orkungedik/SAP-basis-dataset huggingface dataset:
## 4.2.10.1.5.1  Deploy and Undeploy
## Context
Once training has successfully completed for a model, it can then be deployed or undeployed.
## Procedure
1. Launch the SAP Fiori launchpad .
2. Open the Intelligent Scenario Management app.
The Intelligent Scenarios Management app opens with all the available intelligent scenarios.
3. Click the intelligent scenario that you want to work with.
A list of all the available versions for the selected intelligent scenario are displayed in the Version section.
4. Click the version that you want.
A list of all the training for the selected version is displayed in the Training section.
5. Select the training that you want to deploy.
Ensure that the selected training is in the completed status.
6. Click Deploy .
7. Alternatively, you can click Deploy and Monitor .
With this option, you create deployment and navigate to the Deployment tab for monitoring purpose.
8. In the Configuration section, enter the following:
| Field          | Description                                                                                                |
|----------------|------------------------------------------------------------------------------------------------------------|
| Description    | Displays a short description for the deployment. You can either change the description for the deployment. |
| Parameter Name | Enter the parameter value.                                                                                 |
| Artifact Name  | Enter the artifact value.                                                                                  |
<!-- image -->
##  Note
The parameters and artifacts are derived from the Inference Pipeline in the remote machine learning provider. So, the parameter, artifact names, or the number of parameters and artifacts are displayed as configured in the remote machine learning provider.
## 9. Click Deploy .
To undeploy, click the Deployments tab. Select the deployment that you want to undeploy and click Undeploy . Before you undeploy, ensure that you deactivate deployment for your user, other users, and all users.
## 4.2.10.1.5.2  Activate and Deactivate
## Prerequisites
Before you begin:
- For activation, ensure that the deployment is in the deployed status.
- For deactivation, ensure that the deployment is in the active status.
## Context
You activate the deployment to consume the inference in your business application. You can activate deployment for your user and all users by selecting the For Me and For All options respectively. You can activate the deployment only for your user, test the inference in the Business Application, and then decide whether to activate the deployment for all user in the system. For each intelligent scenario, only one active deployment is supported for your user and all users. Once activated, the inference is returned on the active deployment.
Consider the following possible scenarios while activating a deployment:
- You can activate the deployment for your user or all users in the system.
- If you activate the deployment for your user, then the previous activation for your user is deactivated automatically.
- If you activated deployment for you and all users, then the active deployment for your users is considered for inference.
- If you activated deployment for you and all users, and you deactivate deployment for all users, then the deployment for your user is activated.
To activate or deactivate the deployment, follow these steps:
## Procedure
1. Launch the SAP Fiori launchpad .
2. Open the Intelligent Scenario Management app.
The Intelligent Scenarios Management app opens with all the published intelligent scenarios.
3. Click the intelligent scenario that you want to work with.
A list of all the available versions for the selected intelligent scenario is displayed in the Version section.
4. Click the version that you want.
5. Click the Deployments tab.
A list of all the Deployments for the selected version are displayed.
6. Select the deployment that you want to activate.
7. Select one of the following from the Activate drop-down list:
- For Me
- For All
Once activated, the status changes to Active . Now, this active deployment is used to return the inference result in your business application. You can also click the Active status icon to see the list of users for which the deployment is active. Additionally, check the User-Specific Activation Details section in the Deployment Report page to view the activation details.
The selected deployment is now activated. As a result, any previously activated deployment is deactivated.
For deactivating, select an active deployment that you no longer require and selects from the Deactivate drop-down list. You can either choose For Me or For All . Once the deployment is deactivated for your user and for all user, no inference result is returned.
##  Note
You can view the active deployment only in the relevant deployment list. Also, in the Active column, you can check whether the deployment is active for all users, your user, or other users.
## 4.2.10.1.5.3  Turnkey
## 4.2.10.1.5.3.1  Turnkey
The turnkey feature enables you to automate all end-to-end lifecycle operations of an intelligent scenario. Which means, once turnkey is enabled for an intelligent scenario, all the operations, such as pre-requisites check, train, deployment, and activation are run automatically. By automating these operations, turnkey feature significantly reduces manual effort during the initial activation of a scenario and throughout its lifecycle management. You can schedule turnkey and monitor the schedule in the Turnkey tab. Further details are about the schedule and runs are provided in the Turnkey Schedule and Turnkey Runs tabs.
You can select the intelligent scenario that supports the turnkey and switch it on. Once switched on, you can continue with the predefined schedule for turnkey. Else, modify the schedule details and create a new turnkey schedule as needed.
Before using the turnkey option, review the following conditions:
- Side-by-Side :
- Undeploys already deployed deployments. Another deployment may be deployed
- Deactivates already activated deployment. Another deployment may be activated.
- An admin can override the deployment and activation triggered by the turnkey.
## 4.2.10.1.5.3.1.1  Create a Turnkey Schedule
Create a turnkey schedule for an intelligent scenario with predefined schedule pattern.
## Prerequisites
- Intelligent scenario is not in an obsolete state.
- Intelligent scenario already supports turnkey automation feature.
## Context
Any intelligent scenario that supports turnkey automation has predefined recurrence schedules. You can either choose to create a schedule with the same details or modify the existing schedule to create a new turnkey schedule for the scenario.
## Procedure
1. Launch the SAP Fiori launchpad.
2. Open the Intelligent Scenario Management app.
The Intelligent Scenarios Management page opens with a list of published intelligent scenarios that are in Published , Deprecated , and Obsolete status.
##  Note
If the intelligent scenario is in a deprecated state, you can continue to schedule turnkey automation. However, it is strongly recommended to use the successor intelligent scenario as this scenario might be obsolete in future releases.
If the intelligent scenario is in an obsolete state, no further operations are allowed. However, you can use the successor intelligent scenario, if available.
3. Choose any model or version for which you want to create a turnkey schedule.
You can also use the search functionality to filter the intelligent scenario that you want to use and supports turnkey automation.
4. Choose the turnkey switch corresponding to the intelligent scenario from the Turnkey column.
##  Note
- This option is available for intelligent scenario that supports turnkey automation only.
- By default, the turnkey option is set to OFF . By choosing this switch, the turnkey option changes to ON status.
The Schedule Turnkey dialog box opens.
5. Review the following details:
6. Choose Create Turnkey Schedule .
| Name                            | Description                                                                     |
|---------------------------------|---------------------------------------------------------------------------------|
| Description                     | A short description about the schedule.                                         |
| Recurrence Pattern              | Predefined schedule patter for the selected intelligent sce- nario.             |
| Execute Turnkey Run Immediately | Choose whether you want to start the turnkey schedule immediately once created. |
Turnkey schedule is on.
## Next Steps
Depending on your requirement, you can either choose to modify, monitor the schedule progress or cancel the turnkey schedule.
- Modify a Turnkey Schedule [page 860]
- Additional Turnkey Actions [page 863]
- Turnkey Schedule Details [page 865]
## 4.2.10.1.5.3.1.3  Additional Turnkey Actions
## Context
In addition to creating and editing the turnkey schedule for an intelligent scenario, you can choose whether you want to cancel the running schedule or restart any failed turnkey schedule.
## Restart Turnkey Run
## Prerequisites
Ensure that the turnkey run is in Failed state.
## Context
After a turnkey operation is completed, it is possible that due to some error the turnkey run has failed. In such case, you can choose to restart the turnkey run.
## Procedure
1. Launch the SAP Fiori launchpad.
2. Open the Intelligent Scenario Management app.
3. Choose any model or version that you want.
4. Choose Turnkey Turnkey Runs tab.
5. Choose the Run ID for which you want to restart the turnkey run.
6. Choose Restart .
7. On prompt, choose Ok .
## Cancel Turnkey Run
## Prerequisites
Ensure that the turnkey run is in Running state.
## Context
You can cancel any turnkey run that is in progress.
##  Note
Once canceled, all subsequent operations are canceled, and you can no longer continue with that turnkey run.
## Procedure
1. Launch the SAP Fiori launchpad.
2. Open the Intelligent Scenario Management app.
3. Choose any model or version that you want.
4. Choose Turnkey Turnkey Runs tab.
5. Choose the Run ID for which you want to cancel the turnkey run.
6. Choose Cancel .
7. On prompt, choose Ok .
## Switch Off Turnkey
## Context
You can choose to switch off the turnkey. Only the user who switched on the turnkey for that intelligent scenario can switch it off. However, you can grant access to another user to switch off the turnkey for an intelligent scenario. To provide access, see Maintaining Authorizations.
## 4.2.10.1.5.3.1.5  Turnkey Run Details
| Name                   | Description                                                                                                                                                                                                       |
|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Status                 | Displays the turnkey run status, which can be: • Running - Turnkey run is in progress. • Success - Turnkey run completed. • Failed - Turnkey run failed due to errors. • Canceled - Turnkey run canceled by user. |
| Created At             | Displays start time of the turnkey run.                                                                                                                                                                           |
| Created By             | Displays the user ID of the scheduler.                                                                                                                                                                            |
| Changed By             | Displays the user ID who modified the turnkey run.                                                                                                                                                                |
| Duration               | Displays turnkey run duration.                                                                                                                                                                                    |
| Additional Information | Displays information about parent schedule in which the run is created.                                                                                                                                           |
| Turnkey Operations     |                                                                                                                                                                                                                   |
| Name                   | Description                                                                                                                                                                                                       |
| Type                   | Displays MLoperation type, which can be: • Prerequisite Checks • Train • Activate • Deactivate • Deploy (only for Side-by-Side) • Undeploy (only for Side-by-Side)                                                |
| Created At             | Displays start time of the operation.                                                                                                                                                                             |
| Message                | Displays any message that are logged. You can view by click- ing the i button for that operation.                                                                                                                 |
## 4.2.11.1  Identity Management
Identity management comprises setting up trust and providing credentials for business users.
<!-- image -->
When setting up your identity management architecture, the following uses cases are possible:
- Using the default identity provider SAP ID service, an instance of Identity Authentication service. It is used to set up trust for business users and supports identity federation, which enables user access across various systems by exchanging identity information based on a trust relationship. See Identity Federation [page 870].
- Establishing trust to a custom identity authentication service tenant. See Setup of a Custom Identity Service [page 206].
- Using a corporate identity provider in a hybrid landscape. In this case, we recommend using the Identity Authentication service as a proxy for the corporate identity provider. See Corporate Identity Providers. Note that there is no direct trust relationship between the authenticating identity provider and the service provider that the business user is trying to access.
## Related Information
Trust and Federation with Identity Providers SAP Cloud Identity Services - Identity Authentication
## 4.2.11.1.3  User Provisioning
User provisioning is the automated process of creating users, that are later granted permissions to access business services and applications, to allow system to system communication, or to perform troubleshooting.
##  Note
Please make sure that employee and business user data is maintained in accordance with the login\_attribute system provisioning parameter (see Creating ABAP System) and the subject name identifier configured in the Identity Authentication application (see Configure the Subject Name Identifier Sent to the Application): If login\_attribute = email is used, the email address at employee level needs to be maintained for identity federation to work, if login\_attribute = user\_name is configured, the username on business user level needs to match the login name provided in the identity authentication user.
## Creating SAP BTP ABAP environment Users
Each business user created in the ABAP environment system has a unique and stable employee ID. Employees are maintained in the SAP Fiori app Maintain Employees . See Maintain Employees [page 2727].
##  Recommendation
We recommend setting the employee ID by an HR system, which allows you to update master data in the Maintain Employees app, for example, when a business user has a new email address because of a name
change, or if you want to edit the user information of the initial admin of an ABAP environment service instance.
The following provisioning methods to automate identity lifecycle processes for business users are available:
- SAP Fiori app Maintain Employees with CSV file upload. See Maintain Employees [page 2727].
- SOAP service using communication scenario Identity Management Integration SAP\_COM\_0093 . See Inbound Service: Business User [page 959] and Inbound Service: Business User - Read [page 976].
- Identity Provisioning service using communication scenario SAP Cloud Identity Services - Identity Provisioning SAP\_COM\_0193 . See Identity Provisioning - SAP BTP ABAP Environment as a Target System.
##  Recommendation
To create new business users in the ABAP environment, we recommend using the Identity Provisioning service.
This requires setting up the Identity Authentication service as a source system for identity provisioning and managing employee information in the user store. The Identity Provisioning service can then read this information and map the Identity Authentication logon name to the ABAP environment employee ID. See Identity Authentication as a Source System and Tutorial: Provision Users into your SAP BTP ABAP Environment .
To create communication users , see How to Create Communication Users [page 2710].
SAP support users are owned and created by SAP. However, in the Display Technical Users SAP Fiori app, you can check when and why SAP support users accessed your customer system in the past 12 months. See SAP Support User Request Log [page 2796].
## Creating SAP BTP Users
To create platform users and space members , see User and Member Management and Creating New Space Members and Assigning Space Developer Roles to Them.
## Related Information
What Is Identity Provisioning?
## 4.2.11.2  Access Management
Access management comprises the process of implementing and providing authorizations for your services.
## Authorization Basics [page 875]
If you haven't worked with an ABAP system before, you might find this introduction to the basic authorization concepts useful before you proceed.
## Example: Authorizations for a Bonus Calculation Service [page 881]
Let's assume that you have a bonus calculation service, which, in the example used here, is represented by an active service binding. You want to model authorizations for this service.
## Developer-Centric View on System Behavior [page 882]
## Providing Access to a Business Service for Business Users [page 883]
For a newly created business service, you must define how business users can access it and which activities are allowed.
## Providing Access to the SAP Fiori Application [page 918]
Learn what developers and administrators need to do so that an SAP Fiori application appears in the SAP Fiori launchpad of an authorized business user.
## Providing Access to a Business Service for Communication Users [page 921]
For a newly created business service, you must define how communication users can access it and which activities are allowed.
## Providing Read or Write Access to a Business Service Using Privileged Mode [page 932]
With enablement of privileged mode for a business object, it's possible to consume the business object without the need for additional business authorizations.
## Troubleshooting [page 934]
Learn more about apps and tools that help you identify and solve authorization issues.
## 4.2.11.2.2  Example: Authorizations for a Bonus Calculation Service
Let's assume that you have a bonus calculation service, which, in the example used here, is represented by an active service binding. You want to model authorizations for this service.
## The Bonus Calculation Service
The bonus calculation service is part of a sales bonus program where the sales revenues that sales reps were able to generate are used as the basis for their bonus plan. In the ABAP RESTful Application Programming Model (RAP), the bonus plan is modeled as a business object Bonus Calculation of type managed.
With the bonus calculation service, users, for example, managers in sales, can create, update, display, and delete bonus calculations as standard operations. As part of a bonus calculation, users enter an employee name, a bonus variant and validity period can be set, and the bonus be calculated, which is a non-standard, business object-specific activity. In the example used in this guide, the available bonus variants are based on Rate or Amount , that is, the bonus recipient either gets a bonus based on a rate or a fixed amount.
The service can be consumed either by business users via a user interface (UI) or by technical communication users as a Web API. For both consumption types access has to be provided at least for nondevelopment systems because this access isn't automatically available in such systems.
## Consumption in a UI for Business Users
If the business service is consumed by a UI, the available UI enables business users easily, depending on their authorizations, to set data or to execute the actions the service is offering. For example, a UI for managers lets them perform activities on bonus calculations. The UI wraps the underlying service calls for the business users into intuitive UI elements. Changes that the business user isn't authorized for can either be made unavailable on the UI or their corresponding service call is done and an appropriate error returned from the service. The UI can act as a kind of authorization filter. This kind of service consumption always requires business user action.
## Consumption as API with a Communication User
If the business service is consumed as API, no UI wraps the allowed changes to the business service. Instead, the service caller can try to change all data and execute all actions directly and always gets errors if there are missing authorizations to do it.
In the example used here, the bonus calculation is an inbound business service that business users use to create new bonus calculations. There's no dedicated bonus calculation in the HR system, but instead, the HR business service calls the bonus calculation business service in the ABAP environment to set data and execute actions.
Where you work with an API business service (inbound or outbound) from or into the ABAP environment, you need to provide authorizations to technical users, so-called communication users, instead of business users. This service consumption can be performed automatically without any user action.
## 4.2.11.2.4.2  Providing (Unrestricted) Access for Business Users
In this scenario, you get information about how to provide unrestricted access with a few steps.
In this scenario, to provide access to the business service, you must create an IAM app and assign it to a business catalog. Administrators then create a business role that contains the business catalog and assigns the role to business users. Note that all objects that need to be created are highlighted in dark blue in the graphic.
<!-- image -->
This scenario requires only a few steps to provide authorizations, and it's the minimum that you must do to make your service available to business users. However, with this scenario, you always provide unrestricted write and read access. If you want to fine-tune the authorizations in more detail, check the scenarios Providing Access Based on Activities and Providing Access Based on Field Values .
## Related Information
Providing Access Based on Activities for Business Users [page 890] Providing Access Based on Field Values for Business Users [page 901]
## 4.2.11.2.4.2.1  Developing Authorizations for Business Users (Developer)
For providing unrestricted access to a business service for business users, as a developer, you first create an IAM app, a business catalog, and, optionally, a business role template.
## 4.2.11.2.4.2.1.1  Creating an IAM App for the Business Service
As a developer, you need to define an IAM app for the business service that you created in ABAP development tools (ADT). Creating an IAM app is the first step to be able to create a business role for your business service.
## Context
You create the IAM app in ADT. After the IAM app has been created, you can include the IAM app in a business catalog, which, in turn, can be included in a business role. This business role then can be used to control access to the app. For more information about IAM apps, see the user guide for ABAP development tools.
Instead of creating a new app, you can also use an existing IAM app for the service.
## Procedure
1. Follow the procedure in the user guide for ABAP development tools.
##  Note
In this scenario, there are no authorizations that you need to change on the Authorization tab page.
2. Save and publish the newly created IAM app locally.
## 4.2.11.2.4.2.1.2  Creating a Business Catalog
To be able to assign an IAM app to a business role, you first need to include the IAM app in a business catalog.
## Context
In a business catalog, you can bundle several IAM apps for which users should get authorized. You can assign a business catalog to a business role template.
In this simple scenario, no predefined, detailed authorizations are available for the IAM app, but you still need to create a business catalog. By including the IAM app in the business catalog, you simply create the prerequisites for allowing users a full access to your business service once they have the business role with the business catalog assigned.
Instead of creating a new business catalog, you can also reuse an existing business catalog.
##  Recommendation
We recommend that you add the information to the business catalog description that the IAM app belongs to an unprotected service, so that this important information is available to administrators.
## Procedure
To create a business catalog, follow the instructions in the user guide for ABAP development tools (ADT)..
Also follow the instructions to assign your IAM app to the business catalog.
## 4.2.11.2.4.2.1.3  Creating a Business Role Template (Optional)
In addition to a business catalog, you can also create a business role template with ABAP Development Tools (ADT). Creating a business role template is optional, but it can ease the business role creation for the administrator.
## Context
Creating a business role template especially makes sense if you have more than one business catalog to assign to a business role.
## Procedure
1. Create a business role template as described in Creating a Business Role Template.
2. After the business role template has been created, add the business catalog to it.
3. Choose Publish Locally to make the business role template available for use in the development system.
## 4.2.11.2.4.2.2  Creating a Business Role and Assigning Business Users (Administrator)
As an administrator, to be able to grant authorizations to business users, you need to create a business role that you then assign to the business users.
## Context
Perform this task in every system. Alternatively, you can also create a business role once, download it, and upload it to other systems. For more information, see How to Download and Upload Business Roles.
## Procedure
Follow the instructions of the documentation to create a business role from a template or from scratch (but omit the steps for maintaining instance-based restrictions and for managing launchpad space):
- How to Create a Business Role from Scratch
- How to Create a Business Role from a Template
##  Caution
Even if you leave the write restrictions to their default No Access , business users still have write access with this business role in this scenario. Users always have full access because you haven't implemented an authorization check in the service behavior.
We recommend that you set the restrictions in the business role to unrestricted write authorizations to make it transparent to other administrators that this business role provides users with full read and write access.
## Results
Users in the system have full read and write access to the service.
## 4.2.11.2.4.3  Providing Access Based on Activities for Business Users
In this scenario, you provide access depending on what the user should be allowed to do, for example, read or write access.
This scenario is more complex than a simple unrestricted access implementation because you must also create an authorization object and implement authority checks in the behavior implementation. However, you
benefit from the extra efforts because you can enable the administrator to create separate business roles for different activities, that is, based on the authorization field ACTVT ( Activity ) for create, read, update, and delete.
## Overview
<!-- image -->
In the following, you get a more detailed overview of how to implement a separate read and write access. You can achieve such a separation by creating an authorization object with the standard authorization field ACTVT ( Activities ), an authority check to protect the service, an IAM app, and a business catalog. The administrator can then create two business roles for read and for write access each. If you want to enable the administrator to create more fine-tuned business roles, for example, to differentiate between the activities of create and delete, you proceed in a similar fashion, but you need to create two IAM apps (see also Considerations for Implementing Access and Authorizations [page 885]).
## Process
To create access protection and provide authorizations, you perform the following steps:
## Protecting the Service from Unauthorized Use
As a developer, you perform the following steps in ABAP Development Tools (ADT):
1. Create an authorization object with standard authorization field Activity ( ACTVT ) and permitted values 01,02,03,06.
2. Implement authority checks in the behavior implementation of the service to allow create, update, and delete activities only to users who have the authorizations of the authorization object.
As a result, users cannot create, update, or delete the relevant business objects anymore, for example, bonus calculations.
## Developing Authorizations for the Service
As a developer, you perform the following steps in ADT:
1. Add the required authorization objects to the list of default authorization values.
2. Create an IAM app and assign the service binding to it. Under Authorizations , select all activities ( 01 Add or Create , 02 Change , 03 Display , 06 Delete ) to allow them for business users.
3. Create a business catalog and assign the IAM app to it.
4. Optional: Create a business role template and assign the catalog to it.
## Granting Authorizations to Business Users
As an administrator in the ABAP environment, you can now grant authorizations to business users for this service:
1. Create a business role. For business roles with write access, set unrestricted write authorization. For read-only business roles, keep the default, which is no access.
2. Assign the business role to the business users.
As a result, business users can view, create, update, or delete bonus calculations again, depending on their business roles.
## 4.2.11.2.4.3.1  Protecting the Service (Developer)
With creating an authorization object for your service and with the implementation of a protection against unauthorized creation and change activities, you implement a basic protection of your service.
After this, you can implement how authorizations are granted to business users.
## Related Information
Developing Authorizations for Business Users (Developer) [page 896]
## 4.2.11.2.4.3.1.1  Defining Permitted Activities in an Authorization Object
To define the permitted activities for a service, create an authorization object with the standard authorization field Activity ( ACTVT ) for the permitted activities.
## Procedure
To define the permitted activities, follow the procedure for defining authorization objects in the user guide for ABAP development tools (ADT).
##  Note
In our example, in the newly created authorization object, under Authorization Fields , you only need the predefined Activity authorization field to define the permitted activities for the business users of your service. In our example, these activities would be 01 Add or Create , 02 Change , 03 Display , and 06 Delete for standard activities.In addition, you need 93 Calculate for the business object-specific activity Calculate Bonus . If you click on an empty row and choose ENTER , the list of available values is shown.
In theory, by using the syntax authorization: update on an operation in the entity's behavior definition, you could use the authorization check that is implemented for the update operation for the annotated operation. This is also referred to as 'authorization delegation'. However, for security reasons, we recommend that you carefully consider whether you want to use authorization delegation because in this case, a user who is allowed to update a business object is then also allowed to perform all other activities on the business object.
## Results
In the following, the newly created authorization object for the bonus calculation example is called ZBNSCLC\_AO .
## 4.2.11.2.4.3.1.2  Modeling a Protection Against Unauthorized Write Activities
To protect your service from activities such as create, update or delete by unauthorized users, you can use the authorization controls that are available for services based on managed business objects.
## Context
In the example used here, the service is based on a managed business object Bonus Calculation . The use of a managed business object allows you to benefit from the global authorization for managed business objects,
which is part of the ABAP RESTful Application Programming model. For more information about authorization control, see the documentation for the ABAP RESTful Application Programming Model.
## Procedure
1. In ABAP development tools, call up the behavior definition of your service.
2. In the behavior definition, define authorization controls for your service.
In the bonus calculation example, they can be as follows:
```
 Sample Code managed; define own authorization context { 'ZBNSCLC_AO'; } define behavior for z_i_bonus_calculation alias calculation implementation in class zbp_bonus_calculation unique persistent table zbonusclc lock master // Identity and Access Management: // Enable RAP managed authorization check at create, update, and delete // -> requires implementation of two methods, one with the addition "FOR INSTANCE AUTHORIZATION" //  and one with the addition "FOR GLOBAL AUTHORIZATION" authorization master ( instance, global )
```
With the line authorization master ( global ) , an authorization check for the standard operations create , update , and delete and for non-standard operations, for example, calculate bonus , is defined. You must implement the authorization check using a method with addition FOR GLOBAL AUTHORIZATION in the behavior implementation.
The sample code also contains the definition of your own authorization context. The own authorization context documents all authorization objects that are used by the business object implementation. In the bonus calculation example used in this documentation, this is the authorization object ZBNSCLC\_AO because it's checked in the authorization control. The own authorization context is also used to prefill authorization defaults.
## 4.2.11.2.4.3.2  Developing Authorizations for Business Users (Developer)
After you've protected your service against unauthorized use, you can now create the objects that are needed to grant authorizations for business users: authorization default values, an IAM app, a business catalog, and a business role.
Follow the steps for editing authorization default values and for creating an IAM app, a business catalog, and a business role template. You should define own authorization context in the behavior definition first, which can be used to prefill authorization defaults.
##  Note
For developing authorizations for communication users, the procedure is different. For more information, see Developing Authorizations for Communication Users (Developer) [page 929].
## 4.2.11.2.4.3.2.1  Editing Authorization Default Values
Authorization default values are automatically created when you create a service binding. You can add authorization objects and change the default authorization values.
## Context
The authorization default values are the authorizations that are assigned to business users by default if they have a business role based on the service. Note, however, that the authorization default values can be overwritten by values set in the IAM app. Therefore, if you want to avoid double maintenance, try and define the authorization default values in such a way that they can be used by all derived IAM apps.
For more information about authorization default values, see the user guide for ABAP development tools.
## Procedure
1. Open the service binding and choose the Maintain Authorization Default Values link.
2. Choose Synchronize to add the latest authorization objects from the own context.
##  Note
The Synchronize function only adds authorization objects that are not yet part of the list of authorization objects; it does not remove objects.
3. To check or change the authorization default values that are assigned automatically, select the authorization objects in the list.
You can now specify what activities you want to authorize.
4. Choose the authorization object from the list and choose Default With Field Values from the dropdown list. In our example, we authorize for the standard activities Create , Display , Change , and Delete as well as the business object-specific activity Calculate .
## Results
Now, the standard authorizations for the service are defined and will be applied to an IAM app based on the service. You still can change them later in the IAM app itself.
## Related Information
Defining an IAM App for the Business Service [page 898]
## 4.2.11.2.4.3.2.2  Defining an IAM App for the Business Service
To assign a business user to a business role for your service, you need to create an IAM app, which can then be included into a business catalog, which, in turn, can be assigned to a business role.
## Context
Since you want to make your service available to users with a certain business role, you need to define an IAM app for the service that you created in ADT. The IAM app is only relevant for identity and access management (IAM), and you create the IAM app in ADT. You can use an IAM app to define authorizations for one or more business services.
Instead of creating a new IAM app, you can also use an existing IAM app for the service.
For more information, see the information about IAM apps in the user guide for ABAP development tools (ADT).
## Procedure
To create an IAM app, follow the instructions in the user guide for ABAP development tools.
For the bonus calculation IAM app used as an example here, you have already specified before in the authorization default values what you want to authorize. If needed, you can overwrite these defaults again here.
##  Note
In this example scenario, we assume that you create only one IAM app for access using all permitted activities and their access categories (write, read, value help). Be aware at this point that in the business role Fiori app, the administrator can later separate authorizations depending on the access categories (write, read, or value help). Therefore, there's no need to develop different types of access if you just want to separate write, read, and value help.
However, it's different if you want to have different business roles for activities within one access category, for example, one for the create and update activities and another for the delete activity, which are all write activities. In this case, you must start here to separate authorizations: Create separate IAM apps, one for each write activities group that should be separated, go on with separate business catalogs, and finally enable the administrator to create separate business roles based on the business catalogs.
## 4.2.11.2.4.3.2.3  Creating a Business Catalog
To make predefined authorizations for your business service available to administrators to use, create a business catalog.
## Context
In the business catalog, you can bundle multiple IAM apps and their predefined authorizations. You assign a business catalog to a business role. If you have more than one business catalog for the same business role, you might also consider creating a business role template.
Instead of creating a new business catalog, you can also reuse an existing business catalog for the app.
## Procedure
To create a business catalog, follow the instructions of the ABAP development user guide: Creating a Business Catalog.
Also follow the instructions to assign your IAM app to the business catalog.
## 4.2.11.2.4.3.2.4  Creating a Business Role Template (Optional)
In addition to a business catalog, you can also create a business role template with ABAP Development Tools (ADT). Creating a business role template is optional, but it can ease the business role creation for the administrator.
## Context
Creating a business role template especially makes sense if you have more than one business catalog to assign to a business role.
## Procedure
1. Create a business role template as described in Creating a Business Role Template.
2. After the business role template has been created, add the business catalog to it.
3. Choose Publish Locally to make the business role template available for use in the development system.
## 4.2.11.2.4.3.3  Creating a Business Role and Assigning Business Users (Administrator)
To be able to grant authorizations to business users, you need to create a business role that you then assign to the users.
## Context
You can create a business role from a business role template or from scratch.
Perform this task in every system. Alternatively, you can also create a business role once, download it, and upload it to other systems.
## Procedure
1. To create a business role, proceed as follows:
- To create a business role from scratch and assign business users, follow the instructions in How to Create a Business Role from Scratch.
- To create a business role from a business role template and assign business users, follow the instructions in How to Create a Business Role from a Template.
2. For roles with write access, set unrestricted write authorization. For read-only roles, leave the write restrictions as they are (the default is no access).
For more information about restrictions, see How to Maintain Restrictions.
## 4.2.11.2.4.4.1  Protecting the Service (Developer)
With creating authorization fields and an authorization object for your service and with the implementation of a protection against unauthorized read and creation, you can implement a protection of your service against unauthorized use on field level.
After this, you can implement authorizations on field level that can be granted to business users.
## 4.2.11.2.4.4.1.1  Creating a Check Table for Authorization Fields
Create a check table that you can provide to the administrator as value help during business role maintenance.
## Context
The advantage of having a check table is that the administrator has a value help when maintaining business roles with restricted access. As a developer, you provide access to a table where the field values are stored. When administrators create business roles and assign them to business users, they can call up the check table in the format of a value help and select the relevant values from the table.
In the bonus calculation example, the check table contains the bonus variants.
## Procedure
1. In ABAP Development Tools, in the project explorer, right-click on the relevant package node.
2. In the context menu, choose New Other ABAP Repository Object .
3. In the following popup, choose Core Data Services Data Definition and Next .
4. Enter a name, description, and, as referenced object, enter the table where the values are stored that you want to provide for the administrator. In the bonus calculation example, this table is the table where the bonus variants are stored for the app. Choose Next .
5. Select a transport request and choose Next .
6. From the list of templates, choose Define View and choose Finish .
7. In the coding, choose the fields that you need to expose. For the CDS view, it's sufficient that you use only those fields that are needed for a field help.
8. To provide some UI texts for the field help, add @EndUserText.label with a good label for each field that is exposed as part of the CDS view. The labels will be displayed as column headings in the field help of the business role maintenance.
9. Make sure that the annotation @AbapCatalog.sqlViewName is added at the beginning of the CDS view code.
For example, the code of such a CDS view can look as follows:
```
 Sample Code @AbapCatalog.sqlViewName: 'ZVARCHECK' @AbapCatalog.compiler.compareFilter: true @AbapCatalog.preserveKey: true @AccessControl.authorizationCheck: #CHECK @EndUserText.label: 'Check Table for bonus variants' define view Z_VARIANTS_CHECK_TABLE as select from zbonusvar { @EndUserText.label: 'Bonus Variant' key variant as BonusVariant, @EndUserText.label: 'Category' category as Category, @EndUserText.label: 'Description' description as Description, @EndUserText.label: 'Created By' createdby as Createdby, @EndUserText.label: 'Created At' createdat as Createdat }
```
10. Copy the SQL view name from @AbapCatalog.sqlViewName for later use (see Defining an Authorization Field [page 904]).
## 4.2.11.2.4.4.1.2  Defining an Authorization Field
As in the scenario for granting access based on activities, you define an authorization object. However, for this scenario, you first define authorization fields to fine-tune access on field level.
## Context
In the following, we assume that the bonus calculation service has a bonus variant field of type domain. You create an authorization field based on this data element.
## Procedure
1. To create an authorization field ZBNS\_VARN for the bonus variant, following the procedure for defining authorization fields in the user guide for ABAP development tools (ADT).
2. In the Data Element field, enter the data element for the bonus variant.
3. In the Check Table field, enter the SQL view name that you have created as a check table for all possible bonus variants (see Creating a Check Table for Authorization Fields [page 903]).
##  Note
You can use the Search Help button to simulate the field help as it's shown to the administrator during the business role maintenance.
## 4.2.11.2.4.4.1.3  Defining an Authorization Object
As in the scenario for granting access based on activities, you define an authorization object. However, for this scenario, you also add the authorization field ZBNS\_VARN for the bonus variant.
## Procedure
Follow the instructions for defining authorization objects in the user guide for ABAP development tools (ADT).
##  Tip
In our example, in the newly created authorization object, under Authorization Fields , you need the following:
- You need the predefined Activity (ACTVT) authorization field to define the permitted activities for the business users of your business service: 01 Add or Create , 02 Change , 03 Display , and 06 Delete as standard activities.
- If you have non-standard activities such as Calculate Bonus that you need to protect (and to permit later), check the list of existing values. If you click on an empty row and choose ENTER , the list of available values is shown. For the bonus calculation example, let's choose 93 Calculate for the business object-specific activity Calculate Bonus .
- You need the newly created authorization field ZBNS\_VARN for the bonus variant.