# Authorization Iam

> Help with ABAP authorization and IAM (Identity and Access Management) including authorization objects, authorization checks, IAM apps, business catalogs, business roles, restriction types, CDS access control (DCL), privilege access annotations, and role-based access in ABAP Cloud and on-premise. Use when users ask about authorization, AUTHORITY-CHECK, authorization object, IAM app, business catal…

- **Type:** Skill
- **Install:** `agentstack add skill-likweitan-abap-skills-authorization-iam`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [likweitan](https://agentstack.voostack.com/s/likweitan)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [likweitan](https://github.com/likweitan)
- **Source:** https://github.com/likweitan/abap-skills/tree/main/skills/authorization-iam

## Install

```sh
agentstack add skill-likweitan-abap-skills-authorization-iam
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Authorization & IAM

Guide for implementing authorization checks and identity/access management in ABAP Cloud and on-premise systems.

## Workflow

1. **Determine the user's goal**:
   - Implementing authorization checks in ABAP code
   - Creating CDS access controls (DCL)
   - Setting up IAM apps, business catalogs, and business roles (ABAP Cloud)
   - Managing PFCG roles (on-premise)
   - Defining custom authorization objects
   - Understanding restriction types

2. **Identify the platform**:
   - ABAP Cloud (BTP or S/4HANA embedded) → IAM apps + business catalogs + `CL_ABAP_AUTHORIZATION`
   - On-premise / Standard ABAP → PFCG roles + `AUTHORITY-CHECK`

3. **Guide implementation** with the appropriate authorization model

## Authorization Models

### ABAP Cloud (BTP / S/4HANA Cloud)

```
IAM App → Business Catalog → Business Role → Business User
                                    ↑
                            Restriction Type (field-level restrictions)
```

### On-Premise (Standard ABAP)

```
Authorization Object → PFCG Role → User Assignment
       ↑
Authorization Fields + Permitted Values
```

## Authorization Checks in Code

### ABAP Cloud — `CL_ABAP_AUTHORIZATION`

```abap
"Check authorization using released API
DATA(lo_auth) = cl_abap_authorization=>check_authorization(
  EXPORTING
    authorization_object = 'Z_MY_AUTH'
    authorizations       = VALUE #(
      ( field = 'ACTVT' value = '03' )    "Display
      ( field = 'ZCARR' value = lv_carrier )
    ) ).

IF lo_auth->is_authorized( ) = abap_false.
  "User not authorized
  RAISE EXCEPTION TYPE zcx_not_authorized.
ENDIF.
```

### On-Premise — `AUTHORITY-CHECK`

```abap
AUTHORITY-CHECK OBJECT 'Z_MY_AUTH'
  ID 'ACTVT' FIELD '03'
  ID 'ZCARR' FIELD lv_carrier.

IF sy-subrc <> 0.
  MESSAGE e001(z_msg) WITH lv_carrier.
  RETURN.
ENDIF.
```

### Activity Values (ACTVT)

| Value | Activity |
| ----- | -------- |
| `01`  | Create   |
| `02`  | Change   |
| `03`  | Display  |
| `06`  | Delete   |
| `16`  | Execute  |

## Authorization Objects

### Creating a Custom Authorization Object

In ADT or `SU21`:

```
Authorization Object: Z_MY_AUTH
  Fields:
    ACTVT  — Activity (standard field, linked to domain ACTIV_AUTH)
    ZCARR  — Carrier (custom field, type S_CARR_ID)
    ZREGN  — Region (custom field, type CHAR4)
```

#### Structure

- **Authorization Class**: Groups related objects (e.g., `Z_TRAVEL`)
- **Authorization Object**: Contains 1–10 authorization fields
- **Authorization Field**: Links to a data element; defines the check dimension

## CDS Access Control (DCL)

CDS access controls define row-level authorization for CDS view entities.

### Basic DCL

```cds
@EndUserText.label: 'Access Control for Travel'
@MappingRole: true
define role ZI_Travel {
  grant select on ZI_Travel
    where ( carrier_id ) =
      aspect pfcg_auth ( Z_MY_AUTH, ZCARR, ACTVT = '03' );
}
```

### Multiple Conditions

```cds
define role ZI_Travel {
  grant select on ZI_Travel
    where ( carrier_id ) =
      aspect pfcg_auth ( Z_MY_AUTH, ZCARR, ACTVT = '03' )
      and ( agency_id ) =
      aspect pfcg_auth ( Z_AGENCY_AUTH, ZAGENCY, ACTVT = '03' );
}
```

### Unrestricted Access

```cds
define role ZI_Travel_Admin {
  grant select on ZI_Travel
    where _unrestrictedAccess;
}
```

### Inherited Access Control

```cds
"Child entity inherits access control from parent
define role ZI_Booking {
  grant select on ZI_Booking
    where ( carrier_id ) =
      aspect pfcg_auth ( Z_MY_AUTH, ZCARR, ACTVT = '03' );
}
```

### DCL and PRIVILEGED ACCESS

```abap
"Bypass DCL access control when needed (e.g., in background jobs)
SELECT FROM zi_travel
  FIELDS travel_id, description
  INTO TABLE @DATA(lt_all)
  PRIVILEGED ACCESS.
```

## IAM in ABAP Cloud

### IAM App

Created in ADT, links a service binding to the authorization model:

```
ADT: New → Other → IAM App
Name: Z_TRAVEL_IAM
Type: EXT - External App (for OData services)
Service Binding: ZUI_TRAVEL_O4
```

Assign authorization objects to the IAM App to define which checks apply.

### Business Catalog

Groups IAM Apps into logical bundles:

```
ADT: New → Other → Business Catalog
Name: Z_BC_TRAVEL_MGMT
Description: Travel Management
IAM Apps: Z_TRAVEL_IAM, Z_BOOKING_IAM
```

### Business Role

Created in Fiori app "Maintain Business Roles":

1. Create new business role (e.g., `Z_BR_TRAVEL_MANAGER`)
2. Add business catalogs
3. Configure restriction types (field-level access)
4. Assign business users

### Restriction Types

Define field-level restrictions in business roles:

| Restriction Type | Description                               |
| ---------------- | ----------------------------------------- |
| **Unrestricted** | Full access to all values                 |
| **Restricted**   | Access limited to specified values        |
| **No Access**    | No access to the associated functionality |

Example: A travel manager role might restrict `ZCARR` to only `LH` and `AA`.

## On-Premise: PFCG Roles

### Creating a PFCG Role

1. Open `PFCG` transaction
2. Enter role name (e.g., `Z_TRAVEL_DISPLAY`)
3. **Menu tab**: Add transaction codes, Fiori tiles, or apps
4. **Authorizations tab**: Maintain authorization values
   - Set authorization objects and field values
   - Generate the authorization profile
5. **User tab**: Assign users to the role

### Composite Roles

Bundle multiple single roles:

```
Z_TRAVEL_COMPOSITE (Composite Role)
├── Z_TRAVEL_DISPLAY (Single Role — display only)
├── Z_TRAVEL_EDIT (Single Role — create/change)
└── Z_TRAVEL_ADMIN (Single Role — full access)
```

## RAP Authorization

### Instance Authorization in RAP

```abap
"In behavior definition:
define behavior for ZR_Travel alias Travel
  authorization master ( instance )
{
  ...
}
```

```abap
"In behavior implementation:
METHOD get_instance_authorizations.
  READ ENTITIES OF zr_travel IN LOCAL MODE
    ENTITY Travel
    FIELDS ( carrier_id )
    WITH CORRESPONDING #( keys )
    RESULT DATA(lt_travels).

  LOOP AT lt_travels INTO DATA(ls_travel).
    DATA(lo_auth) = cl_abap_authorization=>check_authorization(
      authorization_object = 'Z_MY_AUTH'
      authorizations       = VALUE #(
        ( field = 'ZCARR' value = ls_travel-carrier_id )
        ( field = 'ACTVT' value = COND #(
            WHEN requested_authorizations-%update = if_abap_behv=>mk-on
              THEN '02'
            WHEN requested_authorizations-%delete = if_abap_behv=>mk-on
              THEN '06'
            ELSE '03' ) )
      ) ).

    APPEND VALUE #(
      %tky = ls_travel-%tky
      %update = COND #( WHEN lo_auth->is_authorized( ) THEN if_abap_behv=>auth-allowed
                        ELSE if_abap_behv=>auth-unauthorized )
      %delete = COND #( WHEN lo_auth->is_authorized( ) THEN if_abap_behv=>auth-allowed
                        ELSE if_abap_behv=>auth-unauthorized )
    ) TO result.
  ENDLOOP.
ENDMETHOD.
```

### Global Authorization in RAP

```abap
"In behavior definition:
define behavior for ZR_Travel alias Travel
  authorization master ( global )
{
  ...
}
```

```abap
METHOD get_global_authorizations.
  DATA(lo_auth) = cl_abap_authorization=>check_authorization(
    authorization_object = 'Z_MY_AUTH'
    authorizations       = VALUE #(
      ( field = 'ACTVT' value = '01' ) ) ).  "Create

  IF lo_auth->is_authorized( ).
    result-%create = if_abap_behv=>auth-allowed.
  ELSE.
    result-%create = if_abap_behv=>auth-unauthorized.
  ENDIF.
ENDMETHOD.
```

## Output Format

When helping with authorization/IAM topics, structure responses as:

```markdown
## Authorization Guidance

### Platform

- [ABAP Cloud / On-Premise]
- Approach: [CDS DCL / AUTHORITY-CHECK / CL_ABAP_AUTHORIZATION / IAM]

### Implementation

[Step-by-step with code examples]

### Role Configuration

[How to set up roles and assign access]
```

## References

- ABAP Authorization Cheat Sheet: https://github.com/SAP-samples/abap-cheat-sheets
- CDS Access Control: https://help.sap.com/docs/abap-cloud/abap-development-tools-user-guide/access-controls
- IAM Guide: https://help.sap.com/docs/btp/sap-business-technology-platform/identity-and-access-management-iam

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [likweitan](https://github.com/likweitan)
- **Source:** [likweitan/abap-skills](https://github.com/likweitan/abap-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-likweitan-abap-skills-authorization-iam
- Seller: https://agentstack.voostack.com/s/likweitan
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.