orkungedik/SAP-basis-dataset huggingface dataset:
## 4.2.11.2.4.4.1.5  Modeling a Protection Against Unauthorized Write Activities
To protect your service from activities such as create, update or delete by unauthorized business users, you can use the authorization controls that are available for services based on managed business objects.
## Context
In the example used here, the service is based on a managed business object Bonus Calculation . The use of a managed business object allows you to benefit from the global and instance-based authorizations for managed business objects, which are part of the ABAP RESTful Application Programming model. For more information about authorization control, see the documentation for the ABAP RESTful Application Programming Model.
## Procedure
1. In ABAP development tools, call up the behavior definition of your service.
2. In the behavior definition, define authorization controls for your service.
In the bonus calculation example, they can look as follows:
```
 Sample Code managed; define own authorization context { 'ZBNSCLC_AO'; } define behavior for z_i_bonus_calculation alias calculation
```
```
implementation in class zbp_bonus_calculation unique persistent table zbonusclc lock master // Identity and Access Management: // Enable RAP managed authorization check at create, update, and delete // -> requires implementation of two methods, one with the addition "FOR INSTANCE AUTHORIZATION" //  and one with the addition "FOR GLOBAL AUTHORIZATION" authorization master ( instance, global )
```
With the line authorization master ( instance, global ) , an authorization check for the standard operations create , update , and delete and for non-standard operations, for example, calculate bonus , is defined. Y ou must implement the authorization check using methods with addition FOR GLOBAL AUTHORIZATION (for create ) and FOR INSTANCE AUTHORIZATION (for update , delete ) in the behavior implementation.
The sample code also contains the definition of your own authorization context. The own authorization context documents all authorization objects that are used by the business object implementation. In the bonus calculation example used in this documentation, this is the authorization object ZBNSCLC\_AO because it's checked in the RAP authorization control and the CDS access control. The own authorization context can also be used to prefill authorization defaults.
## 4.2.11.2.4.4.2  Developing Authorizations (Developer)
After you've protected your service against unauthorized use, you create the objects that are needed for granting authorizations to business users to use your service.
For granting authorizations, follow the steps for restriction fields and types and for creating an IAM app, a business catalog, and a business role template. You should define your own authorization context in the behavior definition first, which can be used to prefill authorization defaults.
## 4.2.11.2.4.4.2.1  Editing Authorization Default Values
Authorization default values are automatically created when you create a service binding. You can add authorization objects and change the authorization default values.
## Context
The authorization default values are the authorizations that are assigned to business users by default if they have a business role based on the service. Note, however, that the authorization default values can be overwritten by values set in the IAM app or by restrictions in the business role. Therefore, if you want to avoid double maintenance, try and define the authorization default values in such a way that they can be used by all derived IAM apps.
For more information about authorization default values, see the user guide for ABAP development tools (ADT).
## Procedure
1. Open the service binding and choose the Maintain Authorization Default Values link.
2. Choose Synchronize to add the latest authorization objects from the own context.
##  Note
The Synchronize function only adds authorization objects that are not yet part of the list of authorization objects; it does not remove objects.
3. To check or change the authorization default values that are assigned automatically, select the authorization objects in the list.
An authorization object that is used in the read-protecting access control automatically gets the settings Default with Field Values and the required activity value for Display . Other authorization objects get Default Without Field Values .
4. For the bonus calculation, you can now specify what you want to authorize, which are, in the example used here, the standard activities Create , Change , and Delete as well as the business object-specific activity Calculate .
## Results
Now, the standard authorizations for the service are defined and will be applied to an IAM app based on the service. You still can change them later in the IAM app itself or delegate the value definition to the administrator during business role maintenance (only if restrictions are used).
## Related Information
Defining an IAM App for the Business Service [page 898] Creating Restriction Fields Based on Authorization Fields [page 914]
## 4.2.11.2.4.4.2.2  Defining an IAM App for the Business Service
To assign a business user to a business role for your service, you need to create an IAM app, which can then be included into a business catalog, which, in turn, can be assigned to a business role.
## Context
Since you want to make your service available to users with a certain business role, you need to define an IAM app for the service that you created in ADT. The IAM app is only relevant for identity and access management (IAM), and you create the IAM app in ADT. You can use an IAM app to define authorizations for one or more business services.
Instead of creating a new IAM app, you can also use an existing IAM app for the service.
For more information, see the information about IAM apps in the user guide for ABAP development tools (ADT).
## Procedure
To create an IAM app, follow the instructions in the user guide for ABAP development tools.
For the bonus calculation IAM app used as an example here, you have already specified before in the authorization default values what you want to authorize. If needed, you can overwrite these defaults again here.
<!-- image -->
##  Note
In this example scenario, we assume that you create only one IAM app for access using all permitted activities and their access categories (write, read, value help). Be aware at this point that in the business role Fiori app, the administrator can later separate authorizations depending on the access categories
(write, read, or value help). Therefore, there's no need to develop different types of access if you just want to separate write, read, and value help.
However, it's different if you want to have different business roles for activities within one access category, for example, one for the create and update activities and another for the delete activity, which are all write activities. In this case, you must start here to separate authorizations: Create separate IAM apps, one for each write activities group that should be separated, go on with separate business catalogs, and finally enable the administrator to create separate business roles based on the business catalogs.
## 4.2.11.2.4.4.2.3  Creating Restriction Fields Based on Authorization Fields
For each authorization field that you want to expose and consider in a business role, you must create a corresponding restriction field and assign it to a restriction type.
## Context
In the example used here, create a restriction field for the bonus variant field.
## Procedure
For the procedure, see the ABAP development user guide: Defining Restriction Fields.
## 4.2.11.2.4.4.2.4  Creating Restriction Types
Create a restriction type containing a restriction field and authorization object.
## Context
Restriction types bundle restriction fields. In the example used here, there's one restriction type for the bonus calculation.
## Procedure
For the procedure, see the ABAP development user guide: Defining Restriction Types.
## 4.2.11.2.4.4.2.5  Creating a Business Catalog with Restriction Types
Create a business catalog and add the restriction types to it.
## Context
In the business catalog, you can bundle multiple IAM apps and their predefined authorizations. You assign a business catalog to a business role. If you have more than one business catalog for the same business role, you might also consider creating a business role template.
In the business catalog, you can also define for which fields and access categories an administrator can maintain restriction values during business role maintenance.
Instead of creating a new business catalog, you can also reuse an existing business catalog for the app.
## Procedure
1. Create a business catalog and assign the IAM app to it.
For more information about creating business catalogs, see Creating a Business Catalog in the ABAP development user guide.
2. On the Restriction Type tab, enter the restriction type that you created.
In our example, add the restriction type Bonus Calculation .
3. For each field, choose the appropriate checkboxes for write access, read access, and value help (F4).
##  Note
Even if you defined fewer values for the authorization field on which the restriction field is based in the IAM app (for example, one bonus variant only),the checkboxes here enable the administrator to allow all bonus variants again during business role maintenance.
4. Save the business catalog and publish it locally.
## 4.2.11.2.4.4.2.6  Creating a Business Role Template (Optional)
In addition to a business catalog, you can also create a business role template with ABAP Development Tools (ADT). Creating a business role template is optional, but it can ease the business role creation for the administrator.
## Context
Creating a business role template especially makes sense if you have more than one business catalog to assign to a business role.
## Procedure
1. Create a business role template as described in Creating a Business Role Template.
2. After the business role template has been created, add the business catalog to it.
3. Choose Publish Locally to make the business role template available for use in the development system.
## 4.2.11.2.4.4.3  Granting Authorizations to Business Users (Administrator)
As an administrator, create business roles to grant authorizations to business users.
After a business catalog and optionally a business role template have been created by the developer, administrators take over. They grant authorizations to business users by creating and assigning business roles. The business role needs to contain the business catalog created by the developer to get all the predefined authorizations needed for the business service. If a business role template is available, the administrator can also use the business role template to create a new business role.
## 4.2.11.2.4.4.3.1  Creating a Business Role with Restrictions and Assigning It to Users
You can create a new business role where you can benefit from the predefined values and restrictions that were defined before.
## Context
The default is always no write access and unrestricted read access. You can have dedicated business roles that use these default settings. In the bonus calculation example, you can create multiple roles for changing only bonus calculation instances of a bonus variant.
For more information about maintaining restrictions, see How to Maintain Restrictions.
Perform this task in every system. Alternatively, you can also create a business role once, download it, and upload it to other systems.
## Procedure
1. Create a business role from scratch or from a business role template, add the business catalog with the restrictions that the developer has created for the service.
2. Choose Maintain Restrictions .
3. On the Write, Read, Value Help tab page, choose Restricted .
The available restriction types and their fields are now shown, which is, in our example, the bonus calculation and its bonus variant.
4. Choose the edit button next to the restriction type.
In the following popup, the list of available values from the restriction field is shown.
5. Select the values for which you want to authorize the users.
In our example, the value would be one or multiple bonus variants that have been saved to the check table that the developer has assigned to the authorization field for the bonus variant (see Defining an Authorization Field [page 904]). As a result, business users with the business role assigned can create, update, and delete bonus calculations with the selected bonus variants only.
6. On the Read, Value Help tab page, choose Unrestricted .
This means that business users with this business role can still view all bonus calculations independently of their bonus variant, even if they can only change bonus calculations with a particular bonus variant.
7. On the Assigned Business Users tab, assign the business users to your new business role
These business users get the authorizations as defined in the business role.
8. Save the business role to activate it.
## 4.2.11.2.5  Providing Access to the SAP Fiori Application
Learn what developers and administrators need to do so that an SAP Fiori application appears in the SAP Fiori launchpad of an authorized business user.
## Overview
For business services created in ABAP Development Tools, developers can also create SAP Fiori application UIs. Let's assume that they created UIs using, for example, SAP Business Application Studio or Visual Studio Code and deployed them back to the ABAP environment. To ensure that business users have access to the SAP Fiori application in their SAP Fiori launchpad, developers and administrators need to perform a few steps.
When you deploy an SAP Fiori application to the ABAP environment, the following objects, among others, are created automatically:
- A business server page (BSP) application, which stores the code of the SAP Fiori application
- An SAP Fiori launchpad app descriptor item, which contains the tile and navigation target for the SAP Fiori launchpad integration
- The SAP Fiori launchpad app descriptor item is created from the manifest.json file of the UI5 app, where the tile and navigation parameters are configured.
You can find the BSP application and the SAP Fiori launchpad app descriptor item as objects in your deployment package in ABAP Development Tools.
After an SAP Fiori application has been deployed, it can't be immediately consumed in the SAP Fiori launchpad. You have already created an IAM app and added the business service for which you've created your UI to the IAM app. You must now also assign the automatically created SAP Fiori launchpad app descriptor item to this IAM app.
As an administrator, you must create and enable an SAP Fiori launchpad space and page for business users.
<!-- image -->
This guide outlines the steps that are needed after you've followed the procedures outlined in one of the scenarios Providing (Unrestricted) Access , Providing Access Based on Activities , or Providing Access Based on Field Values . For a general overview of all steps for developing an SAP Fiori application UI in the ABAP environment, see Develop an SAP Fiori Application UI and Deploy it to ABAP Using SAP Business Application Studio [page 1750].
## Tutorial
In addition to this documentation, the following tutorial is available:
Integrate List Report into ABAP Fiori Launchpad
## 4.2.11.2.5.1  Assign the SAP Fiori Application to the IAM App (Developer)
To ensure consistent authorizations for the business service and its UI, you need to assign the SAP Fiori launchpad app descriptor item and the business service to the same IAM app.
## Context
After an SAP Fiori application has been deployed, it can't be immediately consumed in the SAP Fiori launchpad. You have already created an IAM app and added your business service to it. You must now also assign the SAP Fiori launchpad app descriptor item, which was automatically created during deployment, to this IAM app.
You can find the SAP Fiori launchpad app descriptor item as an object in ABAP Development Tools in the package to which you deployed the SAP Fiori application.
## Procedure
1. In ABAP Development Tools, open your IAM app.
2. In the UI5 Application ID field, enter the technical name of the SAP Fiori launchpad app descriptor item or use the field value help.
3. Save and publish locally.
## Results
If you haven't already done so, assign the IAM app to an IAM business catalog, and publish the IAM business catalog in ABAP Development Tools. Publishing generates a corresponding SAP Fiori business catalog that is listed in the SAP Fiori launchpad app Business Catalogs .
## 4.2.11.2.5.2  Integrating the SAP Fiori Application into the SAP Fiori Launchpad (Administrator)
To ensure that an SAP Fiori application appears in the SAP Fiori launchpad of the business users, you, as an administrator, need to perform a few configuration steps.
## Prerequisites
You, as an administrator, have already created one or multiple business roles and assigned them to business users.
## Context
You must integrate the SAP Fiori app into the IAM structure of the SAP Fiori launchpad of SAP Business Technology Platform.
## Procedure
1. Create a space for the business role.
2. Add a page to this space and add the app tile to the page. For more information about how to proceed, see Create a New Space and Page for a Business Role in the
SAP Fiori launchpad documentation on SAP Help Portal.
## Results
You've now enhanced the business roles for the business service with authorizations for the UI. All users that have been assigned to the business roles before can now view the page and SAP Fiori application in their SAP Fiori launchpad.
##  Note
The SAP Fiori application only appears in the spaces mode for the user. The spaces mode was developed to offer more flexibility to influence the launchpad layout for specific user groups. The business role defines which users see a specific space. For more information, see Managing Launchpad Spaces and Pages on SAP Help Portal.
## 4.2.11.2.6  Providing Access to a Business Service for Communication Users
For a newly created business service, you must define how communication users can access it and which activities are allowed.
Instead of accessing a business service using a business user, it is also possible to access a business service using a communication user. Communication users are relevant in scenarios where you work with an API business service (inbound or outbound) from or into the ABAP environment.
For communication users, you must provide access to a newly created service because access isn't automatically available. However, on instance level, all activities are allowed as long as you don't protect your business service. Therefore, you must develop identity and access management artifacts.
The main difference to providing access to a business user is that, as a developer, you do not create an IAM app and a business catalog but a communication scenario. Authorizations are maintained in the communication scenario. Administrators cannot restrict the authorizations defined in the communication scenario later on when they create communication arrangements based on the communication scenario. Therefore, you as a developer decide which authorizations are granted for the communication user by the administrator.
## Overview of Development Options
You can provide access the following ways:
- Unrestricted access
- Access based on activties from an authorization object
## 4.2.11.2.6.1  Granting (Unrestricted) Access for Communication Users
In this scenario, you get information about how to grant unrestricted access for communication users with a few steps.
In this scenario, to provide access to the business service, you must create a communication scenario. Administrators then create a communication arrangement based on this communication scenario. Note that all objects that need to be created are highlighted in dark blue in the graphic.
<!-- image -->
This scenario requires only a few steps to grant authorizations, and it's the minimum that you must do to make your service available to communication users. However, with this scenario, you always grant unrestricted write and read access. If you want to fine-tune the authorizations in more detail, check the scenario Granting Access Based on Activities .
## 4.2.11.2.6.1.1  Creating a Communication Scenario for Unrestriced Access (Developer)
In ABAP Development Tools, you can define communication scenarios, which can be used to access business services using a technical communication user.
## Context
In ABAP Development Tools, you define a communication scenario and add the required services to the scenario. An administrator can then use this communication scenario and create a communication arrangement based on it. This communication arrangement is the basis for accessing the business service using a communication user. If you don't include an authorization object to the communication scenario, the communication user will have unrestricted access to the business service.
For more information, see the information about consuming services in the context of APIs in the user guide for ABAP development tools (ADT).
## Procedure
1. Choose the relevant package in the project explorer.
2. Right-click to open the context menu and choose New Other ABAP Repository Object to launch the creation wizard.
3. Choose Communication Management Communication Scenario and choose Next .
4. Enter a name and a description and choose Next .
5. Choose Finish to create a transport request.
6. On the Inbound or the Outbound tab, add your inbound or an outbound business service to the communication scenario.
7. If you want to test your communication scenario directly in the development system, publish it locally to make sure that the required services have been generated.
## 4.2.11.2.6.1.2  Creating a Communication Arrangement (Administrator)
To grant authorizations to a communication user, as admnistrator, you create a communication arrangement. In this example, the communication arrangement is based on the communication scenario created by the developer.
## Prerequisites
You have created a communication user that is used for data exchange with other systems. To create a communication user, you use the Maintain Communication Users app on the SAP Fiori launchpad (see also How to Create Communication Users).
You have created a communication system, which represents the communication partner within a communication. To create a communication system, you use the Maintain Communication Systems app (see also How to Create Communication Systems).
## Procedure
1. Open the SAP Fiori Launchpad.
2. Choose Communication Arrangements .
3. Create a new communication arrangement based on the communication scenario, using the communication user and system that you have already created.
For more information, see How to Create a Communication Arrangement.
## Results
The communication user in the communication arrangement gets the authorizations that have been defined as part of the communication scenario by the developer. In the example of unrestricted access, no authorization object or fields have been defined, so the communication user gets full access to the business service.
## 4.2.11.2.6.2  Granting Access Based on Activities for Communication Users
In this scenario, you grant access depending on what the communication user should be allowed to do, for example, read or write access.
This scenario is more complex than a simple unrestricted access grant because you also need to create an authorization object and implement authority checks in the behavior implementation.
<!-- image -->
In this documentation, you get a more detailed overview of how to implement a separate read and write access. You can achieve such a separation by creating an authorization object with the standard authorization field for activities, an authority check to protect the service, and a communication scenario with authorization fields and activities defined. The administrator can then create two communication arrangements for read and write access each, for example.
## 4.2.11.2.6.2.1  Protecting the Service (Developer)
With creating an authorization object for your service and with the implementation of a protection against unauthorized creation and change activities, you implement a basic protection of your service.
After this, you can implement how authorizations are granted to communication users.
## Related Information
Developing Authorizations for Communication Users (Developer) [page 929]
## 4.2.11.2.6.2.1.1  Defining Permitted Activities in an Authorization Object
To define the permitted activities for a service, create an authorization object with the standard authorization field Activity ( ACTVT ) for the permitted activities.
## Procedure
To define the permitted activities, follow the procedure for defining authorization objects in the user guide for ABAP development tools (ADT).
##  Note
In our example, in the newly created authorization object, under Authorization Fields , you only need the predefined Activity authorization field to define the permitted activities for the business users of your service. In our example, these activities would be 01 Add or Create , 02 Change , 03 Display , and 06 Delete for standard activities.In addition, you need 93 Calculate for the business object-specific activity Calculate Bonus . If you click on an empty row and choose ENTER , the list of available values is shown.
In theory, by using the syntax authorization: update on an operation in the entity's behavior definition, you could use the authorization check that is implemented for the update operation for the annotated operation. This is also referred to as 'authorization delegation'. However, for security reasons, we recommend that you carefully consider whether you want to use authorization delegation because in this case, a user who is allowed to update a business object is then also allowed to perform all other activities on the business object.
## Results
In the following, the newly created authorization object for the bonus calculation example is called ZBNSCLC\_AO .
## 4.2.11.2.6.2.1.2  Modeling a Protection Against Unauthorized Write Activities
To protect your service from activities such as create, update or delete by unauthorized users, you can use the authorization controls that are available for services based on managed business objects.
## Context
In the example used here, the service is based on a managed business object Bonus Calculation . The use of a managed business object allows you to benefit from the global authorization for managed business objects, which is part of the ABAP RESTful Application Programming model. For more information about authorization control, see the documentation for the ABAP RESTful Application Programming Model.
## Procedure
1. In ABAP development tools, call up the behavior definition of your service.
2. In the behavior definition, define authorization controls for your service.
In the bonus calculation example, they can be as follows:
```
 Sample Code managed; define own authorization context { 'ZBNSCLC_AO'; } define behavior for z_i_bonus_calculation alias calculation implementation in class zbp_bonus_calculation unique persistent table zbonusclc lock master // Identity and Access Management: // Enable RAP managed authorization check at create, update, and delete // -> requires implementation of two methods, one with the addition "FOR INSTANCE AUTHORIZATION" //  and one with the addition "FOR GLOBAL AUTHORIZATION" authorization master ( instance, global )
```
With the line authorization master ( global ) , an authorization check for the standard operations create , update , and delete and for non-standard operations, for example, calculate bonus , is
defined. You must implement the authorization check using a method with addition FOR GLOBAL AUTHORIZATION in the behavior implementation.
The sample code also contains the definition of your own authorization context. The own authorization context documents all authorization objects that are used by the business object implementation. In the bonus calculation example used in this documentation, this is the authorization object ZBNSCLC\_AO because it's checked in the authorization control. The own authorization context is also used to prefill authorization defaults.
## 4.2.11.2.6.2.1.3  Implementing a Protection Against Unauthorized Write Activities
To protect a service such as the example of bonus calculation against unauthorized bonus creations, updates, or deletions, enhance the behavior implementation of the service in ABAP development tools (ADT). The implementation is required by what has been defined in the behavior definition.
## Context
Among the methods of the behavior implementation, you add methods that check the authorizations for creation and for update and delete.
## Procedure
1. In the Source Code Library folder of your package, under Classes , choose the behavior implementation of your service.
2. In the PRIVATE SECTION in the handler class of the behavior implementation, define the methods for authorization checks for creation, update, and deletion.
<!-- image -->
In the bonus calculation example, these method definitions could be the following:
```
 Sample Code METHODS get_global_authorizations FOR GLOBAL AUTHORIZATION IMPORTING REQUEST requested_authorizations FOR calculation RESULT result.
```
3. Add a method implementation that checks the authorizations for creations, updates, and deletions.
##  Note
For more information about authorization control, see the documentation for the ABAP RESTful Application Programming Model.
In the bonus calculation example, this method could be the following:
## 
```
Sample Code METHOD get_global_authorizations. IF requested_authorizations-%create EQ if_abap_behv=>mk-on. *     check create authorization AUTHORITY-CHECK OBJECT 'ZBNSCLC_AO' ID 'ACTVT' FIELD '01'. result-%create = COND #( WHEN sy-subrc = 0 THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized ). ENDIF. IF requested_authorizations-%update EQ if_abap_behv=>mk-on. *     check update authorization AUTHORITY-CHECK OBJECT 'ZBNSCLC_AO' ID 'ACTVT' FIELD '02'. result-%update = COND #( WHEN sy-subrc = 0 THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized ). ENDIF. IF requested_authorizations-%delete EQ if_abap_behv=>mk-on. *     check delete authorization AUTHORITY-CHECK OBJECT 'ZBNSCLC_AO' ID 'ACTVT' FIELD '06'. result-%delete = COND #( WHEN sy-subrc = 0 THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized ). ENDIF. ENDMETHOD.
```
## Results
The implemented methods provide the desired protection from unauthorized uses:
- With the implementation of the method defined with the addition FOR GLOBAL AUTHORIZATION , an unauthorized business user gets an error message when trying to create a business object instance (in the example, a bonus calculation) or when trying to update or delete it via service call.
- Unauthorized business users can't use the Delete button in the list view on the service UI. In addition, the Edit and Delete buttons are hidden in the detail view on the service UI for a business object instance.
Now, the service is secured against unauthorized operations. As a next step, you must make sure that business users who need to use the service get the corresponding authorizations.
## 4.2.11.2.6.2.2  Developing Authorizations for Communication Users (Developer)
After you've protected your service against unauthorized use, you can now create the objects that are needed to grant authorizations for communication users: authorization default values and a communication scenario.
Follow the steps for editing authorization default values and for creating a communication scenario in ABAP Development Tools. You should define own authorization context in the behavior definition first, which can be used to prefill authorization defaults.
##  Note
For developing authorizations for business users, the procedure is different. For more information, see Developing Authorizations for Business Users (Developer) [page 896].
## 4.2.11.2.6.2.2.1  Editing Authorization Default Values
Authorization default values are automatically created when you create a service binding. You can add authorization objects and change the authorization default values.
## Context
The authorization default values are shown when you include an authorization object into a communication scenario. These values are assigned to communication user if you leave them unchanged. Note, however, you can overwrite the authorization default values by values set in the communication scenario.
For more information about authorization default values, see the user guide for ABAP development tools.
## Procedure
1. Open the service binding and choose the Maintain Authorization Default Values link.
2. Choose Synchronize to add the latest authorization objects from the own context.
##  Note
The Synchronize function only adds authorization objects that are not yet part of the list of authorization objects; it does not remove objects.
3. To check or change the authorization default values that are assigned automatically, select the authorization objects in the list.
You can now specify what activities you want to authorize.
4. Choose the authorization object from the list and choose Default With Field Values from the dropdown list.
In our example, we authorize for the standard activities Create , Display , Change , and Delete as well as the business object-specific activity Calculate .
## 4.2.11.2.6.2.2.2  Defining a Communication Scenario Including Authorization Values
In ABAP Development Tools, you can define communication scenarios, which can be used to access business services using a technical communication user.
## Context
In ABAP Development Tools, you define a communication scenario and add the required services to the scenario. As part of the communication scenario definition, you also define the relevant authorization fields and activities. An administrator can then use this communication scenario and create a communication arrangement based on it.
##  Note
Administrators can't change the authorization activities and values that you define as part of the communication scenario when they create their communication arrangements.
For more information, see the information about consuming services in the context of APIs in the user guide for ABAP development tools (ADT).
## Procedure
1. Choose the relevant package in the project explorer.
2. Right-click to open the context menu and choose New Other ABAP Repository Object to launch the creation wizard.
3. Choose Communication Management Communication Scenario and choose Next .
4. Enter a name and a description and choose Next .
5. Choose Finish to create a transport request.
6. On the Inbound or the Outbound tab, add your inbound or an outbound business service to the communication scenario.
7. On the Authorizations tab, add the authorization object that you created for the business service.
8. On the Authorizations tab, also add the relevant authorization fields and activities. For each authorization field, you can now enter the values that you allow for the communication user. Similarly, you can select which activities are allowed for the communication user.
For example, you could define that only bonus variant V0 can be created using the communication user, but you would allow all possible activities.
The communication user will be defined by the administrator as part of the communication arrangement that is based on this communication scenario.
9. If you want to test your communication scenario directly in the development system, publish it locally to make sure that the required services have been generated.
## 4.2.11.2.6.2.3  Creating a Communication Arrangement (Administrator)
To grant authorizations to a communication user, as admnistrator, you create a communication arrangement. In this example, the communication arrangement is based on the communication scenario created by the developer, including all authorization restrictions.
## Prerequisites
You have created a communication user that is used for data exchange with other systems. To create a communication user, you use the Maintain Communication Users app on the SAP Fiori launchpad (see also How to Create Communication Users).
You have created a communication system, which represents the communication partner within a communication. To create a communication system, you use the Maintain Communication Systems app (see also How to Create Communication Systems).
## Procedure
1. Open the SAP Fiori Launchpad.
2. Choose Communication Arrangements .
3. Create a new communication arrangement based on the communication scenario, using the communication user and system that you have already created.
For more information, see How to Create a Communication Arrangement.
## Results
The communication user in the communication arrangement gets the authorizations that have been defined as part of the communication scenario by the developer. If any authorizations based on authorization fields or activities have been defined or values set in the communication scenario, these also apply.
## 4.2.11.2.7  Providing Read or Write Access to a Business Service Using Privileged Mode
With enablement of privileged mode for a business object, it's possible to consume the business object without the need for additional business authorizations.
## Use Case for Business Users
A typical use case for privileged mode is the execution of an application job. In the bonus calculation example used in this documentation, such an application job could be required to schedule calculations of the target bonus amounts of valid bonus calculations that haven't been calculated yet. For this purpose, you can enable privileged access for the Bonus Calculation business object.
As a result, the business user for which the bonus calculation job is scheduled doesn't require all the authorizations that a typical business user of the business service would need. So, there's no need to define an IAM app, a business catalog, and a business role for the authorization to calculate the bonus.
## Use Case for Communication Users
During the execution of instance A of a business object X, write access might be needed to instance B of business object B. This is where privileged mode comes into play. Let's turn to a concrete example: You've created a custom business object for employees and a bonus business object. The employee business object has a performance indicator, such as Exceeds Expectations , Consistently Exceeds Expectations , and so on.
Now, when the bonus of the employee is calculated using the action Calculate Bonus , then the performance indicator of the employee is also updated at the same time, for example, using the action Update Performance Indicator . At this point, it makes sense to check whether the user (human or machine) has the authority to calculate the bonus. If so, then the system could also automatically update the performance indicator even if the user doesn't have a dedicated authority for it. What's more, the user might not even be allowed to display the information.
## 4.2.11.2.7.1  Modeling the Authorization Context for Privileged Mode
To enable privileged mode, you need another authorization context named NoCheckWhenPrivileged .
## Context
Let's assume that you want to enable privileged mode for the bonus calculation object that's used as an example in this documentation. First, you define an authorization context called NoCheckWhenPrivileged
in the behavior definition. This authorization context is needed in addition to the own authorization context of the business object that you've already defined in the behavior definition. Then, you enable privileged mode for the business object by disabling NoCheckWhenPrivileged using the clause with privileged mode disabling NoCheckWhenPrivileged . As a result, authorization objects in the context NoCheckWhenPrivileged aren't checked during privileged access.
## Procedure
In the behavior definition, add the following code, for example:
```
 Sample Code managed; define authorization context NoCheckWhenPrivileged { 'ZBNSCLC_AO'; } with privileged mode disabling NoCheckWhenPrivileged; define own authorization context { 'ZBNSCLC_AO'; } define behavior for z_i_bonus_calculation alias calculation implementation in class zbp_bonus_calculation unique persistent table zbonusclc lock master // Identity and Access Management: // Enable RAP managed authorization check at create, update, and delete // -> requires implementation of two methods, one with the addition "FOR INSTANCE AUTHORIZATION" //  and one with the addition "FOR GLOBAL AUTHORIZATION" authorization master ( instance, global )
```
## 4.2.11.2.7.2  Providing Read Access Using Privileged Mode
Use the keyword WITH PRIVILEGED ACCESS to provide read access using privileged mode.
## Context
For the bonus calculation job in the example used in this documentation, all valid bonus calculations with empty bonus amount are retrieved for calculation in the job. By using the keyword WITH PRIVILEGED ACCESS after the entity z\_i\_bonus\_calculation , the CDS access controls with checks for authorization objects defined in authorization context NoCheckWhenPrivileged are disabled. As a result, unfiltered access to the z\_i\_bonus\_calculation entity is possible.
## Procedure
In the example used in this documentation, you can use the following code for selecting bonus calculations:
```
 Sample Code SELECT * FROM z_i_bonus_calculation WITH PRIVILEGED ACCESS WHERE z_i_bonus_calculation~validityenddate >= @sy-datum AND z_i_bonus_calculation~bonusamount_v = 0 INTO TABLE @DATA(lt_bonus_calculation).
```
## 4.2.11.2.7.3  Providing Write Access Using Privileged Mode
Use the keyword PRIVILEGED to provide write access using privileged mode.
## Context
After open bonus calculations have been retrieved, the bonus calculation action calculatebonus is triggered in the Bonus Calculation business object with privileged access. By using the keyword PRIVILEGED after the behavior definition z\_i\_bonus\_calculation , you enable privileged mode. As a result, the bonus calculation is executed without further authorization checks in the RAP authorization control.
## Procedure
In the example used in this documentation, you can use the following code:
```
 Sample Code MODIFY ENTITIES OF z_i_bonus_calculation PRIVILEGED ENTITY calculation EXECUTE calculatebonus FROM CORRESPONDING  #( lt_bonus_calculation ) RESULT DATA(result) REPORTED DATA(reported) FAILED DATA(failed).
```
## 4.2.11.2.8  Troubleshooting
Learn more about apps and tools that help you identify and solve authorization issues.
## 4.2.11.2.8.1  Authorization Trace
There's an app for troubleshooting available: With the Display Authorization Trace app you can enable an authorization trace for a business user, which helps you to find out if the user's authorizations are insufficient.
## More Information
Display Authorization Trace
## 4.2.11.2.8.2  Debugging
You can use the ABAP Debugger in ABAP development tools to gain more insights about authorization checks. You can do so by activating a breakpoint next to the performed AUTHORITY-CHECK as well as by adjusting the breakpoint activation to be effective for the relevant developer user.
## More Information
For more information about the ABAP debugger, see the user guide for ABAP development tools (ADT).
## 4.2.12.1  Creating Business Configuration Apps with ABAP RESTful Application Programming Model and Custom Business Configurations App
As an ABAP Developer you can leverage the ABAP RESTful Application Programming Model (RAP) and the Custom Business Configurations (CUBCO) app to create a SAP Fiori UI to maintain customizing table data. You don't need to create your own Fiori app. Everything can be implemented with ABAP repository objects.
For more information, see this tutorial .
<!-- image -->
The development of a business configuration maintenance Fiori UI requires developers to perform the following fundamental activities:
## 1. Developing Business Object
Based on the customizing tables you define a data model and business object structure. Check the prerequisites of the business configuration maintenance object to see which kind of business object is supported. Using model-driven development approach, you develop actions, validations, and determinations for the entities of the business object to change, maintain and validate configuration entries.
You have the option to use the Generate ABAP Repository Objects Wizard [page 941] to generate all required development objects based on a customizng table. If required, you can then add further functions or enhance the generated business object structure.
For more information, see Developing a Ready-to-Run Business Object and Developing Business Logic.
## 2. Developing Business Service
Define the scope by exposing the entities of the business object in a service definition and bind the service to OData V4 UI protocol with a service binding. For more information on this, see Working with Business Services.
## 3. Developing Business Configuration Maintenance Object
Declare the service binding as relevant for business configuration by creating a Business Configuration Maintenance Object [page 938].
## 4. Custom Business Configurations App
Based on the Business configuration maintenance object, the custom business configurations app renders a Fiori Elements List Report Floorplan for the entities exposed by the service binding to maintain the configuration entries. For more information, see Custom Business Configurations App [page 2687].
## 4.2.12.1.1  Business Configuration Maintenance Object
## Purpose
A business configuration maintenance object declares a service binding as relevant for business configuration. It will be shown on the list of all maintainable business configurations in the Fiori app Custom Business Configurations App [page 2687]. The business configuration maintenance object can be maintained via API or ADT. For more information, see also Creating Business Configuration Apps with ABAP RESTful Application Programming Model and Custom Business Configurations App [page 936].
## Prerequisites
- The service binding must be of type OData V4 - UI and exposing CDS root entity with draft enabled behavior definition.
- The following two business object composition tree structures are supported:
- the height of the tree is less or equal than 2. Example: Root entity A has two child entities B and C. Entity C has one child entity D. D can't have further child entities
- the height of the tree is less equal than 3 and the option skip root entity list report is enabled. The root entity must be a singleton and have exactly one child entity. Example: Root entity S has one child entity A. Entity A has two child entities B and C. Entity C has one child entity D. D can't have further child entities.
- The data model must consist only of client-dependent tables.
## Provide Authorizations for a Business Configuration
To grant frontend users the rights to use a business configuration maintenance object, first create an Identity and Access Management (IAM) App and assign it to an IAM Business Catalog . Follow this user guide but make sure to select the IAM app type Business Configurations app. In the service tab of the IAM app, select OData V4 as service type and the service binding name of the business configuration maintenance object as service name. In the authorizations tab maintain the authorization object used by the RAP BO for authorization control.
Once you have created the IAM business catalog, assign the catalog to a business role on the Fiori launchpad by following this user guide. Finally, follow this user guide to assign the business role to business users to grant the rights to use your business configuration inside the Custom Business Configurations Fiori app.
## Related Information
Creating a Business Configuration Maintenance Object in ADT [page 941] Business Configuration Maintenance Object Cloud Platform API [page 939] Generating a Business Configuration Maintenance Object with the Generate ABAP Repository Objects Wizard [page 941]