ACL-Based Authorizations for Service Users

Runtime access of messages regarding SAP PI runtime engines can be granted based on a simple authorization check.

More information: Service Users for Message Exchange

In addition to a simple authorization check, you can define that messages containing a specific (normalized) business system or business component as Sender, can only be executed by certain users. You can do this in the Integration Directory by selecting the Assigned Users tab page for the corresponding business system or business component and specifying the list of users permitted to execute messages. This list is also known as an Access Control List (ACL).

More information: Access Control Using Assigned Users

This security concept can also be used with sender agreements (dual usage type PI) or integrated configurations (Advanced Adapter Engine Extended, shortly referred to as AEX ), for which you can define an ACL in the Integration Directory. At runtime, the sender agreement or integrated configuration is determined and the ACL is checked whether it contains the current user. No checks are made, however, if the ACL is empty.

This enables you to grant authorization also on interface level, since sender agreements or integrated configurations can be defined for specific interfaces.