Authorizations in SAP S/4HANA and SAP Fiori

Alessandro Banzer, Alexander Sambill

• Publisher: SAP PRESS
• Year: 2020
• ISBN:
  9781493220373
• Edition: 1
• Topic: Computer Science
• Subtopic: Computer Science General
• Index: Computer Science

1 Introduction to SAP Authorizations

This chapter introduces you to the topic of authorizations in SAP, why and when authorizations are needed, and how to implement authorizations in SAP Business Suite as part of your security framework. We’ll reflect on the evolution of SAP systems and its effect on security, which is no longer a matter for your application layer only. Security has become even more important on the layers underneath (typically an SAP HANA database) and above (SAP Fiori or any other client). In addition, we’ll shine a light on current trends, including digitalization, big data, connectivity, platforms, and their effects on today’s SAP landscapes as we move to hybrid environments consisting of both on-premise and cloud-based solutions. This chapter emphasizes the authorizations point of view when operating such a hybrid SAP system landscape.

SAP technology has significantly changed in recent years. New technologies have been introduced; platforms, modules, and solutions have been consolidated; and new applications have been integrated. In this process, SAP’s cloud-first strategy has impacted entire business processing and system landscapes. The power of modernization and digitalization has also driven a focus on the user experience (UX). However, whether application security is still guaranteed with all these changes is not always clear.

Whenever we talk about security concepts, two terms are commonly tossed around, leading to confusion—authentication and authorization. Authentication is when the user logs on to an SAP system with a user name and password or other credentials. An authentication provider validates if your user name and password are correct and allows you to log on. Authentication determines “who you are” but not “what you can do.”

Once a user is authenticated, authorizations come into play to define what the end user can do in the system. A user without authorizations can still log on to the system but is not enabled to use any functionalities within due to missing authorizations. At this point, the user is authenticated, but not authorized.

A common concern is designing authorizations in the right way so your organization can manage access effectively and efficiently. In this chapter, we’ll focus on the term “authorization,” describing its necessity, its various types, and how it fits into the SAP world.

1.1 What Are Authorizations?

Authorizations enable end users to perform activities in a system, from a business operations point of view. Typically, end users have dedicated responsibilities and tasks for which they require specific authorizations. Lacking authorization results in missing access to particular system functions. Access requirements vary across business functions. In rare scenarios, a user may even require several position-specific authorizations due to cross-functions, deputy roles, or job-sharing.

Authorizations also enable the management of access to sensitive functions or data. As such, access to mission-critical system functions or sensitive business data may not be granted to all users. Unauthorized access could result both in a violation of internal policies, as well as a violation of laws or regulations, such as data protection requirements.

Generally, various requirements affect how the access model is designed and how access is granted to your users. These requirements can generally be categorized in the following way:

• External requirements
  • Legal obligations (Sarbanes-Oxley Act, Foreign Account Tax Compliance Act [FICA], General Data Protection Regulation [GDPR], Law of Obligations)
  • GxP requirements (Good manufacturing practices)
  • Industry standards (IEEE standards)
  • Certifications (Cybersecurity Maturity Model Certification, ISO/IEC 27001 — Information security management)
• Internal requirements
  • Internal controls (over financial reporting)
  • Internal policies (code of conduct)
  • Principles (least privilege)
  • Standards (best p...