Is there an alternative for Eclipse/ADT to workbench-related user exits like EXIT_SAPLSEDD_001?

[BaerbelWinkler]

Hi Folks!

We have a restriction in place that DDIC-objects need to be maintained via special user-IDs instead of our own. To ensure this, checks are active in the dev-systems via CMOD SEDD0001 and EXIT_SAPLSEDD_001 which gets executed whenever transactions like SE11 or SE80 with DDIC-activities are in play.

While trying out some things in Eclipse (Neon) just now, I nonetheless managed to create a data-element with my own user-ID and - as already checked via placing a breakpoint in the exit's include ZXSEUU19 - the exit wasn't accessed.

If these user-exits are "GUI-only" what is the alternative to them for Eclipse/ADT, if any?

We are on NW 750 with SP13

Cheers

Bärbel

[BaerbelWinkler]

There's one additional aspect to this: DDIC-changes are not allowed in the "regular" dev-systems used for other workbench objects but need to be done in a central dev-system which then feeds into the two main dev-systems. This was implemented in an effort to keep the two otherwise separate system landscapes in sync for SAP-versions and SAP-objects which then also affected DDIC-objects in the customer namespace. There's logic in the user-exit to only allow DDIC-changes in the central system and to block it in the others.

We need comparable checks when development happens via Eclipse.

Does anybody have some suggestions?

Cheers

Bärbel

[Florian]

Why not move this checks while a task is released. So you will be also sure noone can transport anything like that in system afterwards and the "special" user can do the supervisor-task also before.

Not asking why a "normal" developer might not be able to create a data-element by it's own. Me personal cannot image how this will not end up in a longer development task even for small changes and at the end, someone pays it with real money:-)

[Florian]

Think you can also do it with an additional check via Codeinspector or when the object will be added to the transport. So you could also deny the creation...

but this is the special snowflake inside the special snowflake...

[BaerbelWinkler]

Hi Florian,

thanks for your comments!

The reason for the special user is, that transports of DDIC-objects into production are centrally coordinated by our basis team to ensure that they make it there ahead of dependent workbench objects. DDIC-objects should only be created/maintained in the central system and with a special user, so doing checks upon task/transport-release is way too late in the game as the objects will then already have been "illegally" created in the wrong system and most likely with the wrong user.

As far as I know Codeinspector doesn't check DDIC-objects, and it would also be too late in the process.

Doing a check while adding objects to a transport is not possible because that particular piece of the BADI-implementation is not available for customers - I already tried but the code doesn't get executed and there's some mention of this somewhere in documentation or an OSS-note.

Cheers

Bärbel

[matt]

You can always add your own checks to code inspector.

[larshp]

"As far as I know Codeinspector doesn't check DDIC-objects, and it would also be too late in the process."

The default object collector does not pick up DDIC objects, but you can write your own, or use https://github.com/larshp/abapOpenChecks/blob/master/src/collectors/zcl_aoc_embedded_packages.clas.a...

I agree its too late in your process, but this is an option which fits into the standard workflow without user exits.

[BaerbelWinkler]

Here is another such exit which should be executed but apparently isn't when an ABAP-program is opened from SE38 or SE80: EXIT_SAPLS38E_001

We recently deactivated many Z-programs and I'm about to add logic to this exit to alert programmers that a source has been deactivated:

DATA lv_exists TYPE abap_bool VALUE abap_false.
CLEAR lv_exists.
SELECT SINGLE @abap_true
         FROM zbc_inaktiv
         INTO @lv_exists
        WHERE repid EQ @program
          AND inakt EQ @abap_true.

IF lv_exists = abap_true.
  message w000(38) WITH 'Program ' program 'marked as inactive!'(001).
ENDIF.

I just tried in Eclipse to set a breakpoint in this code but it didn't get executed and consequently the expected warning message didn't get displayed even though the inactive-flag for the program to be opended had been set.

So, my question remains: does an alternative to these user-exits exist when doing things via Eclipse?

[Sandra_Rossi]

If we are able to embed information lines in an ABAP source code in Eclipse, then I guess we are able to do anything else by using Eclipse ADT SDK.

[BaerbelWinkler]

Thanks for your answer, Sandra!

But, unfortunately the "we" you mention doesn't include me as the ADT SDK is way above my skills judging from just reading the first couple of pages (I just do some simple ABAP-programming and yes, still struggle with ABAP OO). And even if building something ourselves were an option, it would take way too long to implement to be useful right away if/as/when we want to move ahead with pushing the usage of Eclipse.

[BaerbelWinkler]

sandra.rossi

Hi Sandra,

if I understand the purpose of ADT SDK correctly then these are basically an option to create ones own "add-ons" for Eclipse, right? If this is the case, then it's not usable for our case as it would make it necessary to somehow ensure that everybody who does development work for our SAP-systems via Eclipse has the relevant "add-on" installed/available. As this is neither enforcable nor really controllable, we need something which happens at an as central place as possible once requests from Eclipse hit the SAP-backend.

Cheers

Bärbel

[Sandra_Rossi]

Bärbel Winkler Right. You can also set authorizations centrally to prevent using a few strategic standard tools, but permit your own tools...

[matt]

Always with the interesting questions! I think rather than look at how the processes and checks you have in place can be made to work, you should review your processes and consider other ways of achieving the same ends. In my opinion - for whatever it's worth - I think your (not you personally) process is a bit broken. It's led you down a path that's now a dead-end.

If you're wanting to restrict access this way you need to put in place a good authorisation concept. I know that in a dev system, developers can always get around it, but they can't do it by accident. But that's the same with your current solution.

For example, you could move your inactivated programs to a ZINACTIVE development class. (I seem to recall a simple programmatic way of doing this - there's also a hidden mass change of object entries in SE03). Make the normal developer role so that it doesn't allow change of ZINACTIVE objects.

[BaerbelWinkler]

Thanks Matt! At least you think it's an interesting question and not just an annoying or stupid one!

And yes, I know that our processes are "interesting" to say the least, but they are what they are and - at least for the time being - I don't see much chance of them changing.

The thing with the recently deactivated programs is, that we did that "point-blank" based on different sources like ST03N- or SCMON-data but chances are fairly large that several of the programs are actually still needed if only rarely and we'll then need to be able to quickly reactivate them in the relevant system. With our current solution this simply means deleting the inactive-flag in the Z-table in the relevant system(s) and the program can be executed again. Which is why I'd like to avoid doing mass-changes for them like moving them into separate packages with restricted access. Much easier to simply show a message when such a program gets opened for display or edit, which works just fine via the GUI.

Just realised that a somewhat related issue (?) isn't just affecting historical user-exits which don't get accessed but also for example the Badi-implementation CTS_REQUEST_CHECK~CHECK_BEFORE_CREATION. I have this active in our dev-systems to perform checks on the transport-title content to make sure that the titles contain some required elements. When I just tried to create a CTS while activating a program in Eclipse I got the pop-up to specify the transport title and when I enter a wrong one to trigger the logic, I get a dump:

This is happening when the function module POPUP_GET_VALUES gets called where this statement causes the dump:

    CALL SCREEN 300 STARTING AT start_column_100 start_row_100
                    ENDING   AT end_column_100   end_row_100.<br>

At a guess, I should perhaps create another question for this, right?

Update: I copied the issue regarding the BADI to it's own question

Cheers

Bärbel

[matt]

But by taking these arguments, you begin to build a case for change. If a process is less than optimal, preventing perhaps more efficient techniques, then over time it costs money. If you can make incremental steps to improvements, it's more likely to get the ok from management.

That's strange. I just tried a release from my current system that has errors in, and Eclipse opened a SAPGui and showed the errors (wrong transport layer). Perhaps it's a bug in ADT (unforeseen requirement) that it doesn't work for the create check.

I'll check on another system later. That client has many checks on the transport. If it dumps within the release BADI then I'd have to write an add-on in Eclipse. I'd only have to add a front end, since the logic is contained within distinct classes.

Move to new package is just a call to FM TRINT_TADIR_INTERFACE. Changing the directory of objects singly manually or in bulk is a matter of a few moments. Yes, your popup is easier (and easier to ignore/overlook, if that's an issue), but it doesn't work in an Eclipse environment, so either ditch Eclipse, or find a new solution. Or write an addon. 🙂

[BaerbelWinkler]

matthew.billingham - - "Or write an addon. :-)"

That's a good one, Matt! I'm already struggling to memorise the many and (to me!) not intuitive keyboard shortcuts in Eclipse (even with a cheat-sheet in front of me!) and finding my way around. So, I'm lightyears away from writing addons for a tool I don't really understand yet ....

But, is this an issue with Eclipse itself as the dump happens in SAP and Eclipse just reports it via the popup? It seems to not have a connection to my user-session:

Category ABAP programming error
Runtime Errors DYNPRO_SEND_IN_BACKGROUND
ABAP Program SAPLSPO4
Application Component BC-SRV-ASF-POP
Date and Time 28.02.2019 10:00:57

Short Text
Screen output without connection to user.

Something else which is quite annoying, is that it doesn't seem to be possible to copy and paste the error-message from the pop-up shown in Eclipse. Is this a bug or a feature (I'm working with Neon right now)?

[Matt_Fraser]

Since Matthew B already brought up the topic of outdated business processes costing money, I would add to that that you are also paying for expensive developer licenses for these 'special' users for maintaining the DDIC objects, so that's a 'hard' cost that should be easily quantifiable in your arguments to management for change.

[BaerbelWinkler]

Here is another update (March 6):

With the help of setting external breakpoints in the ABAP-code in the GUI and running through the logic either from within the workbench or Eclipse it looks as if almost completely different pathways through the ABAP-code are taken. This obviously explains, why the SE11/SE38 exits are not touched when coming from Eclipse.

Looking through the callstack for both the DDIC- and the ABAP-editor logic the common denominator when coming from Eclipse seems to be FM SADT_REST_RFC_ENDPOINT right at the start, when the SAP-server is hit the first time.

My question - perhaps for thomasfiedler - is, whether it would be possible/feasible/allowed to put some enhancement, BAdIor other logic into this central RFC-function module where we could put some checks to fulfill our special requirements? What I'm looking for is basically an option for a "customer exit" when coming from Eclipse, but one which is able to send back messages to Eclipse.

[BaerbelWinkler]

Another update (March 10):

I actually just wanted to add to my comment from March 6 but I don't seem to be able to edit that (Actions only show "see revision" and "convert to answer").

I happened upon a thread from 2014 started by Jerry Wang which looks interesting: An example to help you understand how does ADT work so I added a question there with a link back to this thread. Nabheet Madan already let me know that this could be a solution for my issue but I'm wondering if this central FM SADT_REST_RFC_ENDPOINT shouldn't really have a simple to use "hook" where customer logic could be centrally placed on the SAP-side of things, something comparable to what the transport check BAdI does when it comes to creating or releasing transport requests?

[UweFetzer_se38]

Hello Bärbel,

with the FM SADT_REST_RFC_ENDPOINT you are not far away from the solution. You could implement your own RFC handler. See the blog post "Creating a ABAP in Eclipse plug-in using the ADT SDK – Part 2" by christian.drumm

[BaerbelWinkler]

Thanks, Uwe!

Just scrolling through that blog post, makes it seem a lot more involved than what the DDIC-User-Exit requires! Not to mention, that I'll have a hard time wrapping my head around the desrciption with not really knowing what would need to be done differently as our requirement is rather different to what Christian implemented in his example. We also won't have the counterpart on the Eclipse/ADT side of things explained in Part 1, so I'm wondering what impact this will have?

Will need to dig a lot deeper into all of this by the looks of it!

[UweFetzer_se38]

Never mind, the comments on the DSAG forum are already pointing to the right direction.

[BaerbelWinkler]

Here is an update with a very promising lead thanks to a "sibling" discussion I started in the development forum on the German DSAG website yesterday.

The suggestion is to add an enhancement at the end of function module TRINT_OBJECTS_CHECK_AND_INSERT which is accessed before objects get attached to a transport request or task. Internal table LT_E071 contains the objects to be attached to a transport, so can be used to query the object-type and take a closer look when things like TABL, DTEL, DOMA and the like are in play.

This looks like a good place to put some logic as it will only be called whenever update activity is in play, so there's no need to worry about accidentally preventing display actions. I already started some prototyping in a sandbox system and thus far things look good in that the enhancement gets called from both Eclipse and SAP GUI processing and I'm able to trigger an error-message if needed.

What will need some work is to determine which information is needed to prevent some activities (what happens e.g. via SE11) but still allow others (i.e. IDOC-customizing via WE31).

Will keep you posted (and down the line, I may turn this discussion into a blog post).

Cheers

Bärbel

[abin_baby]

Hi Bärbel,

So there is a BADI "CTS_OBJ_CHECK_AND_INSERT" existing which provides the method IF_CTS_OBJ_CHECK_AND_INSERT~CHECK_AT_OBJECTS_INSERT which can be used for providing user exists before any object is assigned to a transport request. This BADI will be invoked whenever new objects are created via ADT and also when the objects are edited. This is in-fact is getting called from within the FM TRINT_OBJECTS_CHECK_AND_INSERT. So could you maybe check if this already works for you instead of changing the FM.

----------------------------------------------------------------

[Update]

The BADI CTS_OBJ_CHECK_AND_INSERT looks to be for strictly internal usage and is not recommended to be used by customers.

Regards

Abin

[BaerbelWinkler]

abin.baby

Hi Abin,

thanks for your reply!

Unfortunately, I don't find BADI "CTS_OBJ_CHECK_AND_INSERT" in our system (NW 7.50 SP 13 EHP8) when I look for it e.g. in SE18 or SE84 or via Eclipse. Am I looking in the wrong place(s) or doesn't it yet exist in our version?

I do already have logic in IF_EX_CTS_REQUEST_CHECK~CHECK_BEFORE_CREATION in order to check provided transport titles and would have liked to now add relevant logic in method IF_EX_CTS_REQUEST_CHECK~CHECK_BEFORE_ADD_OBJECTS (which sounds very similar to your seggestion as far as expected functionality goes) but, as far as I know, this method is (still) only available for SAP's own usage and any custom-code added there is simply ignored as the method is never called.

Even if this BAdI were available in our system, it would still mean, that the check occurs fairly late in the process (i.e. when the created/changed object is first saved). There'd also be a need to decide for which object-types checks need to be applied which is bound to be hit-or-miss and therefore rather error-prone. Both of these shortcomings are reasons why my colleagues didn't much like the suggestion to use an implicit enhancement in FM TRINT_OBJECTS_CHECK_AND_INSERT and from the point in time where the BAdI you suggest will get accesed, these same reservation would apply there, wouldn't they?

What we'd like to find is a place fairly early in the process, where the actual object-type doesn't play a role but only that it's a DDIC-object - something comparable to knowing that we are in e.g. SE11 when doing it in SAP GUI. Does such a place exist at all or is there simply no such option and doing the check before adding objects to a transport is the only feasible place to do it?

Cheers

Bärbel

[BaerbelWinkler]

abin.baby

Hi Abin,

just wondering if there's any news about our problem? As long as we don't have a somewhat satisfactory solution for our problem it is keeping us from really roling out Eclipse for our development teams.

Thanks much and cheers

Bärbel

[abin_baby]

Hi Bärbel,

Sorry for the delay.

So the concerned team is looking into this issue and we will update you as soon as possible. But mostly it looks like there are currently no alternative for these workbench related user exists for ADT and the old ones are no longer usable. So it looks like a new requirement for ADT.

Thanks & Regards

Abin

[BaerbelWinkler]

abin.baby

Hi Abin,

thanks for your response which - obviously - is not what I had hoped for but also doesn't come as too big a surprise. I'm really wondering if our requirement is so "exotic" that no such central hook on the SAP-side of ADT has been made available yet? From my perspective such a hook makes quite some sense to have centrally as opposed to creating something in Eclipse which some developers than have installed as e.g. a plug-in but others don't and you can't really control who accesses SAP with what kind of setup.

So, at a guess this will take quite some time to become available and we'll have to potentially work with an interim solution like making use of an enhancement in the FM TRINT_OBJECTS_CHECK_AND_INSERT as mentioned below?

Cheers

Bärbel

[BaerbelWinkler]

wolfgang.woehrle

Hi Wolfgang,

is this something you/your team could help me with? Not having a hook of where to place our verification logic is currently a pretty big stumbling block for us to rolling-out Eclipse. It would already help me to know if there's a better route than SAP Community to address this issue.

Thanks much and Cheers

Bärbel

[thomasalexander_ritter]

Hello Bärbel,

thanks for the call last week. Let me share what we have discussed with the community. Maybe other community members will find it useful.

We discussed the following options:

1) Use standard user authorizations. Simple remove the ability to create DDIC objects via the user profiles

You explained to us that if you would remove the authority to create ddic objects it would also not be possible to perform certain other actions in the DDIC environment were these kind of authorizations are used and needed as well.

2) Use the current SAPGUI userexit

This is not possible anymore. The userexit is hard wired to the SAPGUI SE11 UI implementation. The ADT REST services re-use most of the ABAP workbench code but obviously exits in the SAPGUI UI layer have no effect anymore. As a matter of fact, our ADT REST services are not bound to any UI technology anymore. They do not know whether they are being called from Eclipse, from an iPhone App, from a browser… This makes it impossible to offer a new UI related user exit.

3) Use the ADT authorization BADI

There is a central BADI in place which allows authority checks on every REST communication request. First, the BADI is currently not part of our official API. Second, this exit is too technical for your requirements. You would have to check individual URLs which might even change in the future

4) Use the existing BADIs in the transport area (as mentioned by Abin Baby and others)

This means that the transport system allows you to prevent objects to be assigned to a transport request based on your own rules and conditions. The big advantage about this solution is that it is independent from the respective IDE. The transport system does not know whether ABAP in Eclipse or the SE11 assigns the object to the transport. This makes it the most stable and future proof solution. Even if a completely different IDE is being used (the ABAP Community even has a VSCode extension project going on) you can be sure that the same checks are being executed. The drawback of this option is that the user authorization gets checked at the very end of the user flow not in the beginning.

Conclusion

We agree that the old UI user exits have the advantage that the user gets immediate feedback when they try to create/edit/delete an DDIC object. However, our server architecture is UI independent, now. Therefore, the old behavior is not achievable anymore. Our recommendation is to go with option 4)

regards
Thomas

[BaerbelWinkler]

Hi Thomas,

thanks for your detailed write-up and response!

Which BADIs do you have in mind? We already have code in an implementation of CL_IM_CTS_REQUEST_CHECK for methods if_ex_cts_request_check~check_before_creation and if_ex_cts_request_check~check_before_release. Going by the name, I'd thererfore pick method if_ex_cts_request_check~check_before_add_objects to put our logic in but as far as I know that particular method is not usable for customer code as it's only for SAP internal use and doesn't even get called even if there's active code in it (I tried a while ago in a sandbox and while the other methods were executed this one wasn't).

That would leave the option with an enhancment in function module TRINT_OBJECTS_CHECK_AND_INSERT mentioned up-thread as the most likely place to put our checks. It has the advantage that I already know from some prototyping that it works.

Any thoughts on that?

Cheers

Bärbel

[BaerbelWinkler]

thomasalexander.ritter thomasfiedler

Hi Thomas (both 🙂 )!

As I'm going to discuss our next steps soon with my colleagues, I'd appreciate a pointer regarding which BADI(s) you suggest we make use of in the transport area. As far as I can tell based on Abin Baby's earlier response and my own prototyping, the ones available are "off-limits" to us and cannot be used.

Thanks much and cheers

Bärbel

[BaerbelWinkler]

thomasfiedler thomasalexander.ritter

Hi Thomas & Thomas!

Just wondering if there's any news on this topic? Sooner rather than later we should "get into" using Eclipse but not being able to put in some safeguards unfortunately doesn't make this feasible for us at the moment.

Thanks and cheers

Bärbel

[BaerbelWinkler]

Update January 28, 2020

With the support from the ABAP Workbench Team we could activate the Badi method if_ex_cts_request_check~check_before_add_objects and implement the needed checks via a new global class there. Some details about this implementation can be found in my blog post How SAP Community - and SAT - helped me to understand and write my first unit tests and the comment thread there.

Thanks much, everybody for your help with this!

Cheers

Bärbel