Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 1 of 5

Fiori access layers

10 min

Listen to this lesson

0:00 / 6:10

In SAP GUI, a user's access question was fairly simple: may this user start transaction FB60, and do the authorization checks inside it pass? In SAP Fiori the same back-end checks still run, but two more layers sit in front of them. A user has to see the app on the launchpad, and the app's OData service has to be allowed to run on the user's behalf before any business data is read. Each layer is maintained in a different place, by different people, and fails in a different way.

This course uses Contoso Motor Co.'s conversion from SAP ECC 6.0 to SAP S/4HANA Private Edition as its running example. Contoso's users are moving from SAP GUI menus to the launchpad, and its new security and GRC lead, Nadia, has to rebuild access around Fiori business roles without breaking anyone's day-one work. Priya, the test lead, has to prove that it works.

Four layers between a user and the data

Layout: spaces and pagesWhere tiles appear on the home page. Pure presentation: grants nothing.
Content: business catalogsWhich apps the user may find and launch. The catalog is what makes a tile available at all.
Start authorizationThe OData service (or transaction, for SAP GUI for HTML apps) may be called for this user.
Back-end checksAuthorization objects, activities and organizational values such as company code 1710 decide what data the user can read or change.
The four layers of Fiori access. A role has to be right at every layer for a user to finish a task.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-202

On the front-end server, a role needs the business catalog, which gives the user the tiles and the start authorization for the app's OData services, and a space (or, in the classic layout, a group) to place those tiles on the home page. On the back-end server, the role needs the start authorizations to call the back end plus the business authorizations that the service checks while it runs. SAP's authorization default values in SU24 supply proposals for both: front-end service entries propose start authorizations, back-end service entries propose the business objects.

What a Fiori business role is made of: the catalog brings the target mappings and service entries, and SU24 links each app to its start and business authorizations.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-202

Contoso, like most private cloud customers, runs the launchpad on an embedded front-end server, so the front-end and back-end parts live in the same system and can be maintained in one PFCG role. A hub deployment, with a separate front-end server, splits them across two systems and two sets of roles. Either way the four layers exist; the embedded setup just puts them in one place.

Embedded keeps launchpad and business logic in one system and one role; a hub splits them across systems, so each half needs its own role.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-202

Why the layers fail independently

What the user experiencesMost likely layerFirst thing to check
The app is not in the App Finder at allContent: catalog missing from the roleWhich business catalogs the user's roles contain
The app is in the App Finder but not on the home pageLayout: no space or page shows itWhether the role has a space whose page includes the tile
The tile opens, then shows an error before any data loadsStart authorization for the serviceThe service entry in the role and the gateway error log
The app opens but lists no data, or saving failsBack-end checksAuthorization objects and organizational values, using SU53 or a trace

Symptom to layer: a quick first guess before deeper troubleshooting.

Two consequences matter for testing. First, a tile on the screen proves only that the content and layout layers work. A positive role test has to go all the way to save. Second, hiding a tile is not a control. If the catalog or the back-end authorization is still in the role, a user can reach the app another way, for example through a saved link. Spaces and pages do not control authorizations; SAP says so plainly, and tiles a user is not authorized to launch are simply not shown.

  1. Click the tileThe launchpad resolves the tile to an app through the catalog's target mapping.
  2. Load the appThe UI loads; nothing has been checked against business data yet.
  3. Call the OData serviceThe start authorization for the service is checked.
  4. Run the service logicBack-end checks run: object, activity, company code, plant.
  5. Return or save dataOnly now has the user proved they can do the job.
What happens after Ana, Contoso's AP clerk, clicks Create Supplier Invoice. A failure can stop the chain at any step.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-202

What would you do?

Maria, Contoso's order-to-cash key user, reports during a CMQ walkthrough that she can see the Manage Sales Orders tile on her home page, but when she opens it the list stays empty for sales organization 1710, even though orders exist. What should Nadia look at first?

Key points
  • Fiori access has four layers: layout (spaces and pages), content (business catalogs), start authorization, and back-end checks.
  • The catalog supplies tiles and start authorizations; the space only places the tiles.
  • Embedded front-end servers keep both halves in one PFCG role; hub deployments split them.
  • A visible tile proves very little: positive tests must reach save, and hiding tiles is not a control.

Check your understanding · not graded

Lesson check

  1. 1. A Contoso user finds an app in the App Finder but not on the home page. Which layer is most likely incomplete?

  2. 2. What does adding a business catalog to a PFCG role give the user on the front end?

  3. 3. Why is removing a tile from a page not an effective way to stop users running an app?

  4. 4. In an embedded front-end server deployment, where are the front-end and back-end parts of a business role maintained?