Perform Check: SAP Web Dispatcher (Fact Sheets Only)

App-Specific Configuration
Configuring transactional SAP Fiori Apps - Quick Guide
20
Activities on Front-End Server
3.2.1 Activate ICF Services of UI5 Application (SAP Fiori Administrator)
To activate the apps, you must perform this procedure, as well as the activation of the
OData services per app (next section).
My Leave Requests app
1. Run transaction
Maintain Services
(SICF) on the front-end server.
2. Press F8.
3. Navigate to the following path default_host sap bc ui5_ui5 sap
4. Under this node, navigate to the UI5 application for the
My Leave Requests app: hcm_lr_cre.
5. To activate the service (UI5 application), choose
Service/host
Activate
Customer fact sheet
Check if the ICF service is already active:
1. Retrieve the UI5 application relevant for the
Customer fact sheet in the
App
Implementation: Customer
18
You find this information in the
Extensibility section under
BSP application for annotation files
2. Run transaction
Maintain Services
(SICF) on the front-end server.
3. Press F8.
4. Navigate to the following path default_host sap bc bsp sap
5. Under this node, navigate to the UI5 application for the
Customer fact sheet:
BSCBN_ANF_SDMD.
6. If it is not yet active, activate the ICF service for your app choosing
Service/host
Activate
3.2.2 Activate OData Service for App (SAP Fiori Administrator)
1. Run transaction
Activate and maintain services
(/IWFND/MAINT_SERVICE) on the front-end server.
2. Click
Add Service
3. Enter the system alias of your back-end system.
4. In the
External Service Name field, enter the technical name of the OData service without the version number:
18
http://help.sap.com/fiori
 SAP Fiori Apps 
SAP Fiori Apps for SAP ERP
 Apps for Logistics
 Sales and Distribution (SD)  Customer  App Implementation: Customer

App-Specific Configuration
Configuring transactional SAP Fiori Apps - Quick Guide
21
 /GBHCM/LEAVEREQUEST for the
My Leave Requests app
 CB_CUSTOMER_SRV for the
Customer fact sheet
5. Enter the version number
– 2 for the
My Leave Requests app
– into the
Version field.
6. Click
Get Services
7. Click
Add Selected
Services.
A popup opens up:
8. Give the service a technical name in your customer namespace.
9. Assign a package or choose
Local Object
10. Click
Execute to save the service.
11. In the
Activate and maintain services screen, verify that the system alias is maintained correctly. If not, change it as required by deleting the alias and adding the correct one.
3.2.3 Copy Template Business Role to Create Role with Launchpad Catalog and
Group
You must perform this step and the following authorization- and-role-related tasks on the front-end server to equip the test user with all rights needed for the app.
SAP delivers business roles for users of SAP Fiori apps. Business roles provide access to a sample of apps relevant for specific business users.
The authorization for the
My Leave Requests app is included in the business role for the
HCM employees (SAP_HCM_BCR_EMPLOYEE_X1).
The authorization for the
Customer fact sheet is included in the business role for the fields representative (SAP_SD_BCR_FIELDSALESREP).

App-Specific Configuration
Configuring transactional SAP Fiori Apps - Quick Guide
22
Run transaction
Role Maintenance
(PFCG) to copy the business role to your customer namespace.
Note:
A business catalog and a business catalog group containing apps relevant for business role are displayed under the
Menu tab.
3.2.4 Add Start Authorizations for OData Service of Apps to Business Role
A user trying to consume an OData service needs the following types of authorizations:
 Authorizations on the Gateway side: Role Menu entries for
Authorization Defaults of type
TADIR Service with object type
IWSG
– Gateway: Service Groups
Metadata
 Authorizations on the back-end side: Role Menu entries for
Authorization Defaults of type
TADIR Service with Object Type
IWSV
– Gateway Business Suite
Enablement - Serv
For the back-end entries, an example role is provided, from which the entries can be copied (see section
Assign PFCG Role with OData Service Authorization to Test User
).
For the Gateway-side entries, there are no such examples, as the technical names are entered during the activation of the service, and therefore not known in advance.
To create a role with OData start authorizations on the front-end server, proceed as follows:
Caution:
Be aware that the check for OData service authorization can provide additional security, especially in case SAP NetWeaver Gateway is set up as separate hub. By specifying the services explicitly in the role menu, you control which requests on behalf of a user can pass the Gateway.
If you use a wildcard, users can call all activated services. Unauthorized requests can only be rejected on the back-end server, provided that the user’s authorizations in the back-end are not sufficient.
We therefore recommend that you do not use wildcard authorizations in productive environments.
Instead, add single services as follows:
Note
You must have called an OData service at least once before you can assign start authorizations for it.
1. Edit the business role created under
Copy Template Business Role to Create Role with Launchpad Catalog and Group in transaction
Role Maintenance
(PFCG).
2. On the
Menu tab, open the dropdown menu of the button for adding objects (+ button). By default, the object type
Transaction is selected.
Change the selection to
Authorization Default

App-Specific Configuration
Configuring transactional SAP Fiori Apps - Quick Guide
23 3. In the Service pop-up that opens, select
TADIR Service from the dropdown menu for the
Authorization Default
. Specify the following values:
 Program ID: R3TR
 Object Type: IWSG
4. In the table, enter the name of the activated OData service (see
Activate OData
Service for App (SAP Fiori Administrator)
Note:
You need to enter the name in the form _, for example, ZLEAVEREQUEST_0002.
5. Under the
Authorization tab, click the button next to the
Profile Name field to generate the authorization profile for the role.
6. Choose
Change Authorization Data
On the screen that opens up, click the
Generate button.
3.2.5 Assign Business Role to Test User on Front-End Server
In transaction
Role Maintenance
(PFCG), assign the business role to the test user initially created (see
Create Test User on Front-End Server
) by specifying the user ID under the
User tab.
3.2.6 Remove Apps Not Required from Catalog (Optional Step)
This is a clean-up step. You can narrow down the authorizations contained in the business role delivered (see
Copy Template Business Role to Create Role with Launchpad Catalog and Group
) to the apps that should actually be available for the test user. For this purpose, remove apps that are not required from the business catalog.
1. Retrieve the name of the relevant business catalog

Implementation Information for My Leave Requests:
SAP_HCM_BC_EMPLOYEE_X1.

App-Specific Configuration
Configuring transactional SAP Fiori Apps - Quick Guide
24

App Implementation: Customer
:
SAP_SD_BC_FIELDSALESREP
2. Enter the SAP Fiori Launchpad designer in customization mode (see
Perform
Check: SAP Fiori Launchpad with App Content
): https://:
/sap/bc/ui5_ui5/sap/arsrvc_upb_admn/main.html
?sap-client=&scope = CUST
3. Search for the business catalog.
4. Delete tiles not required.
Caution:
Do not delete target mapping tiles (blue) or app launcher tiles (white) of the apps you want to keep.
To delete tiles, drag them to the lower right corner in the Launchpad designer.
3.2.7 Perform Check: SAP Fiori Launchpad with App Content
1. Open the SAP Fiori Launchpad with the test user credentials.
2. Choose
Open Catalog from the menu.
The business catalog with the
My Leave Requests app/
Customer fact sheet should be visible.
At this stage, however, starting the app will lead to an error, because back-end authorizations are still missing.

Download 1 Mb.

Share with your friends: