authorization-iam

Authorization & IAM

Guide for implementing authorization checks and identity/access management in ABAP Cloud and on-premise systems.

Workflow

1. Determine the user's goal:

   • Implementing authorization checks in ABAP code
   • Creating CDS access controls (DCL)
   • Setting up IAM apps, business catalogs, and business roles (ABAP Cloud)
   • Managing PFCG roles (on-premise)
   • Defining custom authorization objects
   • Understanding restriction types

2. Identify the platform:

   • ABAP Cloud (BTP or S/4HANA embedded) → IAM apps + business catalogs + AUTHORITY-CHECK
   • On-premise / Standard ABAP → PFCG roles + AUTHORITY-CHECK

3. Guide implementation with the appropriate authorization model

Authorization Models

ABAP Cloud (BTP / S/4HANA Cloud)

IAM App → Business Catalog → Business Role → Business User
                                    ↑
                            Restriction Type (field-level restrictions)

On-Premise (Standard ABAP)

Authorization Object → PFCG Role → User Assignment
       ↑
Authorization Fields + Permitted Values

Authorization Checks in Code

AUTHORITY-CHECK — ABAP Cloud and On-Premise

The same statement checks authorizations on both. ABAP for Cloud Development restricts it in two ways: the authorization object must be named as a literal, not passed in a data object, and only the current user can be checked — naming another user is a Standard ABAP addition. In ABAP Cloud, check a released authorization object or one created in ADT. There is no released class that replaces the statement; CL_ABAP_AUTHORIZATION does not appear in SAP's list of released objects.

AUTHORITY-CHECK OBJECT 'Z_MY_AUTH'
  ID 'ACTVT' FIELD '03'
  ID 'ZCARR' FIELD lv_carrier.

IF sy-subrc <> 0.
  "User not authorized
  RAISE EXCEPTION TYPE zcx_not_authorized.
ENDIF.

Activity Values (ACTVT)

Value	Activity
01	Create
02	Change
03	Display
06	Delete
16	Execute