Fiori Configurations

Configuring SAP Fiori Apps

-Quick Guide

An example-based step-by-step guide to enable the usage of

transactional SAP Fiori apps and SAP Fiori fact sheets

Version 1.2 2014-07-08

© Copyright 2014 SAP AG. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The

information contained herein may be changed without prior notice.

Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary.

SAP Landscape Transformation Replication Server installation SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries.

Please see http://www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices.

Disclaimer

The content of this document is not part of SAP product documentation.SAP does not guarantee the correctness of the information provided.You may not infer any product documentation claims against SAP based on this information.

Introduction

Contents

Install and Set up SAP Web Dispatcher (Fact Sheets Only) ... 12

1.1 Create Administrator User on Front-End Server ... 12

1.2 Create Test User on Front-End Server ... 12

1.3 2 Initial Configuration on Front-End Server (One-Time Activities) ...13

Activate OData Services for SAP Fiori Launchpad ... 13

2.1 Activate SICF Services for SAP Fiori Launchpad... 15

2.2 Assign Administrator Role for SAP Fiori Launchpad to Administration User ... 16

2.3 Assign Role with Launchpad Start Authorization for End Users... 18

2.4 Set up SAP Fiori Search (Fact Sheets Only) ... 18

2.5 Perform Check: ICF Service for Fact Sheets (Fact Sheets Only) ... 18

2.6 Perform Checks: SAP Fiori Launchpad Designer and SAP Fiori Launchpad ... 18

2.7 Perform Check: SAP Web Dispatcher (Fact Sheets Only) ... 19

2.8 Perform Check: Search UI (Fact Sheets Only) ... 19

2.9 3 App-Specific Configuration ... 19

Open Product Documentation for My Leave Requests App/Customer Fact Sheet ... 19

3.1 Activities on Front-End Server ... 20

3.2 3.2.1 Activate ICF Services of UI5 Application (SAP Fiori Administrator) ... 20

3.2.2 Activate OData Service for App (SAP Fiori Administrator) ... 20

3.2.3 Copy Template Business Role to Create Role with Launchpad Catalog and Group ... 21

3.2.4 Add Start Authorizations for OData Service of Apps to Business Role ... 22

3.2.5 Assign Business Role to Test User on Front-End Server ... 23

3.2.6 Remove Apps Not Required from Catalog (Optional Step) ... 23

3.2.7 Perform Check: SAP Fiori Launchpad with App Content... 24

Activities on Back-End Server ... 24

3.3 3.3.1 Assign RFC Authorization to Test User ... 24

3.3.2 Assign PFCG Role with OData Service Authorization to Test User ... 24

3.3.4 Start Indexing of Search Connectors (Fact Sheets Only) ... 26 3.3.5 Perform Check: SAP Fiori Launchpad with Content and Authorizations ... 26

Introduction

Introduction

This document guides you through the steps required to enable users to access transactional SAP Fiori apps and SAP Fiori fact sheets in the SAP Fiori Launchpad. The process is described using the examples of theMy Leave Requests app – a

transactional app – and theCustomer fact sheet. You can use it as a reference process for the setup of any transactional app or fact sheet.

The process follows a straight-forward path with several prerequisites already in place. This documentation gives you an insight into the setup process for SAP Fiori apps. The approach does not necessarily correspond to the system setup in a productive

environment.

For SAP Fiori app implementation in a productive environment, see theApp Implementation Information for SAP Fiori1 _{on the SAP Help Portal.}

Note:

If you use SAP NetWeaver 740 SPS 6 or higher, you can use tasklists to do the steps 2.1 and 2.2.

For more information about the tasklists for the setup of SAP Fiori and how to use them,

seehttp://service.sap.com/sltoolset Software Logistics Toolset 1.0 Documentation

System Provisioning Technical Configuration Automation Fiori Frontend.

Prerequisites

The following conditions must be met:

All required components are installed.

For more information, see the following documentation on SAP Help Portal:

o Implementation Overview2

o System Landscape Required for SAP Fiori3.

Note:

For fact sheets, you need to set up the system landscape with SAP HANA database.

Initial configuration of SAP NetWeaver Gateway is in place. For more information, seeBasic Configuration Settings4

HTTPS connectivity is enabled between the front-end server (FES) running SAP NetWeaver Gateway and the back-end systems, including SAP HANA Extended Application Services (SAP HANA XS).

1 _{http://help.sap.com/fiori App Implementation Information for SAP Fiori Implementation}

Information

2_{http://help.sap.com/fiori SAP Fiori Overview Implementation Overview} 3_{http://help.sap.com/fiori System Landscape Required for SAP Fiori}

4_{http://help.sap.com Technology SAP Gateway SAP NetWeaver Gateway 2.0}

In the Internet Communication Manager (ICM), the fundamental ability of connecting to a system with HTTP(S) is activated.

In the Internet Communication Framework (ICF), certain services can be activated, for example, the service /sap/public/ping for testing connections.

Out of Scope

Authorizations in complex system landscapes

Back-end configuration to enable the business functionality, for example,

configuration of the employee self-services in SAP Human Capital Management, or mapping of users to the corresponding entities in personal management.

Back-end configuration required for the specific Fiori app.

Configuration Overview

The configuration of SAP Fiori apps requires steps on a front-end Server (FES) and on one or multiple connected SAP Business Suite back-end systems.

On the front-end server resides an SAP NetWeaver Gateway system with the SAP NetWeaver UI Add-On.

On the back-end servers, the SAP ERP or SAP CRM systems are installed, for example. The SAP NetWeaverNetWeaver UI Add-On includes the SAP Fiori LaunchpadLaunchpad designer, which is the administration tool to configure the content for the SAP Fiori LaunchpadLaunchpad.

The SAP Fiori Launchpad is the entry point for end users. They access the Launchpad and the Launchpad designer from a Web browser via secure requests to the FES.

To enable these requests, UI5 applications and their related OData services need to be activated in SAP NetWeaver Gateway on FES. In addition, users need start authorizations for the services on the front-end and authorizations for related functions on the back-end. The majority of configuration steps are activation steps (for applications and services) and authorization steps on both the front-end server and in back-end systems.

Chapter 2 describes the initial configuration of the SAP Fiori Launchpad and of the SAP Fiori Launchpad designer:

Activation of the ICF services of the SAP Fiori Launchpad to create the HTTP request handlers for the Launchpad URLs

Activation of the OData services for the SAP NetWeaver UI Add-On

Creation of a PFCG role for administrators with authorizations for the SAP Fiori Launchpad designer

Creation of a PFCG role for end users with authorizations for the SAP Fiori Launchpad At the end of these one-time activities you can launch the SAP Fiori Launchpad designer and the SAP Fiori Launchpad.

Introduction

Chapter 3 describes how to configure individual SAP Fiori apps using the example of the

My Leave Requestsapp and theCustomer fact sheet.

Each app is included in a business catalog of apps available for a sample business role, in our example: the role for the HCM employee or for the fields representative, respectively. On the front-end Server (FES) you have to do the following:

Activate the OData services and ICF nodes for the SAP UI5 applications in SAP NetWeaver Gateway. This enables the corresponding HTTP request handlers. Create a PFCG role that provides access to the relevant catalog in the SAP Fiori Launchpad. In our example, we copy the sample business role delivered by SAP. Add start authorizations for the required OData service to the business role (we provide an unsecure shortcut: use wildcard authorization).

Assign the role to a user, which has to have the same user name as in the back-end system

Adapt the business catalog to your needs in the SAP Fiori Launchpad designer SAP Fiori fact sheets are based on search models, and the results list of SAP Fiori search is the main entry point to fact sheets. For fact sheets, you must therefore create search connectors on the back-end server.

In addition, users for both, fact sheets and transactional apps, must be assigned the authorizations required in the back-end to be able to run the apps. You have to do the following:

Assign the RFC Authorization to the user to allow remote access from the front-end server to the back-end server

Assign and generate the authorizations to call and perform the OData services on the back-end

Process Steps

Step Back-End Server/

Front-End Server/ Other

Transaction Data Required Preparation

Install and set up SAP Web Dispatcher (Fact Sheets Only)

Separate Server See detailed documentat ion

See detailed documentation

Create administrator user Front-End Server SU01 User name as on the back-end server

Create test user Front-End Server SU01 User name as on the back-end server

Initial Configuration on Front-End Server (One-Time Activities)

Activate OData services for

SAP Fiori Launchpad Front-End Server /IWFND/MAINT_SERV

ICE /UI2/PAGE_BUILDER_CONF /UI2/PAGE_BUILDER_PERS /UI2/PAGE_BUILDER_CUST /UI2/INTEROP /UI2/TRANSPORT

Activate SICF services for

SAP Fiori Launchpad Front-End Server SICF Full list for both Launchpad anddesigner:

/default_host/sap/bc/ui2/nwbc /default_host/sap/bc/ui2/start_u p /default_host/sap/bc/ui5_ui5/sa p/ar_srvc_launch /default_host/sap/bc/ui5_ui5/sa p/ar_srvc_news /default_host/sap/bc/ui5_ui5/sa p/arsrvc_upb_admn /default_host/sap/bc/ui5_ui5/ui2 /ushell /default_host/sap/public/bc/ui2/ default_host/sap/public/bc/ui5_u i5

Assign administrator role for SAP Fiori Launchpad to adminstration user

Front-End Server PFCG SAP role: SAP_UI2_Admin_700 The activated gateway service names for: o /UI2/PAGE_BUILDER_CON F o /UI2/PAGE_BUILDER_PER S o /UI2/PAGE_BUILDER_CUS T o /UI2/INTEROP o /UI2/TRANSPORT

Introduction

start authorization for end

users The activated gateway servicenames for:

o /UI2/PAGE_BUILDER_PER S

o /UI2/INTEROP

Set up SAP Fiori Search

(Fact Sheets Only) Back-End Server Seedetailed

documentat ion

See detailed documentation

Perform Check: ICF Service for Fact Sheets (Fact Sheets Only)

Front-End Server SICF /sap/bc/ui5_ui5/ui2/ushell/reso urces/sap/ushell/components/fa ctsheet

Perform checks:SAP Fiori Launchpad designer and SAP Fiori Launchpad

Front-End Server Web

browser URL of Launchpad designer, seeLaunching the Launchpad Designer5

URL of Launchpad, seeLaunching

the Launchpad6

Perform Check: SAP Web Dispatcher (Fact Sheets Only)

Front-End Server Web

browser https://<server>/sap/es/ina/getserverinfo

Perform Check: Search UI

(Fact Sheets Only) Back-End Server ESH_SEARCH

5 _{http://help.sap.com Technology User Interface Add-On for SAP NetWeaver Application}

Help SAP Fiori Launchpad Using the Launchpad Designer Launching the Launchpad Designer

6_{http://help.sap.com Technology User Interface Add-On for SAP NetWeaver Application}

App-Specific Configuration

Open product

documentation forMy

Leave Requests app /Customer fact sheet

Public internet Implemen tation Informatio n for My Leave Requests7 App Implem entatio n: Custo mer8 Activities on Front-End Server

Activate ICF services of UI5 application (SAP Fiori administrator)

Front-End Server SICF UI5 applications:

My Leave Requests app: HCM_LR_CRE

Customer fact sheet: BSCBN_ANF_SDMD

Activate OData services per app (SAP Fiori

administrator)

Front-End Server /IWFND /MAINT _SERVI CE SAP Fiori Launch pad designer OData services

My Leave Requests app: /GBHCM/LEAVEREQUEST (2)

Customer fact sheet: CB_CUSTOMER_SRV Business catalog:

My Leave Requests app: SAP_HCM_BC_EMPLOYEE_X1

Customer fact sheet:

SAP_SD_BC_FIELDSALESREP

Copy template business role to create role with Launchpad catalog and group

Front-End Server PFCG Business role

My Leave Requests app:

SAP_HCM_BCR_EMPLOYEE_X1

Customer fact sheet:

SAP_SD_BCR_FIELDSALESREP

Add start authorizations for OData services of apps to business role

Front-End Server PFCG OData services

My Leave Requests app: /GBHCM/LEAVEREQUEST (2)

Customer fact sheet: CB_CUSTOMER_SRV

Assign business role to test

user on front-end server Front-End Server PFCG Test user on front-end server

Remove apps not required

from catalog Front-End Server SAP FioriLaunchpad

designer

URL of Launchpad designer in customization mode, seeLaunching the Launchpad Designer.

Perform check: SAP Fiori Launchpad with app content

Front-End Server SAP Fiori Launchpad

7_{http://help.sap.com/fiori SAP Fiori Products SAP Fiori for SAP ERP SAP Fiori Principal}

Apps for SAP ERP 1.0 SAP Fiori Apps for SAP ERP My Leave Requests Implementation Information for My Leave Requests.

8_{http://help.sap.com/fiori SAP Fiori Apps SAP Fiori Apps for SAP ERP Apps for Logistics} Sales and Distribution (SD) Customer App Implementation: Customer

Preparation

Activities on Back-End Server

Assign RFC authorization to

test user Back-End Server SU01 authorizations S_RFC andS_RFCACL

Assign PFCG Role with OData Service

Authorization to User

Back-End Server PFCB

SU01 Back-end authorization role:My Leave Requests app:

SAP_GBHCM_LEAVE_REQUEST_E MPL

Customer fact sheet: SAP_SD_CUSTOMER_APP

Create Search Connectors

(Fact Sheets Only) Back-End Server ESH_COCKPIT SeeApp Implementation: Customer

9

Start Indexing of Search Connectors (Fact Sheets Only)

Back-End Server ESH_COCK PIT

Activity on Front-End Server

Perform check: SAP Fiori Launchpad with content and authorizations

Front-End Server SAP Fiori Launchpad

9_{http://help.sap.com/fiori SAP Fiori Apps SAP Fiori Apps for SAP ERP Apps for Logistics} Sales and Distribution (SD) Customer App Implementation: Customer

1 Preparation

Install and Set up SAP Web Dispatcher (Fact Sheets Only)

1.1

To be able to use SAP Fiori fact sheets, you must install SAP Web Dispatcher and set up the connections between SAP Web Dispatcher and the ABAP servers.

For more information, see:

Installation of SAP Web Dispatcher10

Communication Between SAP Web Dispatcher and ABAP Servers11

Note

You must configure both the HTTP port and the HTTPS port, even if you use the HTTPs connection only, as strongly recommended by SAP.

Create Administrator User on Front-End Server

1.2

If an administrator user is not yet available on the front-end server, you have to create one. If you are using a trusted RFCC connection to the back-end server, the user IDs need to be identical on the front-end and on the back-end server.

The administration user needs extensive authorizations, such as S_SERVICE, S_DEVELOP, /UI2/CHIP, and S_CTS_SADM.

1. Run transactionUser Maintenance (SU01) on the front-end server.

2. Create a user – if applicable, with the ID the user already has in the back-end (see above).

Create Test User on Front-End Server

1.3

Create a test user in transaction SU01, using the same user-ID as on the back-end server.

10_{http://help.sap.com/fiori System Landscape Required for SAP Fiori Setup of SAP Fiori}

System Landscape with SAP HANA Database Installation Installation of SAP Web Dispatcher.

11 _{http://help.sap.com/fiori System Landscape Required for SAP Fiori Setup of SAP Fiori} System Landscape with SAP HANA Database Communication Channels Communication Between SAP Web Dispatcher and ABAP Servers.

Initial Configuration on Front-End Server (One-Time Activities)

2 Initial Configuration on Front-End Server

(One-Time Activities)

Note:

If you use SAP NetWeaver 740 SPS 6 or higher, you can use tasklists to do the steps 2.1 and 2.2.

For more information about the tasklists for the setup of SAP Fiori and how to use them,

seehttp://service.sap.com/sltoolset Software Logistics Toolset 1.0 Documentation

System Provisioning Technical Configuration Automation Fiori Frontend.

The SAP Fiori Launchpad uses the User interface add-on for SAP NetWeaver. It requires the ICF nodes that provide access to the web resources, and the OData services which provide the information about the configured app tiles to be displayed.

For more information, see the following documentation on SAP Help Portal under http://help.sap.com:

SAP NetWeaver User Interface Add-On for SAP NetWeaver

Especially: SAP NetWeaver User Interface Add-On for SAP NetWeaver

Application Help Administration Guide Content Administration SAP Fiori Launchpad

Activate OData Services for SAP Fiori Launchpad

2.1

The activation of the OData services and of the ICF services (described in the next section) are required to initially set up the SAP Fiori Launchpad and the SAP Fiori Launchpad designer.

SAP NetWeaver Gateway provides the infrastructure for the OData services used by the SAP Fiori Launchpad and the SAP Fiori apps.

An OData service has to be enabled in Gateway. This basically establishes a mapping between the technical OData service name and the corresponding back-end service (identified by system alias, namespace, and the external service name).

1. Run transactionActivate and maintain services (/IWFND/MAINT_SERVICE) on the front-end server.

2. Use the system alias of your local system when activating the following services: Note:

You do not need to activate the /UI2/LAUNCHPAD service. This service is not relevant for SAP Fiori.

The service names listed below are concatenations of the namespace /UI2/ and the technical names of the individual services. Enter these concatenations when adding new services in transaction /IWFND/MAINT_SERVICE. When searching for services, you need to search either by namespace or by technical name.

/UI2/PAGE_BUILDER_PERS /UI2/PAGE_BUILDER_CUST /UI2/INTEROP

/UI2/TRANSPORT

Result:

The services are activated in your customer namespace, with the following technical names, for example:

ZINTEROP

ZPAGE_BUILDER_CONF ZPAGE_BUILDER_CUST ZPAGE_BUILDER_PERS ZTRANSPORT

3. Call each service once by selecting it in transactionActivate and maintain services

(/IWFND/MAINT_SERVICE), then clickingCall Browserin the screen areaICF Nodes. Always select theODatanode, not theSDATA node.

Initial Configuration on Front-End Server (One-Time Activities) Note:

You have called a service successfully when an XML document is displayed without any error messages.

When you call a service, a hash key is generated in the background. The hash key is required for the generation of authorizations described underAssign

Administrator Role for SAP Fiori Launchpad to Administration User.

You can verify the hash key generation in table USOBHASH in transaction

Data Browser (SE16). In the selection screen, specify the following: o R3TR in thePGMID field

o IWSG in theObject field

o The technical service name in the OBJ_NAME field. Use the technical name of your generated service, typically starting with Z, and having the version number appended in four-digit format with leading zeros

The hash key should be displayed in theNAME column of the results table.

Activate SICF Services for SAP Fiori Launchpad

2.2

In addition to the ICF services that correspond to the OData services it is necessary to activate the following ICF services manually:

2. Activate services under the following subtrees, either by right-clicking the mouse and selectingActivate Service, or selectingService/host Activate from the menu:

/default_host/sap/bc/ui2/nwbc /default_host/sap/bc/ui2/start_up /default_host/sap/bc/ui5_ui5/sap/ar_srvc_launch /default_host/sap/bc/ui5_ui5/sap/ar_srvc_news /default_host/sap/bc/ui5_ui5/sap/arsrvc_upb_admn /default_host/sap/bc/ui5_ui5/ui2/ushell /default_host/sap/public/bc/ui2 /default_host/sap/public/bc/ui5_ui5 Note:

To activate all child nodes under a service, choose theYes button with the hierarchy icon in theActivation of ICF Services dialog box.

Assign Administrator Role for SAP Fiori Launchpad to

2.3

Administration User

In this step, you copy the SAP-delivered administrator role for the SAP Fiori Launchpad and assign it to your administrator user. The administrator is then authorized to use the SAP Fiori Launchpad designer.

1. Run transactionRole Maintenance (PFCG) to copy the role SAP_UI2_ADMIN_700 to your customer namespace.

2. Edit the new role in transactionRole Maintenance (PFCG) as follows:

1. On theMenu tab, open the dropdown menu of the button for adding objects (+ button). By default, the object typeTransaction is selected. Change the

selection toAuthorization Default.

2. In theService pop-up that opens, selectTADIR Servicefrom the dropdown menu for theAuthorization Default. Specify the following values:

Program ID: R3TR Object Type: IWSG

In the table, enter the names of your activated services (seeActivate OData Services for SAP Fiori Launchpad) in the form <technical name>_<four-digit version number with leading zeros>, for example:

ZINTEROP_0001

ZPAGE_BUILDER_CONF_0001 ZPAGE_BUILDER_CUST_0001 ZPAGE_BUILDER_PERS_0001 ZTRANSPORT_0001

Initial Configuration on Front-End Server (One-Time Activities)

3. On theAuthorizations tab, clickPropose Profile Name next to theProfile Name field. 4. ChooseChange Authorization Data .

On the screen that opens up, click theGenerate button. Result:

You have a role with 5 IWSG authorizations and 5 IWSV authorizations. The IWSV authorizations are included in the role from the start, so they are not in the customer namespace:

5. Assign the new role to the administrator user created underCreate Administrator User on Front-End Server.

Assign Role with Launchpad Start Authorization for End

2.4

Users

Proceed as described underAssign Role for SAP Fiori Launchpad Administration to

Administration User, but using the SAP_UI2_USER_700 role as a template and assigning

only a subset of services: ZINTEROP_0001

ZPAGE_BUILDER_PERS_0001

Assign this role to the test user you have created underCreate Test User on Front-End Server.

Set up SAP Fiori Search (Fact Sheets Only)

2.5

To be able to use SAP Fiori fact sheets, you must set up the SAP Fiori search. At this stage, perform steps 1-5 as described underSetup of SAP Fiori Search12 _{on the SAP Help Portal.} To clean up your back-end system eliminating existing search connectors, run report ESH_ADM_INDEX_ALL_SC. Mark the checkboxDelete All Search Connectors.

Perform Check: ICF Service for Fact Sheets (Fact Sheets

2.6

Only)

Run transactionMaintain Services (SICF) on the front-end server and check that the following service is active:

/sap/bc/ui5_ui5/ui2/ushell/resources/sap/ushell/components/factsheet

Perform Checks: SAP Fiori Launchpad Designer and SAP Fiori

2.7

Launchpad

For productive usage with a system landscape including SAP Web Dispatcher, you need the Web Dispatcher links to perform the checks.

1. Look up the composition of the URLs of the Launchpad designer and the Launchpad in the following documentation:

Launching the Launchpad Designer13

Launching the Launchpad14

2. Adapt the URLs entering your landscape information, such as server and port.

12_{http://help.sap.com/fiori Configuration of SAP Fiori Infrastructure Setup of SAP Fiori}

Search

13 _{http://help.sap.com Technology User Interface Add-On for SAP NetWeaver Application}

Help SAP Fiori Launchpad Using the Launchpad Designer Launching the Launchpad Designer

14_{http://help.sap.com Technology User Interface Add-On for SAP NetWeaver Application}

App-Specific Configuration

Note:

You can determine the server and port Launchpad as follows: Run transaction SICF

Drill Down default host -> sap -> public -> ping

Right mouse click on the ping service -> click Service test 3. Check that the Launchpad designer can be opened.

4. Check that the Launchpad can be opened. At this stage, an empty Launchpad should be displayed.

Perform Check: SAP Web Dispatcher (Fact Sheets Only)

2.8

To check that SAP Web Dispatcher is operating, enter the following URL into your Web browser:https://<server>/sap/es/ina/getserverinfo. Fill the placeholder for the server with the address of your back-end server.

You should be able to view a description of the server.

Perform Check: Search UI (Fact Sheets Only)

2.9

To check that SAP Fiori search has been installed correctly, run transaction ESH_SEARCH in the back-end system.

The WebDynpro UI for the search should appear in the back-end system.

3 App-Specific Configuration

Open Product Documentation for

My Leave Requests

3.1

App/

Customer

Fact Sheet

For the following procedures, you need information from the product documentation, such as technical names of services, roles, and so on.

The information is included in the following sections.

However, to have the documentation with the required entities at hand, go to http://help.sap.com and open the following documents:

1. Implementation Information for My Leave Requests15_.

2. App Implementation: Customer16

15_{http://help.sap.com/fiori SAP Fiori Products SAP Fiori for SAP ERP SAP Fiori Principal}

Apps for SAP ERP 1.0 SAP Fiori Apps for SAP ERP My Leave Requests Implementation Information for My Leave Requests.

16_{http://help.sap.com/fiori SAP Fiori Apps SAP Fiori Apps for SAP ERP Apps for Logistics} Sales and Distribution (SD) Customer App Implementation: Customer

Activities on Front-End Server

3.2

3.2.1 Activate ICF Services of UI5 Application (SAP Fiori Administrator)

My Leave Requests app

1. Run transactionMaintain Services (SICF) on the front-end server. 2. Press F8.

3. Navigate to the following path default_host sap bc ui5_ui5 sap .

4. Under this node, navigate to the UI5 application for theMy Leave Requests app: hcm_lr_cre.

5. To activate the service (UI5 application), choose Service/host Activate .

Customer fact sheet

Check if the ICF service is already active:

1. Retrieve the UI5 application relevant for theCustomerfact sheet in theApp Implementation: Customer17_{.You find this information in theExtensibility section} underBSP application for annotation files.

2. Run transactionMaintain Services (SICF) on the front-end server. 3. Press F8.

4. Navigate to the following path default_host sap bc bsp sap .

5. Under this node, navigate to the UI5 application for theCustomerfact sheet: BSCBN_ANF_SDMD.

6. If it is not yet active, activate the ICF service for your app choosing Service/host Activate .

3.2.2 Activate OData Service for App (SAP Fiori Administrator)

1. Run transactionActivate and maintain services (/IWFND/MAINT_SERVICE) on the front-end server.

2. ClickAdd Service.

3. Enter the system alias of your back-end system.

4. In theExternal Service Name field, enter the technical name of the OData service without the version number:

17_{http://help.sap.com/fiori SAP Fiori Apps SAP Fiori Apps for SAP ERP Apps for Logistics} Sales and Distribution (SD) Customer App Implementation: Customer

App-Specific Configuration

/GBHCM/LEAVEREQUEST for theMy Leave Requests app CB_CUSTOMER_SRV for the Customer fact sheet

5. Enter the version number – “2” for theMy Leave Requests app – into theVersion field. 6. ClickGet Services.

7. ClickAdd Selected Services. A popup opens up:

8. Give the service a technical name in your customer namespace. 9. Assign a package or chooseLocal Object.

10. ClickExecute to save the service.

11. In theActivate and maintain services screen, verify that the system alias is maintained correctly. If not, change it as required by deleting the alias and adding the correct one.

3.2.3 Copy Template Business Role to Create Role with Launchpad Catalog

and Group

You must perform this step and the following authorization- and-role-related tasks on the front-end server to equip the test user with all rights needed for the app.

SAP delivers business roles for users of SAP Fiori apps. Business roles provide access to a sample of apps relevant for specific business users.

The authorization for theMy Leave Requestsapp is included in the business role for the HCM employees (SAP_HCM_BCR_EMPLOYEE_X1).

The authorization for theCustomer fact sheet is included in the business role for the fields representative (SAP_SD_BCR_FIELDSALESREP).

Run transactionRole Maintenance (PFCG) to copy the business role to your customer namespace.

Note:

A business catalog and a business catalog group containing apps relevant for business role are displayed under theMenu tab.

3.2.4 Add Start Authorizations for OData Service of Apps to Business Role

Authorizations on the Gateway side: Role Menu entries forAuthorization Defaults

of typeTADIR Service with object type “IWSG – Gateway: Service Groups Metadata”.

Authorizations on the back-end side: Role Menu entries forAuthorization Defaults

of typeTADIR Service with Object TypeIWSV – Gateway Business Suite Enablement - Serv.

For the back-end entries, an example role is provided, from which the entries can be copied (see sectionAssign PFCG Role with OData Service Authorization to Test User). For the Gateway-side entries, there are no such examples, as the technical names are entered during the activation of the service, and therefore not known in advance. To create a role with OData start authorizations on the front-end server, proceed as follows:

Caution:

Be aware that the check for OData service authorization can provide additional security, especially in case SAP NetWeaver Gateway is set up as separate hub. By specifying the services explicitly in the role menu, you control which requests on behalf of a user can pass the Gateway.

If you use a wildcard, users can call all activated services. Unauthorized requests can only be rejected on the back-end server, provided that the user’s

authorizations in the back-end are not sufficient.

We therefore recommend that you do not use wildcard authorizations in productive environments.

Instead, add single services as follows: Note

You must have called an OData service at least once before you can assign start authorizations for it.

1. Edit the business role created underCopy Template Business Role to Create Role

with Launchpad Catalog and Group in transactionRole Maintenance (PFCG).

2. On theMenu tab, open the dropdown menu of the button for adding objects (+ button). By default, the object typeTransaction is selected.

App-Specific Configuration

3. In the Service pop-up that opens, selectTADIR Service from the dropdown menu for theAuthorization Default. Specify the following values:

Program ID: R3TR Object Type: IWSG

4. In the table, enter the name of the activated OData service (seeActivate OData Service for App (SAP Fiori Administrator).

Note:

You need to enter the name in the form <technical name>_<four-digit version number with leading zeros>, for example, ZLEAVEREQUEST_0002.

5. Under theAuthorization tab, click the button next to theProfile Name field to generate the authorization profile for the role.

6. ChooseChange Authorization Data .

On the screen that opens up, click theGenerate button.

3.2.5 Assign Business Role to Test User on Front-End Server

In transactionRole Maintenance (PFCG), assign the business role to the test user initially created (seeCreate Test User on Front-End Server) by specifying the user ID under the

User tab.

3.2.6 Remove Apps Not Required from Catalog (Optional Step)

This is a clean-up step. You can narrow down the authorizations contained in the business role delivered (seeCopy Template Business Role to Create Role with Launchpad Catalog and Group) to the apps that should actually be available for the test user. For this

purpose, remove apps that are not required from the business catalog. 1. Retrieve the name of the relevant business catalog

Implementation Information for My Leave Requests:

App Implementation: Customer: SAP_SD_BC_FIELDSALESREP

2. Enter the SAP Fiori Launchpad designer in customization mode (seePerform

Check: SAP Fiori Launchpad with App Content):

https://<server>:<port>/sap/bc/ui5_ui5/sap/arsrvc_upb_admn/main.html ?sap-client=<client>&scope = CUST

3. Search for the business catalog. 4. Delete tiles not required.

Caution:

Do not delete target mapping tiles (blue) or app launcher tiles (white) of the apps you want to keep.

To delete tiles, drag them to the lower right corner in the Launchpad designer.

3.2.7 Perform Check: SAP Fiori Launchpad with App Content

1. Open the SAP Fiori Launchpad with the test user credentials. 2. ChooseOpen Catalog from the menu.

The business catalog with theMy Leave Requests app/Customer fact sheet should be visible.

At this stage, however, starting the app will lead to an error, because back-end authorizations are still missing.

Activities on Back-End Server

3.3

3.3.1 Assign RFC Authorization to Test User

If the OData back-end service is located on a remote back-end, users need permission to perform the RFC call on the back-end system, that is, they require the authorizations S_RFC and S_RFCACL for trusted RFC.

In this case, and if your user does not have these authorizations yet, assign a role including the RFC authorization objects to the back-end user that corresponds to the test user initially created (seeCreate Test User on Front-End Server).

Note:

You can check whether the user has the RFC authorizations in the user information system (by entering transactionUser Maintenance (SU01) and choosing

Information Information System).

3.3.2 Assign PFCG Role with OData Service Authorization to Test User

The following procedure describes how you assign the OData service to a user for just the one app (My Leave Requests app/Customer fact sheet).

For a productive usage of Fiori apps, you would most probably do the PFCG role assignment differently: You would create a PFCG role that contains multiple OData

App-Specific Configuration

start authorizations. For example, you would include the start authorizations for all HR apps, based on the technical catalog for HR.

1. Run transactionRole Maintenance (PFCG) to copy the back-end authorization role required for your app to your customer namespace:

Technical role name for theMy Leave Requestsapp: SAP_GBHCM_LEAVE_REQUEST_EMPL

Technical role name for theCustomerfact sheet: SAP_SD_CUSTOMER_APP

2. Edit the copied business role in transactionRole Maintenance (PFCG)

3. On theMenu tab, open the dropdown menu of the button for adding objects (+ button). By default, the object typeTransaction is selected. Change the selection to

Authorization Default.

4. In the Service pop-up that opens, select TADIR Service from the dropdown menu for the Authorization Default. Specify the following values:

Program ID: R3TR Object Type: IWSV

5. In the table, enter the name of the activated OData service (seeActivate OData Service for App (SAP Fiori Administrator)

6. Under theAuthorization tab, click the button next to theProfile Name field to generate the authorization profile for the role.

7. ChooseChange Authorization Data. On the screen that opens up, clickSave and then theGenerate button.

8. Run transaction User Maintenance (SU01) and assign the role to the test user user initially created (seeCreate Test User on Front-End Server).

Note:

The following steps are only necessary if the user does not yet have the business authorizations that are required to use theMy Leave Requestsapp.

1. On theAuthorization tab, clickGenerate Profile next to the profile name. 2. ChooseMaintain Authorization Data.

3. On theAuthorization Details screen, click theGenerate icon in the toolbar.

3.3.3 Create Search Connectors (Fact Sheets Only)

To create search connectors, you need the following authorizations: SAP_ESH_SEARCH

SAP_ESH_LOCAL_ADMIN

SAP Fiori fact sheets are based on search models.

To enable the use of fact sheets, search connectors must be created for the underlying search models.

Retrieve the search connectors required for theCustomer fact sheet in theApp

Implementation: Customer.

Create the search connectors as described on SAP Help Portal underBack-End Server: Create Search Connectors for Apps18_.

3.3.4 Start Indexing of Search Connectors (Fact Sheets Only)

3.3.5 Perform Check: SAP Fiori Launchpad with Content and Authorizations

My Leave Requests app:

1. ChooseOpen Catalog from the menu.

2. The business catalog with the your transactional app (My Leave Requests app) should be visible.

Customer fact sheet

Fact sheets can be called from the results of the SAP Fiori search.To access theCustomer

fact sheet, proceed as follows:

1. Use the SAP Fiori search. To narrow down the search results to customer business objects, enter a customer name and then enter the term customer in the search field.

2. From the search results, you should be able to open the Customer fact sheet When starting the apps, the actual app functions should be available.

Note

If you get an error message stating that configuration is missing when you start the app, it means that your back-end system has not been configured correctly to enable the business functionality (seeOut of Scope).

18_{http://help.sap.com/fiori App Implementation Information for SAP Fiori Implementation}

Information App Implementation for Fact Sheets Back-End Server: Create Search Connectors for Apps.

19_{http://help.sap.com/fiori Configuration of SAP Fiori Infrastructure Setup of SASP Fiori}