Securing BTP Applications: Trust, Role Collections and Authorization

Keep this: job aid

BTP app security checklist

• Trust your own SAP Cloud Identity Services tenant, linked to the corporate IdP; hide the default provider for business users.
• Keep shadow user creation on unless you have a reason not to; refresh trust if the issuer changes.
• Define scopes, attributes and role templates in xs-security.json; regenerate from CDS after role changes.
• Assign role collections, never scopes; map them to IdP groups for business users.
• Use @requires to gate services and actions; @restrict with where for data-level rules.
• Expect 401 for anonymous, 403 for forbidden writes, 404 for forbidden single reads.
• Configure mock users per role and set "*": false in tests.
• Run a deployed test set with real identities, including group joiner and leaver tests.
• Never use administrators for test evidence; record the identity that ran each test.
• Review direct assignments and administrator collections before go-live and regularly after.