Maintain Back-End Authorization Objects for Fiori App

Overview

This blog is meant to help you to find all authorization objects which are using by custom Fiori app and then creating roles in back-end, front-end systems.

In this blog you will learn, how we can maintain authorization objects for custom Fiori/SAPUI5 apps step by step.

When after creating a Fiori project, some authorization objects related to processes are needed. Users who want to use Fiori app need back-end and front-end roles to run the app properly.

Front-end system roles

As a beginning Launchpad Catalog, Group and Gateway service should be added to role in Front-end system.
You can take reference below documentation for front-end;
https://help.sap.com/saphelp_hba/helpdata/en/fa/9344533d2e6757e10000000a44538d/frameset.htm

Back-end system roles

For authorization objects of back-end role, traces can save with t-codes in below and add to roles easily,
STUSOBTRACE – Authorization Trace,
STAUTHTRACE – System Trace,
STUSERTRACE – User Trace.

Step 1: Trace

I will use STAUTHTRACE tcode for trace in this blog.

At first, we need to activate trace for testing user in tcode,

After process all cases in Fiori app, we can see the report of all used authorization objects with “Evaluate” button.

Step 2: Maintain Authorization Values in SU24

We should add these objects to our Gateway service in SU24 tcode,

Type of Application should be TADIR for Fiori app,
Object name begins with your gateway project name.

When we open it with “Edit” mode, we can insert Object from Trace like in below, also there is opportunity to add object directly.

You can select filter of trace here for all applications or only current application.

After adding objects, proposal should be selected yes for object which we will need in role.

We can see values for fields of objects in STAUTHTRACE.

In here some values begin with $ , that means this object on organizational level and we can maintain that in PFCG.

Step 3: Adding Authorization object to role

We’ve completed su24 maintain, next step is creating a role in PFCG tcode.

I will create a test role for our example (blue SAP screens),

Add Authorization Default in Menu tab;

Auth. Default will be        TADIR
Obj. Type is                         IWSV.

We should select our gateway service which its objects already filled.

After press copy, service will be seen in Menu tab.

Now we should go “Change authorization data” in Authorizations tab,

All authorization objects will be automatically inherited from gateway service in su24 tcode.

The values for organizational level fields need to know and filling them in that step.

After generate and save, finally users can be added in our role.

When users have back-end and front-end roles, they will be able to use the Fiori app.

Conclusion

In this blog you learned, how you can maintain authorization objects for custom Fiori/SAPUI5 apps step by step. So we are able to maintain all roles for a custom Fiori app and add users to roles.

Please feel free for your suggestions and questions.

References:

https://help.sap.com/viewer/f3e3a9ffe47f4c039ebd1546747288f2/7.51/en-US/3c49e1a27806488689b2ad7c67e77291.html

Özkan YILMAZ