You have set up the scopes and attributes that are needed to protect your application in the Cloud Foundry environment, but a user is unable to access your application. What might be the reason?

Question

Options

• ARoles aren't assigned to the client application.
• BRole collections aren't assigned to the user.
• CRoles aren't assigned to the user.
• DRole collections aren't assigned to the client application.

• A
  10% (5)
• B
  15% (7)
• C
  71% (34)
• D
  4% (2)

Explanation

In Cloud Foundry's authorization model, scopes and attributes define what permissions exist, but a user still needs roles assigned to them to actually receive those permissions. Without role assignments, the user has no grants linking them to the defined scopes, so access is denied regardless of how well the scopes and attributes are configured.

Why the distractors are wrong:

• A & D (client application): Roles and role collections are assigned to users, not to client applications. Client apps interact with scopes through service bindings, not role assignments.
• B (role collections not assigned to user): Role collections are an SAP BTP layering concept that groups roles - but in the core Cloud Foundry authorization flow, roles are assigned directly to users. Role collections are relevant in the BTP cockpit context, not as the root cause here.

Memory tip: Think of it as a pipeline - Scopes → Attributes → Roles → User. The question tells you the first two steps are done. The broken link is always at the end: the role must be assigned to the user or nothing flows through. If the user can't get in, ask "who's missing the role?" - and in CF, that's always the user.

No community discussion yet for this question.