## 13.3.4.3.4  Employee Self-Service
## About This Document
This chapter provides an overview of the security-relevant information that applies to Employee Self-Service (CA-ESS).
The following deployment options are available for Employee Self-Service (ESS):
- Business Package for Employee Self-Service (up to and including 1.50) This Business Package is a 'classic' SAP Business Package that runs in the SAP Enterprise Portal. The
Portal role consists of worksets and iViews based on Web Dynpro ABAP technologies.
- Business Package for Employee Self-Service (WDA)
This Business Package also runs in the SAP Enterprise Portal but it has only one workset with one iView that launches the role structure with the applications maintained in the back-end system. In this business package, all applications are based on Web Dynpro ABAP technology.
- Employee Self-Service in SAP Business Client for HTML
The role structure of this deployment option is maintained in the back-end system with the SAP role maintenance transaction PFCG . All applications available with this role are based on Web Dynpro ABAP technology.
##  Note
Some parts of the security information in this chapter only apply to individual ESS deployment options. In this case, you will find a comment explaining for which deployment option this information is valid right at the beginning of each section. If not stated otherwise, the security information in this chapter applies to all ESS deployment options.
## See also:
- For more information about the roles in SAP Business Client, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Roles in SAP Business Client into the search bar, press Enter , and open the search result with that title.
- For more information about SAP Business Client, go to https:/ /help.sap.com/s4hana\_op\_2021, enter SAP Business Client into the search bar, press Enter , and open the search result with that title.
## Overview of the Main Sections of This Chapter
This chapter comprises the following sections with security-related topics specific to Employee Self-Service:
- Before You Start
This section comprises references to other Security Guides that are relevant for Employee Self-Service and a list of the most important notes for Employee Self-Service regarding security.
- User Administration and Authentication
This section provides an overview of the following user administration and authentication aspects for Employee Self-Service:
## · User Management
This section contains information about the user types that are required by Employee Self-Service and standard users for Employee Self-Service.
- Integration into Single Sign-On Environments
This topic describes how the Employee Self-Service supports Single Sign-On mechanisms.
## · Authorizations
This section provides an overview of the authorization concept that applies to Employee Self-Service.
- Session Security Protection
This section provides information on activating secure session management.
- Network and Communication Security
This section provides an overview of the communication paths used by Employee Self-Service and the security mechanisms that apply. It also includes our recommendations for the network topology to restrict access at the network level:
- Communication Channel Security
- Network Security
- Communication Destinations
- Internet Communication Framework Security
This section provides an overview of the Internet Communication Framework (ICF) services that are used by Employee Self-Service.
- Security-Relevant Logging and Tracing
This section provides an overview of the logging and tracing mechanisms that apply to Employee SelfService.