Skip to Content
Technical Articles
Author's profile photo Emanuel Affatati

Mobile apps for SAP S/4HANA – Customer Guide

Hello SAP Community,

This time I am going to talk about the mobile ready capabilities of the SAP S/4HANA system.

Preamble

During these particular times, we have been hearing a lot the following words: quarentines, lockdowns, Supply Chain challenges, consumer demand shocks, …

And the question everyone is asking is: How can companies be prepared for this situation?.

The answer that comes to my mind is mobility. Doesn’t matter where you are, in order to be prepared for what’s coming next and be able to take a quick decision, you need to have information at the palm of your hand.

This topic is largely tackled in SAP S/4HANA by using SAP Fiori apps (web apps).

As you know, SAP Fiori apps are are built using SAP Fiori paradigm which with the following design principles:

  • Role-based
  • Adaptive
  • Simple
  • Coherent
  • Delightful

This means that due to the “Adaptive” principle, users are enable to work with the SAP Fiori apps either from desktop and mobile devices.

But apart from the SAP Fiori apps available in the SAP S/4HANA systems, there is an offering of mobile apps you can download from your favourite app store.

This is the current list of mobile applications available for SAP S/4HANA environments:

  • SAP Customer Guide Apple

Using “SAP Customer Guide” app you can retrieve the latest customer financial data anywhere and any time. This app connects to SAP S/4HANA and allows regional CFOs and sales manager to prepare for upcoming customer meetings and keep track of a customer right from their iPhone or iPad.

More info

SAP Shop Floor Manager mobile app helps “Production Supervisors” in the Manufacturing Plant to reach the production figures for the day, ensure smooth running production line and remove breakdowns and bottlenecks, have the right people at the right time at the right place and have all machines up and running and all material at work.

More info

Using SAP Asset Manager mobile app you can manage work orders, notifications, condition monitoring, material consumption, time management, and failure analysis. It supports the highly skilled workers who maintain enterprise assets to perform their job with complex information and business logic that is always available whether they are connected to the network or working in offline environments.

This particular app needs an add-on to be installed on the backend system.

More info

SAP Field Service Management provides industry-leading field service management capabilities in real-time, by bringing together the right data at the right moment to delight customers and drive business results at the most critical points of service.

More info

Introduction

In this article I am going to focus on how to configure one of the apps previously listed, against an SAP S/4HANA on premise system. Particularly, I am going to show the step by step configuration of the “SAP Customer Guide” mobile app. Help SAP

Requirements

Before starting with this tutorial, let’s list the prerequisites:

  • SCP Cloud Foundry with Mobile Services
  • SCP Cloud Connector
  • SAP S/4HANA system
  • Identity Provider (IdP)

Architecture

The architecture of this solution contains a lot of components, so let’s start analyzing it by identifying the different systems that are part of it.

Now that we are aware of what are the different systems that interacts in the landscape, we are going to step into the details of the authentication process.

Using a native mobile app that you have downloaded from your phone’s app store, you authenticate against an IdP that then propagates your identity to the SAP S/4HANA system.

There are some important points you have to be aware with about the IdP prerequisites that can be ffound in the help sap documentation.

The IdP needs to fulfill the SAML 2.0 standard. Use one of the following mutually exclusive options:

  1. Use an existing SAML 2.0 IdP: If you already have a SAML 2.0 compliant IdP, you can use this for the Corporate Identity Provider. For more information, see Identity Federation with a Corporate Identity Provider.

  2. Use an Identity Authentication Tenant: If you don’t have a Corporate Identity Provider, you can use SAP’s cloud product – SAP Cloud Platform Identity Authentication Service. A detailed description about this product can be found here: SAP Cloud Platform Identity Authentication Service

  3. Use the SAP ID Service: The SAP ID service is SAP’s ready-to-use identity service that is offered as a Software-as-a-Service solution completely operated by SAP. This variant should only be considered for testing scenarios as you don’t have control over the user store. Also, you cannot integrate this solution with your on-premise user management.

For the purpose of this blog, I am going to use the SAP ID Service.

Going back to the architecture explanation, I am going to paste below the graphic of the detailed architecture for this solution that can be found at the following link.

We are going to talk back about this, when configuring the security tab in the SCP Mobile Services application tab.

Configuration of mobile application

First you have to create a new application in your mobile services cockpit.

Select the features that the app need to have:

  • Mobile Client Log Upload

  • Mobile Client Resources

  • Mobile Client Usage and User Feedback

  • Mobile Connectivity

  • Mobile Network Trace

Press finish button.

 

Configuration of Application Security tab (and SCC setup)

The Customer Guide app works letting the user authenticate against an IdP and then propagaiting this authentication against the SAP S/4HANA system. In this sense, the SAP Cloud Connector need to be configured for this purpose. Check the following links for understanding principal propagation between SAP Cloud Platform and an OnPremise system Link (Link1 and Link2). Just one small clarification, you don’t need to configure the destination on the SAP Cloud Platform. The mobile app knows which cloud connector/system to use due to the “url” and “cloud connector location id” specified in the SCP mobile servies destinations defined in the connectivity tab of the mobile app. This will be presented in the next section.

Remember that for the purpose of this blog, I have used SAP ID Service IdP.

The steps to configure principal propagation from the Cloud Connector to the SAP S/4HANA system are the following.

  • In SCC administration console:
  1. Synchronize the IdP for Principal Propagation
  2. Create System certificate
  3. Create CA certificate
  4. Change Principal Propagation config to propagate mail attribute to map to the SAP S/4HANA user. This is some important info to know about the SAP ID Service IdP mapping and Cloud Foundry environment. be aware that most of the articles related to principal propagation are done in Neo. In my case, I used Cloud Foundry environment so I have to use ${email} parameter.

5. Create sample certificate using the e-mail you have been configured in the account within the SAP ID Service (IdP)

6. Add the Backend System with Principal Propagation config in the “Cloud To On-Premise” tab

Note: This is a nice article about how to create the SSL certificates needed for the Cloud Connector.

 

  • In the SAP S/4HANA system:
  1. Upload SCC System certificate in t-code strustsso2. Note: SCC system certificate should be signed either with a local CA or public, otherwise the SAP S/4HANA will give you SSL communication errors.

The SCC certificate should be uploaded in the “SSL Server Standard” folder like detailed in the blogs mentioned at the beginning of the section.

2. Configure the required system parameters mentioned in the two blogs previously provided. Some of them are not dynamic, so you will need to reboot the instance.

  • login/certificate_mapping_rulebased
  • icm/HTTPS/verify_client
  • icm/HTTPS/trust_client_with_issuer
  • icm/HTTPS/trust_client_with_subject

 

  • icm/trusted_reverse_proxy_0. –> Not needed in most of the cases.

3. Go to t-code CERTRULE and configure the rule necessary to map the SAP ID Service user to the SAP S/4HANA user using the e-mail property (use the sample certificate you previously generated in the SCC to verify this is working fine)

It’s very probably that you have some issues with the principal propagation configuration, keep checking the SMICM log trace to debug and SCC log file ljs_trace.log located in /<home>/SCC/log folder, and consult these excellent resources (info1 and info2) about the meaning of the errors.

 

  • Finally, in the SCP Mobile Services cockpit, we just need to know that in the security tab of the app it needs to be selected the option “OAuth”.

 

For those who are wondering what is OAuth, you can check the explanation in the mobile services documentation. Link

OAuth is an open protocol for securely authorizing applications using a standard method. SAP Cloud Platform must be the authorization server. This is the default option, and the OAuth client is generated automatically. You can use API keys with this choice.

Configuration of SCP Mobile Services destination

In this step we are going to define the backend connection that the app is going to use.

Go to the Connectivity tab of your app:

 

You will have to create the following destinations with the same configuration except for the following parameters:

Destination Name URL

com.sap.mobile.apps.CustomerGuide.API_BUSINESS_PARTNER

http://<scc-host>/sap/opu/odata/sap/API_BUSINESS_PARTNER

com.sap.mobile.apps.CustomerGuide.API_OPLACCTGDOCITEMCUBE_SRV

http://<scc-host>/sap/opu/odata/sap/API_OPLACCTGDOCITEMCUBE_SRV

com.sap.mobile.apps.CustomerGuide.API_SALES_CONTRACT_SRV

http://<scc-host>/sap/opu/odata/sap/API_SALES_CONTRACT_SRV

com.sap.mobile.apps.CustomerGuide.C_DAYSSALESOUTSTANDING_CDS

http://<scc-host>/sap/opu/odata/sap/C_DAYSSALESOUTSTANDING_CDS

com.sap.mobile.apps.CustomerGuide.C_FUTUREACCTRBLS_CDS

http://<scc-host>/sap/opu/odata/sap/C_FUTUREACCTRBLS_CDS

com.sap.mobile.apps.CustomerGuide.C_OPENDISPUTECASE_CDS

http://<scc-host>/sap/opu/odata/sap/C_OPENDISPUTECASE_CDS

com.sap.mobile.apps.CustomerGuide.C_OVERDUEACCTRBLS_CDS

http://<scc-host>/sap/opu/odata/sap/C_OVERDUEACCTRBLS_CDS

com.sap.mobile.apps.CustomerGuide.C_SALESVOLUMEANALYTICSQRY_CDS

http://<scc-host>/sap/opu/odata/sap/C_SALESVOLUMEANALYTICSQRY_CDS

com.sap.mobile.apps.CustomerGuide.C_TOTALACCOUNTSRECEIVABLES_CDS

http://<scc-host>/sap/opu/odata/sap/C_TOTALACCOUNTSRECEIVABLES_CDS

In the connectivity feature, press the create button.

 

Enter the “destination name” and the “url” according to the table shown above.

If you are using Cloud Connector, set the checkbox and enter the SCC Location ID according to your SCC configuration.

In the Custom Headers screen, insert the system client.

Leave the annotations screen empty.

Enable propagate User Name and select “Cloud Connector SSO”.

 

The final configuration should look like this:

Note: The odata services should be activated in your backend system.

Upload configuration files to SCP Mobile Services

The customer guide app uses some configuration files to render the application functionality. Depending on the content you defined in these files, your app will display different content, and functionality as different action and navigations. Please check this link for further information.

You will have to navigate to the “Mobile Client Resources” feature of the app, and create these files:

  • AppConfiguration.json
  • FLPEndpointConfiguration.json
  • LayoutConfiguration.json

 

 

 

The content of the files is the following.

AppConfiguration.json

The AppConfiguration file contains basic technical configuration required by the app.

Property Name Description
supportEmail

Email address used by the app as a recipient for composing emails to report issues to support.

Please use a non-personal email address, such as a generic address or a distribution list.

{
   "supportEmail": "SupportEmailAddress@MyCompany.com"
}

FLPEndpointConfiguration.json

This is required by the app to construct URLs for navigating from the app to corresponding SAP Fiori apps. This feature allows the user to deep dive into information shown in the app.

In case the FLPEndpointConfiguration file is not uploaded, the navigation feature is not available.

{
    "version": "1.0.0",
    "flpEndpointSettings": {
        "default": {
            "baseUrl": "https://<Fiori-Launchpad-Host>/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html",
            "clientId": "<System-Client>"
        }
    },
    "navigationSettings": {
        "Customer": {
            "hiddenActions": ["displaySalesOverview"]
        },
        "AccountingDocument": {
            "hiddenActions": ["*"]
        }
    }
}

LayoutConfiguration.json

The LayoutConfiguration contains the configuration of the app layout. With this configuration, administrators can determine which components are shown in the app at which position. The detailed explanation on how to populate this file can be checked at this link.

{
   "version": "1.0.0",
   "tabs":[
      {
         "title":"Overview",
         "sections":[
            {
               "title":"customerHeader",
               "type":"customerHeader",
               "components":[
                  {
                     "title":"Component0",
                     "context":"CustomerHeader"
                  }
               ]
            },
            {
                "title":"Contact Information",
                "type":"contactInformation",
                "components":[
                    {
                        "title":"Component1",
                        "context":"CustomerDetail"
                    }
                ]
            },
            {
                "title":"Key Contacts",
                "type":"contactList",
                "components":[
                    {
                        "title":"Component2",
                        "context":"AccountExecutives"
                    }
                ]
            },
            {
                "title":"KPIs",
                "type":"kpi",
                "components":[
                    {
                        "title":"Receivables Amount Overdue",
                        "context":"InvoiceAmountOverdue"
                    },
                    {
                        "title":"Total Receivable Amount",
                        "context":"totalReceivablesAmount"
                    },
                    {
                        "title":"DSO, Last 12 Months",
                        "context":"DSO"
                    },
                    {
                        "title":"Number of Disputes",
                        "context":"NumberOfDisputes"
                    },
                    {
                        "title":"Amount of Disputes",
                        "context":"AmountOfDisputes"
                    }
                ]
            },
            {
               "title":"Revenue",
               "type":"barChart",
               "components":[
                  {
                     "title":"Revenue",
                     "context":"Revenue"
                  }
               ]
            },
            {
               "title":"Sales Volume per Material",
               "type":"chartCard",
               "components":[
                  {
                     "title":"Trends",
                     "context":"SalesRevenueCardsBySegment"
                  }
               ]
            },
            {
               "title":"Stock Market",
               "type":"stockChart",
               "components":[
                  {
                     "title":"Component6",
                     "context":"StockChart"
                  }
               ]
            },
            {
               "title":"News Feed",
               "type":"newsFeed",
               "components":[
                  {
                     "title":"Component7",
                     "context":"NewsFeed",
                     "options": {
                         "news": {
                             "providers": ["bing"],
                             "keys": {
                                 "bing": "<Your Bing API key>"
                             }
                         }
                     }
                  }
               ]
            }
         ]
      },
      {
         "title":"Contracts",
         "sections":[
            {
               "title":"customerHeader",
               "type":"customerHeader",
               "components":[
                  {
                     "title":"Component0",
                     "context":"CustomerHeader"
                  }
               ]
            },
            {
                "title":"Contracts",
                "type":"contractList",
                "components":[
                    {
                        "title":"Contract List",
                        "context":"ContractList"
                    }
                ]
            }
         ]
      },
      {
          "title":"Accounts Receivables",
          "sections":[
              {
                  "title":"customerHeader",
                  "type":"customerHeader",
                  "components":[
                      {
                          "title":"Component0",
                          "context":"CustomerHeader"
                      }
                  ]
              },
              {
                  "title":"barChartCardHeader",
                  "type":"barChartCard",
                  "components":[
                      {
                          "title":"Future Receivables",
                          "context":"InvoiceAmountDue"
                      },
                      {
                          "title":"Overdue Receivables",
                          "context":"InvoiceAmountOverdue"
                      },
                      {
                          "title":"DSO Trend",
                          "context":"DSOTrend"
                      }
                  ]
              },
              {
                  "title":"Invoices",
                  "type":"invoiceList",
                  "components":[
                      {
                          "title":"Invoice List",
                          "context":"InvoiceList"
                      }
                  ]
              }
          ]
      }
   ]
}

For more information on the file content, please check this link.

Download the app from appstore

The final step is to download the SAP Customer Guide mobile app, and scan the QR code available in the APIs section of your mobile app definition in SCP Mobile Services.

 

After logging into the app, you will be able to review your customer’s finance data, according to the info you populated in the LayoutConfiguration.json file.

These captures are from a demo system, but in a real system with plenty of data, the mobile app is going to look similar to the next images.

Here you can find a document with an overview of the app capabilities.

Conclusion

As you have seen in this blog, SAP Customer Guide provides a new way to interact with SAP S/4HANA systems, using a native mobile app. Once configured, you will be able to check customer’s data directly from your cellphone/tablet, using a total mobile native approach that you are able to personalize using json files.

Remember that this is not the only SAP standard app app available for SAP S/4HANA, and each one has their different configuration setups. I encourage you to review each of them, so you can get the most of your SAP S/4HANA systems.

I hope you like the content, and start implementing them in your projects.

 

Thanks.

Best regards,

Emanuel

Assigned tags

      8 Comments
      You must be Logged on to comment or reply to a post.
      Author's profile photo Ivan Mirisola
      Ivan Mirisola

      Great info Emanuel! Keep your it up with the good quality of both writing and technical information..

      Author's profile photo Emanuel Affatati
      Emanuel Affatati
      Blog Post Author

      Thanks Ivan!

      Author's profile photo Aleksandar Mijailovic
      Aleksandar Mijailovic

      Hi Emanuel,

       

      really good and detailed! Thank you !

      BR,

      Aleksandar

      Author's profile photo Emanuel Affatati
      Emanuel Affatati
      Blog Post Author

      Thanks Alexandar!

      Author's profile photo Murugesh Karunamurthy
      Murugesh Karunamurthy

      thanks for the blog..
      if we don't enable principal propagation how can we achieve the same?

      Author's profile photo Emanuel Affatati
      Emanuel Affatati
      Blog Post Author

      Hello Murgesh,

      The architecture proposed on this blog is based on an S/4HANA system that is not exposed to internet. Due to this scenario, you must use the SCC to be able to reach the system from SCP.

      Having said that, the only way S/4HANA system can know the identity of the user that is logging to the system from the SCC, is configuring some way of communication that forwards the identity of the user logged in the selected IdP. This so common mechanism needed for forwarding the identity SAP calls it “Principal Propagation”. You can check more information about Principal Propagation at this link.

      Coming back to your question, in this scenario, the only way you have to authenticate the user in S/4HANA that had previously logged against the IdP is by using Principal Propagation through the SCC.

      Best regards,

      Emanuel

       

      Author's profile photo Murugesh Karunamurthy
      Murugesh Karunamurthy

      thanks,
      say we have DRIVER app/ STORE app  which will be used by many endusers... creating user for everyone in the SAP system might not be feasbile, but still authorisation and user updates have to be captured. One solution is to use some common technical user but what would be a best way to send the user context in a secure way ( instead of query params)

      Author's profile photo Eagle apk
      Eagle apk

      thankyou i uploaded apps on eagleapk and got a good response