SAP FIORI - Configuring Fiori Environment and Security

CREATE RFC USER ID COMMUNICATION / SYSTEM USER ID (FES and BES)

For using TRUSTED RFC Connections

• Assign the roles with access to authorization objects S_RFC and S_RFCACL to all FIORI Administrators if you are going to user Trusted RFC connection

For Using Regular RFC Connections

If you are going to use regular RFC connection,

• Create a system / communication type user id and assign the above role to the user id

TRUSTED RFC CONNECTIONS

Create three Trusted RFC Connections with the above mentioned naming pattern between Front End Server (FES) and Back End Server (BES) using the transaction SMT1 and one Trusted RFC connection between Back End Server (BES) and Front End Server (FES)

OR 

Create three RFC Connections between Front End System (FES) and Back End System (BES) using the transaction SM59 with the following naming patter and normal RFC connection between Back End System (BES) and Front End System (FES)

1.  ABAP RFC CONNECTIONS

RFC CONNECTIONS REQUIRED FROM BETWEEN FES and BES

- <BES SID>CLNT<Client No.>_HTTPS - E.g. S4HCLNT100_HTTPS

o HTTPS connection will be of type H

RFC CONNECTIONS REQUIRED BETWEEN BES and FES

- <FES SID>CLNT<Client No.> - E.g. G12CLNT100

2. Create another RFC connection with _RFC naming convention

3. Create another RFC connection with _HTTP or _HTTPS naming convention

NOTE: You will get host name and port number in transaction code SMMS in Back End System

Or You can use Tcode SMICM and then click on Services

Also, Create RFC CONNECTIONS REQUIRED BETWEEN BES and FES

The results should be same as above when you the RFC connections test for all three types of RFCs

OBSERVATIONS:

1. _RFC are taken into account when catalogs replication is performed in FES

2. _HTTPS connection is taken into account when you use SAP GUI apps

The front-end system needs to connect to the back-end server during:

- SAP Fiori launchpad design time, when replicating back-end catalogs to the front-end server: here we need an RFC connection.

- SAP Fiori launchpad runtime, when navigating to the application: here we need an HTTP or an HTTPS connection.

Before you can use SAP Gateway functionality, you have to activate it globally in your FES system. You can activate and deactivate SAP Gateway. When you deactivate it, all SAP Gateway services stop running, no consumer servers can communicate with it, and an error message is sent to any system that calls for the services

Your have multiple options to activate SAP Gateway in an SAP system:

• In the customizing (transaction SPRO), choose SAP NetWeaver → UI Technologies → SAP Fiori → Initial Setup → Connection Settings (Front-End Server to ABAP Back-End Server) → Activate SAP Gateway

  
  

• Start transaction /IWFND/IWF_ACTIVATE.

  
  

• Alternatively, you can use the task list SAP_GATEWAY_BASIC_CONFIG to perform basic SAP Gateway settings, including the activation.

Activate SAP Gateway (in FES)

a. SPRO --> UI Technologies --> SAP FIORI --> Initial Setup --> Connection Setting --> Activate SAP Gateway

OR

use the transaction code /n/IWFND/IWF_ACTIVATE

Create at least two system aliases for each Back End System that you want to integrate with your FIORI Front End System

- <SID>CLNT<Client No.> (with software version DEFAULT)

o Specify the RFC connection, System Id and Client

OR

- <SID>CLNT<Client No.>_RFC (with software version DEFAULT)

o Specify the RFC connection, System Id and Client

AND

- _PGW (with Software version /IWPGW/BWF)

o Specify the RFC connection, System Id and Client

o Check mark “For Local Apps” check box

An SAP Gateway alias is needed to have at least one entry for the SAP Gateway hub (here: the FES system) in the Service Builder (transaction SEGW) to register OData services that you are going to develop.

The Business Enablement Provisioning (BEP) functionality can publish events to one or more hosts running SAP Gateway (the FES system in this case). However, you must first identify the SAP Gateway landscape to use with it. For OData Channel, you also specify the SAP Gateway landscape.

Create SAP Gateway Aliases (in both FES and BES)

In transaction SPRO, open the SAP Reference IMG and navigate to SAP NetWeaver → SAP Gateway Service Enablement → Backend Odata Channel → Connection Settings to SAP Gateway → SAP Gateway Settings

OR

Tcode SM30 à /IWBEP/C_SYSTEM

In FES, System alias and RFC Destination need not be specified

o Destination System: <FES RFC Connection>

o Client: <FES client>

o System Alias: <Can be blank or specify LOCAL or FES RFC Connection>

o RFC Destination: NONE or <FES RFC Destination>

In the BES, define the SAP Gateway with FES RFC connection and system details

o Destination System: <FES RFC Connection>

o Client: <FES client>

o System Alias: <leave it blank>

o RFC Destination: <FES RFC Destination>

Maintain System Alias List (FES and BES)

- Add the BES system alias that you created in FES system in the table /UI2/V_SYSALIAS

Mapping sources and system alias

- In the next step, each customer must fill view /UI2/V_ALIASMAP

- In this view, you map the system alias with your own system aliases

- Alternatively, you can directly create SM59 destination called NW_RFC, S4CMD_RFC etc. and skip this step

Map the System Delivered Alias to BES System Alias

- Source System Alias: <SAP Delivered System Alias>

- Target System Alias: <Target System Alias>

Example:

o Source System Alias: S4FIN

o Target System Alias: <BES RFC Connection>_RFC

o Source System Alias: S4FICA

o Target System Alias: <BES RFC Connection>_RFC

o Source System Alias: S4SD

o Target System Alias: S4CLNT100_RFC or S4CLNT100

o Source System Alias: S4FICA

o Target System Alias: S4CLNT100_RFC or S4CLNT100

o Source System Alias: S4MDG

o Target System Alias: S4CLNT100_RFC or S4CLNT100

OR

Map the system alias in the view /UI2/V_ALIASMAP

o Source System Alias: <FES RFC Connection>

o Target System Alias: <BES RFC Connection>_RFC

Note: In this case, you will have to replace the system delivered alias in table /UI2/V_ALIASCAT with your system alias

In the table /UI2/V_ALIASCAT, change the system alias to your BES system Alias for Catalog that you want to replicate and user in FIORI

TCode SM30 à /UI2/V_ALIASCAT

When you are activating the Odata Services, you will be asked to specify a package name so that the configuration of the Odata Service is transported

If it is new FIORI implementation, then either you or someone from the BASIS or Development team will have to create a package

These are the relevant OData services for the SAP Fiori Launchpad resp. the SAP Fiori Launchpad designer:

OData Service                                            Purpose

/UI2/PAGE_BUILDER_CONF                         used by the launchpad designer

/UI2/PAGE_BUILDER_CUST                          used by the launchpad designer

/UI2/PAGE_BUILDER_PERS                           used by the launchpad

/UI2/TRANSPORT                                        used by the launchpad designer

/UI2/INTEROP                                             used by the launchpad and launchpad designer

To activate them, you can use the transaction /N/IWFND/MAINT_SERVICE to activate them separately and use LOCAL as the system alias

11. ACTIVATING MANDATORY SICF SERVICES IN FES

/sap/bc/ui2/smi/rest_tunnel

/sap/bc/ui2/nwbc

/sap/bc/ui2/start_up

/sap/bc/ra

/sap/bc/ra/flp

/sap/bc/ra/repo

/sap/bc/ui5_ui5/ui2/ushell

o ABAP Class = /UI2/CL_SRA_LOGIN

o PROTOCOL = DO NOT SWITCH

/sap/public/bc/ui2

/sap/public/bc/ui5_ui5

/sap/bc/ui2/flp

o Note: Ensure Error Handling à Configuration is configured to match /sap/bc/ui5_ui5/ui2/ushell)

/sap/bc/ui5_ui5/sap/ar_srvc_launch

o Note: Ensure Error Handling à Configuration is configured to match /sap/bc/ui5_ui5/ui2/ushell)

/sap/bc/ui5_ui5/sap/ar_srvc_news

o Note: Ensure Error Handling à Configuration is configured to match /sap/bc/ui5_ui5/ui2/ushell)

/sap/bc/ui5_ui5/sap/arsrvc_upb_admn (

o Note: Ensure Error Handling à Configuration is configured to match /sap/bc/ui5_ui5/ui2/ushell)

/sap/bc/ui2/c2g

/sap/bc/rest/themes

/sap/bc/ui2/app_index

/sap/bc/lrep

SAPUI5 needs these ICF services for the application resources from the FES system:

/sap/public/bc/ui5_ui5

/sap/bc/ui5_ui5/ui2

Cache buster techniques cause web browsers to load content from the server rather than from the browser cache when new resources are available on the server.

The cache buster for the SAP Fiori launchpad and SAP Fiori apps is based on versioned URLs. Cache buster tokens are added to the URLs of the resources. After a software update, URLs containing new tokens are used, which means that the browser considers these URLs as initial requests and loads the new resources from the server.

The cache buster for the SAP Fiori launchpad and SAP Fiori apps is not active by default. To use it, you have to activate the ICF service /sap/ bc/ui2/flp.

Follow these steps to activate Cache Buster:

1. In the ABAP front-end server, run Transaction SICF.

2. Enter “/sap/bc/ui2/flp” in the Service Path field.

3. Click Execute , or press (F8). 4. Choose Activate Service in the context menu.

After activating the SICF service, the launchpad with cache buster can be accessed under any of the following ICF services:

• /sap/bc/ui2/flp/

• /sap/bc/ui2/flp/index.html

• /sap/bc/ui2/flp/FioriLaunchpad.html

Configure the SAP Fiori Launchpad Login Screen (FES)

Configure the SAP FIORI Launchpad Login Screen

1. TCode: SICF à Service /sap/bc/ui5_ui5/ui2/ushell

2. Double click on ushell

3. Go to tab Error Pages

4. Select the radiobutton System Logon

5. Click on Configuration button

6. Maintain ABAP Class, Protocol, System Logon Setting section

Configure the SAP FIORI Launchpad Logoff Screen

TCode: SICF --> Service /default_host/sap/public/bc/icf/logoff

After activating the SICF service for the launchpad with cache buster, you can create an external alias for the default URL of the launchpad. This enables your users to use the same URL.

Alternatively, you can make the launchpad available under a short URL of your choice within your domain.

STEPS FOR CONFIGURATION

1. Start transaction SICF

2. Select hierarchy type SERVICE, then choose

3. Choose External Aliases

4. Select DEFAULT_HOST and right click to create an external host

5. In the External Alias field, enter the alias under which you want the launchpad to be available. Enter an alias of your choice, for example: /fiori

6. On the Trg Element tab, select the following target handler: /sap/bc/ui2/flp

SAP FIORI ADMINISTRATOR ROLE

Create a custom role with merging the authorizations from SAP_UI2_ADMIN_750 + SAP_UI2_ADMIN_700 and add the following OData services to the role

– ZINTEROP_0001

– ZPAGE_BUILDER_CONF_0001

– ZPAGE_BUILDER_CUST_0001

– ZPAGE_BUILDER_PERS_0001

– ZTRANSPORT_0001

This role should be assigned to FIORI developers and users who will works with FIORI Launchpad Designer

FIORI Role for End Users

Create a role with merging the authorizations from the standard roles SAP_UI2_USER_750 + SAP_UI2_USER_700 and add the following Authorization value, select TADIR entry, Object type as – IWSG, in the role

- IWSG ZINTEROP_0001

- IWSG ZPAGE_BUILDER_PERS_0001

Additionally, authorization to the below objects are required for the user to view the tiles on FLP without any errors:

/UI2/CHIP

S_PB_CHIP

and the transaction code /UI2/FLP if it is not already included in the role

In the FES system, execute the program /UI2/GET_APP_DESCR_REMOTE_DEV to extract Backend Application Descriptors and replicate them to the FIORI Designer launchpad

Specify the System Alias (BES System Alias or System Delivered Alias that is mapped in /UI2/V_ALIASCAT for the catalog)

- If you have mapped system delivered aliases to your alias in /UI2/ALIASMAP, you can use the system delivered alias in Replication System Alias field

- If you decided to change the system alias in /UI2/V_ALIASCAT, you have to use your system alias in Replication System Alias field

Run the program first in test mode and then without it if the test run does not show any errors

Run the program for the first in Full Replication mode and then you can schedule a background job to run in Delta Replication mode

Note: Unless this step is executed the catalog will not be available for use in Launchpad Designer (/n/UI2/FLPD_CUST or /n/UI2/FLPD_CONF)