Authorization & IAM

Guide for implementing authorization checks and identity/access management in ABAP Cloud and on-premise systems.

Workflow

1. Determine the user's goal:

   • Implementing authorization checks in ABAP code
   • Creating CDS access controls (DCL)
   • Setting up IAM apps, business catalogs, and business roles (ABAP Cloud)
   • Managing PFCG roles (on-premise)
   • Defining custom authorization objects
   • Understanding restriction types

2. Identify the platform and clean core level:

   • ABAP Cloud (SAP Cloud ERP or SAP BTP ABAP Environment) → IAM apps + business catalogs + CL_ABAP_AUTHORIZATION (Level A)
   • Classic ABAP / SAP Cloud ERP Private → PFCG roles + AUTHORITY-CHECK (Level B)
   • Wrapper scenarios → SU22 data and variants for non-released authorization objects