Creating Roles and Managing Authorizations in SAP Build Apps

[Hossam_Fathy]

I am working on SAP Build Apps and need some assistance with managing roles and authorizations effectively. Specifically, I have the following queries:

1. How can I create a role with specific objects or actions in SAP Build Apps? For example, if I want to grant access to certain features or functionalities, what is the best approach to define such roles?

2. What is the recommended way to configure and manage authorizations for these roles to ensure that users only access the features assigned to them?

3. Are there specific tools or configurations in SAP Build or SAP BTP that I should use to streamline the process?

Any guidance, best practices, or relevant documentation links would be highly appreciated.

Looking forward to your support.

[Dinu · Accepted solution]

Adding to what Dan said about the lack of support from Build Apps for roles, Note that access control is the responsibility of the backend. Only support from Build Apps is for Authentication. If the user can login, she can access your app. What user have access to is determined by the backend. So look for authorization control in the backend.

SAP Build Apps - Service Guide | Security | SAP Help Portal

Any authenticated users with access to the SAP Build Work Zone tenant will be able to access the Build Apps frontend applications.

Access to all business services and data must be done using BTP Destinations, and the destinations must be configured to use principal propagation. The backend system is responsible for authorization checks when accessing data resources. 

[Dan_Wroblewski]

SAP Build Apps does not currently have role-based access, except to VCF. Some possible ideas:

• If you want to use BTP roles, you could create a CAP service that defines roles, assign those roles to users as you would with any other roles in the cockpit, and then when your app loads see the roles and hide the UIs as needed. This is described in this tutorial: https://developers.sap.com/tutorials/build-apps-cap-app.html#0bb3011a-41c3-40dc-90d3-5084d2fab47b
• You can use the role based access in VCF to allow an admin to manage a table(s) with user permissions, and then similarly check these when a user opens the app.

These are just my ideas, and I do not know what would be the recommendation by the product team.