Skip to Content
Technical Articles
Author's profile photo Thomas Schneider

Restricted ABAP for SAP Cloud Platform ABAP Environment

In the blog post S/4HANA Extensibility Concept Details: Restricted ABAP  I introduced the concept of restricted ABAP, or naming it correctly: ABAP language versions. Initially it was introduced for the usage in the key user editor in SAP S/4HANA Cloud. With SAP Cloud Platform ABAP Environment (aka Steampunk https://blogs.sap.com/2019/08/20/its-steampunk-now/ ) a second  use case was introduced. In this blog post, I want to spend some words about this use case.

First, let me recap the basics of the concept of ABAP language versions (for more details read my previous post):

The concept is built of two pillars:

  • Restricted syntax: only a well-defined part of the ABAP syntax tree is allowed in a specific ABAP language version.
  • White-listing check: only whitelisted SAP APIs (for example white-listed classes and CDS views) can be used. The syntax check analyses the used SAP objects and checks if they are whitelisted.

The concept of ABAP language versions supports two targets:

  • De-couple custom code from the SAP core by enforcing the exclusive use of white-listed SAP APIs
  • Minimize the risk of damages to the system or the data integrity/security

The ABAP language version is a property of the ABAP object, and so is independent of the used editor. This means, if you set a ABAP language version to, lets say “ABAP for Key Users” the syntax restrictions and whitelisting checks are executed an any case – whether you use the Web editor in the Fiori app Custom Fields and Logic, the Eclipse-based editor or the ABAP editor in SAPGUI.

Figure: Relation between ABAP sources, language version and ABAP editors

 

In an on-premise system, you can set the language version using the Eclipse-based ABAP editor (ADT) as shown in the following figure:

Figure: Set the ABAP language version in the Eclipse-based ABAP editor (ADT).

 

In Cloud systems, the ABAP language version is automatically set and cannot be changed. For example:

  • SAP S/4HANA Cloud: the ABAP language version ABAP for key users is automatically set by the key user tools (e.g. Fiori app Custom Fields and Logic).
  • SAP Cloud Platform ABAP Environment: the ABAP language version ABAP for SAP Cloud Platform is automatically when creating new ABAP objects.
  • When using the key user tools (e.g. Fiori app Custom Fields and Logic) in on-premise, the key user tools will also set the ABAP language version ABAP for key users.

Let us now shortly discuss the common parts and the differences between the ABAP language version ABAP for key users and ABAP for SAP Cloud Platform.

1) Both language versions are designed for use in Cloud. Therefore, they must not support all kind of statements that would endanger the operations in the Cloud: Examples are:

  • Access to file system OPEN/CLOSE/READ/GET DATASET
  • Low-level access to the database and to other clients: EXIT FROM SQL, EXEC SQL, OPEN/CLOSE CURSOR, SELECT CLIENT SPECIFIED, SELECT USING CLIENT 
  • Low-level access to the ABAP system: CALL CFUNCTION, SYSTEM CALL, SYSTEM EXIT

2) Some frameworks and technologies are no longer supported in Cloud development. This includes reports, list processing, dynpros. Thus, the related ABAP statement are forbidden.

3) Both language versions are designed to support “modern” ABAP, Therefore, obsolete statements are not supported. Here, ABAP for key users is stricter than ABAP for SAP Cloud Platform, because in the second, we want to support the migration of coding from on-premise to the Cloud ( How to bring your ABAP custom code to SAP Cloud Platform ABAP Environment ). For ABAP for key user use cases, we assume that coding starts on a green field and can be modernized to a larger extend.

Here are some examples for obsolete statements, which are forbidden in both language versions:

  • COMPUTE, MAXIMUM/ MINIMUM, MOVE, TABLES, DATA WITH HEADER LINE
  • DESCRIBE, WRITE TO, SEARCH
  • EXPORT MEMORY, EXPORT SHARED MEMORY

For these statements, “modern” alternatives are available.

In ABAP for SAP Cloud Platform, some statements are available, but a warning is issued that they should be replaced by a newer syntax.

4) Working (creating and calling) with classes is supported for ABAP for Key Users and for ABAP for SAP Cloud Platform. In the Key user tools, you can create custom libraries (ABAP classes) only using the Fiori app Custom Reusable Elements.

Function modules (creating and calling) are supported in ABAP for SAP Cloud Platform only.

5) Dynamic programming is supported in ABAP for SAP Cloud Platform, but not in ABAP for Key Users.

6) Code (object) generation is supported in ABAP for SAP Cloud Platform, but not in ABAP for Key Users. For code generation in ABAP for SAP Cloud Platform, APIs can be used, see for example the following blog: https://blogs.sap.com/2020/05/17/the-rap-generator/

7) Asynchronous programming is supported in ABAP for SAP Cloud Platform, but not in ABAP for Key Users. But statement like CALL FUNCTION … STARTING NEW TASK, RECEIVE, WAIT are no longer supported. They are replaced by an API (CL_ABAP_PARALLEL).

8) Providing and implementing extensions is supported in ABAP for SAP Cloud Platform, but not in ABAP for Key Users. Thus, CALL BADI, GET BADI is supported in ABAP for SAP Cloud Platform (planned). Obsolete extension technology is not supported, e.g. ENHANCEMENT-POINT

9) For ABAP for Key Users is design for implementation of “code snippets” in exits, for example BAdI implementations and determinations, validations, actions in business objects. Therefore, direct manipulation (insert, update, delete) of tables (even for custom tables) is not supported here.

10) System variables (SY-) are also subject to whitelisting. Some of them are no longer available due to the Cloud environment (e.g. mandt, application server name and number) or non-supported frameworks (e.g. dynpro). For use cases like language, time, etc. APIs are provided that must be used, e.g. class CL_ABAP_CONTEXT_INFO.

11) Finally, what is “in” for both language versions?

  • Statements for the program flow: IF, CASE, WHILE, DO, TRY,
  • Statements for working with data type, including field symbols: DATA, TYPES, CONCATENATE, ASSIGN
  • Statements for working with internal tables and selecting data from the database: APPEND, LOOP, SELECT, READ, …

Let me conclude with a list of useful documentation:

 

Assigned tags

      27 Comments
      You must be Logged on to comment or reply to a post.
      Author's profile photo Andre Fischer
      Andre Fischer

      Nice and crisp overview !

      Author's profile photo Paul Hardy
      Paul Hardy

      Is CONCATENATE an obsolete statement or not?

      It's inclusion in ABAP in the Cloud would tend to indicate it is not. However the ATC checks in the "Code Pal" used to saysay that CONCATENATE is obsolete.

       

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      CONCATENATE is obsolete. SAP has released it in the language version for key users and Cloud dev because it is oftern used.

      The current recommended syntax is: x = a && b && c.

      Or using string templates  myname = |Thomas{ nickname }Schneider| 

      Author's profile photo Grzegorz Owczarek
      Grzegorz Owczarek

      > WAIT are no longer supported. They are replaced by an API.

      Could you please let me know which API you ment?

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      The API for parallel processing is CL_ABAP_PARALLEL.

      Author's profile photo Pavel Astashonok
      Pavel Astashonok

      Low-level access to the ABAP system: CALL CFUNCTION

      here you mean system calls, but what about usual FM calls? I haven't found them mentioned in text, except parallel ones. Do we allow to call functions in ABAP SCP version?

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      Yes creating and useing function modules is supported.

      Author's profile photo Vishnu Gadwal Kammar
      Vishnu Gadwal Kammar

      Is there a list of objects supported for ABAP on SCP(Version 5) has also been published somewhere like SAP did for List of statements for ABAP for key users?

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      This is basically the index of the ABAP documentation (see link in my blog, then go to index).

      Author's profile photo Srinivas Bhimavarapu
      Srinivas Bhimavarapu

      Thanks for sharing this Thomas. This is really helpful.

      Best Regards,

      Srini B

      Author's profile photo Gregor Wolf
      Gregor Wolf

      Hi Thomas,

      I have several questions regarding the restricted ABAP settings:

      1. Is there an option to set "ABAP for key users" as the default?
      2. Is there a reporting option how much custom code uses which "ABAP Language Version"?
      3. Can you mention the corresponding ATC / SCI check variants that correspond to each "ABAP Language Version"?
      4. Is there a ATC / SCI check variant that would allow me to check also for the use of released BAPI's?

      Best regards
      Gregor

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      Hi Gregor,

      very good questions. Just to make sure that I understand the context of the questions correctly. They are related to on-premise. Because:

      • for S/4HANA Cloud, the language version "ABAP for key users" is enforced by the environment (Web-based ABAP editor).
      • for SAP Cloud Platform ABAP Environment, the language version "ABAP for SAP Coud Platform" is enforced by the environment

      As your questions call for a detailed answer, I will create a new blog post with focus on on-premise.

      Best, Thomas

      .

       

      Author's profile photo Gregor Wolf
      Gregor Wolf

      Hi Thomas,

      my questions are related to an on-premise S/4HANA installation. But we would like to enforce to use only released APIs (CDS views).

      Best regards
      Gregor

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      Hi Gregor,

      see my new blog post Restricted ABAP and SAP S/4HANA On-Premise. It provides the information on what is possible on premise. It particularly answers the question 1 & 3.

      Question 2: there is no reporting on the "lines of code". What I would recommend: run the "Cloud readiness" ATC check and count the number of violations in your code. This would be a good KPI from my point of view.

      Question 4: BAPIs are technically (in terms of the whitelisting framework) not released because they cannot be used in language version ABAP for Key Users. And the whitelist for language version ABAP for SAP Cloud Platform contains Basis objects only (because it is originally built for SAP Cloud Platform ABAP Environment, which a "Basis-only" offering). This is a limiting factor for the use of the whitelisting framework in on-premise.

      Best regards, Thomas

      .

      Author's profile photo Amandeep Bal
      Amandeep Bal

      Hi Guys,

      In the S4/HANA cloud world - extended edition, is setting defaulted to "ABAP for Key Users"  in ADT? Documents state that development can be performed via SAP GUI as well but not sure how the restrictions play in.

      Thanks

      -A

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      The technical setup in S/4HANA extended edition is on-premise-like. See: https://blogs.sap.com/2020/07/23/restricted-abap-and-sap-s-4hana-on-premise/

      The language version in ADT and in SE80 is not defaulted. It can be optionally set.

      Author's profile photo Amandeep Bal
      Amandeep Bal

      Hi Thomas,

       

      Thanks for the answer. Another question:

      We are considering EX, but have a lot of questions regarding the custom code which we have been writing on our onPrem system. What’s the best way to find if can move custom code to EX which we wrote for ages? Is ATC the only way to check compatibility?

      If yes, do we use ABAPGit or Transport system ?

       

      On S4HANA cloud, which ABAP language is enforced at SE80 level ?

       

      Thanks

      A

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      Please refer to the blog post How to bring your ABAP custom code to SAP Cloud Platform ABAP Environment as a starting point for your code migration. It describes e.g. how to use abapGit and the checks that you can perform.

      On S/4HANA Cloud, SE80 is not available.

      Best regards, Thomas

      Author's profile photo Stoyko Stoev
      Stoyko Stoev

      Hey Thomas Schneider,

       

      I have a question with regards to this point:

      White-listing check: only whitelisted SAP APIs (for example white-listed classes and CDS views) can be used. The syntax check analyses the used SAP objects and checks if they are whitelisted.

       

      Where can we find a list of all the whitelisted SAP APIs? I think providing something like this is a must. According to my Google search, there is an app called "Released ABAP Artifacts" that should provide this. But it is only a desktop application, and requires some special rights to access. Would it be possible to provide a web, free-to-access app of whitelisted APIs? Otherwise, if we get a Cloud Trial account to experiment with some features, we are just shooting in the dark with regards to what we can do. For example, the use of "if_http_client" interface is not permitted. So how am I supposed to know which API is whitelisted for sending HTTP requests?

       

      Best,

      Stoyko

       

       

       

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      The list of whitelisted APIs depends on the product you are using, and therefore the tool is different and embedded in the product.

      For SAP Cloud Platform ABAP Environment the tool is in the Eclipse-based ABAP development tools (ADT) -> Project Explorer -> Released Objects.

      This tool is of course also available in the free SAP Cloud Platform ABAP Environment trial account (but unfortunately not in a free web tool).

       

      Your concrete question: the cloud-ready replacement for “if_http_client” is "IF_WEB_HTTP_CLIENT".

      Best regards,

      Thomas

      .

       

      Author's profile photo Stoyko Stoev
      Stoyko Stoev

      Hey, Thomas,

      This is of course a perfectly valid solution too! I was not aware that we could also find the Released objects within Eclipse itself. (In fact, I think that's a problem that's all too common in ABAP - it's not that you can't do stuff with it, it's just that information about how to achieve it is lacking... but that's off topic!)

      Thank you for the very fast and concise reply!

      Best,

      Stoyko

      Author's profile photo Mehmet Ünal
      Mehmet Ünal

      Hey Thomas,

      in this course many classes are no longer supported I guess, e.g. the class cl_rsda_csv_converter. Are there alternative possibilities or is there a list of obsolete classes with alternatives?

      Beste Regrads

      Mehmet

      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      There is unfortunately no comprehensive list of obsolete classed and function module with their successor. However, for important functions, SAP provides a successor information. You can see this for example for the function module SI_UNIT_GET. When you open the API state window in ADT, you can see that the status is "Not to be released" and a successor CL_UOM_CONVERSION is maintained.

      But, as mentioned, you cannot expect this for all thousands of classed and function module, data types, etc. in the ABAP platform.

       

      Author's profile photo Mehmet Ünal
      Mehmet Ünal

      Thank you for your quick answer Thomas!

      Author's profile photo Jan Hobelmann
      Jan Hobelmann

      Hi Thomas Schneider,

      thanks for sharing this article.

      Am I right that point 8) is outdated? Im also confused that it says "Providing and implementing extensions are not supported for ABAP for Key Users", because this article 2019 is about exactly that - no?

      https://blogs.sap.com/2019/11/01/business-logic-extensions-cloud-badis-in-sourcing-and-procurement-self-service-procurement/

      Thanks for making things clear for me!

      Kind regards

      Jan

      Author's profile photo Santhosh Kumar Cheekoti
      Santhosh Kumar Cheekoti

      Hi Thomas,

      Thank you for summarizing. Few Questions.

      1. What ABAP Language support is available for streaming? For example, streaming data from a DB table or a file, etc.
      2. Is CL_ABAP_PARALLEL whitelisted? Can the customer or partner use the class or is it only for internal SAP development?
      Author's profile photo Thomas Schneider
      Thomas Schneider
      Blog Post Author

      Hi Santhosh, sorry I cannot answer questions on specific frameworks of objects here.

      For parallel processing, IF_ABAP_PARALLEL / CL_ABAP_PARALLEL is released
      For streaming, classed such as CL_ABAP_*_READER are available. Please check if they support your needs.