authorization-iamlisted

Help with ABAP authorization and IAM (Identity and Access Management) including authorization objects, authorization checks, IAM apps, business catalogs, business roles, restriction types, CDS access control (DCL), privilege access annotations, and role-based access in ABAP Cloud and on-premise. Use when users ask about authorization, AUTHORITY-CHECK, authorization object, IAM app, business catalog, business role, restriction type, CDS access control, DCL, access control, privilege annotation, role assignment, PFCG role, S_DEVELOP, or securing ABAP applications. Triggers include "authorization check", "create authorization object", "CDS access control", "IAM app", "business catalog", "business role", "PFCG", "restrict access", or "role-based security".
williamcorrea23/sap-router-skill · ★ 1 · API & Backend · score 66

Install: claude install-skill williamcorrea23/sap-router-skill

# Authorization & IAM Guide for implementing authorization checks and identity/access management in ABAP Cloud and on-premise systems. ## Workflow 1. **Determine the user's goal**: - Implementing authorization checks in ABAP code - Creating CDS access controls (DCL) - Setting up IAM apps, business catalogs, and business roles (ABAP Cloud) - Managing PFCG roles (on-premise) - Defining custom authorization objects - Understanding restriction types 2. **Identify the platform**: - ABAP Cloud (BTP or S/4HANA embedded) → IAM apps + business catalogs + `CL_ABAP_AUTHORIZATION` - On-premise / Standard ABAP → PFCG roles + `AUTHORITY-CHECK` 3. **Guide implementation** with the appropriate authorization model ## Authorization Models ### ABAP Cloud (BTP / S/4HANA Cloud) ``` IAM App → Business Catalog → Business Role → Business User ↑ Restriction Type (field-level restrictions) ``` ### On-Premise (Standard ABAP) ``` Authorization Object → PFCG Role → User Assignment ↑ Authorization Fields + Permitted Values ``` ## Authorization Checks in Code ### ABAP Cloud — `CL_ABAP_AUTHORIZATION` ```abap "Check authorization using released API DATA(lo_auth) = cl_abap_authorization=>check_authorization( EXPORTING authorization_object = 'Z_MY_AUTH' authorizations = VALUE #( ( field = 'ACTVT' value = '03' ) "Display ( field = 'ZCARR' value = lv_carrier ) ) ). IF lo