Show TOC

 App Implementation: Critical Role Assignments Locate this document in the navigation structure

System Landscape Requirements

Before you can start to implement the app, ensure that your system landscape has been set up to enable SAP Fiori. This also implies that the front-end and back-end components for your app are already available in this system landscape:

SAP Fiori System Landscape Options

Setup of SAP Fiori System Landscape with SAP HANA XS

Configuration of Front-End Server

Configuration of SAP Fiori Infrastructure

Back-End Components (Product Version Stack)

SAP Access Control 10.0 SPS14

SAP Access Control 10.1 SPS06

SAP HANA Content Component Delivered with (Product Version Stack)

SAP Smart Business 1.0 for SAP solutions for GRC

VDM Contained (Product Version Stack)

SAP HANA Analytics for GRC 1.0

Front-End Components Delivered with (Product Version Stack)

SAP Smart Business 1.0 for SAP solutions for GRC

Instance: Frontend Serv. Cont. GRC Analy.

Software Component Version: UIHGRC01 100

Tile Type for Launching App

The Critical Role Assignments analytical app uses a KPI tile to launch the app.

Required SAP Notes

For the Critical Role Assignments app, the following SAP Notes must be implemented:

Back-End/Front-End Server

SAP Note Number

Description

General Note

1938011

SAP Smart Business for access control management

Implementation Tasks

The following sections list tasks that have to be performed to implement the Critical Role Assignments tile. The tables contain the tile-specific data required for these tasks.

HANA Server: Assign SAP HANA Roles to Users and Roles

SAP HANA Role

Needed for ...

sap.hba.r.grc.roles::SAP_SMART_BUSINESS_ACCESS_CONTROL_MANAGER

Read access to KPI data (views and XS OData services)

As a prerequisite for read-access to KPI definition, ensure you have assigned the generic role Smart Business Runtime Role (sap.hba.apps.kpi.s.roles::SAP_SMART_BUSINESS_RUNTIME) for read-access to KPI definition to all users or roles.

As a prerequisite for KPI modeling, ensure you have assigned the generic role Smart Business Administration Role (sap.hba.apps.kpi.s.roles::SAP_SMART_BUSINESS_MODELER) to specific users (e.g. key user, administrator).

For more information about SAP HANA roles, see Assigning Roles for Accessing SAP HANA Data.

HANA Server: Generate and Assign Analytic Privileges to Users and Roles

Needed for ...

How to generate?

Access to KPI data (only views)

Generated by Authorization Assistant

For more information, see Generating Analytic Privileges.

Access to KPI definition in KPI catalog

Generated by KPI Modeler

For more information, see KPI Modeler.

Needed for ...

How to generate?

Access to business data (only views)

Generated by Authorization Assistant tool

For more information, see Generating Analytic Privileges.

Front-End Server: Activate UI5 Application

UI5 Application

Technical Name

Generic Drill-down Application

/sap/bc/ui5_ui5/sap/ca_kpi

For more information about how to activate the UI5 application (ICF service), see Activate ICF Services.

Front-End Server: Enable App for Access in SAP Fiori Launchpad

There are several steps to be performed to enable the app for access in the SAP Fiori launchpad. You require the following data to perform these steps:

Component

Technical Name

Business Role (needed for access to KPI catalog and generic drill-down application)

SAP_KPIFRW4_TCR_S

This business role comprises the following two catalog providers listed under Business Catalog.

For more information about adding an app to the SAP Fiori Launchpad, see Setup of Catalogs, Groups, and Roles in the SAP Fiori Launchpad.

Technical Data

Technical Data

Technical Name

KPI Definition (ID)

sap.hba.grc.AccessControlUsersWithCriticalRoleQuery

Query Views (Assigned to this KPI)

AccessControlUsersWithCriticalRoleQuery

OData Services (Assigned to this KPI)

/sap/hba/r/grc/odata/grc.xsodata()

Entity Sets and Measures (Relevant for this KPI)

Entity set: AccessControlUsersWithCriticalRoleQuery

Measures: NumberOfUserAssignments

Semantic Object

AccessUser

Business Role (Needed for Access to KPI Catalog and Generic Drill-Down Application)

SAP_KPIFRW4_TCR_S

This business role comprises the two catalogs listed under Business Catalog below.

Business Catalog

SAP_KPIFRW_TC_R (for KPI catalog)

SAP_KPIFRW_TC_S (for generic drill-down application)

Report Launchpad (for Generic Drill-Down Application)

Role: UISKPI01

Instance: ANALYTICS

Application Alias: analyzeKPIDetails