11.4 Identity and Access Management: Users, Business Roles, Catalogs, Spaces, and Pages

Identity and Access Management: Users, Business Roles, Catalogs, Spaces, and Pages

A sales user who cannot see the Create Sales Orders tile is a common problem in projects and in practice systems. The S4C03 unit Creating Users and Defining Authorizations explains the chain from user to app: user master record, business role, business catalog, and launchpad space and page.

Business Roles and Who Owns Them

A business role represents a job, such as an internal sales representative. SAP delivers hundreds of business role templates; their security roles start with SAP_BR_. A template contains the SAP Fiori and classic apps of the job, the navigation between them, markings for supported devices, a default launchpad layout (groups or spaces and pages), and the matching security role. Copy a template instead of editing it, or build a role from scratch.

Customers own their business roles. Role administrators work with the line-of-business experts, review the roles after each upgrade (deprecated and new roles), maintain spaces and pages, remove the access of the external project team after the project, and apply the rule of least privilege. The course advises against giving this job to the security administrator, the functional or Basis consultant, the UI designer or developer, or the project manager, because none of them focuses on the end-to-end user experience or stays with the system long enough.

The Authorization Chain

In short: the catalog in a role grants access to the app and brings its authorizations into the role; the space and page in the role make the tile appear automatically. A tile on a page whose app is not in any of the user's catalogs is not displayed. In addition, the OData services of each app must be activated, individually or with task lists.

Standard roles for people who configure and extend the system include Administrator, Analytics Expert, Business Process Specialist, and several Configuration Expert roles. Administrators set up the launchpad and its content, end users personalize it, and developers can extend the launchpad UI through APIs.

Users

Users are created as user master records with SU01; at a minimum, the last name and a password are required. Users log on with a user name and password or with single sign-on. The user master record grants access to the SAP S/4HANA application only, not to the SAP HANA database or the operating system; the application reaches SAP HANA through a technical user. To use the launchpad, a user needs the SAP Fiori foundation user role from Rapid Activation (section 11.3) plus the catalogs, and usually the spaces, of their job.

Setting Up Launchpad Content

Three Configuration Layers

1. Cross-client configuration layer (SAP Fiori administrator): technical catalogs.
2. Client-specific customizing layer (SAP Fiori administrator): business catalogs, spaces, and pages. Content changed here is decoupled from the configuration layer.
3. Personalization layer (end users): users can add, remove, and rearrange tiles they already have access to, but they cannot give themselves access.

For new implementations, SAP sets up the launchpad for one client per system, with sample apps, as part of the standard services; partners enable the apps for the customer's processes. For conversions, partners set up the launchpad with Rapid Activation.

Tools (SAP S/4HANA 2021 and Later)

The Launchpad Designer (/UI2/FLPD_CONF, /UI2/FLPD_CUST) is not deprecated and is still needed when settings should apply only to a subset of users in a client, but it does not distinguish technical from business catalogs, so administrators must keep originals and references apart themselves. KPIs and reports are maintained with Manage KPIs and Reports (F2814), which replaced the SAP Smart Business tools in SAP S/4HANA 1909.

Recommended Procedure

1. Create a business catalog, preferably by copying an SAP business catalog, which keeps the target mappings needed for app-to-app navigation. Do not change SAP catalogs directly. Apps delivered only in technical catalogs (mainly SAP GUI for HTML apps) are added as references.
2. Create a business role in PFCG and assign the catalog on the Menu tab (Insert Node → SAP Fiori Launchpad → Launchpad Catalog). The catalog's authorization objects are added to the role and maintained on the Authorizations tab.
3. Create a space with at least one page, and assign the space to the role (Launchpad Space) before adding tiles. Pages are assigned only through their space.
4. Add the apps to the page. Apps from catalogs that are not in the same role are flagged "Out of Context", a warning that users may not see them.

Further recommendations: keep originals in technical catalogs and references in business catalogs, work in one scope at a time, and keep a catalog below 100 apps to avoid performance problems at design time. About 300 new SAP Fiori apps arrive with each release, which is why the Content Manager offers mass maintenance and where-used lists (which roles use a catalog, which catalogs contain an app). The role SAP_FLP_ADMIN contains the catalogs SAP_BASIS_BC_UI_FLA and SAP_BASIS_BC_UI_FLD and the space SAP_BASIS_SP_UI_FLP for these tools.