Accessing SAP Fiori Launchpad and Getting Administrative Access

From his experience at his former job, Adam was used to working with SAP GUI to access on-premise based SAP systems of SAP Business Suite (such as SAP ECC). This is no longer valid for SAP S/4HANA Cloud, public edition, which only provides an HTTP(s) based access for both end users and administrators.

As the access of SAP systems with the help of a Web Browser is a significant change for him, he again asks Carl to show him how to access SAP applications in the context of SAP S/4HANA Cloud.

For this, Carl connects to SAP Fiori Launchpad of his partner demo system landscape and explains the role of SAP Fiori Launchpad.

He explains that SAP Fiori launchpad is the entry point to apps on mobile and desktop devices. It gives users the relevant information they need at a glance and focuses on their needs and how they work.

Carl points out that – after successful authentication with the help of the Identity Authentication Service – users are redirected directly to the entry page of SAP Fiori Launchpad for the system they are logged on. The entry page is the main area where the users work and where tiles (representing the apps they work with) are clustered.

As of SAP S/4HANA Cloud 2302, the default layout is to use spaces and pages.

• A space is assigned to a user based on their work profile (Business Role). It can hold one or more pages.
• A page is the part of the space that contains the apps as tiles and links clustered into different sections.

My Home has become the standard entry page, this page is divided into different sections. Users can view their To Dos, Pages, Apps and Activities, and Insights on this page. They can personalize the entry page to hide or display specific sections as well as the content maintained within these sections. For more information on the spaces and pages, see the blog Switching from Groups to Spaces and Pages in SAP S/4HANA Cloud, Public Edition that includes a comparison of the layout with spaces and pages with the previous layout with groups.

For security recommendations, Carl advises Adam to read the corresponding section in the Protect Your SAP S/4HANA Cloud documentation.

After this explanation, Carl gets the idea that – compared to the on-premise world he is used to –

• the authentication (this represents either the user master record or the use of Single Sign-On software in the on-premise world) is done with the help of the Identity Authentication Service running outside the SAP S/4HANA Cloud, public edition system.

  Note

  The Authentication Token from SAP Cloud Identity Service plays a role very similar to Single Sign-On. If the Web Browser (closing a single tab is not sufficient) is closed, the token is lost (and the token can also expire after a certain time).

• the authorizations are assigned to users similar as in the on-premise world by assigning roles (which are now called Business Roles and which are mapped to Business Catalogs) in the SAP S/4HANA Cloud, public edition system itself.

But he wants to know this in more detail. Therefore, he asks Carl to outline the authorization concept in SAP S/4HANA Cloud, public edition. Carl then explains the basic idea of Identity and Access Management (IAM):

Carl points out that there are two user concepts within SAP S/4HANA Cloud, public edition: workers and business users.

• Workers can be either permanent or temporary, depending on their Worker Type (with his background knowledge on on-premise ERP, Adam would have called this "Business Partner Role": BUP003 (employee) for permanent, BBP005 (contingent worker) for temporary). They can be imported with the help of the Manage Workforce app. This app is included in the Business Role BR_ADMINISTRATOR_HRINFO and SAP_BR_ADMINISTRATOR (via the Business Catalog SAP_BUM_BC_MNG_WORKFORCE_PC).
• A Business User first needs to be an employee of the company before they have a user account in the SAP system. To assign Business Roles to Business Users, Adam may use either the Maintain Business Roles or the Maintain Business Users app. Both apps are included in the Business Role SAP_BR_ADMINISTRATOR (via the Business Catalogs SAP_CORE_BC_IAM_RM and / and SAP_CORE_BC_IAM_UM).

Carl continues that access to business apps is controlled by a role-based authorization management. That means the user administrator assigns Business Roles to Business Users and these roles provide (via the assignment of Business Catalogs) access to certain business tasks.

After this meeting, Adam has learned that he needs to use the Maintain Business Users app to select the Business User in question and then assign them the Administrator (SAP_BR_ADMINISTRATOR) Business Role to make that user an administrator.