[FEATURE] JWT single-sign-on support for HANA Cloud (JWTProvider, PublicKey, PSE + User extensions)

[edofic]

Context

We run this provider to manage HANA Cloud tenants at SAP LeanIX and want to declare IdP-backed human-login flows (SAP IAS to HANA Cloud SSO) fully through Crossplane. Today the provider covers password-based and X.509 auth for HANA users, but the JWT trust chain that HANA Cloud uses for IdP-driven SSO has no CRD surface. Bootstrapping it requires imperative SQL against the tenant:

CREATE PUBLIC KEY IAS_SIGNING_KEY VALUE '...PEM...';
CREATE JWT PROVIDER IAS
  WITH ISSUER 'https://<tenant>.accounts.ondemand.com'
  CLAIM 'user_uuid' AS EXTERNAL IDENTITY
  PRIORITY 100
  CASE INSENSITIVE IDENTITY;
CREATE PSE IAS_JWT_PSE PURPOSE JWT FOR PROVIDER IAS;
ALTER PSE IAS_JWT_PSE ADD PUBLIC KEY IAS_SIGNING_KEY;
ALTER USER JOHN ENABLE JWT;
ALTER USER JOHN ADD IDENTITY 'john.doe@sap.com' FOR JWT PROVIDER IAS;
ALTER USER JOHN ENABLE CLIENT CONNECT;

Scope

Add first-class Crossplane resources for the SAP HANA Cloud JWT authentication stack.

Two new managed resources under admin.hana.sap.crossplane.io/v1alpha1:

• JWTProvider wrapping CREATE/ALTER/DROP JWT PROVIDER
• PublicKey wrapping CREATE/DROP PUBLIC KEY for IdP signing keys

Extensions to two existing resources:

• PersonalSecurityEnvironment: purpose discriminator (X509 or JWT, defaults to X509 for backward compatibility), jwtProviderRef, and publicKeyRefs. Client emits SET PSE ... PURPOSE JWT FOR PROVIDER and ALTER PSE ... ADD/DROP PUBLIC KEY when purpose is JWT. Existing X509 manifests keep working unchanged.
• User: authentication.jwtProviders[] (provider name or providerRef plus external identity) and enableClientConnect. Reconciler drives ALTER USER ... ENABLE/DISABLE JWT, ADD/DROP IDENTITY ... FOR JWT PROVIDER, and ENABLE/DISABLE CLIENT CONNECT

End state: a typical IAS-to-HANA SSO setup is five resources: PublicKey, JWTProvider, PersonalSecurityEnvironment (purpose: JWT), Role, and a restricted User with a JWT identity.

Out of scope

• SAML provider CRDs (CREATE SAML PROVIDER / ALTER USER ... ADD IDENTITY FOR SAML). Same shape as JWT, but a separate resource pair; can follow.
• LDAP provider CRDs. Same reasoning.
• Certificate CRD (CREATE CERTIFICATE). Adjacent to PublicKey but distinct SQL surface; tracked separately in [FEATURE] Add Certificate CRD to HANA Crossplane Provider #134.
• Automatic key rotation orchestration. PublicKey is immutable by design so callers must swap via delete + recreate; helper composition can layer on top later.

Additional context

As you can probably tell from the level of detail I did some discovery and have a proof-of-concept already. Happy to polish it up and contribute this.