Enabling WEBGUI Firefighter in SAP GRC

[Shivday]

Purpose

SAP has enabled the feature to execute Fire Fighter for web-based transactions using WEB-GUI Firefighter functionality. Now FF users can execute NWBC, FIORI and other web-based transactions using WEB-GUI FF. Web GUI is enabled for the cases where some web apps are not accessible via SAP GUI. In this blog, I am going to provide the step-by-step process for enabling WEBGUI firefighter, pre-requisites, limitations and usage.

 

Configuration

 This configuration is applicable for centralized Firefighter configurations in SAP GRC 12.0, SP17

 

Activation steps

Actions needs to be performed in GRC system

GRC Team

• Go to SPRO à IMG à Governance, Risk and Compliance à Access Control à Maintain Connector Settings

• Select the connector à Assign Attributes to the connector
• For Embedded Fiori systems and Fiori systems we have to add SESSION_MANAGER and /UI2/FLP parameter

• For the systems, where Fiori is not there, we just have to add SESSION_MANAGER

Basis Team

• Offline coActivate below SICF services:

         /default_host/sap/bc/gui/sap/its/webgui

        /default_host/sap/public/myssocntl

        /default_host/sap/public/bc/ur

       /default_host/sap/public/bc/its/mimes

• Below RZ10 parameters needs to be maintained with mentioned parameter values.

               Login/accept_sso2_ticket = 1

               login/create_sso2_ticket = 2

Actions needs to be performed in PLUG-IN system

Basis Team

• Activate below SICF services

              /default_host/sap/bc/gui/sap/its/webgui

              /default_host/sap/public/myssocntl

• Below RZ10 parameters needs to be maintained with mentioned parameter values

         login/accept_sso2_ticket = 1

         login/create_sso2_ticket = 2

• ~NO_LOGON_USEREXIT = 1 parameter needs to be maintained under GUI configuration in WEBGUI SICF service under path “/default_host/sap/bc/gui/sap/its/”

Click on GUI configuration and maintain the ~NO_LOGON_USEREXIT=1

• Whitelisting of WEBGUI URL’s is required – where basis team confirmed on the process.
  • Go to Uconcockpit transaction.
  • Cross verify, if paths are whitelisted or not. If not kindly whitelist the required path
  • Add entry - https *.azure.intra.xxxxxx, port = *  /sap/bc/gui/sap/its/* and whitelist if any path is blocked with below parameters.  *.azure.intra.xxxx  port = *
  • Activate and ask GRC team to validate in all systems.

Below is the reference Screenshot.

Fiori Team

Create a Fiori Tile “GRC_FireFighter WebGUI” for end user and create a portal role to access the WEBGUI FF functionality by clicking on that Tile.

 

Pre-requisite to access FFID via Web GUI

• FFID for required plug-in system should be assigned to FF users.
• To access any backend systems WEBGUI FF ID, user should login to Fiori portal link to access GRC-Firefighter- WEBGUI tile.

Limitations

1. Web-Gui Browser needs to be closed and should be refreshed during logout.
2. SAP has limited the FF login using multiple FF IDs for same FF user and system. (Reference SAP note: 2672041 - GRC 12.0: Web Based Emergency Access Management)
3. Not all FF logs will be captured related to web applications, especially for Web Dynpro tiles (Reference SAP note: 2952305 about FF log limitation)

Functionality availability

If you have different backend system then below table provides information about what the functionality available in the corresponding system on like WEBGUI FF logon, WEGGUI TCODES, GUI Tiles, WDA tiles, UI5 tile, BRF+, SOAMANAGER, NWBC, CRM_UI etc. and this may change going forward.

System	WEBGUI FF logon- GRC	WEBGUI TCODES	GUI tile	WDA tile	UI5 tile	BRF+	SOAMANAGER	NWBC	CRM_UI
S4	Available	Available	Available	Available	Available	Available	Available	Available	NA
MDG	Available	Available	Available	Available	Available	Available	Available	Available	NA
CRM	Available	Available	NA	NA	NA	Available	Available	Available	Available
BW	Available	Available	NA	NA	NA	NA	NA	Available	NA
EWM	Available	Available	Available	Available	Available	Available	Available	Available	NA
Fiori	Available	Available	Available	Available	Available	Available	Available	Available	NA
GRC	Available	Available	NA	NA	NA	Available	Available	Available	NA

 

Summary

In this blog, I explored the significance of enabling SAP WEBGUI Firefighter features, configuration, pre-requisite, limitation, functionality available.

In upcoming blog, I will provide fixes of all issues that encountered during the WEBGUI FF functionality testing.