App Implementation: Role Analytics

System Landscape Requirements

Before you can start to implement the app, ensure that your system landscape has been set up to enable SAP Fiori. This also implies that the front-end and back-end components for your app are already available in this system landscape:

SAP Fiori System Landscape Options	Setup of SAP Fiori System Landscape with SAP HANA XS
Configuration of Front-End Server	Configuration of SAP Fiori Infrastructure
Back-End Components (Product Version Stack)	SAP Access Control 10.1 SPS05
SAP HANA Content Component Delivered with (Product Version Stack)	SAP Smart Business 1.0 for SAP solutions for GRC
VDM Contained (Product Version Stack)	SAP HANA Analytics for GRC 1.0
Front-End Components Delivered with (Product Version Stack)	SAP Smart Business 1.0 for SAP solutions for GRC Instance: Frontend Serv. Cont. GRC Analy. Software Component Version: UIHGRC01 100

Tile Type for Launching App

The Role Analytics app does not use a KPI tile or an app launcher tile to launch the app. The Role Analytics app uses specific tiles delivered for the SAP Smart Business 1.0 for Access Control Management product to launch the app.

The following tiles can open the Role Analytics app:

Required SAP Notes

No SAP Notes are available.

Implementation Tasks

The following sections list tasks that have to be performed to implement the Role Analytics app. The tables contain the tile-specific data required for these tasks.

HANA Server: Assign SAP HANA Roles to Users and Roles

SAP HANA Role	Needed for ...
sap.hba.r.grc.roles::SAP_SMART_BUSINESS_ACCESS_CONTROL_MANAGER	Read access to KPI data (views and XS OData services)
sap.hba.apps.grcia.s.roles::SAP_GRC_ROLE_ANALYST	Navigation to Role Analytics app

As a prerequisite for read-access to KPI definition, ensure you have assigned the generic role Smart Business Runtime Role (sap.hba.apps.kpi.s.roles::SAP_SMART_BUSINESS_RUNTIME) for read-access to KPI definition to all users or roles.

As a prerequisite for KPI modeling, ensure you have assigned the generic role Smart Business Administration Role (sap.hba.apps.kpi.s.roles::SAP_SMART_BUSINESS_MODELER) to specific users (e.g. key user, administrator).

For more information about SAP HANA roles, see Assigning Roles for Accessing SAP HANA Data.

HANA Server: Generate and Assign Analytic Privileges to Users and Roles

Needed for ...	How to generate?
Access to KPI data (only views)	Generated by Authorization Assistant For more information, see Generating Analytic Privileges.
Access to KPI definition in KPI catalog	Generated by KPI Modeler For more information, see KPI Modeler.

Needed for ...

How to generate?

Access to KPI data (only views)

Generated by Authorization Assistant

For more information, see Generating Analytic Privileges.

Access to KPI definition in KPI catalog

Generated by KPI Modeler

For more information, see KPI Modeler.

Needed for ...	How to generate?
Access to business data (only views)	Generated by Authorization Assistant tool For more information, see Generating Analytic Privileges.

Needed for ...

How to generate?

Access to business data (only views)

Generated by Authorization Assistant tool

For more information, see Generating Analytic Privileges.

Front-End Server: Activate UI5 Application

UI5 Application	Technical Name
Generic Drill-down App	`/sap/bc/ui5_ui5/sap/ca_kpi`

For more information about how to activate the UI5 application (ICF service), see Activate ICF Services.

Front-End Server: Enable Tile for Access in SAP Fiori Launchpad

There are several steps to be performed to enable the app for access in the SAP Fiori launchpad. You require the following data to perform these steps:

Component	Technical Name
Semantic Object	`AccessControlRole`
Business Role (needed for access to KPI catalog and generic drill-down application)	`SAP_KPIFRW4_TCR_S` This business role comprises the two catalog providers listed under Business Catalog.
Business Catalog	`SAP_KPIFRW_TC_R` (for KPI catalog) `SAP_KPIFRW_TC_S` (for generic drill-down application)
Application-specific Business Role	`SAP_KPIFRW4_TCR_A` This is the application-specific Business Role required to launch the Role Analytics app.
Application-specific Business Catalog	`SAP_KPIFRW_TC_A` (for Role Analytics application)
Business Catalog Group	Not applicable.
Technical Role	Not applicable.
Technical Catalog	Not applicable.
Report Launchpad (for generic drill-down application)	Role: `UISKPI01` Instance: `ANALYTICS` Application Alias: `analyzeKPIDetails`
Report Launchpad for optional or alternative application-specific drill-down applications	Not applicable.

For more information about adding an app to the SAP Fiori Launchpad, see Setup of Catalogs, Groups, and Roles in the SAP Fiori Launchpad.

Front-End and Back-End Server: Assign Role with ODATA Service Authorization to Users

To restrict access to OData services to specific users, you have to assign roles (including OData service authorization for the app) to your users. You have to make the assignment on the back-end and on the front-end server:

OData Service (Version Number)	Back-end Server: Delivered Authorization Role (PFCG Role)	Front-End Server: Authorization Role
`sap.hba.apps.grcia.s.odata::grcia.xsodata`	`sap.hba.apps.grcia.s.roles::SAP_GRC_ROLE_ANALYST`	Use an existing role or create a new one.

For more information about authorization roles and assigned OData services, see Roles, Users, and Authorizations on Back-End Server.