-
Non-Product Related Assistance
Request for existing cases, user IDs, Portal navigation support and more
Request for existing cases, user IDs, Portal navigation support and more
Every use case uses landscape objects in some way. SAP Cloud ALM for Operations use cases monitor the managed system landscape, while SAP Cloud ALM for Implementation uses services and systems in projects. SAP Cloud ALM uses an XSUAA-based role concept to control access to its applications. To access an application, a user needs to be assigned a role collection that contains the necessary scopes for this application. That works well to control general access to and possible activities within an application. What it can't restrict is the access to single landscape entities used by the application. That means that if a user has access to, for example, Health Monitoring, they will be able to view all services and systems supported by Health Monitoring in this SAP Cloud ALM tenant.
This authorization concept doesn't go far enough for many customers. For this reason, Landscape Management developed its own attribute-based authorization concept on top of the existing XSUAA-based concept. Attribute-based access control will allow customers to restrict exactly which specific services and systems users can access within their applications.
Please note: Attribute-based Access Control doesn't replace the Role-based authorizations maintained in User Management, but rather complements and refines them. To access Landscape Management, a user still needs the appropriate roles assigned in User Management.
For security reasons, activating Access Control is a one-way switch. Once it is activated in Landscape Management, it cannot be disabled globally anymore.
Therefore, the following steps are recommended before the activation:
For Access Control to take effect for your end-users, no specific roles need to be assigned to them. Once Access Control is activated, all end-users will automatically be affected.
However, to view the Access Control UIs and maintain Access Control, you require specific Landscape Management roles.
To maintain Access Control Lists and User Assignments, you need the role:
To view existing Access Control Lists and user Assignments, you need the role:
Attribute-based Access Control in Landscape Management works using Access Control Lists (ACLs). Each access control list has a set of restrictions that define which landscape objects it covers. To grant a user access to the objects in the access control list, the user needs to be assigned to the list.
To set up Attribute-based Access Control in Landscape Management, you have to execute the following tasks:
Important: In this section, you will also see the toggle button for global activation. Before activating Access Control, ensure you understand the consequences as described on this page. You do not need to activate Access Control to access the maintenance UIs. You should create your access control lists and user assignments before you activate Access Control globally.
Restrictions in Access Control can be:
The restriction evaluation is executed in the following way:
Access Restrictions
Some input help dialogs are access-restricted. This was designed to enable customers to have different Access Controllers for each subsidiary and to facilitate data separation even within Access Controllers.
If this is not desired, it is recommended that access controllers be exempt from Access Restrictions. This is described in the section 'Exempt Users from Access Restrictions'.
Otherwise, it is recommended that access control lists for Access Controllers be created first, based on, for example, the customer number.
Technical Restrictions
Technical restrictions limit the number of entries in each restriction input field to 100 entries.
In the unlikely case that you need to add more than 100 customer numbers, system types, names, or single landscape objects to an access control list, please create an additional access control list.
Please note: it is not necessary to create an “All systems” access control list. If you want someone to see everything, it makes more sense to “exempt” this person from Access Control. This process is described in the section “Exempt Users from Access Restrictions.”
Rule-based Restrictions
The following rule-based restrictions are currently available for services and systems:
| Restriction Attribute | Description | Operators | Access controlled |
|---|---|---|---|
| Customer Number | The ERP customer number the landscape object is assigned to. | IS | No |
| Service Type | The product type of the service or system | IS | No |
| Service/System Name | The name of the landscape object. | IS or CONTAINS* | Yes |
| Customer Unit | The customer unit a landscape object belongs to | IS | No |
* For contains, you can either enter a part of the name (without wildcards) and press ENTER or if you want a precise name, select it from the input help.
Fixed Restrictions
The following fixed restrictions are currently available for services and systems:
| Restriction Attribute | Description | Operators | Access Controlled |
|---|---|---|---|
| Landscape Object ID | The technical ID of the landscape object. Please use the input help to select the correct landscape object | IS | Yes |
Rule-based Restrictions
The following rule-based restrictions are currently available for Business Services:
| Restriction Attribute | Description | Operators | Access Controlled |
|---|---|---|---|
| Business Service Name | The name of the Business Service | IS or CONTAINS* | Yes |
* For contains, you can either enter a part of the name (without wildcards) and press ENTER or if you want a precise name, select it from the input help.
Fixed Restrictions
The following fixed restrictions are currently available for Business Services:
| Restriction Attribute | Description | Operators | Access Controlled |
|---|---|---|---|
| Business Service ID | The technical ID of the Business Service. Please use the input help to select the correct business service. | IS | Yes |
Adding a business service to an access control list does not automatically give access to the systems and services in this business service.
The user will only have access to information on the business service level and the header information of the services and systems for which they don't have explicit authorizations.
If the user is to have access to the services or system, the Access Controller must ensure that they are also added to the services and systems in this or another Access Control List assigned to the user.
You must assign users to Access Control Lists to give them access to landscape objects on this list.
When you assign a user to an access control list, you can decide whether to grant the user edit or read-only privileges for the objects on this list. This means the same user can have edit access for some systems in Landscape Management and read-only access for others.
In Landscape Management, we support two different privileges:
You can access the user assignment in several ways:
The 'User Assignment' > 'By List' view contains all Access Control Lists maintained in this SAP Cloud ALM. In this view, you can see which users are currently assigned to each Access Control List.
You can use the Live Search to search for access control lists.
The 'User Assignment' > 'By User' view contains all users known in SAP Cloud ALM. In this view, you can see which users are currently restricted by Access Control and which Access Control Lists are assigned to a user.
You can use the Live Search to search for users.
Depending on the global status of Access Control there is also a button to:
During the user assignment, we also check if the user has the necessary roles to execute his tasks in Landscape Management. If the user doesn't have the required roles, we will try to assign the respective role in User Management in Cloud ALM.
Which role is assigned depends on the privilege that is assigned to the user:
If the user already has the necessary roles, no assignment request is sent to User Management.
The feature to exempt users from Access Control restrictions was included to allow the customer to address exceptional situations and to easily create super-users in their system without having to create all-encompassing Access Control Lists (i.e. a "See All ACL").
The assignment of access control lists to the user will not be affected. This is to allow for a fast reactivation of Access Control if a user is only temporarily unrestricted.
To make it easier for Access Controllers to reestablish the status quo (i.e. setting the global setting for all users), we included a feature that allows you to
With the global activation, Access Control will be activated in Landscape Management and all participating use cases.
The global activation is a setting that cannot be reversed.
Before activating Access Control globally you should create your access control lists and test them. To test Access Control, you can activate access restrictions for single users, before you flip the global switch.
Please note: We do not automatically activate restrictions for users when they are assigned to an access control list. We want to enable the customer to completely maintain their access control lists including the user assignment before the global activation of Access Control.
Hence, you have to manually activate Access Control for the test users as long as Access Control is globally inactive.
Access Control influences which services, systems, and business services a logged-on user can see in Landscape Management and whether he can edit them.
The effects of Access Control will be visible in different components of Landscape Management.
In the Scope Selector, the user will only see service types if they can access at least one object of these types.
All other service types will be hidden, even if services and systems with this type exist in the managed landscape.
In the Overview, the user will only see information on the cards for service types if they can access at least one object of these types. Cards for service types that were selected in the scope before the activation of Access Control and can no longer be accessed will show no information and contain the label "No Authorization".
The Event Status indicator will be calculated based on the authorized services and systems associated with a specific service type. This means if an outage exists for a service the user doesn't have access to, it will not be propagated in the status event indicator on the service type card.
In Favorites, the user will only see information on the cards for services, systems, and service types if they can access the service or systems, or at least one object of these types. Cards for services, systems, and service types that were selected in the scope before the activation of Access Control and can no longer be accessed will show no information and contain the label "No Authorization". The user can still remove the favorite even if they are no longer authorized to access it by clicking on the star icon.
The Services & Systems list will only contain services and systems to which the user has access. It can be optionally pre-filtered by service type, depending on the selected scope and the navigation path chosen from the Overview.
The filter, sort, and group functions are defined by the service types that are in scope.
The Live Search will only find services and systems for which the user has authorizations. If the user searches for a service or system for which they don't have authorizations, the Live Search will return an empty result.
The user can add any new service or system type. To do so, he needs a role that contains the x-landscape-manage-ui scope. However, if the user adds a service or system with attributes that are not covered by any of their assigned access control lists, they will not be able to find or access it again until access is granted.
From the Services & Systems List, the user can navigate to the System Details. Whether the details view is opened in edit or read-only mode depends on the user's privileges for this system. The privilege is defined during the user's assignment to the access control list (see the 'User Assignment' section).
In read-only mode, the user cannot perform any change operations for the system. This means the user cannot change system properties, create or change clients or endpoints, and cannot assign or edit tags.
On the Where-Used list for a system, the user can view the Business Services to which the system belongs. Currently, all business services are shown. However, the user can only successfully navigate to the ones he has access to. If he attempts to navigate to a business service for which he has no access, he will receive an error message.
Direct jump-ins are also protected. If a user attempts to access a service or system to which they have no access via a direct URL, they will receive an error message.
On the Business Services view, users can only see the business services to which they have access.
In the business services details, they can see all services and systems that are part of this business service, even if they don't have authorization to access the system details. This was designed to avoid blind spots for the user. However, if they attempt to access a system to which they have no access, they will receive an error message.
Once Access Control is activated in Landscape Management, it will automatically affect use cases that have been onboarded to Access Control.
Right now the following use cases inherit Landscape Management Access Control settings:
In the use case Scope Selector, the user will only see services, systems, and (if supported) business services for which he has authorizations.
All other services, systems, and business services will be hidden, even if they exist in the managed landscape, and are supported and configured for this use case.
The views of the use cases are also access restricted. How exactly Access Control affects them depends on the use cases.
Please make sure that one of the following roles is assigned to your user:
If you just assigned the roles to yourself, please make sure to log off and log on to SAP Cloud ALM for the role changes to take effect.