## 4.2.14.1.2  Users and Roles
| User     | Role                 | Description                                                                                                                                    | Tasks/Usage                                                                                                                                                                                                                                                                                                                          |
|----------|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Provider | Add-On Administrator | The add-on administrator is responsible for everything re- lated to the add-on produc- tion, for example, releasing an add-on product version. | • Creating software com- ponent • Importing changes in software component to test systems • Adjusting add-on descriptor file addon.yml for new versions • Registering add-on product for installation in global account for de- velopment and produc- tion. See Register Prod- uct. • Executing add-on build pipeline in Jenkins in- |
| User   | Role            | Description                                                                                                                                                                                           | Tasks/Usage                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
|--------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|        |                 |                                                                                                                                                                                                       | ity checks for released objects.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
|        | DevOps Engineer | The DevOps engineer is re- sponsible for the configura- tion of the pipeline and im- plementation of the multiten- ant application that needs to be deployed to enable the add-on as a SaaS solution. | • Initial configuration of add-on pipeline, espe- cially config.yml file in git repository • Implementing pipeline extensions if necessary • Implementing a multi- tenant application. See Multitenant Applications [page 1248]. • Deploy multitenant ap- plication to provider subaccount in global ac- count for development • Subscribe to multiten- ant application from consumer subaccount in global account for devel- opment • Deploy multitenant ap- plication to provider subaccount in global ac- count for production |
| User   | Role      | Description                                                                                                                                                                                                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
|--------|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|        | Developer | Developer users use ABAP Development Tools (ADT) to create backend service artifacts and UI develop- ers create and deploy SAP Fiori apps in SAP Business Application Studio. See What is SAP Business Application Studio. | Tasks/Usage • Developing backend services in ABAP Devel- opment Tools (ADT) us- ing ABAP RESTful Ap- plication Programming Model. See Eclipse Tool for the ABAP Environ- ment and ABAP REST- ful Application Program- ming Model [page 751]. • Developing SAP Fiori based UI in SAP Business Application Studio and deploying back to ABAP system. See Develop an SAP Fiori Application UI and Deploy it to ABAP Using SAP Business Applica- tion Studio [page 1750]. • Supporting and trouble- shooting customer is- sues via provider sup- port access in the Land- scape Portal. See Land- scape Portal. • Creates software com- |
| User   | Role                                             | Description                                                                                                                                                                                                                                                                                                                    | Tasks/Usage                                                                                                                                                                                                                                                                                                                                           |
|--------|--------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|        | Quality Manager                                  | Evaluates requested ATC ex- emptions in ABAP develop- ment tools for Eclipse.                                                                                                                                                                                                                                                  | • Approving or rejecting ATC exemptions                                                                                                                                                                                                                                                                                                               |
|        | Test User                                        | Test users are business users in test systems TST and QAS that validate the correct im- plementation of the add-on. This involves, among others, maintaining business roles and communication arrange- ments delivered as part of the add-on.                                                                                  | • Maintaining business roles. See Maintain Busi- ness Roles. • Creating spaces and pa- ges for business roles. See How to Create and Assign Spaces and Pa- ges. • Maintaining communi- cation arrangements. See Communication Ar- rangements. • Creating business con- figuration • Creating key user exten- sibility • Testing ABAP backend services |
|        | Provider Identity Authentica- tion Administrator | An Identity Authentication service tenant can be con- figured for authentication in development/test/assem- bly systems. The Identity Authentication administrator configures the trust setup between the subaccount and Identity Authentication appli- cation. See SAP Cloud Iden- tity Services - Identity Au- thentication. | • Configuring Identity Au- thentication application for trust setup in devel- opment/test/assembly subaccounts. See Cre- ate New Application. • Configuring corporate identity provider in Iden- tity Authentication ten- ant. See Corporate Iden- tity Providers.                                                                                    |
| User   | Role     | Description                                                                                                                                                     |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
|--------|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|        | Operator | The SaaS solution operator is responsible for creating the account model on the provider side (creating con- sumer subaccounts), adding subaccount members etc. | Tasks/Usage • Setting up global ac- counts for development and production includ- ing entitlements, sub- accounts, Cloud Foun- dry org, spaces, serv- ices, and apps, as well as trust configuration and connectivity per subaccount. See Sys- tem Landscape/Account Model [page 1192]. • Consumer tenant on- boarding: creating con- sumer subaccount and subscription. See Sub- scribe to Multitenant Applications Using the Cockpit . • Creating users in ABAP systems. See Creation of Additional Adminis- trator Users. • Developer users in DEV/COR systems. See Creation of De- veloper Users. • Tester users in TST/ |
|        |          |                                                                                                                                                                 | QAS systems • Add-on update of exist- ing systems in the Up- date Product Version app. See Deploy Prod- uct. • Monitoring of sys- tem/tenant provisioning and user onboarding. See Operations Dash- board. •  Note If you use gCTS for delivery to cus- tomer production systems instead of                                                                                                                                                                                                                                                                                                                                 |
| User   | Role                  | Description                                                                                                                                                                                                                | Tasks/Usage                                                                                                                                                                                                                                                                                                                                                                                               |
|--------|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|        |                       |                                                                                                                                                                                                                            | are responsible for cloning software components and pulling the latest changes into the system using the Manage Software Components app. See Delivery via Add-On or gCTS [page 1214].                                                                                                                                                                                                                     |
|        | Jenkins Administrator | A Jenkins CI/CD server is used as the infrastructure for automation purposes. Pipe- line configuration, user man- agement, credentials man- agement etc. is handled by the Jenkins administrator. See Operations Dashboard | • Creating Jenkins in- stance • Maintaining Jenkins cre- dentials for: • Cloud Foundry technical platform user • Technical commu- nication user • Credentials of serv- ice user for git re- pository of pipeline configuration • Maintaining Jenkins pipeline with reference to git repository of pipe- line configuration • Adding additional Jen- kins users, for example for add-on administrator user |
| User                        | Role                                  | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | Tasks/Usage                                                                                                                                                                                                                                                                                                      |
|-----------------------------|---------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                             | S-User                                | S-users are used by part- ners and customers to log on to SAP ONESupport Launchpad to reserve de- velopment namespaces or to create technical commu- nication users. User man- agement is taken care of by user administrators in the User Management app. If customer numbers are assigned to a Partner ID, S-users are registered via PartnerEdge. See User Man- agement and SAP note 2261006 .                                                                                                                             | • Reserving development namespace in Name- space Application See https:/ /launchpad.sup- port.sap.com/#/name- spaces . • Activating new name- spaces in already exist- ing systems using Land- scape Portal. See Main- tain Namespaces. • Creating technical com- munication user. See SAP note 2532813 . • test |
| Technical Users of Provider | Technical Cloud Foundry Platform User | A platform user is added as a member to subaccounts in the Cloud Foundry envi- ronment to create or delete ABAP service instances, cre- ate service keys etc. This user should be a non-per- sonalized user, for example based on a distribution list. The user does not need au- thorizations in SAP ONESup- port Launchpad. The user does not need authorizations in SAP ONESupport Launch- pad. Platform users are cre- ated by default in SAP ID Service. See User and Mem- ber Management and Default Identity Provider. | • Creating ABAP system AMTvia ABAP solution service for consumer tenants. See Define Your ABAP Solution. • Creating ABAP system BLD via add-on build pipeline for add-on as- sembly • Creating ABAP system ATI via add-on build pipeline for add-on in- stallation test • Deleting ABAP systems                  |
|                             | Service User Git                      | Jenkins pipeline definitions are source-code-based and stored in a source code re- pository, usually a Git repo- sitory. To retrieve the pipe- line definition from the repo- sitory, a (technical) service user is configured.                                                                                                                                                                                                                                                                                               | • Pulling changes in git re- pository of pipeline con- figuration • Pulling changes in SAP/ Jenkins library to project "Piper" library steps                                                                                                                                                                     |
| User     | Role                                             | Description                                                                                                                                                                                                                                                                                                                                                                | Tasks/Usage                                                                                                                                                                            |
|----------|--------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|          | Technical Communication User                     | A technical communication user (created viaSAPONE Support Launchpad) is used for system-to-system con- nections with the SAP Sup- port backbone. For informa- tion on how technical com- munication users are differ- ent from S-users, see SAP note 2668288 .                                                                                                             | Used for communication with the AAKaaS. See Add-on Assembly Kit as a Service (=AAKaaS) .                                                                                               |
| Consumer | Consumer Identity Authenti- cation Administrator | An Identity Authentication Service tenant can be con- figured for authentication at consumer tenants in the productive ABAP systems. The Identity Authentication admin configures the trust setup between consumer subaccount and Identity Au- thentication application. See Identity Authentication Serv- ice.                                                            | • Configuring Identity Au- thentication application for trust setup in con- sumer subaccount • Optional: Configuring corporate identity pro- vider in Identity Authen- tication tenant |
|          | Consumer Subaccount Ad- ministrator              | The consumer subaccount administrator is responsible for the configuration of: • Trust settings (custom identity provider), see Trust and Federation with Identity Providers. • Connectivity via Cloud Connector, see Connec- tivity in the Cloud Foun- dry Environment • Destinations, see Man- aging Destinations in the consumer subaccount created for the cus- tomer. | • Setting up connectivity via Cloud Connector • Adding destinations in consumer subaccount • Setting up trust configu- ration                                                          |
| User   | Role                            | Description                                                                                                                                                                                                                                                                                                   | Tasks/Usage                                                                                                                                                                                                                                                                                                                                  |
|--------|---------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|        | Business User                   | Business users make use of the SaaS solution in the con- sumer tenant for their daily work.                                                                                                                                                                                                                   | • Initial administrator on- boarding • Creating additional busi- ness users • Creating business roles • Creating spaces and pa- ges for business roles. See How to Create and Assign Spaces and Pa- ges. • Creating communication arrangements • Creating business con- figuration • Creating key user exten- sibility • Using SAP Fiori UIs |
|        | Cloud Connector Administra- tor | To connect on-premise sys- tems on the customer side to the consumer tenant with the SaaS solution, Cloud Connector can be configured in the consumer subaccount. The Cloud Connector admin- istrator maintains the con- sumer subaccount, cloud- to-on-premise system map- pings etc. See Cloud Connec- tor. | • Adding a consumer sub- account to Cloud Con- nector. See Managing Subaccounts. • Configuring cloud to on- premise system map- pings. See Configure Ac- cess Control. • Synchronizing trust con- figuration for principal propagation. See Set Up Trust for Principal Prop- agation.                                                        |