BTP & Integrationadvanced

BTP Security Part 3: App-to-App Security with OAuth2

Key takeaway

Secure service-to-service communication: OAuth2 client credentials for technical calls, token exchange/JWT bearer to propagate user identity, granting scopes to other apps (foreign scopes), X. 509 credentials instead of secrets, and troubleshooting token errors.

Explanation

📌 KEY POINTS
✅ Client credentials: app A obtains a token as itself to call app B (technical context).
✅ Token exchange / JWT bearer: app A exchanges the user's token so B sees the user.
✅ App B grants scopes to A (e.g. grant-as-authority-to-apps / foreign-scope references) in xs-security.json.
✅ X.509-based credentials avoid long-lived client secrets.
⚠️ Using client credentials when user context is required removes user-level authorization checks.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 2 configured app security. Now app-to-app.

━━━━━━━━━━━━━━━━━━━━
▶ 1. TECHNICAL CALLS

Client credentials flow.

━━━━━━━━━━━━━━━━━━━━
▶ 2. USER PROPAGATION

Token exchange / JWT bearer.

━━━━━━━━━━━━━━━━━━━━
▶ 3. SCOPE GRANTS

Provider grants scopes to consumer apps.

━━━━━━━━━━━━━━━━━━━━
▶ 4. CREDENTIAL TYPES

Client secret vs X.509.

━━━━━━━━━━━━━━━━━━━━
▶ 5. TROUBLESHOOTING

Decode token: issuer, audience, scopes, expiry.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Grant a scope from app B to app A.
Call B with client credentials.
Call B with token exchange and compare tokens.

✅ CHECKPOINT: B sees the technical client in one case and the user in the other.

Code example

ABAP Code

===== PROVIDER (app B) xs-security.json excerpt ====="scopes": [ { "name": "$XSAPPNAME.Read", "grant-as-authority-to-apps": ["$XSAPPNAME(application,orders-a)"] } ] ===== CONSUMER (app A) ====="authorities": ["$XSAPPNAME(application,orders-b).Read"] ===== FLOWS =====Client credentials: POST /oauth/token grant_type=client_credentialsJWT bearer (user): grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer with user's token

Real project scenario

A reporting service called an orders API with client credentials, so all users saw all countries' data. Switching to token exchange let the orders API apply the user's country attribute.

Common mistakes

Client credentials for user data.
Missing scope grants.
Long-lived secrets.
Not validating audience.
Guessing instead of decoding tokens.

Best practices

Choose flow by user need.
Explicit grants.
Certificates or rotation.
Validate issuer/audience.
Decode tokens when debugging.

Interview angle

Questions: "Client credentials vs token exchange?", "How does one app grant scopes to another?", "How do you troubleshoot 403?"
Strong answer: flows, grants, credential types, troubleshooting.

Practice this lesson

Quick check

1. In the Kyma environment, how is application-level authentication and authorization typically enforced for microservices instead of relying solely on native XSUAA integration within the application code?

2. Which OAuth 2.0 grant type is typically used for service-to-service communication on SAP BTP where no interactive end user is involved, such as a scheduled job calling another service?

3. When configuring a destination in the SAP BTP Destination service to call a backend that requires mutual TLS with a client certificate, which authentication type should be selected?

Interview questions

1. A service calls another API and users see data they shouldn't. How do you design app-to-app security?

Answer it in your own words first, then compare.

2. A production issue is reported in BTP Security for Integration and Application Architecture. What would you check first, and how would you troubleshoot it systematically?