TalkTalkA recorded or written talk.See every one →YouTube — SAP Developers playlists
Developing authorizations for business users in SAP Business AI Platform, ABAP environment
A Devtoberfest 2026 session that walks the places an authorization check has to be written when a RAP business object is implemented, which is the whole of the authorizationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed edge: read restrictions as DCL access controls that become a filter at query time, a child entity inheriting its parent's conditions through an association, the projection layer inheriting rather than changing them, and the same check repeated on the draft side. The ABAP CDSABAP CDSThe modelling layer of ABAP Cloud — view entities, projections and annotations defined above database tables, delivered with the platform rather than installed.sap official, abap edge holds on that draft half — until 2608 a draft query view was needed above the draft table so a DCL had something to attach to, while a draft table entity is already on CDS level and takes the DCL directly, as long as the associations used in the inherited conditions are redefined on it. Create, update and delete are then taken handler by handler, including the trap that instance authorization reads the buffer and so cannot see the new value a pre-check would reject, and the session closes on in local mode and privileged EML calls.
Where it sits
Explains
AuthorizationABAPAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.ABAP CDSABAPABAP CDSThe modelling layer of ABAP Cloud — view entities, projections and annotations defined above database tables, delivered with the platform rather than installed.
Who is behind it
Andre FischerAndre FischerWrote this
In the atlas: contributes to 19, wrote 5@anfiscauthor
In the atlas: contributes to 19, wrote 5@anfiscauthor
Properties
About this work
Published
Published on
For authorization
Applies in
Group by14 of 14 pieces
Piece, what it offersStill applies
CDS Associations & JoinsCDS Associations & JoinsA Devtoberfest 2026 session from SAP's performance and scalability team on what an ABAP CDS association becomes on SAP HANA, taken as an excerpt from their internal performance training. The CDS edge rests on the three ways an association is used: a path expression and an explicit join both put a left outer join into the generated view, while exposing the association leaves the view without one and adds the join only for a query that asks for its fields, which the session calls join on demand. The data modelling edge is the advice that follows and the demo under it — cardinality written as precisely as the data allows, because the optimiser trusts it, shown with a view whose missing cardinality let SELECT COUNT(*) prune the join and return 18 rows where selecting the columns returned 56, plus the left-hand, right-hand and left-outer-to-inner rewrites that correct cardinalities make possible.SAP Developers, published 2026-10-12
Updates on Embedded Analytics in ABAP Cloud for DevelopersUpdates on Embedded Analytics in ABAP Cloud for DevelopersA Devtoberfest 2026 session (ABA-33) on the generator wizards for Embedded Analytics in ABAP Cloud, run by right-clicking a data definition in the ADT Project Explorer. It first names the artefacts a star schema needs, all of them ABAP CDS — cube view at its centre, dimension, text and hierarchy views reached by association, a hierarchy directory, and an InA service definition and binding — and then generates them: the star schema generator reads a view entity's metadata, sorts its fields into dimensions and measures, asks about the ones it cannot decide, offers the dimension views it found and writes an activated cube view; the hierarchy generator produces directory, node, base and definition views plus a maintenance business object with a generated app, which is used to group airlines into alliances before the hierarchy is switched on in the layout of the multi-dimensional analysis app. That is analytic modelling on the ABAP platform, which is what the edges rest on; the outlook names time-dependent hierarchies, translatable texts and dimensions generated from database tables.published 2026-10-05
Running AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverRunning AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverNicolasHernandez recounts building and running, over two years, an MCP server written in plain ABAP behind a single ICF node, for SAP ECC 6.0 and S/4HANA on-premise customers that the ADT MCP Server and SAP Joule for Developers, ABAP AI capabilities do not reach. Authorization runs as the calling user rather than a technical RFC user, a choice forced by a customer security team after an earlier version used a technical RFC user, and a later security review found a display-authority check applied uniformly across every write endpoint. The failure modes that cost the most time sat in RFC connectivity itself: RFC_READ_TABLE's empty-table exception collapsed into a false success, a where-used filter was applied only after the row limit, and BAPI calls treated an empty string and an absent parameter as different, silently wrong inputs.NicolasHernandez, published 2026-08-28
RAP - Feature Control (Part 2)RAP - Feature Control (Part 2)Implements a reusable AUTHORITY-CHECK wrapper class and wires it into a RAP behaviour implementation's Feature Control, both the static global check on Create and the instance-based, partner-scoped checks on Update and Delete, so that an authorization decision greys out an action in the Fiori UI rather than only rejecting it after the save. Part two of the author's Sales App series, it also flags a newer, more strictly typed Feature Control flag SAP introduced since the first article, since using the older type produces a warning and can leave a flag silently without effect.Björn S., published 2026-08-14
BTP - Restriction TypeBTP - Restriction TypeWalks through creating a Restriction Type and Restriction Field for an ABAP RAP authorization object, so the values an IAM app would otherwise fix as static entries can instead be maintained per Business Role in the Fiori Launchpad. Read and Write access on the restriction still follow the activities defined on the authorization object itself (03 for read, 01/02/06 for write), and the piece shows the effect end to end: a Fiori app narrowed to only the business partners assigned on the role. This is the ABAP door's authorization mechanism made dynamic — an access decision moved from the IAM app's fixed values onto the role, without touching the underlying CDS access control.Björn S., published 2026-08-11
BTP - Authorization ObjectBTP - Authorization ObjectWalks through building a classic ABAP authorization object for the ABAP environment — an authorization field, the object itself created in ABAP Development Tools rather than the classic SU21 transaction, and its activities (01 create, 02 change, 03 display, and others) — then wires it into a CDS role's access control with the pfcg_auth aspect on the WHERE condition, which is authorization's ABAP form: CDS access control limiting what a view entity returns to the conditions in a CDS role. The check inherits down to a consumption view and even the Data Preview, and the piece notes the WITH PRIVILEGED ACCESS addition developers use in the SQL console to bypass it while testing.Björn S., published 2026-08-07
From SEGW to @OData.publish: Expose Your CDS View as OData in S/4HANAFrom SEGW to @OData.publish: Expose Your CDS View as OData in S/4HANAWalks through exposing an ABAP CDS view as an OData service in an on-premise S/4HANA system by adding the @OData.publish: true annotation, then registering and activating the generated service in SAP Gateway (transaction /IWFND/MAINT_SERVICE) before testing it with $filter, $top and $count. It sets this against the manual route through transaction SEGW, since the annotation generates the service, its navigation properties and its OData properties straight from the CDS view without a Service Builder project.rupalipunekar1234, published 2026-07-09
How to Check Fiori Apps Related Authorization Object MassHow to Check Fiori Apps Related Authorization Object MassA structured, table-driven method for mass-checking which authorization objects back a set of Fiori apps: map each Fiori App ID to its OData service, look up that service's hash in USOBHASH, then resolve the hash to its authorization objects (S_SERVICE, S_RFC, among others) in USOBTC. The author reports the method's limits in practice — apps built on a transaction code are already findable directly in USOBTC, and the same approach resolved only 5 of 300 Web Dynpro apps, which needed a manual catalog-and-hash workaround instead.MehmetSaidDemir, published 2025-10-07
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Analyze and optimize ABAP Cloud model apps built on core data servicesAnalyze and optimize ABAP Cloud model apps built on core data servicesPerformance anti-patterns in data models built with ABAP CDS under ABAP Cloud applications, and the tools that find them: the abstract names ABAP cross trace, the SQL analyzer (PlanViz) in Visual Studio Code and the SAP HANA database explorer as what the session uses to follow a bottleneck from the application to the database. The anti-patterns are taken from real business applications, which is where the data modelling edge holds; which ones are shown is not in the abstract. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Ingo Braeuninger, Robert Werlich, Steffen Siegmund and Thomas Fiedler, written here from SAP's abstract; the recording is not yet published.
Always in Sync — Field-level and event-driven side effects for reactive UIs in RAPAlways in Sync — Field-level and event-driven side effects for reactive UIs in RAPA Devtoberfest 2026 session on side effects in RAP — the declarations in a behaviour definition that tell a draft UI to reload what a change affected, instead of leaving the user to refresh the browser. Field-level side effects recalculate a total price from a determination when a booking fee is entered, including across the association from a child item up to the root entity, and a permissions side effect toggles a description field between read-only and editable; a global side effect is attached to a determine action, fires when the user presses Enter, and only one may exist per business object, which is why the prepare action and a second determine action cannot both carry it. The last part starts a long-running calculation through the background processing framework and raises a business event that the behaviour definition lists as a side effect source and the projection makes public, so the Fiori app is updated with a notification when the work finishes, whether it was triggered by the user or by an application job — the transactional model and the async processing side the edges rest on.published 2026-10-05
How to Build Application Jobs in SAP Business AI Platform, ABAP environmentHow to Build Application Jobs in SAP Business AI Platform, ABAP environmentA Devtoberfest 2026 session on the application job framework in the cloud ABAP environment, built from the repository objects outwards: a class implementing the new application job interface, whose public attributes become the parameters and select options, the application log object it writes to, a job catalog entry that lays out sections, groups and value helps, and a job catalog template that works like a report variant. The demo schedules and monitors runs in the Application Jobs Fiori app, starts a job from a RAP action through the scheduling API under a job user of its own, and debugs one through the template's run-for-testing entry. It closes on the alternatives for work that should not be a job — the background processing framework for short-running work, and RAP events consumed locally or sent over the event mesh — which is the async processing this session covers for SAP BTP ABAP environment.published 2026-09-28
What's new with draft handling in RAP?What's new with draft handling in RAP?An ABAP-day session at Devtoberfest 2026 on two additions to draft handling in RAP: collaborative draft, where two users work on the same draft instance and a field is locked only while the other is in it, and draft scope, where editing an instance of one draft-enabled business object puts the related instances of a dependent one into draft as well. Andre Fischer shows what each costs in the behaviour definition and projection, the draft query view and its DCL that collaborative draft needs over a table-based business object, and the CDS table entities that remove both the draft query view and the persistence table, with their current restrictions in ABAP analytics and extensibility; the from-scratch generator in ADT grows a checkbox for them. Both demos run against the DMO flight scenario of SAP-samples/abap-platform-refscen-flight, and the last part hides the draft-related features of an OData V4 app in its manifest, which the session gives as the reason a simple create-update-delete app no longer needs a V2 service binding.published 2026-09-21
How to rename an OData V4 service?How to rename an OData V4 service?Renaming an OData V4 service binding changes its Service Alias and the resulting service URL, breaking any app already deployed against the old one — shown on a /DMO/TRAVEL-based example in the SAP BTP ABAP environment by unpublishing, renaming and republishing the binding, then reading the new URL back from the OData V4 service catalog's ServiceGroups entry. It weighs that against two alternatives: adding a second service definition and publishing it as a new service version under the same binding, or creating an entirely new service definition and binding, which keeps the original URL live during the cutover.published 2026-07-04
Details
Graph
Authorizationcapability, core and community
ABAP CDSartifact
YouTube — SAP Developers playlistspublishing source
YouTube — SAP Developers playlistsdevtoberfest-2026
Source
Type
talk
Published on
Host
youtube.com
Discovered via
First seen
History
- Entered the atlasDiscovered via YouTube — SAP Developers playlists · devtoberfest-2026.
For your agent
- Ref
content:devtoberfest-2026-rap-authorizations-business-users- JSON
- /content/devtoberfest-2026-rap-authorizations-business-users.json
- MCP
- Connecting an agent