Dashboard Authorizations
OCC, Tactical and Operation dashboards are used to display, mix and organize metrics coming from different use cases/applications (like System Monitoring or Real User Monitoring).
In order to be able to configure and display Dashboard instances, two sets of roles are needed:
- Dashboard specific roles (SAP_FRN_FI*)
- Use case specific roles (described in the Security Guide, section "Dialog User Roles with Application Authorization")
Hence, if a user has enough authorizations to display the underlying use case data, then he will be able to display the same metrics in a Dashboard provided (s)he has access to the specific instance.
The Tactical, OCC and Operation Dashboards are part of the "Advanced Analytics & Intelligence" group accessible in the SAP Focused Run Launchpad.
The access to this SAP Fiori Group is granted by the SAP_FRN_FLP_5_6_AAI role (SAP_FRN_FLP_1_1_ADI in FRUN 2.0 FP01)
Individual access to the Tactical, OCC and Operation Dashboards is granted by additional roles described in the next section.
Display Users
Display Users can use the following roles to ensure they have access to individual Dashboards:
- SAP_FRN_FI_TACTICAL
- SAP_FRN_FI_OCC
- SAP_FRN_FI_OPE (as of SAP Focused Run 3.0 SP00)
These roles contain the authorization objects needed to start the application from the launchpad and, depending on the release of SAP Focused Run, the configuration of custom pages.
As of SAP Focused Run 3.0 SP00 a new Authorization Object has been added to the SAP_FRN_FI_* roles to control and restrict the access to individual Public Pages.
FRN_AAI_ID
- Field PAGEID
- Used to filter the Public Page access based on its ID, e.g. 98F2B3032C971EDABE81E8F644CD6331
- The Page ID of a public page can be retrieved by using the "Share Current Page" button in the Dashboard Header.
- Field USECASE
- Used to filter the Dashboard Access (possible values fiocc, fitac or fiope)
As of SAP Focused Run 3.0 SP00, display users can only display authorized public pages. All the functionalities in the personalization pane are disabled and custom pages creation not possible (i.e. the "+" button is not available anymore).
Administrators
As of SAP Focused Run 3.0 FP01 an additional role is needed for Administrators. These users are allowed to create and manage (delete/update) public pages that can be shared with display users.
As of SAP Focused Run 3.0 FP01, a new role has been provided for Administrators:
- SAP_FRN_FI_ADMIN
This role can be used to create new instances and modify the personalization settings of existing pages. It includes additional authorizations to execute specific test reports:
For releases lower than SAP Focused Run 3.0 FP01, the following role can be used to enable page personalization.
- SAP_FRN_UI5_PERS_PUB
The Authorization Object SR_UOC contained in this role grants administration rights when the field ACTVT is 70 (Administer).
FRN_AAI_ID is never checked for Administrators (i.e. users having the SAP_FRN_UI5_PERS_PUB or any other role with the SR_UOC Authorization Object). Administrators can therefore access all the dashboards and every public page. "Display" roles are needed by Administrators just to enable the access to the Dashboard Applications and services.