Configuring SAP Fiori APPS - Quick Guide

Configuring SAP Fiori Fiori Apps Quick Guide An example example-based based step-by step by-step step guide to enable the usage of transactional SAP Fiori apps

Version 1.1 2014 2014-05-12

Introduction

© Copyright 2014 SAP AG. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. SAP Landscape Transformation Replication Server installation SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Please see http://www.sap.com/corporate http://www.sap.com/corporate-en/legal/copyright/index.epx#trademark en/legal/copyright/index.epx#trademark for additional trademark information and notices. Disclaimer The content of this document is not part of SAP product documentation. SAP does not guarantee the correctness of the information provided. You u may not infer any product documentation claims against SAP based on this information.

Configuring transactional SAP Fiori Apps - Quick Guide

2

Introduction

Contents Introduction Introduction................................ ................................................................ ................................................................ ............................................................................................. ............................................................. 4 Prerequisites ................................................................ ................................................................................................ ................................................................................................ .................................................................. 4 Out of Scope Scope................................ ................................................................ ................................................................ ................................................................................................ ................................................................... 5 Configuration Ov Overview erview ................................ ................................................................ ................................ ................................................................ ................................................. ................. 5 Process Steps Steps................................ ................................................................ ................................................................ ................................................................................................ .................................................................. 7 1

2

Preparation ................................ ................................................................ ................................................................ .................................................... .................................................... 10 1.1

Create Administrator User on Front Front-End End Server................................ Server .............................................................. .............................................................. 10

1.2

Create Test User on Front-End Front End Server ................................ ................................................................ ................................ ............................................. 10

Initial Configuration on FrontFront-End End Server (One-Time (One Time Activities).............................. Activities) .............................. 10 2.1

Activate OData Services for SAP Fiori Launchpad ............................................................ ............................................................ 10

2.2

Activate SICF Services for SAP Fiori Launchpad ............................................................... ............................................................... 13

In addition ion to the ICF services that correspond to the OData services it is necessary to activate the following ICF services manually:................................ manually: ................................................................ ................................................................. 13

3

2.3

Assign Administrator Role for SAP Fiori Launchpad to Administration User................... User ................... 14

2.4

Assign Role with Launchpad Start Authorization for End Users ...................................... ................................ 15

2.5

Perform Checks: SAP Fiori Launchpad Designer and SAP Fiori Launchpad...................... Launchpad...................... 16

App-Specific Specific Configuration ................................................................ ........................................................................................... ...........................................................16 16 3.1

Open Product Documentation for My Leave Requests App ............................................ ................................ 16

3.2

Activities on Front-End Front End Server ................................................................ ......................................................................................... ......................................................... 17

3.2.1

Activate ICF Services of UI5 Application (SAP Fiori Administrator).......................... Administrator).......................... 17

3.2.2

Activate OData Service for App (SAP Fiori Administrator) Administrator)................................ ................................ ....................................... 17

3.2.3

Copy Template Business Role to Create Role with Launchpad Catalog and Group . 18

3.2.4

Add Start Authorizations for OData Service of Apps to Business Role .................... 19

3.2.5

Assign Business iness Role to Test User on Front-End Front End Server Server................................ ................................ ........................................... 20

3.2.6

Remove Apps Not Required from Catalog (Optional Step) Step)................................ ................................ ...................................... 20

3.2.7

Perform Check: SAP Fiori Launchpad with App Content ......................................... ................................ 21

3.3

Activities on Back-End Back End Server Server................................ ................................................................ ........................................................... ........................................................... 21

3.3.1

Assign RFC Authorization to Test User................................ User ................................................................ ................................ 21 .....................................

3.3.2

Assign PFCG Role with OData Service Authorization to Test User........................... User ........................... 21

3.3.3

Perform Check: SAP Fiori Launchpad with Content and Authorizations ................. 22

Configuring transactional SAP Fiori Apps - Quick Guide

3

Introduction

Introduction This document guides you through the steps required to enable users to access transactional SAP Fiori apps in the SAP Fiori LLaunchpad Launchpad. The process is described using the example of the My Leave Requests app. It follows a straight straight-forward forward path with several prerequisites already in place. The documentation is intended - to give you an insight into the setup process for transactional SAP Fiori apps. The approach does not necessarily correspond to the system ystem setup in a productive environment. For SAP Fiori app implementation in a productive environment, see the central implementation information for SAP Fiori1 on the SAP Help Portal.

Prerequisites The following conditions must be met: All required components are installed. For more information, see the following documentation documentation on SAP Help Portal: o Implementation Overview2 o For transactional apps and fact sheets: Central Implementation Information o For analytical apps: Installation3 Initial configuration of SAP NetWeaver Gateway is in place. For more information, see Basic Configuration Settings4 HTTPS connectivity is enabled between the front front-end end server (FES) running SAP NetWeaver Gateway ateway and the back back-end end systems, including SAP HANA Extended Application Services (SAP HANA XS XS). ). In the ICM the fundamental ability of connecting to a system with HTTP(S) is activated. In the ICF certain services can be activated, e.g. /sap/public/ping service for connection testing.

1

http://help.sap.com SAP Business Suite SAP Fiori for SAP Business Suite SAP Fiori for SAP Business Suite 7 Innovations 2013 SAP Fiori Apps – Overview Transactional Apps and Fact Sheets Central Implementation Information 2 http://help.sap.com SAP Business Suite SAP Fiori for SAP Business Suite SAP Fiori for SAP Business Suite 7 Innovations 2013 SAP Fiori Apps – Overview SAP Fiori Implementation Overview 3 http://help.sap.com SAP Business Suite SAP HANA Innovations for SAP Business Suite SAP Smart Business Administrator’s Guide Installation 4 http://help.sap.com SAP NetWeaver SAP NetWeaver Gateway SAP NetWeaver Gateway 2.0 Configuration and Deployment Information Basic Configuration Settings

Configuring transactional SAP Fiori Apps - Quick Guide

4

Introduction

Out of Scope SAP Smart Business cockpits SAP Fiori fact s sheets heets Single sign sign-on Authorizations in complex system landscapes Back--end end configuration to enable the business functionality, for example, configuration of the employee self self-services services in SAP Human Capital Management, or mapping of users to the corresponding entities entities in p personal ersonal management. management Back--end end configuration required for the specific Fiori app.

Configuration Overview The c configuration onfiguration of SAP Fiori app apps requires res steps on a front-end Server (FES) and on one or multipl multiple e connected SAP Business Suite back-end b end systems systems. On the front front--end end server resides reside an SAP NetWeaver Gateway system ystem with the SAP NetWeaver UI Add Add-On. On the back back--end end servers, the SAP ERP or SAP CRM systems are installed, installed, for example. example The SAP NetWeaverNetWeaver UI Add Add-On On includes the SAP Fiori LaunchpadLaunchpad designer, d , which is the administration tool to configure the content for the SAP Fiori LaunchpadLaunchpad. LaunchpadLaunchpad The SAP Fiori LaunchpadLaunchpad is the entry point for end users. They access the Launchpad and the Launchpad designer from a Web Web brow browser via secure requests requests to the FES. To enable th these se requests, UI5 applications and their related OData services need to be activated in SAP NetWeaver Gateway ateway on FES. FES. In addition, users need start authorizations for the services on the front-end end and authorizations for related functions on the back--end. Th The e majority of configuration steps are activation steps (for applications cations and services) and authorization steps on both the front front-end end server s and in back back-end end systems. systems. Chapter 2 describes the initial configuration of the SAP Fiori Launchpad and of the SAP Fiori Launchpad designer: Activation of the ICF services of the SAP Fiori Launchpad to create the HTTP request h handlers andlers for the Launchpad URLs Activation of the OData service services for the SAP NetWeaver UI Add-On Add Creation of a PFCG role for administrators with authorizations for the SAP Fiori Launchpad designer esigner Creation reation of a PFCG role for end u users with authorizations for the SAP Fiori Launchpad At the end of the these e one-time one time activities you can launch the SAP Fiori Launchpad designer esigner and the SAP Fiori Launchpad Launchpad.

Configuring transactional SAP Fiori Apps - Quick Guide

5

Introduction

Chapter 3 describes how to configure individual SAP Fiori apps using the example of the My Leave Request Requestss app.

My Leave Request Requests is included in the business catalog of apps available for the sample role for the HCM e employee mployee. On Front-end end Server (FES) you have to do the following: following: Activate ctivate the OData services and ICF nodes for the SAP UI5 applications in SAP NetWeaver Gateway. This enables the corresponding HTTP request handlers. handlers. Create reate a PFCG role that provides access to the relevant catalog in the SAP Fiori Launchpad Launchpad. In our example, we copy the sample business role delivered by SAP. Add start authorizations for the required OData OData service to the business role (we provide an unsecure shortcut: use wildcard authorization). Assign ssign the role to a user, which has to have the same user name as in the th backend system Adapt dapt the business catalog to your needs in the SAP Fiori Launchpad designer d In addition addition, the user must be assigned the authorizations required in the back-end back to be able to run the apps apps. You have to do the following: following Assign ssign the RFC Authorization Authorization to the user to to allow remote access from the frontf end server to the back-end b end server Assign ssign and generate the authorizations to call and perform the OData services on the back-end end

Configuring transactional SAP Fiori Apps - Quick Guide

6

Introduction

Process Steps Step

Back-End End Server/ Front-End End Server/ Server/ Other

Transaction

Data Required

Preparation Create Front-End End Server SU01 User name as on the back-end back end server administrator user Create test user Front-End End Server SU01 User name as on the back-end back end server Initial Configuration on Front-End Front End Server (One (One-Time Time Activities) Activate OData services for SAP Fiori Launchpad

Front-End End Server

/IWFND/M AINT_SERV ICE

Activate SICF services for SAP Fiori Launchpad

Front-End End Server

SICF

Assign administrator role for SAP Fiori Launchpad to adminstration user

Front-End End Server

PFCG

SAP role: SAP_UI2_Admin_700 The activated gateway service names for: o /UI2/PAGE_BUILDER_CONF o /UI2/PAGE_BUILDER_PERS o /UI2/PAGE_BUILDER_CUST o /UI2/INTEROP o /UI2/TRANSPORT

Assign role with Launchpad start authorization for end users

Front-End End Server

PFCG

SAP role: SAP_UI2_User_700 The activated gateway service names for: o /UI2/PAGE_BUILDER_PERS o /UI2/INTEROP

Configuring transactional SAP Fiori Apps - Quick Guide

/UI2/PAGE_BUILDER_CONF /UI2/PAGE_BUILDER_PERS /UI2/PAGE_BUILDER_CUST /UI2/INTEROP /UI2/TRANSPORT Full list for both Launchpad and designer: /default_host/sap/bc/ui2/nwbc /default_host/sap/bc/ui2/start_up /default_host/sap/bc/ui5_ui5/sap /ar_srvc_launch /default_host/sap/bc/ui5_ui5/sap /ar_srvc_news /default_host/sap/bc/ui5_ui5/sap /arsrvc_upb_admn /default_host/sap/bc/ui5_ui5/ui2/ ushell /default_host/sap/public/bc/ui2/d efault_host/sap/public/bc/ui5_ui5 _host/sap/public/bc/ui5_ui5

7

Introduction

Perform Front-End End Server checks:SAP Fiori Launchpad designer and SAP Fiori Launchpad App-Specific Specific Configuration

Web browser

Open product documentation for My Leave Requests app

Implementa tion Information for My Leave Requests7

Public internet

Activities on Front Front-End End Server Activate ICF Front-End End Server services of UI5 application (SAP Fiori administrator) Activate OData Front-End End Server services per app (SAP Fiori administrator)

URL of Launchpad designer, see Testing the Launchpad Designer5 URL of Launchpad, Launchpad, see Testing the Launchpad6

SICF

UI5 application for the My Leave Requests app: HCM_LR_CRE OData service for the My Leave Requests app: /SNCE/PO_S_SRV (1) Business catalog for the My Leave Requests app: SAP_HCM_BC_EMPLOYEE_X1

OData service for the My Leave Requests app: /GBHCM/LEAVEREQUEST (2)

Copy ttemplate business role to create role with Launchpad catalog and g group roup

Front-End End Server

/IWFND /MAINT _SERVI CE SAP Fiori Launch pad designer PFCG

Add start authorizations for OData services of apps pps to business usiness role

Front-End End Server

PFCG

the business role related to the My Leave Requests app: SAP_HCM_BCR_EMPLOYEE_X1

5

http://help.sap.com SAP NetWeaver User Interface Add Add-On On for SAP NetWeaver Application Help Administration Guide Content Administration SAP Fiori Launchpad Launchpad Designer Testing the Launchpad Designer 6 http://help.sap.com SAP NetWeaver User Interface Add Add-On On for SAP NetWeaver Application Help Administration Guide Content Administration SAP Fiori Launchpad Setting Up the Launchpad and Launchapd Designer Testing the Launchpad 7 http://help.sap.com SAP Business Suite SAP Fiori for SAP Business Suite SAP Fiori for Releases prior to SAP Business Suite 7 Innovations 2013 SAP Fiori principal apps for SAP ERP 1.0 SAP Fiori Apps for SAP ERP My Leave Requests Implementation Information for My Leave Requests.

Configuring transactional SAP Fiori Apps - Quick Guide

8

Introduction

Assign ssign b business role to test user on front front-end server erver

Front-End End Server

PFCG

Test user on front-end front end server

Remove apps not required from catalog

Front-End End Server

SAP Fiori Launchpad designer

URL of Launchpad designer in customization mode, mode, see Testing the Launchpad Designer

Perform check: Front-End End Server SAP Fiori Launchpad with app content Activities on Back Back-End End Server Assign RFC Back-End End Server authorization to test user Assign PFCG Role Back-End End Server with OData Service Authorization to User

SAP Fiori Launchpad

Perform check: SAP Fiori Launchpad with content and authorizations

SAP Fiori Launchpad

Front-End End Server

SU01

authorizations S_RFC and S_RFCACL

PFCB SU01

back-end end authorization role: SAP_GBHCM_LEAVE_REQUEST_E MPL

Configuring transactional SAP Fiori Apps - Quick Guide

9

Initial Configuration on Front Front--End Server ver (One (One-Time Time Activities)

1 Preparation 1.1 Create Administrator User on FrontFront-End End Server If an administrator user is not yet available on the frontfront-end end server, you have to create one. If you are using a trusted RFCC connection to the back-end back end server, the user IDs need to be identical on the front-end front end and on the back-end back end server. The adminis administration tration user needs extensive authorizations, such as S_SERVICE, S_DEVELOP, /UI2/CHIP, and S_CTS_SADM. 1. Run transaction User Maintenance (SU01) on the front front-end end server. 2. Create a user – if applicable, with the ID the user already has in the back-end back (see above) above).

1.2 Create Test User on Front Front-End End Server Create a test user in transaction SU01 SU01, using the same user user-ID ID as on the back-end back server.

2 Initial Configuration on Front Front-End End Server (OneTime Activities) The SAP Fiori Launchpad uses the User interface add-on a on for SAP NetWeaver. NetWeaver. It requires the ICF nodes that provide access to the web resources, and the OData services which provide the information about the configured app tiles to be displayed. For more information, see the following documentation on SAP Help Portal under http://help.sap.com: SAP NetWeaver User Interface Add-On Add On for SAP NetWeaver Especially: SAP NetWeaver User Interface Add Add-On for or SAP NetWeaver Application Help Administration Guide Content Administration SAP Fiori Launchpad

2.1 Activate OData Services for SAP Fior Fiori Launchpad The activation of the OData services and of the ICF services (described in the next section) are required to initially set up the SAP Fiori Launchpad and the SAP Fiori Launchpad designer. SAP NetWeaver Gateway provides the infrastructure for the OData services used by the SAP Fiori Launchpad and the SAP Fiori a apps. pps.

Configuring transactional SAP Fiori Apps - Quick Guide

10

Initial Configuration on Front Front--End End Server (One (One-Time Time Activities)

An OData service has to be enabled in Gateway. This basically establishes a mapping betw between een the technical OData service name and the corresp corresponding onding back-end back end service (identified by system alias, namespace, and the external service name). 1. Run transaction Activate and maintain services (/IWFND/MAINT_SERVICE) on the front front-end end server. 2. Use the system alias of your local system when activating the following services: Note:: You do not need to activate the /UI2/LAUNCHPAD /UI2/LAUNCHPAD service. This service is not relevant for SAP Fiori. The service names listed below are concatenations of the namespace /UI2/ and the technical names of the individual services. Ent Enter er these concatenations when adding new services in transaction /IWFND/MAINT_SERVICE. When searching for services, you need to search either by namespace or by technical name. /UI2/PAGE_BUILDER_CONF /UI2/PAGE_BUILDER_PERS /UI2/PAGE_BUILDER_CUST /UI2/INTEROP /UI2/TRANSPORT

Result Result: The services are activated in your customer namespace namespace,, with the following technical names, for example example: ZINTEROP ZPAGE_BUILDER_CONF ZPAGE_BUILDER_CUST ZPAGE_BUILDER_PERS ZTRANSPORT

Configuring transactional SAP Fiori Apps - Quick Guide

11

Initial Configuration on Front Front--End End Server (One (One-Time Time Activities)

3. Call all each service once by select selecting it in transaction Activate and maintain services (/IWFND/MAINT_SERVICE), then clicking clicking Call Browser in the screen area ICF Nodes Nodes. Always select the OData node, not the SDATA node. Note:: You have called a service successfully when an XML document is displayed without any error messages. When you call a service, a hash key is generated in the background. The hash key is required for the generation of authorizations authorization described under Assign Administrator Role for SAP Fiori Launchpad to Administration User. User. You can verify the hash key generation in table USOBHASH in transaction Data Browser (SE16). In the selection screen, specify the following: o R3TR in the PGMID field o IWSG in the Object field o The technical service name in the OBJ_NAME field. Use the technical name of your generated service, typically starting with Z, and having the version number appended in four-digit four digit format with leading zeros The hash key should be displayed in the t NAME column of the results table.

Configuring transactional SAP Fiori Apps - Quick Guide

12

Initial Configuration on Front Front--End End Server (One (One-Time Time Activities)

2.2 Activate SICF ICF Services for SAP Fiori Launchpad In addition to the ICF services that correspond to the OData services it is necessary to activate the following ICF services manually: 1. Run transaction Maintain Services (SICF) on the front front-end end server. 2. Activate services under the following subtrees, either by right right-clicking clicking the mouse and selecting Activate Service, or selecting Service/host Activate from the menu: menu: /default_host/sap/bc/ui2/nwbc /default_host/sap/bc/ui2/start_up /default_host/sap/bc/ui2/start_up /default_host/sap/bc/ui5_ui5/sap/ar_srvc_launch /default_host/sap/bc/ui5_ui5/sap/ar_srvc_news /default_host/sap/bc/ui5_ui5/sap/arsrvc_upb_admn /default_host/sap/bc/ui5_ui5/ui2/ushell /default_host/sap/public/bc/ui2 /default_host/sap/public/bc/ui5_ui5

Configuring transactional SAP Fiori Apps - Quick Guide

13

Initial Configuration on Front Front--End Server (One (One-Time Time Activities)

Note Note: To activate all child nodes under a service, choose the Yes button with the hierarchy icon in the Activation of ICF Services dialog box. box

2.3 Assign Administrator Role for SAP Fiori Launchpad to Administration User In n this step, you copy the SAP-delivered SAP delivered administrator role for the SAP Fiori Launchpad and assign it to your administrator user. The administrator is then authorized to use the SAP Fiori Launchpad designer. 1. Run transaction Role Maintenance (PFCG) to copy the role SAP_UI2_ADMIN_700 to your customer namespace. 2. Edit the new role in transaction Role Maintenance (PFCG) as follows: 1. On the Menu tab, open the dropdown menu of the button for adding objects (+ button). By default, the object type Transaction ansaction is selected. Change the se selection to Authorization Default. 2. In the Service pop-up up that opens, select TADIR Service from the dropdown menu for the Authorization Default. Specify the following values: Program ID: R3TR Object Type: IWSG WSG In the tab table, le, enter the names of your activated services (see Activate OData Services for SAP Fiori Launchpad Launchpad) in the form __ zeros>, for example: ZINTEROP_0001 ZINTEROP ZPAGE_BUILDER_CONF ZPAGE_BUILDER_CONF_0001 _0001 ZPAGE_BUILDER_CUST ZPAGE_BUILDER_CUST_0001 _0001 ZPAGE_BUILDER_PERS ZPAGE_BUILDER_PERS_0001 _0001 ZTRANSPORT_0001 ZTRANSPORT 0001

3. On the Authorizations tab, click Propose Profile Name next to the Profile Name field. 4. Choose Change Authorization Data . On the screen that opens up, click the Generate button.

Configuring transactional SAP Fiori Apps - Quick Guide

14

Initial Configuration on Front Front--End End Server (One (One-Time Time Activities)

Result: You have a role with 5 IWSG authorizations and 5 IWSV authorizations. The IWSV authorizations are included in the role from the start, so they are not in the customer namespace:

5. Assign the new role to the administrator administrator user user created under Create Administrator User on Front Front-End End Server. Server

2.4 Assign Role with Launchpad Start Authorization for End Users sers Proceed as described under Assign Role for SAP Fiori Launchpad Administration to Administration User User,, but using the SAP_UI2_USER_700 role as a template and assigning only a subset of services: ZINTEROP_0001 ZPAGE_BUILDER_PERS_0001 Assign this role to the test user you have created under Create Test User on Front-End Front Server Server.

Configuring transactional SAP Fiori Apps - Quick Guide

15

App App-Specific Specific Configuration

2.5 Perform Checks: SAP Fiori Launchpad Designer and SAP SA Fiori Launchpad Note: For productive usage with a system landscape including SAP Web Dispatcher, you need the Web Dispatcher links to perform the checks.

1.

2.

3. 4.

Look up the composition of the URLs of the Launchpad designer and the Launchpad in the following documentation: Testing the Launchpad Designer8 Testing the Launchpad9 Adapt the URLs entering your landscape information, such as server and port. Note: You ou can determine the server and port Launchpad as follows: Run transaction SICF Drill Down default host -> sap -> > public -> > ping Right mouse click on the ping service -> > click Service test Check that the Launchpad designer can be opened. opened. Check that the Launchpad can be e opened. At this stage, an empty Launchpad should be displayed.

3 App--Specific Specific Configuration 3.1 Open Product Documentat Documentation ion for My Leave Requests App For the following procedures, you need information from the product documentation, documen such as technical names of services, roles, and so on. on The information is included in the following sections. However, to have a document with the required entities at hand, go to http://help.sap.com and open the Implementation Implementation Information for My Leave Requests10.

8

http://help.sap.com SAP NetWeaver User Interface Add Add-On On for SAP NetWeaver Application Help Administration Guide Content Administration SAP Fiori Launchpad Launchpad Designer Testing the Launchpad Designer 9 http://help.sap.com SAP NetWeaver User Interface Add Add-On On for SAP NetWeaver Application Help Administration Guide Content Administration SAP Fiori Launchpad Launchp Setting Up the Launchpad and Launch Launchpad ad Designer Testing the Launchpad 10 http://help.sap.com SAP Business Suite SAP Fiori for SAP Business Suite SAP Fiori for Business Suite 7 Innovations 2013 SAP Fiori for SAP ERP 1.0 SAP Fiori Apps for SAP

Configuring transactional SAP Fiori Apps - Quick Guide

16

App App-Specific Specific Configuration

3.2 Activities on Front-End Front End Server 3.2.1 Activate ICF Services of UI5 Application (SAP Fiori Administrator) Administrator To activate the My Leave Requests app,, you must perform this procedure, as well as the activation of the OData services services per app (next section). 1. 2. 3. 4. 5.

Run transaction Maintain Services (SICF) on the front front-end end server. Press F8. Navigate to the following path default_host sap bc ui5_ui5 sap . Under this node, navigate to the UI5 application for the My Leave Requests app: hcm_lr_cre cre. To activate the service (UI5 application), choose Service/host Activate .

3.2.2 Activate OData Service for App pp (SAP Fiori Administrator) 1. 2. 3.

4. 5. 6. 7.

Run transaction Activate and maintain services (/IWFND/MAINT_SERVICE) on the front-end end server. Click Add Service. Enter the system alias lias of your back back-end end system.

In the External Service Name field field,, enter the technical name of the OData service for the My Leave Requests app without the version number number: /GBHCM/LEAVEREQUEST. Enter the version number – “2” in our example – into the Version field. Click Get Services. Click Add Selected Services.

ERP Apps for Human Capital Management Information for My Leave Requests.

My Leave Requests

Configuring transactional SAP Fiori Apps - Quick Guide

Implementation

17

App App-Specific Specific Configuration

A popup opens up up:

8. 9. 10. 11.

Give ive the service a technical name in your customer namespace. Assign a package or choose Local Object. Click Execute to save the service. In the Activate and maintain services screen, verify that the system alias is maintained correctly. If not, change it as required by deleting the alias and adding the correct one.

3.2.3 Copy Template Business Role to Create Role wi with Launchpad Catalog and Group You must perform tthis his step and the following authorization authorization- and-role role-related related tasks on the front front-end end server to equip the test user with all rights needed for the app. SAP delivers business roles for users of SAP Fiori apps. apps. Business roles role provide provid access to a sample of apps relevant for specific business users. users. The authorization for the My Leave R Requests equests app is included in the business role for the HCM employees (SAP_HCM_BCR_EMPLOYEE_X1 SAP_HCM_BCR_EMPLOYEE_X1) SAP_HCM_BCR_EMPLOYEE_X1). Run transaction Role Maintenance (PFCG) to copy the business role SAP_HCM_BCR_EMPLOYEE_X1 to your customer namespace. Note Note: A business catalog and a business catalog group containing apps relevant for HCM employees are displayed under the Menu tab.

Configuring transactional SAP Fiori Apps - Quick Guide

18

App App-Specific Specific Configuration

3.2.4 Add Start A Authorizations uthorizations for OData Service of Apps to Business Role R A user trying to consume an OData service needs the following types of authorizations: Authorizations on the Gateway side: Role Menu entries for Authorization Defaults of type TADIR Service with object type “IWSG – Gateway: Gateway: Service Groups Metadata”. Authorizations on the back back-end end side: Role Menu entries for Authorization Defaults of type TADIR Service with Object Type IWSV – Gateway Business Suite Enablement - Serv. For the back back-end end entries, an example role is provided, fr from om which the entries can be copied (see section Assign PFCG Role with OData Service Authorization to Test User). User For the Gateway Gateway-side side entries, there are no such examples, as the technical names name are entered during the ac activation tivation of the service, and therefore not known in advance. To create a role with OData start authorizations on the front front-end end server, proceed as follows: Caution: Be aware that the check for OData service authorization can provide additional security, es especially pecially in case SAP NetWeaver Gateway is set up as separate hub. By specifying the services explicitly in the role menu menu,, you control which requests on behalf of a user can pass the Gateway. If you use a wildcard, users c can an call all activated services. Unauthorized requests can only be rejected on the back back-end end server, provided that the user’s authorizations in the back-end end are not sufficient. We therefore recommend that you do not use wildcard authorizations in productive environments. Instead, add single services as follows:

Note You must have called an OData service at least once before you can assign start authorizations for it. 1. Edit the business role created under Copy Templ Template ate Business Role to Create Role with Launchpad Catalog and Group in transaction Role Maintenance (PFCG PFCG). 2. On the Menu tab, open the dropdown menu of the button for adding objects (+ button). By default, the object type Transaction is selected. Change the selection to Authorization Default. 3. In the Service pop-up pop up that opens, select TADIR Service from the dropdown menu for the Authorization Default. Specify the following values: Program ID: R3TR Object Type: IWSG 4. In the table, enter the name of the activated OData service (see Activate OData Service for App (SAP Fiori Administrator). Administrator)

Configuring transactional SAP Fiori Apps - Quick Guide

19

App App-Specific Specific Configuration

Note: You need to enter the name in the form __ zeros>,, for example, ZLEAVEREQUEST_0002.

N 5. Under the Authorization tab tab,, click the button next to the Profile Name field to generate the authorization profile for the role. role 6. Choose Change Authorization Data . On the screen that opens up, cl click ick the Generate button.

3.2.5 Assign Business Role to Test User on Front Front-End End Server In transaction Role Maintenance (PFCG), assign the business role to the test user initially created (see Create Test User on Front-End Front Server Server) by specifying the user ID under the User tab.

3.2.6 Remove Apps Not Required from Catalog (Optional Step) This is a clean clean-up up step. You can narrow down the authorizations contained in the th business role delivered (see Copy Template Business Role to Create Role with Launchpad Catalog and Group) Group) to the apps that should actually be available for the test user user. For this purpose, remove apps that are not required from the business catalog. ca 1. Retrieve the name of the relevant business catalog in the Implementation Information for My Leave Requests: SAP_HCM_BC_EMPLOYEE_X1. 2. Enter the SAP Fiori Launchpad designer in customization mode (see Perform Check: SAP Fiori Launchpad with App Content): Content : https://:/sap/bc/u https://:/sap/bc/ui5_ui5/sap/arsrvc_upb_admn/main.html i5_ui5/sap/arsrvc_upb_admn/main.html ?sap--client=&scope client=&scope = CUST 3. Search for the business catalog. 4. Delete tiles not required. Caution Caution:

Configuring transactional SAP Fiori Apps - Quick Guide

20

App App-Specific Specific Configuration

Do not delete target mapping tiles (blue) or app launcher tiles (white) of the apps you want to keep. To delete tile tiles, s, drag them to the lower right corner in the Launchpad designer.

3.2.7 Perform C Check: heck: SAP Fiori Launchpad with App C Content ontent 1. Open the SAP Fiori Launchpad with the test user credentials. 2. Choose Open Catalog from the menu. The business catalog with the My Leave Requests app should be visible. At this stage, however, starting the app will lead to an error, because back-end back authorizations are still missing.

3.3 Activities on Back-End Back End Server 3.3.1 Assign ssign RFC Authorization to Test User If the OData back back-end end service is locate located d on a remote back back-end,, users need permission to perform the RFC call on the back back-end end system, that is, they require the authorizations S_RFC and S_RFCACL for trusted RFC. In this case, and if your user does not have these authorizations yet, assign a role including the RFC authorization objects to the back-end end user that corresponds correspond to the test user initially created (see Create Test User on Front Front-End End Server). Server Note:: You can check whether the user has the RFC authorizations in the user information system (by (by entering transaction User Maintenance (SU01) and choos choosing Information Information System).

3.3.2 Assign PFCG Role with OData Service Authorization to Test User Note:: The following procedure describes how you assign assign the OData service to a user for just the My Leave Requests app. For a productive usage of Fiori apps, you would most probably do the PFCG role assignment differently: You would create a PFCG role that contains multiple OData start authorizations. For example, you would include the start authorizations for all HR apps, based on the technical catalog for HR. 1. Run transaction Role Maintenance (PFCG) to copy the back-end back end authorization role required for the My Leave Requests app to your customer namespace. The technical role name is SAP_GBHCM_LEAVE_REQUEST_EMPL. SAP_GBHCM_LEAVE_REQUEST_EMPL 2. Edit the copi copied ed business role in transaction Role Maintenance (PFCG) 3. On the Menu tab, open the dropdown menu of the button for adding objects (+ button). By default, the object type Transaction is selected. Change the selection to Authorization Default.

Configuring transactional SAP Fiori Apps - Quick Guide

21

App App-Specific Specific Configuration

4. In the Service pop-up pop up that opens, select TADIR Service from the dropdown menu for the Authorization Default. Specify the following values: a. Program ID: R3TR b. Object Type: IWSV 5. In the table, enter the name of the activated OData service (see Activate OData Service for App (SAP Fiori Administrator) Administrator 6. Under the Authorization tab, click the button next to the Profile Name field to generate the authorization profile for the role. 7. Choose Change Authorization Data. On the screen that op opens ens up, click Save and then the Generate button. 8. Run transaction User Maintenance (SU01) and assign the role to the test user user initially created (see Create Test User on Front Front-End End Server). Server

Note: The following steps are only necessary if the user does not yet have the business authorizations that are required to use the My Leave Requests app. 1. On the Authorization tab, click Generate Profile next to the profile name. Data. 2. Choose Maintain Authorization Da 3. On the Authorization Details screen, click the Generate icon in the toolbar.

3.3.3 Perform C Check: heck: SAP Fiori Launchpad with C Content and Authorizations 1. Open the SAP Fiori Launchpad with the test user credentials. 2. Choose Open Catalog from the menu. The business catalog with the My Leave Requests app should be visible. When starting the app, the actual app functions should be available. Note If you get an error message stating that configuration is missing when you start the app, it means that your b back-end end system has not been configured correctly to enable the business functionality (see Out of Scope Scope).

Configuring transactional SAP Fiori Apps - Quick Guide

22