authorization-iam

Name: authorization-iam
Author: likweitan

28stars11forks

How to install authorization-iam?

likweitan/abap-skills/authorization-iam

$npx -y skills add likweitan/abap-skills --skill authorization-iam

Installs into the current project.

Summary

Help with ABAP authorization and IAM (Identity and Access Management) including authorization objects, authorization checks, IAM apps, business catalogs, business roles, restriction types, CDS access control (DCL), privilege access annotations, and role-based access in ABAP Cloud

Files · 1

View on GitHub

SKILL.md

1	# Authorization & IAM
2
3	Guide for implementing authorization checks and identity/access management in ABAP Cloud and on-premise systems.
4
5	## Workflow
6
7	1. Determine the user's goal:
8	- Implementing authorization checks in ABAP code
9	- Creating CDS access controls (DCL)
10	- Setting up IAM apps, business catalogs, and business roles (ABAP Cloud)
11	- Managing PFCG roles (on-premise)
12	- Defining custom authorization objects
13	- Understanding restriction types
14
15	2. Identify the platform:
16	- ABAP Cloud (BTP or S/4HANA embedded) → IAM apps + business catalogs + `CL_ABAP_AUTHORIZATION`
17	- On-premise / Standard ABAP → PFCG roles + `AUTHORITY-CHECK`
18
19	3. Guide implementation with the appropriate authorization model
20
21	## Authorization Models
22
23	### ABAP Cloud (BTP / S/4HANA Cloud)
24
25	```
26	IAM App → Business Catalog → Business Role → Business User
27	↑
28	Restriction Type (field-level restrictions)
29	```
30
31	### On-Premise (Standard ABAP)
32
33	```
34	Authorization Object → PFCG Role → User Assignment
35	↑
36	Authorization Fields + Permitted Values
37	```
38
39	## Authorization Checks in Code
40
41	### ABAP Cloud — `CL_ABAP_AUTHORIZATION`
42
43	```abap
44	"Check authorization using released API
45	DATA(lo_auth) = cl_abap_authorization=>check_authorization(
46	EXPORTING
47	authorization_object = 'Z_MY_AUTH'
48	authorizations = VALUE #(
49	( field = 'ACTVT' value = '03' ) "Display
50	( field = 'ZCARR' value = lv_carrier )
51	) ).
52
53	IF lo_auth->is_authorized( ) = abap_false.
54	"User not authorized
55	RAISE EXCEPTION TYPE zcx_not_authorized.
56	ENDIF.
57	```
58
59	### On-Premise — `AUTHORITY-CHECK`
60
61	```abap
62	AUTHORITY-CHECK OBJECT 'Z_MY_AUTH'
63	ID 'ACTVT' FIELD '03'
64	ID 'ZCARR' FIELD lv_carrier.
65
66	IF sy-subrc <> 0.
67	MESSAGE e001(z_msg) WITH lv_carrier.
68	RETURN.
69	ENDIF.
70	```
71
72	### Activity Values (ACTVT)
73
74	\| Value \| Activity \|
75	\| ----- \| -------- \|
76	\| `01` \| Create \|
77	\| `02` \| Change \|
78	\| `03` \| Display \|
79	\| `06` \| Delete \|
80	\| `16` \| Execute \|
81
82	## Authorization Objects
83
84	### Creating a Custom Authorization Object
85
86	In ADT or `SU21`:
87
88	```
89	Authorization Object: Z_MY_AUTH
90	Fields:
91	ACTVT — Activity (standard field, linked to domain ACTIV_AUTH)
92	ZCARR — Carrier (custom field, type S_CARR_ID)
93	ZREGN — Region (custom field, type CHAR4)
94	```
95
96	#### Structure
97
98	- Authorization Class: Groups related objects (e.g., `Z_TRAVEL`)
99	- Authorization Object: Contains 1–10 authorization fields
100	- Authorization Field: Links to a data element; defines the check dimension
101
102	## CDS Access Control (DCL)
103
104	CDS access controls define row-level authorization for CDS view entities.
105
106	### Basic DCL
107
108	```cds
109	@EndUserText.label: 'Access Control for Travel'
110	@MappingRole: true
111	define role ZI_Travel {
112	grant select on ZI_Travel
113	where ( carrier_id ) =
114	aspect pfcg_auth ( Z_MY_AUTH, ZCARR, ACTVT = '03' );
115	}
116	```
117
118	### Multiple Conditions
119
120	```cds
121	define role ZI_Travel {
122	grant select on ZI_Travel
123	where ( carrier_id ) =
124	aspect pfcg_auth ( Z_MY_AUTH, ZCARR, ACTVT = '03' )
125	and ( agency_id ) =
126	aspect pfcg_auth ( Z_AGENCY_AUTH, ZAGENCY, ACTVT = '03' );
127	}
128	```
129
130	### Unrestricted Access
131
132	```cds
133	define role ZI_Travel_Admin {
134	grant select on ZI_Travel
135	where _unrestrictedAccess;
136	}
137	```
138
139	### Inherited Access Control
140
141	```cds
142	"Child entity inherits access control from parent
143	define role ZI_Booking {
144	grant select on ZI_Booking
145	where ( carrier_id ) =
146	aspect pfcg_auth ( Z_MY_AUTH, ZCARR, ACTVT = '03' );
147	}
148	```
149
150	### DCL and PRIVILEGED ACCESS
151
152	```abap
153	"Bypass DCL access control when needed (e.g., in background jobs)
154	SELECT FROM zi_travel
155	FIELDS travel_id, description
156	INTO TABLE @DATA(lt_all)
157	PRIVILEGED ACCESS.
158	```
159
160	## IAM in ABAP Cloud
161
162	### IAM App
163
164	Created in ADT, links a service binding to the authorization model:
165
166	```
167	ADT: New → Other → IAM App
168	Name: Z_TRAVEL_IAM
169	Type: EXT - External App (for OData services)
170	Service Binding: ZUI_TRAVEL_O4
171	```
172
173	Assign authorization objects to the IAM App to define which checks apply.
174
175	### Business Catalog
176
177	Groups IAM Apps into logical bundles:
178
179	```
180	ADT: New → Other → Business Catalog
181	Name: Z_BC_TRAVEL_MGMT
182	Description: Travel Management
183	IAM

People who liked this also viewed

6 picks

Type

authorization-iam

28stars11forks

View on GitHub

How to install authorization-iam?

likweitan/abap-skills/authorization-iam

$npx -y skills add likweitan/abap-skills --skill authorization-iam

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Authorization & IAM
2
3	Guide for implementing authorization checks and identity/access management in ABAP Cloud and on-premise systems.
4
5	## Workflow
6
7	1. Determine the user's goal:
8	- Implementing authorization checks in ABAP code
9	- Creating CDS access controls (DCL)
10	- Setting up IAM apps, business catalogs, and business roles (ABAP Cloud)
11	- Managing PFCG roles (on-premise)
12	- Defining custom authorization objects
13	- Understanding restriction types
14
15	2. Identify the platform:
16	- ABAP Cloud (BTP or S/4HANA embedded) → IAM apps + business catalogs + `CL_ABAP_AUTHORIZATION`
17	- On-premise / Standard ABAP → PFCG roles + `AUTHORITY-CHECK`
18
19	3. Guide implementation with the appropriate authorization model
20
21	## Authorization Models
22
23	### ABAP Cloud (BTP / S/4HANA Cloud)
24
25	```
26	IAM App → Business Catalog → Business Role → Business User
27	↑
28	Restriction Type (field-level restrictions)
29	```
30
31	### On-Premise (Standard ABAP)
32
33	```
34	Authorization Object → PFCG Role → User Assignment
35	↑
36	Authorization Fields + Permitted Values
37	```
38
39	## Authorization Checks in Code
40
41	### ABAP Cloud — `CL_ABAP_AUTHORIZATION`
42
43	```abap
44	"Check authorization using released API
45	DATA(lo_auth) = cl_abap_authorization=>check_authorization(
46	EXPORTING
47	authorization_object = 'Z_MY_AUTH'
48	authorizations = VALUE #(
49	( field = 'ACTVT' value = '03' ) "Display
50	( field = 'ZCARR' value = lv_carrier )
51	) ).
52
53	IF lo_auth->is_authorized( ) = abap_false.
54	"User not authorized
55	RAISE EXCEPTION TYPE zcx_not_authorized.
56	ENDIF.
57	```
58
59	### On-Premise — `AUTHORITY-CHECK`
60
61	```abap
62	AUTHORITY-CHECK OBJECT 'Z_MY_AUTH'
63	ID 'ACTVT' FIELD '03'
64	ID 'ZCARR' FIELD lv_carrier.
65
66	IF sy-subrc <> 0.
67	MESSAGE e001(z_msg) WITH lv_carrier.
68	RETURN.
69	ENDIF.
70	```
71
72	### Activity Values (ACTVT)
73
74	\| Value \| Activity \|
75	\| ----- \| -------- \|
76	\| `01` \| Create \|
77	\| `02` \| Change \|
78	\| `03` \| Display \|
79	\| `06` \| Delete \|
80	\| `16` \| Execute \|
81
82	## Authorization Objects
83
84	### Creating a Custom Authorization Object
85
86	In ADT or `SU21`:
87
88	```
89	Authorization Object: Z_MY_AUTH
90	Fields:
91	ACTVT — Activity (standard field, linked to domain ACTIV_AUTH)
92	ZCARR — Carrier (custom field, type S_CARR_ID)
93	ZREGN — Region (custom field, type CHAR4)
94	```
95
96	#### Structure
97
98	- Authorization Class: Groups related objects (e.g., `Z_TRAVEL`)
99	- Authorization Object: Contains 1–10 authorization fields
100	- Authorization Field: Links to a data element; defines the check dimension
101
102	## CDS Access Control (DCL)
103
104	CDS access controls define row-level authorization for CDS view entities.
105
106	### Basic DCL
107
108	```cds
109	@EndUserText.label: 'Access Control for Travel'
110	@MappingRole: true
111	define role ZI_Travel {
112	grant select on ZI_Travel
113	where ( carrier_id ) =
114	aspect pfcg_auth ( Z_MY_AUTH, ZCARR, ACTVT = '03' );
115	}
116	```
117
118	### Multiple Conditions
119
120	```cds
121	define role ZI_Travel {
122	grant select on ZI_Travel
123	where ( carrier_id ) =
124	aspect pfcg_auth ( Z_MY_AUTH, ZCARR, ACTVT = '03' )
125	and ( agency_id ) =
126	aspect pfcg_auth ( Z_AGENCY_AUTH, ZAGENCY, ACTVT = '03' );
127	}
128	```
129
130	### Unrestricted Access
131
132	```cds
133	define role ZI_Travel_Admin {
134	grant select on ZI_Travel
135	where _unrestrictedAccess;
136	}
137	```
138
139	### Inherited Access Control
140
141	```cds
142	"Child entity inherits access control from parent
143	define role ZI_Booking {
144	grant select on ZI_Booking
145	where ( carrier_id ) =
146	aspect pfcg_auth ( Z_MY_AUTH, ZCARR, ACTVT = '03' );
147	}
148	```
149
150	### DCL and PRIVILEGED ACCESS
151
152	```abap
153	"Bypass DCL access control when needed (e.g., in background jobs)
154	SELECT FROM zi_travel
155	FIELDS travel_id, description
156	INTO TABLE @DATA(lt_all)
157	PRIVILEGED ACCESS.
158	```
159
160	## IAM in ABAP Cloud
161
162	### IAM App
163
164	Created in ADT, links a service binding to the authorization model:
165
166	```
167	ADT: New → Other → IAM App
168	Name: Z_TRAVEL_IAM
169	Type: EXT - External App (for OData services)
170	Service Binding: ZUI_TRAVEL_O4
171	```
172
173	Assign authorization objects to the IAM App to define which checks apply.
174
175	### Business Catalog
176
177	Groups IAM Apps into logical bundles:
178
179	```
180	ADT: New → Other → Business Catalog
181	Name: Z_BC_TRAVEL_MGMT
182	Description: Travel Management
183	IAM

People who liked this also viewed

6 picks

Type