Consume S/4HANA (Cloud) Object authorizations in a Side-By-Side Extension

[gregorw]

Hallo SAP BTP Extension Developers,

during yesterdays SAP TechEd 2021 "Experts and Executives in the Keynote Exchange" the following question was brought up: "How do you think the topic of governance will play in the proper adoption of low code, no code platforms?"

That where the answers by Jürgen, Thomas and Julia (links to the starting location in the YouTube Video).

In Side-By-Side Extension projects I'm facing the issue that I'm currently not able to consume detailed Object authorizations from S/4HANA (Cloud). Let's give me more details:

When you're developing Side by Side Apps on SAP BTP using the SAP Cloud Application Programming Model (CAP) you can implement the general authorizations baled on Roles. Such roles are assigned in BTP Cloud Foundry to Role Collections. The Role Collections can be assigned to a user using mapping of SAML Group Assertions, automated assignment using SAP Identity Provisioning or manual assignment by an Admin. But those roles are are rather broad restrictions. In most cases you will have an admin rolle that gives access to the applications used for to configure technical settings it. Another role might be a business admin that does the customizing. And last but not least you have application specific roles like a processor and approver.

But this roles are not suficcient to restric the access to specific business objects. CAP has the concept of User Attributes and you can fill them using SAML Assertions. But I doubt that any customer would invest the effort to replicate the S/4HANA Authorization Objects to the Identity Provider (IdP). Let's take the example "V_KONH_VKO - Condition: Authorization for Sales Organizations". This Object has already 4 attributes:

VKORG Sales Organization
VTWEG Distribution Channel
SPART Division
ACTVT Activity

and that is just a single authorization object. I don't think that SAML Assertions are the right way to bring them to the Cloud applicaiton. Authorizations like the restriction of Sales Organizations are part of S/4HANA (Cloud).

On a technical level accessing the authorization objects would be possible using the RFC enabled function module SUSR_USER_AUTH_FOR_OBJ_GET. But to call this function module using a SAP Supported Build Pack in SAP BTP Cloud Foundry I'm forced to use Java. Only there I have support for the Java Connector (JCo). If you're building CAP using Node.JS this results in an extra runtime (longterm costs) and skills that you might not have in your team.

Here is my wish:

SAP please get together with the SAP developers building Side-By-Side extensions and work on a concept how such detailed authorizations can be consumed from S/4HANA (Cloud).

Best Regards
Gregor Wolf

This was also cross posted in the DSAG Working Group for BTP: Zugriff auf S/4HANA Berechtigungsobjekte in Side-By-Side Extension

CC: juergen.mueller, thomas.saueressig

[gregorw]

Hope that michael.ameling and martingrasshoff can add their 2 cents here.

[gregorw]

I've created the following S/4HANA influencing request:

Provide released OData API to consume object authorizations for Side-By-Side Extensions

[MustafaBensan]

gregorw,

It's a shame that the result of your S/4HANA Cloud Influencing Request is: "Prioritization - Not planned within SAP's standard in the foreseeable future".

[gregorw]

Hi Mustafa,

thank you for the heads up. Seems I've missed the notification about this decision. Let's see if Helmut answers my follow up question.

Best Regards
Gregor

[nils-lutz]

So is it correct that we are currently not able to use S/4HANA (Cloud) auth objects and values in Side-by-Side Extensions? If yes, CAP with Node.JS is more or less useless because every customer would want to integrate their extension apps/solution with already in-place and maintained authorizations and business roles.

[Tayane]

Dear Gregor,

We helped you to accept the answer, since there were no updates after 7 days.

You can unaccept it anytime if the answer provided was not helpful enough and you have further questions.

Kind regards.

[gregorw]

Hello,

Martins answer was more a comment that this requirement also exists for SuccessFactors.

CU
Gregor

[zia_akbar3]

For side-by side applications, building authorizations on BTP is adding a lot of extra effort to on-board users. In addition, constant maintenance of user roles requires a separate admin/process. Auditing and checking for Segregation of duties is another item to take care of. This is a major roadblock to moving new applications from backend SAP to BTP. Backend development is still more efficient and due to tools like GRC, authorizations are simple to handle.

[martinstenzig]

While we are on the subject of authorization, we have similar issues with SuccessFactors. Customers would like to use the SF internal authorization as basis for BTP apps.

So the aspirational target should be a consistent authorization management across all SAP solutions (including BTP).

[gregorw]

Hi Martin,

thank you for joining the discussion. Good to know that I'm not alone :-).

CU
Gregor

[Tayane]

Dear Gregor,

Thank you for the Influencing Request.

SAP is committed to reviewing and responding to the requests submitted on a regular basis. The requests with most votes will receive a higher level of attention for responses and consideration. The processes and procedures associated with this site will continue to evolve and enhance over time.

Kind Regards.