ABAP add-on

What the add-on is for

Without the add-on FrontTailor works as usual. With it you also get:

• the Roles tab: roles, catalogs, groups, spaces and reachable intents of your own user or – with authorization – another user (Roles and authorizations);
• the complete check chain “Why don’t I see this tile?” with the stages role and start authorization, field by field as in SU53;
• the actual ICF timeout of the session in health instead of an estimate (Health and morning check).

The service only reads; it creates and changes nothing. That is why it is allowed on PROD systems too.

Install

1. Pull the package /CDNA/FIORITAILOR with abapGit from the backend/abap/ folder of the FrontTailor repository.
2. Publish the service group /CDNA/FIORITAILOR_O4 in /IWFND/V4_ADMIN. Default path: /sap/opu/odata4/cdna/fioritailor_o4/srvd/cdna/fioritailor/0001/.
3. Assign the roles (see below).
4. In FrontTailor, switch on Use backend service for this SAP host in the Roles tab. The state should change to Available.

The detailed guide with transport and SICF is in backend/abap/README.md. If an object fails on import (especially the service binding, the authorization object or the application log object), you can create it by hand in ADT, SU21 or SLG0.

Roles and log

Every check of another user is written to the application log SLG1 (object /CDNA/FT, subobject SIMULATION) before the check – with caller, action and checked user. If the log cannot be saved, the check is refused. The panel warns before sending and shows the log number afterwards.

What goes over the wire

• FrontTailor calls the service only after you have switched on Use backend service for the host. Before that, not a single request goes to the service.
• The call always goes to the host of the launchpad tab, with your existing browser session. A different path can be entered, a different host cannot.
• Only the switch (and a different path) is stored, locally in the browser – no answers, users, tokens or cookies. The CSRF token lives in memory only.
• With the policy modules.backend: false the tab disappears, and the check chain and health no longer ask the backend (Enterprise deployment).

States in the “Roles” tab