3777028 - Platform Scopes Not Issued in Access Tokens Due to XSA Runtime 1.5.0 Security Changes

After security-related changes introduced in XSA Runtime 1.5.0 the platform scopes can be issued by an UAA instance only when referenced in foreign-scope-references. This means that from XSA Runtime 1.5.0 the configuration for UAA instances - xs-security.json allows to put platform defined scopes in application role templates but would not consider them when issuing tokens.

Example:

xs-security.json:

"role-templates": [
  {
    "name": "ApplicationCloudController",
    "description": "Custom defined role template exposing platform scope",
    "scope-references": [
      "cloud_controller.admin_read_only"
    ]
  }
]

If a role is created from “ApplicationCloudController” role template even if this role is assigned to a business user, this user would not get the platform scope in its access token after successful authentication.

SAP HANA Extended Application Services, Advanced model

XSA, XSA 1.5.0, XSUAA for XSA, platform scopes, missing scopes, xs-security.json, grant-as-foreign-scope-to-apps, granted-apps , KBA , BC-XS-RT , XS Advanced Runtime / XS Controller , Problem