Landscape objects, such as cloud services, technical systems, and business services, are among the main entities in SAP Cloud ALM. Cloud services and technical systems represent the managed landscape of the SAP Cloud ALM customer, while business services group these services and systems into logical units.
Every use case uses landscape objects in some way. SAP Cloud ALM for Operations use cases monitor the managed system landscape, while SAP Cloud ALM for Implementation uses services and systems in projects. SAP Cloud ALM uses an XSUAA-based role concept to control access to its applications. To access an application, a user needs to be assigned a role collection that contains the necessary scopes for this application. That works well to control the general access to and the possible activities in an application. What it can't restrict is the access to single landscape entities used by the application. That means if a user has access to, e.g., Health Monitoring, they will be able to see all services and systems that are supported by Health Monitoring in this SAP Cloud ALM tenant.
This authorization concept doesn't go far enough for many customers. For this reason, Landscape Management developed its own attribute-based authorization concept on top of the existing XSUAA-based concept. The attribute-based access control will allow customers to restrict exactly which specific services and systems users can access in their applications.
Please note: Attribute-based Access Control doesn't replace the Role-based authorizations maintained in User Management, but rather complements and refines them. To access Landscape Management a user still needs the appropriate roles assigned in User Management.
For security reasons, activating Access Control is a one-way switch. Once it is activated in Landscape Management, it cannot be disabled globally anymore.
Therefore the following steps are recommended before the activation:
Access Control will also affect the following SAP Cloud ALM use cases:
For Access Control to take effect in your end-users, no specific roles need to be assigned to them. Once Access Control is activated, all end-users will automatically be affected.
However, to see the Access Control UIs and to maintain Access Control you need certain Landscape Management roles.
To maintain Access Control Lists and User Assignments you need the role:
To view existing Access Control Lists and user Assignments you need the role:
Attribute-based Access Control in Landscape Management works using Access Control Lists (ACLs). Each access control list has a set of restrictions, which define which landscape objects are covered by it. To grant a user access to the objects in the access control list, the user needs to be assigned to the list.
To set up Attribute-based Access Control in Landscape Management you have to execute the following tasks:
Important: In this section, you will also see the toggle button for global activation. Before you activate Access Control, make sure you understand the consequences as described on this page. You do not need to activate Access Control to access the maintenance UIs. You should create your access control lists and user assignments before you activate Access Control globally.
Restrictions in Access Control can be:
The restriction evaluation is executed in the following way:
Access Restrictions
Some input help dialogs are access-restricted. This was designed to allow customers to have different Access Controllers for different subsidiaries and to allow data separation even for Access Controllers.
If this is not desired, it is recommended that access controllers be exempt from Access Restrictions. How to do this is described in the section 'Exempt Users from Access Restrictions'.
Otherwise, it is recommended that access control lists for Access Controllers be created first, based on, for example, the customer number.
Technical Restrictions
Technical restrictions limit the number of entries in each restriction input field to 100 entries.
In the unlikely case that you need to add more than 100 customer numbers, systems types, names, or single landscape objects to an access control list, please create an additional access control list.
Please note: it is not necessary to create an “All systems” access control list. If you want someone to see everything it makes more sense to “exempt” this person from Access Control. How this is done is described in the section “Exempt Users from Access Restrictions”.
Rule-based Restrictions
The following rule-based restrictions are currently available for services and systems:
| Restriction Attribute | Description | Operators | Access controlled |
|---|---|---|---|
| Customer Number | The ERP customer number the landscape object is assigned to. | IS | No |
| Service Type | The product type of the service or system | IS | No |
| Service/System Name | The name of the landscape object. | IS or CONTAINS* | Yes |
| Business Unit | The business unit a landscape object belongs to | IS | No |
* For contains, you can either enter a part of the name (without wildcards) and press ENTER or if you want a precise name, select it from the input help.
Fixed Restrictions
The following fixed restrictions are currently available for services and systems:
| Restriction Attribute | Description | Operators | Access Controlled |
|---|---|---|---|
| Landscape Object ID | The technical ID of the landscape object. Please use the input help to select the correct landscape object | IS | Yes |
Rule-based Restrictions
The following rule-based restrictions are currently available for Business Services:
| Restriction Attribute | Description | Operators | Access Controlled |
|---|---|---|---|
| Business Service Name | The name of the Business Service | IS or CONTAINS* | Yes |
* For contains, you can either enter a part of the name (without wildcards) and press ENTER or if you want a precise name, select it from the input help.
Fixed Restrictions
The following fixed restrictions are currently available for Business Services:
| Restriction Attribute | Description | Operators | Access Controlled |
|---|---|---|---|
| Business Service ID | The technical ID of the Business Service. Please use the input help to select the correct business service. | IS | Yes |
Adding a business service to an access control list does not automatically give access to the systems and services in this business service.
The user will only have access to information on the business service level and the header information of the services and systems for which he doesn't have explicit authorizations.
If the user should have access to the services or system, the Access Controller needs to make sure that he also adds the services and systems to this or another Access Control List assigned to the user.
You must assign users to Access Control Lists to give them access to landscape objects on this list.
When you assign a user to an access control list, you can decide whether to grant the user edit or read-only privileges for the objects on this list. This means the same user can have edit access for some systems in Landscape Management and read-only access for others.
In Landscape Management we support two different privileges:
You can access the user assignment in several ways:
The 'User Assignment' > 'By List' view contains all Access Control Lists maintained in this SAP Cloud ALM. In this view, you can see which users are currently assigned to each Access Control List.
You can use the Live Search to search for access control lists.
The 'User Assignment' > 'By User' view contains all users known in SAP Cloud ALM. In this view, you can see which users are currently restricted by Access Control and which Access Control Lists are assigned to a user.
You can use the Live Search to search for users.
Depending on the global status of Access Control there is also a button to:
During the user assignment, we also check if the user has the necessary roles to execute his tasks in Landscape Management. If the user doesn't have the required roles, we will try to assign the respective role in User Management in Cloud ALM.
Which role is assigned depends on the privilege that is assigned to the user:
If the user already has the necessary roles, no assignment request is sent to User Management.
The feature to exempt users from Access Control restrictions was included to allow the customer to address exceptional situations and to easily create super-users in their system without having to create all-encompassing Access Control Lists (i.e. a "See All ACL").
The assignment of access control lists to the user will not be affected. This is to allow for a fast reactivation of Access Control if a user is only temporarily unrestricted.
To make it easier for Access Controllers to reestablish the status quo (i.e. setting the global setting for all users), we included a feature that allows you to
With the global activation, Access Control will be activated in Landscape Management and all participating use cases.
The global activation is a setting that cannot be reversed.
Before activating Access Control globally you should create your access control lists and test them. To test Access Control, you can activate access restrictions for single users, before you flip the global switch.
Please note: We do not automatically activate restrictions for users when they are assigned to an access control list. We want to enable the customer to completely maintain their access control lists including the user assignment before the global activation of Access Control.
Hence, you have to manually activate Access Control for the test users as long as Access Control is globally inactive.
Access Control influences which services, systems, and business services a logged-on user can see in Landscape Management and whether he can edit them.
The effects of Access Control will be visible in different components of Landscape Management.
In the Scope Selector, the user will only see service types, if he can access at least one object of these types.
All other service types will be hidden, even if services and systems with this type exist in the managed landscape.
Currently still the total number of existing services and systems in the landscape is shown for authorized service types, even if the user can only access a subset of them. This will be addressed in the near future.
In the Overview, the user will only see information on the cards for service types if he can access at least one object of these types. Cards for service types that were selected in the scope before the activation of Access Control and can no longer be accessed, will show no information and contain the label "No Authorization".
Currently still the total number of existing services and systems in the landscape is shown for authorized service types, even if the user can only access a subset of them. This will be addressed in the near future.
The Event Status indicator will be calculated based on the authorized services and systems of a service type. This means if an outage exists for a service the user doesn't have access to, it will not be propagated in the status event indicator on the service type card.
In Favorites, the user will only see information on the cards for services, systems, and service types if he can access the service or systems or at least one object of these types. Cards for services, systems, and service types that were selected in the scope before the activation of Access Control and can no longer be accessed, will show no information and contain the label "No Authorization". The user can still remove the favorite even if he is no longer authorized to access it by clicking on the star icon.
The Services & System list will only contain services and systems that the user has access to. It can optionally be pre-filtered by service type depending on the selected scope and the navigation path chosen from the Overview.
The filter, sort, and group functions are defined by the service types that are in scope.
The Live Search will only find services and systems for which the user has authorizations. If the user searches for a service or system for which he doesn't have authorizations the Live Search will return an empty result.
The user can add any new service or system type. To do so, he needs a role that contains the x-landscape-manage-ui scope. However, if the user adds a service or system with attributes that are not covered by any of his assigned access control lists, he will not be able to find or access it again until access is given.
From the Services & Systems List, the user can navigate to the System Details. Whether the details view is opened in edit or read-only mode depends on the user's privileges for this system. The privilege is defined during the user's assignment to the access control list (see section 'User Assignment').
In read-only mode, the user cannot perform any change operations for the system. This means the user cannot change system properties, create or change clients or endpoints, and cannot assign or edit tags.
On the Where-Used list for a system, the user can see the Business Services the system is part of. Currently, all business services are shown. However, the user can only successfully navigate to the ones he has access to. If he tries to navigate to a business service he has no access to, he will receive an error message.
Direct jump-ins are also protected. If a user tries to access a service or system that he has no access to via a direct URL, he will receive an error message.
On the Business Services view the user can only see the business services he has access to.
In the business services details, he can see all services and systems that are part of this business service even if he doesn't have authorization to access the system details. This was designed to avoid blind spots for the user. However, if he tries to jump to a system to which he has no access, he will receive an error message.
Once Access Control is activated in Landscape Management, it will automatically affect use cases that have been onboarded to Access Control.
Right now the following use cases inherit Landscape Management Access Control settings:
In the use case Scope Selector, the user will only see services, systems, and (if supported) business services for which he has authorizations.
All other services, systems, and business services will be hidden, even if they exist in the managed landscape, and are supported and configured for this use case.
The views of the use cases are also access restricted. How exactly Access Control affects them depends on the use cases.
Please make sure that one of the following roles is assigned to your user:
If you just assigned the roles to yourself, please make sure to log off and log on to SAP Cloud ALM for the role changes to take effect.