Providing Authorizations for SAP FIORI KPI Apps

Hi,

This is a blog regarding providing authorizations to End Users/ Admin Users to specific KPI Apps. I did not find much help regarding this, hence I penned down the steps I followed to provide authorizations.

Steps to assign required roles and authorizations to maintain proper structure and business hierarchy for KPI Apps:

• Login to your HANA server through SAP HANA client or HANA plugin for Eclipse.

• Open Security folder -> User -> AdminUser. Click on granted roles and assign the following roles:
  • sap.hba.r.sb. core.roles::SAP_SMART_BUSINESS_MODELER
  • sap.hba.r.sb.core.roles::SAP_SMART_BUSINESS_RUNTIME
  • sap.hba.apps.kpi.s.roles::SAP_SMART_BUSINESS_ MODELER
  • sap.hba.apps.kpi.s.roles::SAP_SMART_BUSINESS_RUNTIME
  • KPI_SPECIFIC_HANA_ROLE (You can find the role from FIORI Apps library)

• Open EndUser. Click on granted roles and assign the following roles:
  • sap.hba.r.sb.core.roles::SAP_SMART_BUSINESS_RUNTIME
  • sap.hba.apps.kpi.s.roles::SAP_SMART_BUSINESS_RUNTIME
  • KPI_SPECIFIC_HANA_ROLE (You can find the role from FIORI Apps library)

• Now login to Gateway server from SAP GUI and execute transaction SU01.

• Enter “AdminUser” and click on edit, navigate to roles tab and assign the following roles:
  • /UI2/ SAP_KPIFRW5_TCR_S
  • /UI2/SAP_KPIMOD_TCR_S (For KPI Modeler)
  • KPI_SPECIFIC_PFCG_ROLE(You can find the role from FIORI Apps library)

• Launch SAP FIORI Launchpad with AdminUser using http://<host>.<domain>:<port>/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html?sap-client=<CLNT>&sap-language=EN

• Check if KPI Modeler group with the following tiles are present :

• Configure and activate the KPI applications using the above modeler applications.

(http://help.sap.com/fiori_bs2013/helpdata/en/d1/c44b527fb7077de10000000a445394/content.htm)

• Once the activation is done, open the left panel and click on “Tile Catalog” and search for SAP: KPIs catalog. Add the KPI apps to your group and Test.

• Now for the “EndUser” go to su01 transaction in your gateway server and assign the following roles

• /UI2/ SAP_KPIFRW5_TCR_S
• KPI_SPECIFIC_PFCG_ROLE(You can find the role from FIORI Apps library)

• Launch SAP FIORI Launchpad with EndUser using http://<host>.<domain>:<port>/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html?sap-client=<CLNT>&sap-language=EN

• Open the left panel and click on “Tile Catalog” and search for SAP: KPIs catalog. Here you can see all the KPI applications configured and the End User is able to access all the KPIs. In order to restrict the authorization for the EndUser to access only one KPI app, AdminUser has to create a Custom Catalog and Custom Group. Here how it is:

• Launch Fiori Launchpad Designer with http://<host>.<domain>:<port>/sap/bc/ui5_ui5/sap/arsrvc_upb_admn/main.html

• On the catalogs tab click on “+” icon to create catalog and save

• Go to target mapping tab and click on create target mapping

• Enter the following details in the popup that appears:
  • Semantic Object: *
  • Action: analyzeSBKPIDetails
  • Source of Navigation Target: select SAPUI5 Fiori App
  • Title: Analyze KPI Details
  • URL: /sap/bc/ui5_ui5/ui2/ushell/resources/sap/suite/ui/smartbusiness/drilldown/
  • Component: sap.suite.ui.smartbusiness.drilldown
  • In Parameters field, Enter
    • Name : chipId, Mandatory: true
    • Name : evaluationId, Mandatory: true

• Click on save

• Go to groups tab and click on “+” icon to create custom group

• Save the group and click on “+” on empty tile to add the tiles

• Here search for SAP: KPI catalog and add the KPI app that is to be assigned to EndUser.

• Next step is to create a role to add these catalog and group, go to PFCG transaction in gateway server and create a single role

• Go to Menu tab and add the SAP FIORI Catalog (Z_CUSTOM_CAT) and SAP FIORI Group(Z_CUSTOM_GRP)

• Save the PFCG role and add this role to our EndUser from SU01 transaction and remove the role “/UI2/ SAP_KPIFRW5_TCR_S”

• Open the Launchpad with EndUser and now you can see the group “Custom Group for End User” with one KPI App.

Thanks and Regards,

Vinuta