CAP Authentication: Is it Role or Scope?

[kammaje_cis]

I have named my scopes and roles differently. Say my scope is named as 'manager_scope' and the role containing it is named as 'manager'.

So whenever I use @requires annotation in cds definitions, or use the API 'req.user.is', I see that I have to use name of the scope ('manager_scope') along with them, but not the name of the role.

For example,

Below code works.

annotate Escalations with @(requires: 'manager_scope')

Below code does not work.

 annotate Escalations with @(requires: 'manager')

But all the documentation always refers to roles with these concepts. Why is this disconnect?

[marcbecker · Accepted solution]

CAPs concept of roles is mapped to XSUAAs concept of scopes. You can also read about this in the documentation: https://cap.cloud.sap/docs/guides/authorization#xsuaa-configuration.

So when the CAP documentation talks about roles, you should think XSUAA scopes and not XSUAA roles.