va3Nob3AtY2FwLXNhbmRib3gtcGF0cmljZSF0NTAwMTUifQ.irC6G4CIhATwTn2yNEdj9GbwKUCrS8hkxwH3h9Hpnl9zwXMvSgoAQkNi94zJ2i3t6Z0ddTQ3kjpGEVpdKiCKVDZZ0J8pdxUK_oRW0_2VXG7AY8RJ0KBpx5Un9-Kxp3NJTJ3Zs_dn0lsLLxj78_bX0DoatBcrFojZ00FhPrRgjVthVuLZdMDFqKBjo5FtXxIkSDI0BExhXBIyV1mHLVbJz3gFxV-DwR7fXYbix8EqL00WASNwyIk7Q_YYtm8fEiibpnwg1ytPi2hEq2ruuj4wauN9FzLX_VrCQMIKd3o3vRN4NWgM5ogsi4B44u1ZXplH_peStQEt8HM3jGL3HHe_Og",
+  "token_type": "bearer",
+  "id_token": "eyJ0eXAiOiJKV1QiLCJqaWQiOiJxQ1FmNUs4SmZtZ0NqT0Rta3BPK1NmTURRRmZCN1ZjS2ZKeXpqZ0VnMXIwPSIsImFsZyI6IlJTMjU2Iiwiamt1IjoiaHR0cHM6Ly9jYXAtc2FuZGJveC5hdXRoZW50aWNhdGlvbi5ldTEyLmhhbmEub25kZW1hbmQuY29tL3Rva2VuX2tleXMiLCJraWQiOiJkZWZhdWx0LWp3dC1rZXktMTQ5NjU0NDk4NCJ9.eyJzdWIiOiJjZWIwNGY5Yi1mMTNiLTQ5MDItYTQ2NS0yYTllMmNmOTE4N2IiLCJwcmV2aW91c19sb2dvbl90aW1lIjoxNzY1NDUwNDMwNzc3LCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwidXNlcl9uYW1lIjoicGF0cmljZS5iZW5kZXJAc2FwLmNvbSIsImFtciI6WyJleHQiLCJvYXV0aCJdLCJvcmlnaW4iOiJzYXAuZGVmYXVsdCIsImlzcyI6Imh0dHBzOi8vY2FwLXNhbmRib3guYXV0aGVudGljYXRpb24uZXUxMi5oYW5hLm9uZGVtYW5kLmNvbS9vYXV0aC90b2tlbiIsImNsaWVudF9pZCI6InNiLWJvb2tzaG9wLWNhcC1zYW5kYm94LXBhdHJpY2UhdDUwMDE1IiwiYXVkIjoic2ItYm9va3Nob3AtY2FwLXNhbmRib3gtcGF0cmljZSF0NTAwMTUiLCJ6aWQiOiJhNmQ4NWU3YS1jNGNiLTQ5ZTAtYWZlYy0yNDQ5YTU5ZGRlODciLCJncmFudF90eXBlIjoicGFzc3dvcmQiLCJ1c2VyX2lkIjoiY2ViMDRmOWItZjEzYi00OTAyLWE0NjUtMmE5ZTJjZjkxODdiIiwiYXpwIjoic2ItYm9va3Nob3AtY2FwLXNhbmRib3gtcGF0cmljZSF0NTAwMTUiLCJzY29wZSI6WyJvcGVuaWQiXSwiYXV0aF90aW1lIjoxNzY1NDUwNzg1LCJleHAiOjE3NjU0OTM5ODUsImlhdCI6MTc2NTQ1MDc4NSwiZW1haWwiOiJwYXRyaWNlLmJlbmRlckBzYXAuY29tIiwianRpIjoiMTgwODUzZjE0YzFmNDcwNTlmNjZhODRhNGI5NjIyMjEiLCJyZXZfc2lnIjoiOTNjZTZmYjciLCJjaWQiOiJzYi1ib29rc2hvcC1jYXAtc2FuZGJveC1wYXRyaWNlIXQ1MDAxNSJ9.hhtXRzN2xgAkKcoKi9zDnNbUYjTSo3IrxixY2lTlT5ZsWchxP_AVT46vEx6Fn5imvD0L4TjqrDSViNrKMBa86fnhmOqmRZemS5oz3_JmARG-156oFzEHIbIX0-VxOKXerOa0zQeoaYP9YA-YxmKl23W5J8ABUQAA1V-5USpG89S6rRcJ-b-Dv6QKXqh5w-Wco26FVguVQPswaeCnDjY96RK3AK1qqMSNE6ZxlTyAZsvELiEwqJS2Q7ovUgrDtObMW3z4xWjsmvGW1yee9_9JtC3cxIZqlMW-C2lj9RHXTQR5kZjf4dP-d5sB0i0WOr8qBaf4V0EmmBs6M30Vu3HbSw",
+  "refresh_token": "47e1bfb110134610a82662428a377f14-r",
+  "expires_in": 43199,
+  "scope": "openid bookshop-cap-sandbox-patrice!t50015.admin",
+  "jti": "180853f14c1f47059f66a84a4b962221"
+}