Transcription

Security and SAP Fiori: Tips and Tricks as YouMove from Transaction Codes to ApplicationsGreg Capps, Business Systems Consultant, Georgia-PacificSession ID # 83589May 7 – 9, 2019

About the SpeakerGreg Capps Business Systems Consultant, Georgia-Pacific 15 years managing security access, risk, governance andarchitecture

Key Outcomes/Objectives1. The Way it Was (And still is for some)2. Fiori Moved My Cheese3. Lessons Learned

Why would a hacker seek SAP vulnerabilities? SAP products are used in 190 countries, by around 300,000businesses. 80% of businesses who use SAP products are in the SMEcategory. 98% of the most valued brands are SAP customers 87% of the Forbes Global 2000 78% of the food in the world is produced by companies big andsmall who use SAP Estimated that 74% of the transaction revenue in the worldtouches a SAP system.

Agenda Classic SAP Transactional Security Fiori Security (S4 and Gateway) Troubleshooting Fiori Security

Classic SAP Security - Build

Classic SAP - Error

Failed Authorizations – SU53

Failed Authorizations TraceSU53 has improvementsbut an authorization traceprovides a better pictureof potential authorizationobject values

SAP GUI SecuritySAP Menu is not linkedto user security roleassignments.USER Menu only includes applications orlinks specifically assigned to the role.

Standard ABAP System Security Security roles needed in a single systemTransactions are added to the role menuAuthorization Errors limited to a single systemReviewing an SU53 you may need to be on theusers application server Authorization traces show all failures but not allfailures are required

Basics of Fiori Security & Troubleshooting FIORI Security OverviewBuilding roles in the SAP Gateway (Frontend)Building roles in an SAP ABAP system (Backend)Troubleshooting Issues

Why FIORI? Single Point of Entry to Multiple SystemsRuns on many devicesDocumented User Productivity GainsMay be designed as a Dashboard or CockpitIntuitive - May reduce training costsSAP Delivered Business Content

FIORI Security Overview FIORI Authorization roles contain tile catalogs andtile groups FIORI Applications require backend security roles Catalog – Set of apps you want to make availablewithin a role Group – Subset of a catalog that shows visibleapps from a catalog

Sample Catalog with Assigned Apps

Sample Catalog Target Mappings

Sample Group with Available Tiles

Build Frontend Gateway Role Insert FIORI Catalogs and Groups Insert Transactions Insert Services (Tiles added to the Catalog will require Services in the PFCG role)

Build Backend Role (S4, GRC, BW, etc.)

Authorizations from SU24 Inserted

After Failure Validate FrontendEvaluate Missing: Authorizations Services Applications

Update with missing services

Test, Validate, Repeat

Troubleshooting is a processSecurity Audit Log

Identifying the root cause is complex Missing ServicesMissing TilesMissing GroupsInactive ServicesMissing Authorization ObjectsTools ST01 STAUTHTRACE /IWFND/ERROR LOG SM20 SLG1 HTTP Trace

Lessons Learned Unlike Standard SAP – FIORI security may takemultiple rounds of analysis No single tool has all of the missing values Remember that the user must exist with thesame ID in both the frontend and backend system Not all failed authorizations or missing tiles arerole related – may be catalog, group or service

Lessons Learned Continued Default Authorizations Values May Be Incomplete Services and Missing Authorizations maybedocumented on the FIORI App Catalog Need to identify where the failure is occurringsince multiple systems are involved

Useful Links ewer/https://help.sap.com/saphelp /content.htm?no cache misconceptionsto-avoid/

Take the Session Survey.We want to hear fromyou! Be sure to completethe session evaluation onthe SAPPHIRE NOW andASUG Annual Conferencemobile app.

Presentation MaterialsAccess the slides from 2019 ASUG Annual Conference here:http://info.asug.com/2019-ac-slides

Q&AFor questions after this session, contact me at [email protected]

Let’s Be Social.Stay connected. Share your SAP experiences anytime, anywhere.Join the ASUG conversation on social media: @ASUG365 #ASUG