## 13.7.5  Web UI Framework
## User Administration and Authentication
## Authentication When Using Search Modeling Workbench
The enterprise search modeling workbench (transaction ESH\_COCKPIT ) is an SAP GUI application. Users are authenticated when they log on to the system.
## Authentication When Using Atom Feed
When Atom Feed service is accessed, the standard user authentication is performed. This implies that the Atom reader used must support feeds requiring authentication.
Once the user is authenticated, the system sends the corresponding data back to the Atom reader under the following conditions:
- The user has the right to use the feed, as checked with the authorization object WCF\_FEED .
- The user is assigned to the business role for which the feed is requested.
- The authority checks allow the user to access the corresponding data. For more information, see the Authorizations section below.
An individual entry returned by the feed can contain a direct link to a business object on the WebClient UI. The user can click that link to open the standard application in the web browser. The security standards are the same as when the user accesses the WebClient UI in a web browser and navigates to the business object.
## Role Administration
## Authorization Concept Overview
In the application role concept, there is a dependency between business roles and PFCG roles. Each business role has a corresponding PFCG role containing only those authorization objects needed to fulfill the task defined in the business role. This section describes the parts involved in creating custom PFCG roles for business roles.
For more information about setting up authorizations for business roles, see Customizing for Service under UI Framework Business Roles Overview .
The figure below, along with the table that follows, illustrates dependencies between the following:
- PFCG role menu and the business role
- User and the PFCG role
<!-- image -->
## Role Dependencies
## Description
## Component
| User                      | Users are maintained under User Maintenance (transaction SU01 ). Authorizations are provided using PFCG profiles and roles assigned to the users.                                                                                                                                                                                                                                         |
|---------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Organizational management | Users are indirectly assigned to business roles using organ- izational management. If a position in organizational man- agement is assigned to a business role using info type Business Role , then in turn, all users are assigned to this business role as well. For more information about other ways to assign business roles, see the Determination of Business Roles section below. |
| Navigation bar profile    | Used to define work centers or logical links. Provides com- monsettings used in business roles.                                                                                                                                                                                                                                                                                           |
| Component                   | Description                                                                                                                                                                                                                                                      |
|-----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Business role               | Uses and adopts the navigation bar profile to the needs of particular business functions. For example, work centers can be turned off. There is usually an assignment to one PFCG role.                                                                          |
| Report CRMD_UI_ROLE_ASSIGN  | Assigns PFCG roles to users based on user assignments in organizational management (positions in organizational management are assigned in turn to business roles).                                                                                              |
| PFCG role                   | Contains authorizations tailored to the business role. The authorizations are retrieved from SU22/SU24 traces (at SAP customers), based on the PFCG role menu.                                                                                                   |
|                             |  Caution Every user must be assigned to the PFCG role SAP_CRM_UIU_FRAMEWORK , in addition to the business role-specific PFCG role.                                                                                                                              |
| PFCG role menu              | This menu is imported from a file created by report CRMD_UI_ROLE_PREPARE in the PFCG transaction. Each role menu option is linked to an SU22/SU24 trace. The menu contains all traces and in turn all the authorizations needed to run a specific business role. |
| Report CRMD_UI_ROLE_PREPARE | The report creates the role menu file based on the settings in Customizing. This information represents the link between the business role settings and the SU24 traces.                                                                                         |
The figure below, along with the table that follows, illustrates dependencies between the following:
- PFCG role and the SU22/SU24 traces
- PFCG role and the WebClient-based application
<!-- image -->
## Dependencies
Description
## Component
| PFCG profile   | Contains authorization objects needed for a particular busi- ness role. The profile retrieves authorization objects from the SU22/ SU24 trace during profile creation. Only the traces con- nected to the PFCG role by the role menu are read.   |
|----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SU22 trace     | Authorization traces delivered by SAP. The WebClient UI uses the external trace type UIU_COMP .                                                                                                                                                  |
| SU24 trace     | Authorization traces maintained by the customer. These traces are copied from the SAP namespace ( SU22 ) using transaction SU25 .                                                                                                                |
| Component    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Applications | Available UI functions are controlled using business role Customizing. Authorizations are controlled by PFCG roles. SU22 (at SAP) and SU24 (at the customer) traces are writ- ten if they are activated when the application performs an authorization check. Activate or deactivate a trace under Profile Parameter Maintenance (transaction RZ11 ): auth/authorization_trace = Y: active auth/authorization_trace = N: inactive To optimize the coverage of the authorization check in the SU22 and SU24 traces, execute a larger number of functions |
## Determining Business Roles
To use the WebClient UI, the user needs to have a business role assigned to his or her user. Business roles are determined in the following order:
1. Check whether a single business role is assigned using the user parameter CRM\_UI\_PROFILE . This setting overrules any other role assignments.
2. Check whether there are business roles assigned using Organizational Management .
If none of the above cases are true, the system determines the PFCG roles assigned to the user and checks whether they are linked to a business role. If this is the case, this business role is used.
## Web-Based Business Role Customizing
For more information about customizing business roles using the WebClient UI, see the product assistance on the SAP Help Portal at https:/ /help.sap.com/s4hana under Enterprise Business Applications Service WebClient UI Framework Business Roles .
## Application Enhancement Tool
The application enhancement tool is defined in the Administration work center (work center link groups CT-ADM-SR ). Activating the Administration work center in any business role requires an update of the PFCG role.
The application enhancement tool provides the standard PFCG role SAP\_AXT\_EXTENSIBILITY\_ADMIN , which contains the entire needed authorization object from the SU22 trace.
To use the Application Reference field type, ensure that users accessing fields of that type have applicationspecific authorization objects. For more information about application-specific authorization objects, see the relevant application-specific section.
To use tags from the central data storage in calculated fields or the embedding mechanism, you need the authorization object TAG\_ATB .
To define calculated fields from the Application Enhancement Tool , no additional authorization is required. For support or administration of Business Rule Framework plus (BRFplus) formula, you need the SAP\_BC\_FDT\_ADMINISTRATOR role.
## Central Sharing Tool: Prevention of Unauthorized Access to Items by Recipients
The central sharing tool is a feature that allows users with special privileges to share their tags, favorite objects, saved searches, and reports with other users, business roles, an organizational unit, or a position in a business role.
Technical and authorization checks are run to prevent recipients from accessing items, such as saved searches, that they would not be otherwise allowed to access. A two-level approach is used:
1. When the object is shared, all technically possible checks are run to verify that the recipients have the authorization/option to view the shared items. If a problem is detected, sharing is not possible.
2. Before the items are displayed in the recipient's share box, all the remaining checks are run. If any authorization problems are detected, the corresponding item is not displayed.
The following table is a description of the checks that are run:
| Object       | Description                                                                                                                                                                                                                                                                                     | Sharing Time                                                                                                       | Recipient Display Time                                                                                                                                                         |
|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Saved Search | The user needs to navigate to the relevant search page or result page. Criteria are shared, not the result. It is not necessary to check each result entity. When the ac- tual search is executed, the results of the authorization checks dictate whether or not the BOL returns the en- tity. | Is the required Customizing for navigation available?                                                              | Is the required Customizing for navigation available?                                                                                                                          |
| Favorites    | The user needs to be able to dynamically navigate to the object overview page and to display the corresponding entity.                                                                                                                                                                          | Is the required Customiz- ing for navigation available? (Navigation to mixed list and to the object overview page) | Is the required Customiz- ing for navigation available? (Navigation to mixed list and to the object overview page) Can the current user access the corresponding BOL en- tity? |
| Tags         | The tag itself is shared, not the tagged object. It is not necessary to check each tag- ged entity. When the mixed list is called, the objects are filtered to display only those that the user is allowed to see.                                                                              | Is the required Customiz- ing for navigation available? (Navigation to mixed list)                                 | Is the required Customiz- ing for navigation available? (Navigation to mixed list)                                                                                             |
| Object   | Description                                                                                                                                                                                                                                                                                  | Sharing Time                                                                             | Recipient Display Time                                                                  |
|----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------|
| Reports  | If the Logical Link report is customized for a business role, the report can be dis- played by all users of that business role. There is only an authorization check on the content of the report. Dif- ferent users might see differ- ent data in the report based on their authorizations. | Is the required Customiz- ing for navigation available? (Navigation to the logical link) | Is the required Customizing for navigation available? Nav- igation to the logical link) |
The BOL implementation authorization check is used to check if the recipient has access to a BOL entity.
## Central Sharing Tool: Prevention of Unauthorized Access to Items by Sharers
The sharer can select the following as recipients:
- Organizational units
- Positions within an organizational unit
- Business roles
- Individual users
The following authorization objects are used to control access by the sharers to only those recipients to whom they were granted access.
| Audience Type                      | Authorization Object   | Field/Suggested Values               |
|------------------------------------|------------------------|--------------------------------------|
| Users                              | S_USER_GRP             | ACTVT/03 (Display)                   |
| Business role                      | S_TABU_DIS             | S_USER_GRP (Display) DICBERCLS/CRMC  |
| Organizational units and positions | PLOG                   | PPFCODE/DISP PLVAR/01 OTYPE/O, S, US |
## Standard Roles
| Role                  | Role Description                                                                                                                  |
|-----------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| SAP_CRM_UIU_FRAMEWORK | Special role that is assigned to every user. It contains the authorizations that are necessary to use the WebClient UI framework. |
## Authorizations
## Authorization Objects
The WebClient UI framework includes the following authorization objects:
| Used By                        | Authorization Object   | Description                                                                                                                                                                                                     |
|--------------------------------|------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| UI framework                   | UIU_COMP               | Restricts access to applications at the component level. Only au- thorized users can launch the WebClient UI.                                                                                                   |
| UI Customizing                 | CRM_CONFIG             | Restricts the authorization for UI configuration based on compo- nent name, BSP view name, UI object type, and role configuration key.                                                                          |
| Transaction launcher           | C_LL_TGT               | Controls authorizations of logical links of type C(launch transac- tion) and D(BI report).                                                                                                                      |
| Web service tool               | CRM_WST                | Controls access to the Web service tool.                                                                                                                                                                        |
| Rapid Application Tool         | S_CTS_ADMI             | Used to transport rapid applications                                                                                                                                                                            |
| Rapid Application Tool         | S_CTS_SADM             | Used to transport rapid applications                                                                                                                                                                            |
| Rapid Application Tool         | S_DEVELOP              | Used in the embedding tool to generate rapid applications.  Note Required for design time only.                                                                                                                |
| Rapid Application Tool         | S_ICF_ADM              | Used to generate UIs for rapid applications.                                                                                                                                                                    |
| Rapid Application Tool         | S_TABU_DIS             | Used in the embedding tool to restrict authorization for generation of table entries.                                                                                                                           |
| Rapid Application Tool         | S_TCODE                | Used within the generation framework to regenerate invalid load.                                                                                                                                                |
| Rapid Application Tool         | TAG_ATB                | Used to make use of the tag attribute.                                                                                                                                                                          |
| Rapid Application Tool         | S_TRANSPRT             | Used in the embedding tool to create new transport requests or new tasks.                                                                                                                                       |
| Web Service Consump- tion Tool | CRM_WSC                | Controls access to the Web Service Consumption Tool. For more information, see the SAP Library on the SAP Help Portal at http:/ / help.sap.com/crm under Basic Functions Web Services Web Service Consumption . |
| Web Service Consump- tion Tool | S_CTS_ADMI             | This authorization object is needed to transport the generated objects.                                                                                                                                         |
| Web Service Consump- tion Tool | S_CTS_SADM             | Used to transport the generated objects.                                                                                                                                                                        |
| Used By                         | Authorization Object   | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
|---------------------------------|------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                 | S_DATASET              | Used to access the locally saved WSDLfile.                                                                                                                                                                                                                                                                                                                                                                                                                                  |
|                                 | S_DEVELOP              | Used to generate the objects.  Note Required for design time only.                                                                                                                                                                                                                                                                                                                                                                                                         |
|                                 | S_TRANSPRT             | Used to create transport requests or tasks.                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Enterprise search integra- tion | S_DEVELOP              | Restricts access to the enterprise search modeling workbench  Note Required for design time only.                                                                                                                                                                                                                                                                                                                                                                          |
|                                 | S_ESH_ADM              | Restricts transfer of application models to enterprise search to authorized users                                                                                                                                                                                                                                                                                                                                                                                           |
|                                 | S_TABU_DIS             | Restricts client copy of application models to authorized users                                                                                                                                                                                                                                                                                                                                                                                                             |
|                                 | S_TRANSPRT             | Restricts maintenance of Customizing transports containing the application models to authorized users                                                                                                                                                                                                                                                                                                                                                                       |
| Atom feed                       | WCF_FEED               | Used to authorize or forbid the usage of the Atom feed feature in applications. The following authorization check is performed to verify the rights of the user to access the feed:                                                                                                                                                                                                                                                                                         |
|                                 |                        | AUTHORITY-CHECK OBJECT 'WCF_FEED' ID 'FEED_ID' FIELD iv_feed_id ID 'ACTVT' FIELD '03'.                                                                                                                                                                                                                                                                                                                                                                                      |
|                                 |                        |  Note In other words, the user needs display rights to access the feed with ID iv_feed_id . So far only the feed with ID DEFAULT is delivered, so the only value used for iv_feed_id variable is DEFAULT . In addition to this authorization check, when a given type of data is being retrieved, such as an alert, the authority checks performed are the same ones that are used when data is ac- cessed in the standard WebClient UI (for example, in worklist alerts). |
For more information, see the object documentation under Maintain the Authorization Objects (transaction SU21 ).
The main business-related authority checks are done by business objects within the business object layer (BOL) and by applications.
For more information about authority checks and working with authorization objects, see the ABAP platform Security Guide on the SAP Help Portal at http:/ /help.sap.com/s4hana .
## Protection of User Parameters
We recommend that you prevent users from adding new parameters or changing user parameters in the profile.
##  Note
If users have access to the WebClient UI, but not the SAP GUI, users should not be able to use the Maintain User Profile (transaction SU3 ) to change user parameters.
## Logon Service
The logon procedures are provided by the Internet communication framework of the ABAP platform under Maintain Services (transaction SICF ).
The logon procedure is configured in /default\_host/sap/bc/bsp/sap/crm\_ui\_start :
- Default form-based logon procedure (user/password)
- Function for changing passwords
If you want to change the default logon procedure, create your own alias of service / default\_host/sap/bc/bsp/sap/crm\_ui\_start and make the changes there. Do not change the SAP service/alias.
For more information about ICF services, search for Activating and Deactivating ICF Services on the SAP Help Portal at.SAP S/4HANA
For more information about ICF security, see the ICF and Session Security [page 21] section in this security guide.
## Data Storage Security
## Stored Data
| Data        | Storage Location   | Stored When       | Access Type                                                              |
|-------------|--------------------|-------------------|--------------------------------------------------------------------------|
| Customizing | AS ABAP database   | Post installation | Read/write/change/delete Only by users with Customiz- ing authorizations |
| Data             | Storage Location                                                                                            | Stored When                                                                                                 | Access Type                                                                                                 |
|------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|
| Application data | AS ABAP database                                                                                            | User logon/request                                                                                          | Read/write/change/delete                                                                                    |
| Atom feed        | No data is stored by application feeds.                                                                     | No data is stored by application feeds.                                                                     | No data is stored by application feeds.                                                                     |
|                  |  Note The feed reader can store user credentials. SAP does not have any control over third- party readers. |  Note The feed reader can store user credentials. SAP does not have any control over third- party readers. |  Note The feed reader can store user credentials. SAP does not have any control over third- party readers. |
The WebClient UI framework supports or requires a web browser as its user interface. The data is stored on the application server.
All data stored in the system is protected by the back end. Customizing data can be accessed only by users with Customizing authorizations. This data is accessed by the system administrator during system configuration. Application data is protected by authorization objects. Roles define the authorizations. Users assigned to a role inherit authorizations from that role.
## Tracing and Log Files
The following information is traced in the AS ABAP cache:
- Messages exchanged between a communication management software (CMS) and the application server
- Messages exchanged between ABAP sessions
By default, tracing is switched off. For more information on turning on the trace and changing the trace level, search for Administration of the Internet Communication Manager on the SAP Help Portal at SAP S/4HANA.
## Further Security-Related Information
## JavaScript
The WebClient UI framework uses JavaScript and AJAX to render the UI in the browser, and to handle user interactivity as well. Precautions have been taken against cross-site scripting (CSS) and other related types of attacks.
## Cookies
WebClient UI Framework does not use its own session or persistent cookies.
## Additional Information
For more information, see:
- ABAP Platform Security Guide on the SAP Help Portal at http:/ /help.sap.com/s4hana
- Application Server ABAP Security Guide on the SAP Help Portal at http:/ /help.sap.com/s4hana