OVERVIEW

This blog gives an overview of configuration steps required to configure and use Fiori as the front end for SAP GRC 12.0 Access control in HUB deployment scenario.

SAP GRC Fiori apps are an alternative to NWBC for accessing SAP GRC Access Control. SAP provides individual apps for the links for that you find in NWBC including dashboard reports

There are 130 apps provided for SAP GRC Access Control that give you flexibility for assigning access as required.

Another feature that SAP GRC Fiori apps provides is that they are mobile devices compatible

You will also learn to simulate as to how the apps would be displayed on mobile devices

ASSUMPTION

• SAP GRC 12.0 is implemented

PRE-REQUISITES

• For integrating GRC for FIORI, ensure that the addon UIGRAC01 with SP02 (minimum) is installed in the FIORI system

• Ensure that ALL users have proper authorizations for authorization objects S_RFC and S_RFCACL (required for trusted RFC connections)

CONFIGURATION

Step 1:  Setup Trusted RFC connections from Gateway system to GRC system.

• Ensure that three (four if HTTP connection is considered) Trusted RFC connections are setup to GRC system from Fiori system

• You have to create one Trusted RFC connection from GRC system to Fiori system

Step 2: Create System Alias for GRC system in FES

• Execute transaction /n/ui2/GW_SYS_ALIAS to create system alias for GRC system or maintain the table /IWFND/V_DFSYAL with the Tcode SM30

Step 3: Maintain System Alias table

• Verify system alias table /UI2/V_SYSALIAS for SOHGRAC system alias (SAP delivered) for GRC AC and maintain the system alias of your GRC system

Step 4: Map the Your System Alias to SAP system Aliases

• Map the system alias SOHGRAC to the system alias of your GRC system in the table /UI2/V_ALIASMAP

Step 5: Replicate the Technical Catalog from the Back-end System

Search for GRC catalog SAP_TC_GRC_AC_BE_APPS  in Fiori Launchpad designer

• It the catalog does not exist in Fiori Launchpad Designer, execute the program /UI2/GET_APP_DESCR_REMOTE_DEV with the following selection criteria

• • SOHGRAC – system Alias
  • SAP_TC_GRC_AC_BE_APPS – SAP standard back end program for replication
  • Replication mode: Full Replication

After executing the program, you will get a summary information on the catalogs and number of apps available in the catalog for deployment

Step 6: Validate the Technical Catalog in the Launchpad Designer

You can validate the catalog availability in the Fiori LaunchPad Designer with transaction code /n/UI2/FLPD_CUST

Step 7: Create Fiori Catalog page in font end system

• Create a custom catalog with Access Request apps as per your requirement using the transaction /UI2/FLPD_CUST

Step 8: Create Fiori Group page in Front End System

• Next, create group with Access Request apps that you want to give access to the users using transaction /UI2/FLPD_CUST

Step 9: Assign the Catalog and Group in PFCG role

• Create a role in FIORI system for the GRC apps based on the catalog and group created by you in the Fiori system

• • Assign the catalog id and group id in the Fiori (FES) system

Create a test user id in FES and assign the role to the user id

Step 10: Assign the WebDynpros of the GRC apps in PFCG Role in Back-End (GRC) System

• Create a role in FIORI system for the GRC apps based on the catalog and group created by you in the GRC system (BES)
• • Assign the Webdynpro service of the apps in the Backend (BES) system
• • • In PFCG Menu tab, go to Authorizations Default –> TADIR –>  WebDynpro (WDYA)

Create a test user id with the same name that you created in FES, in BES and assign the role the user id

Step 11: Validating the Configuration

Login with the test user id and execute the transaction /n/ui2/flp

Click on the Group containing your Fiori apps, and then click on the tile that you want to execute (E.g. Search Requests)

‘

Click on Search button

You get a list of access requests

Step 12: Simulating Mobile Display

To simulate how the app will look on mobile devices, right click on the browser and click on Inspect

You will get into the debug mode of the browser

Another section will open on the left side of the browser you will find Dimension Responsive pull-down option

You have the options for selecting the mobile device to check how the app would look like on that particular device

In this example, we are simulating the app on iPad Air device

SUMMARY

• For integrating GRC for FIORI, ensure that the addon UIGRAC01 with SP02 (minimum) is installed in the FIORI system
• SICF services of the WebDynpros of the GRC apps should be activated
• The App Webdynpros should be added to PFCG role in GRC system

Any feedback, thoughts and comments on this topic are welcome.

Other blogs to follow on the topic

SAP Fiori Solution for SAP Access Control