Auth Objects for Fiori Target Mapping

[#1]

Hi Gurus,

I'm doing a security assessment that includes a SoD analysis of Fiori Apps. In many of the catalogs we have, I found some Target Mappings (Semantic Object + Semantic Action) that does not have a Tile assigned in the Launchpad Designer. This Catalogs are part of a role and that role is being assigned to the end user.

This means that the user has authorization for this Target Mapping even if he doesn't see a Tile in his Fiori Launchpad.

I need to know if there is a way to get the Auth Objects related to that Target Mapping. A trace is not an option since the user can't execute it because there is not a Tile in his Launchpad.

Thank you in advance

[Colleen · Accepted solution]

HI Lucrecia

Some Fiori Apps have App to App navigation and the additional target mapping provides the additional access. Tiles are not the only entry point to an application (I think of it a bit like menu hopping and navigating in SAPGUI - line item report can allow you to jump across to changing a document which is a different transaction code).

I've tracked some of this by going into F12 developer tools and grabbing the library.preload.json URL. I then relaunch it in another browser tab. From there I can then search for the target mapping to see if it relates to a button, etc on the App. Once I've figured out what it's like to I can then trace that part of the app. My trace file then confirms which OData Service, etc that I launched to help match it back. The trace file will then give me the authorisation objects which I can map into SU24.

Do you have an example of SAP Standard Catalog, etc?

Also, if by chance they have split tile and taget mapping up, you can try going into Fiori Content Manager and search for the app information to see if there is a tile define in another catalog.

[Former Member · Accepted solution]

Hi Collen,

This looks promising, I will follow your process and let you know if I got what i need.

Thank you so much.

[filipn]

I don’t know full answer, so just a little help:

If you want to implement e.g. two Standard Fiori Application (Manage External requirements <APP ID - F0250> & Manage Internal requirements <APP ID - F0270>), the standard Tiles are missing for these two applications in Technical as well as Business Catalogs while we can see Target mapping exist for these two apps.

Explanation:

No tile is delivered for this Manage app. To open it, you first have to start one of the Monitor Material Coverage apps and make various settings to display only those materials you want to monitor. After selecting one or more materials in the list, you can navigate to this Manage app.

You can save your personalized settings as a variant tile and then access this Manage app directly from your SAP Fiori home page.

Regards,

Filip

[Former Member]

Hi Filip,

Thanks for your answer.

What you are telling me confirms that this "Apps", that doesn't have a tile, have underlying authorizations that are given to the user when being assign. The user has the capacity to perform actions even if it is not as directly as to click on a tile.

What I need is the Authorization Objects that this Target Mappings grants to the user, but I can't find them anywhere. If we do a trace for your example, we will have the AuthObj from the other apps in the same log, so we won't be sure which ones belong to the one "App" without a tile.

Regards