authorization-iam

Authorization & IAM

Guide for implementing authorization checks and identity/access management in ABAP Cloud and on-premise systems.

Workflow

1. Determine the user's goal:

   • Implementing authorization checks in ABAP code
   • Creating CDS access controls (DCL)
   • Setting up IAM apps, business catalogs, and business roles (ABAP Cloud)
   • Managing PFCG roles (on-premise)
   • Defining custom authorization objects
   • Understanding restriction types

2. Identify the platform:

   • ABAP Cloud (BTP or S/4HANA embedded) → IAM apps + business catalogs + CL_ABAP_AUTHORIZATION
   • On-premise / Standard ABAP → PFCG roles + AUTHORITY-CHECK

3. Guide implementation with the appropriate authorization model

Authorization Models

ABAP Cloud (BTP / S/4HANA Cloud)

IAM App → Business Catalog → Business Role → Business User
                                    ↑
                            Restriction Type (field-level restrictions)

On-Premise (Standard ABAP)

Authorization Object → PFCG Role → User Assignment
       ↑
Authorization Fields + Permitted Values

Authorization Checks in Code

ABAP Cloud — CL_ABAP_AUTHORIZATION

"Check authorization using released API
DATA(lo_auth) = cl_abap_authorization=>check_authorization(
  EXPORTING
    authorization_object = 'Z_MY_AUTH'
    authorizations       = VALUE #(
      ( field = 'ACTVT' value = '03' )    "Display
      ( field = 'ZCARR' value = lv_carrier )
    ) ).

IF lo_auth->is_authorized( ) = abap_false.
  "User not authorized
  RAISE EXCEPTION TYPE zcx_not_authorized.
ENDIF.

On-Premise — AUTHORITY-CHECK

AUTHORITY-CHECK OBJECT 'Z_MY_AUTH'
  ID 'ACTVT' FIELD '03'
  ID 'ZCARR' FIELD lv_carrier.

IF sy-subrc <> 0.
  MESSAGE e001(z_msg) WITH lv_carrier.
  RETURN.
ENDIF.

Activity Values (ACTVT)

Value	Activity
01	Create
02	Change
03	Display
06	Delete
16	Execute