Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 5 of 5

Fiori layers

10 min

Listen to this lesson

0:00 / 5:32

SAP GUI users meet one authorization layer: the transaction start check, then the checks inside the program. SAP Fiori adds more. A tile has to be visible in the launchpad, the app's OData service has to be allowed to start, and only then do the familiar business checks run on the data. Testers who know the layers can tell in seconds why an app fails, and security teams avoid the classic mistake of granting a tile without the access behind it.

Front end and back end

SAP's Fiori authorization course describes two kinds of system. The front-end server serves the launchpad and UI content; it is an ABAP stack without the business applications. The back-end server holds the business logic and data. In embedded deployment, which SAP recommends for S/4HANA, the front end runs inside the back-end system, so roles and authorizations are maintained centrally in one system. In hub deployment, front end and back end are separate systems, and roles and authorizations must be maintained in several systems; SAP recommends it mainly for Business Suite scenarios or a central launchpad.

Embedded deploymentHub deployment
SystemsFront end inside the S/4HANA systemSeparate front-end system serving one or more back ends
Where roles are maintainedCentrally in one systemIn several systems: front end and each back end
SAP's recommendationRecommended for SAP S/4HANAMainly Business Suite scenarios or a central launchpad
ContosoCMD, CMQ and CMP each run embeddedNot used
Fiori deployment options and what they mean for authorizations.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-101

Three layers of a Fiori app

Launchpad contentBusiness catalogs hold the apps; spaces and pages (or legacy groups) display tiles. The role's menu carries them
Start authorizationS_SERVICE for the app's OData service; added automatically when a catalog is added to the role
Business authorizationThe same back-end objects as SAP GUI, such as F_BKPF_BUK with activity and company code, checked when the service reads or changes data
The three layers a Fiori app passes through.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-101

SAP's course on business roles explains how they come together in PFCG. A business role is a PFCG role filled with one or more Fiori catalogs and spaces. When a catalog is added on the Menu tab, its service entries (shown as IWSG and IWSV) come with it, and the required start authorizations are added automatically. SAP recommends adding catalogs rather than individual OData services, because manually added services are not covered by the catalog comparison tools. Default values for the service objects cover start authorizations; business authorizations come from the default values of the app's back-end checks, and still need organizational values filled in.

An embedded Fiori call passes three gates in order: the tile from the role, S_SERVICE for the OData service, then the business object check on the data.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-101
  1. Copy a templateStart from the SAP business role template for the job, found in the Fiori apps reference library
  2. Add catalogsOn the Menu tab, add the business catalogs; start authorizations follow
  3. Add a spaceSo tiles appear on the launchpad home page
  4. Complete valuesFill organizational levels and open fields on the Authorizations tab
  5. Generate and assignGenerate the profile, assign users, run the comparison
  6. Keep currentWhen catalogs change, compare and update the role
Building a Fiori business role in PFCG.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-101

Reading the symptoms

SymptomLikely layerWhere to look
The tile is not on the launchpadLaunchpad contentCatalog or space missing from the user's roles
The tile is there but the app will not openStart authorizationS_SERVICE for the OData service; STAUTHTRACE and /IWFND/ERROR_LOG
The app opens but shows no data or refuses to saveBusiness authorizationBack-end objects and organizational values; STAUTHTRACE
Some company codes are missing from a listBusiness authorizationOrganizational values in the role, such as BUKRS

Diagnosing Fiori access problems by layer.

In SAP S/4HANA Cloud Public Edition the mechanics differ: business roles are built from SAP business catalogs in the identity and access management apps, with restrictions instead of PFCG organizational values. The principle of separate visibility, start and data layers still applies.

In Public Edition, business roles are built from SAP business catalogs in the identity and access apps, with restrictions in place of PFCG organizational values.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-101

What would you do?

After go-live, Ana can see the Manage Supplier Line Items tile, but when she opens it the app shows an error before any data loads. Which layer should the security team check first?

Key points
  • Fiori separates launchpad content, service start authorization (S_SERVICE) and business authorization.
  • SAP recommends embedded deployment for S/4HANA, keeping roles in one system.
  • Add catalogs, not single services, to PFCG roles; start authorizations then follow automatically.
  • A visible tile is not access; test what users can do with the data.

Check your understanding · not graded

Lesson check

  1. 1. Which object controls the start of a Fiori app's OData service?

  2. 2. Which Fiori deployment does SAP recommend for S/4HANA?

  3. 3. Why add catalogs rather than individual OData services to a role?

  4. 4. A user sees a tile but the app shows no data for company code 1810. Which layer is likely?