How to assign Users as Approver and Requester in SAP Build Process Automation

[ayechan]

Hi Everyone,

I am now creating Approval Form using SAP Build Process Automation.

1. And I am confusing how can I assign users as Approver and Requester Roles.

2. And how can I give administrator role to user also?

Could you please give me advice about these questions?

And if you have any related documentation, cloud you please share with me?

Thank you.

Best Regards,

Aye Chan

[Dan_Wroblewski]

Also see https://help.sap.com/docs/build-process-automation/sap-build-process-automation/authorizations

[Dan_Wroblewski · Accepted solution]

AFter creating approval form, you fill in the Recipients for who will do the approving. It can be an email address, or a group defined in your custom IDP, or multiple users.

As for the requester, that will be the user who fills out the trigger form or who calls the API trigger.

There is an administrator role that you can give to anyone. Perhaps explain the second question some more

[ayechan · Accepted solution]

Hi @Dan_Wroblewski,

In this place, I added new user mail by using custom variable.

But, the form request is not sent to the added user's BTP inbox.

Do I miss something like give permission to use the form for the other user?

And also how can I get the users from custom IDP (is it same with cloud identity service?)?

Could you please show me sample set up?

For second question, I mean that I would like to add more users as administrator who can add new users and define which user should have Approver access and which user should have Normal User access.

So, how can I add that kind of more administrator users from the specific one administrator?

And if we want to use inbox of SAP Build, we will need to assign the required Role collection to user, right?

So, is it possible to assign the required Role collection to other users from the specific one admin user?

Thank you very much for your answer in previously comment!

Best Regards,

Aye Chan

[arroyoweisson]

@ayechan ,

Based on the overview, your problem is that the recipient do not receive the form when you send the approval form, right? (this is given that all the respective user roles in BTP have been assigned properly).

Here is the thing:

the variable Approver you created should be a "List" of string. In this way, the form accepts the email addresses separately.

if you are expecting a single email/approver to pass. The script should look like this.

$context.custom.Approver =[];
$context.custom.Approver[0] = test@email123.com;

if you are expecting to have multiple approvers. You need to add condition splitting them by ";"

then pass the Approver variable to the "Users" recipient.

I hope this help. 

[ayechan]

Hi @arroyoweisson ,

Thanks for sharing information!

Now, when I change approver mail in workflow, the approval request is sent to the Inbox.

But since all approver users are created in the same BTP subaccount,

All users share to use only one "Inbox" in my case.

So, although requester sent approval request to Approver A only, all other approvers who can access "Inbox" can see that request too and "Approve" or "Reject" too.

Only "A Citizen Developer Tool Access Request by test" is sent to Approver A and all other requests are sent to Approve B.

But both Approver A and Approver B can see all requests.

The requirement I would like to get is that if the approval request is sent to Approver A, only Approver A should see that request. Other Approvers should not see it.

Is it some steps missing in my case?

Could you please continue to guide for me?

Thank you very much!

Best Regards,

Aye Chan

[Dan_Wroblewski]

OK, now I'm further confused. 

• Why does each user needs his/her own subaccount?
• A user does not really belong o a subaccoun, hey belong to an IDP that defines a set of users. Each subaccount can form a trust with an IDP and then recognize those users within that subaccount. 
• You said you created a BTP account for each user. You mean a BTP global account, nit just subaccount?
• And it doesn't make sense to me that users would have multiple Inboxes.

I think we need to clarify the landscape you want to have -- IDPs, global accounts, subaccounts, users.

I imagine there are scenarios of federation, like a company with BTP buys a subsidiary with a different BTP and there is a need to unify things, but I'm not an expert there. 

@beapasch-- maybe you can help or refer his to someone  

[ayechan]

Hi @Dan_Wroblewski,

I created one user for one global account and one subaccount.

So, I have now 2 users, 2 global accounts and 2 subaccounts.

Because in our approval system, there can be many approvers and each approver wants to login to the system with their own email.

So, I think, each approver user has each own inbox separately.

And I am not sure that this requirement can be done by using only one BTP account.

Can we let the approver users login and use Inbox of SAP Build by using their own emails if we created many subaccount in only one BTP account?

If we can, how can I proceed to get like this. I mean that creating many subaccounts by using many emails in just one BTP account?

Could you please provide the information about it?

Thank you.

Best Regards,

Aye Chan

[Dan_Wroblewski]

Why did you do all this? Are you working with others on this project? Did someone tell you that you need a landscape like this?

[Dan_Wroblewski]

Unless you have a specific landscape in mind, you do the following: (1) 1 global account and 1 subaccount; (2) Create users in your custom IDP and make sure they are listed as users in your subaccount (and make sure your IDP is trusted by your subaccount); (3) Use Process Automation. You will have one component that is Inbox but everyone will open it and see their items.

[ayechan]

Hi @Dan_Wroblewski,

Actually, I am now checking by myself how can I able to achieve the requirement (using many approvers) that I mentioned above.

So, I though that I will need to create like that and created them.

And during checking, I am confusing that I am doing the right thing or not.

So, I decided to ask a question in community.

And if so, I would like to confirm that I will need to create users for approver in that Security > Users of BTP account?

And is it possible to show/hide the approval form request based on the login users in Inbox of sap build since they shared one Inbox?

Because since the workflow I would like to create have multiple approval steps like (HR can approve after Manager have done approving and only show to HR user at that time Manager have done approving).

[Dan_Wroblewski]

As for question 2, you are saying that you want to give to allow more people to give the ProcessAutomationParticipant role collection to users. To give role collections to people you must have some admin rights on the BTP subaccount level. You may have to give subaccount admin rights, which are pretty powerful rights.

I will ask if there is another way.

[ayechan]

Hi @Dan_Wroblewski,

Thanks for your information.

And I would like to know that is it possible to give that role collection assignment of user from another admin access user?

e.g. There is admin user A and normal user B.

normal user B has no role collection assignment yet.

And admin user A want to give the required role collection assignment to normal user B without doing anything from normal user B's side.

is it possible to do so?

if yes, how can we do like this?

(or) each user will need to login to their BTP account and give the required role collection by themselves?

[Dan_Wroblewski]

I'm confused why you would think the user gives himself the role collection? Or that it would not be possible for an admin to assign a role to a user? Or why a user would have to do anything to receive the role? I think it's best to better understand how BTP works a little better ... happy o assist

[ayechan]

Hi @Dan_Wroblewski,

Normally, the work of admin is

1. they can add new users in the system

2. they can decide which user can access which part of the system

3. they can add access to other user as new admin, etc...

So, I would like to know the admin role of user in SAP Build Process Automation service is same like other?

And as I checked,

1. I created one approval workflow and I assigned myself as Admin role by assigning "Administrator" role in BTP account.

2. I can access the approval form workflow and can also able to access Inbox that can decide "Approve" or "Reject" the approval form.

3. I added new users in Cloud Identity Service and these users are also able to access the form link directly by using their own user and password.

4. I assigned the ProcessAutomationAdmin, ProcessAutomationParticipant roles to the new user accounts from my BTP account.

5. But, they cannot access the Inbox of SAP Build automatically although I assigned the required roles to these user accounts.

6. I needed to login the other new user BTP account and need to assign the required roles.

7. After then, that new user account also access the Inbox of SAP Build. 

8. I updated the Recipient User of Workflow as the new user mail. But the approval request of "Approve" or "Reject" is not shown in Inbox of new user.

I checked the documentation about user assignment provided by SAP and it is hard to understood for me, how the User Role assignment and Admin role works in SAP Build Process Automation.

So, I am checking that I miss some steps (or) do something wrong by asking questions in community blog.

Could you please point out for me if I understood wrongly?

[Dan_Wroblewski]

As to question 1,  users who you want to receive forms for any process must be given the role collection ProcessAutomationParticipant.

Users should be set up in the custom IDP (though I think this is not mandatory for Process Automation) and you should provide the role collections in the correct IDP.

When you "get the users from IDP", what do you mean? 

[ayechan]

Hi @Dan_Wroblewski,

I already gave these 4 role collections to the user that is used as Recipient User in SAP Build Process Automation workflow.

But, when I submit the approval form, the approval form request notification is not shown in the Inbox of that user.

The steps I have done in workflow is that

1. I added the other BTP account user's mail in this custom variable.

2. Used that custom variable in Recipient User like this.

3. Save, release and deploy the workflow and copy form link and submit the form.

4. But none is shown in Inbox of Recipient User.

Note: If I used Process Started By in Recipient User, request is successfully sent to Inbox of Process Started By user.

So, I set Process Started By user's mail in custom variable "Approver" and test the workflow.

If so, the request successfully sent to Inbox too.

So, meaning to say, the problem is not because of custom variable.

May be because of some access needed in BTP account of other user that is used as Recipient User.

So, I would like to know that I miss some steps to do in BTP account of other user, rather than assigning ProcessAutomationParticipant role collection. 

Could you please point out for me if I miss some steps?

[Dan_Wroblewski]

You assigned the role to the custom IDP user, default IDP user, or both? How does hat other user get to their inbox?

[ayechan]

Hi @Dan_Wroblewski,

I assigned these roles to Default Identity provider.

And the inbox is got because the other user that I used in Recipient User also subscribed "SAP Build Process Automation" service.

This inbox is SAP Build's Inbox. Open form the yellow highlighted icon.

[Dan_Wroblewski]

2 things I'm confused about: How did the other user log into SAP Build (meaning which IDP)? When you say the other user "subscribed" to process automation, hat is confusing, because "subscribing to a service" is done by the admin when they essentially install the service on the subaccount, so what does it the user "subscribed ... o the service"?

[ayechan]

Hi @Dan_Wroblewski,

We have 2 emails like user1@company.com and user2@company.com.

And we created BTP account for both email.

So, user1@company.com subscribed to BTP account and has its own subaccount.

And also, user2@company.com subscribed to BTP account and has its own subaccount too.

The workflow is created by user1@company.com and we would like to set many approvers in our workflow.

eg. if amount > 100 - approval of user1@company.com will be needed.

      if amount > 200 - approval of both user1@company.com and user2@company.com will be needed.

So, we want to give Inbox and Permission of "Approve" or "Reject" access to both users.

And these access are ok for user1@company.com who is created the workflow. But for the user2@company.com, we don't unsure how to give these access.