Skip to content

Update Authentication Documentation #2471

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
samyuktaprabhu wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Update Authentication Documentation #2471

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b1fcb9e
Remove outdated tip on authentication mode from documentation and cla…
samyuktaprabhu Mar 26, 2026
648a657
Merge branch 'main' into sam-local-env-auth-mode-update
rjayasinghe Mar 26, 2026
a12f639
Merge branch 'main' into sam-local-env-auth-mode-update
smahati Mar 26, 2026
f61981c
fix linting error
smahati Mar 26, 2026
6a8a084
fix linting error
smahati Mar 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions guides/security/authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,10 +114,6 @@ As the mock user authentication is active, all (CAP) endpoints are [authenticate

<div class="impl java">

::: tip
To simplify the development scenario, you can set <Config java>cds.security.authentication.mode = "model-relaxed"</Config> to deactivate authentication of endpoints derived from unrestricted CDS services.
:::

If you stay with the standard authentication mode, sending the OData request results in a `401` error response from the server, indicating that the anonymous user has been rejected due to missing authentication.

```sh
Expand Down Expand Up @@ -280,7 +276,7 @@ MockedUserInfoProvider: Resolved MockedUserInfo [id='mock/viewer-user', name='vi

<div class="impl node">

```
```sh
[basic] - authenticated: { user: 'viewer-user', tenant: 'CrazyCars', features: [ 'cruise', 'park' ] }
```

Expand Down Expand Up @@ -755,7 +751,7 @@ IAS offers a cross-consumption mode that allows IAS users to consume legacy XSUA

::: tip
In contrast to [IAS](#ias-auth), XSUAA does not allow cross-landscape user propagation out of the box.
:::
:::

You can best configure and test XSUAA authentication in the Cloud, so let's enhance the sample with a deployment descriptor for SAP BTP, Cloud Foundry Runtime (CF).

Expand Down
6 changes: 3 additions & 3 deletions java/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,11 +91,11 @@ The property `cds.security.authentication.mode` controls the strategy used for a
| :---------------------------------------------------- | :----------------------------------------------------- |
| `never` | No endpoint requires authentication. All protocol-adapter endpoints are considered public.
| `model-relaxed` | Authentication is derived from the authorization annotations `@requires` and `@restrict`. If no such annotation is available, the endpoint is considered public.
| `model-strict` | Authentication is derived from the authorization annotations `@requires` and `@restrict`. If no such annotation is available, the endpoint is authenticated. An explicit `@requires: 'any'` makes the endpoint public (Default).
| `model-strict` | Authentication is derived from the authorization annotations `@requires` and `@restrict`. If no such annotation is available, the endpoint is authenticated. An explicit `@requires: 'any'` makes the endpoint public.
| `always` | All endpoints require authentication.

By default the authentication mode is set to `model-strict` to comply with secure-by-default.
In that case you can use the annotation `@requires: 'any'` on service-level to make the service and its entities public again.
When the auth mode is explicitly configured, it takes precedence. When it is not configured, the mode is derived automatically i.e. `model-relaxed` if mock users are enabled (local development), `model-strict` otherwise (production).
But, one can use the annotation `@requires: 'any'` on service-level to make the service and its entities public again.
You can only make an endpoint public if the full endpoint path is also considered public.
For example you can only make an entity public, if the service that contains it is also considered public.

Expand Down
Loading