SAP OData Requirements
The documented authorizations cover only the technical connection and OData/ODP access requirements. They do not cover business authorizations for the underlying CDS views, tables, or application data that are accessed through the service. If additional authorizations are required for specific CDS views or tables, they must be identified separately, for example by using STAUTHTRACE.
Supported Solutions
| Extraction Type | Solution |
|---|---|
| Full Extraction | - SAP NetWeaver 7.4 SPS08 - SAP NetWeaver 7.5 (we recommend SPS02 or higher) - SAP BW/4HANA 1.0 |
| Delta Extraction | - SAP NetWeaver 7.5 SPS05 or higher - SAP BW/4HANA 1.0 SPS01 |
Minimum supported: S/4HANA 1909 FPS01 Recommended: S/4HANA 2020 or newer Recommended for RAP-heavy OData V4: S/4HANA 2021 FPS01 or newer
Service Catalog
The service catalog is available via service group /IWFND/CONFIG and is delivered in an inactive state.
Find all information about the service catalog in this article in the SAP Help Portal.
To publish/enable the service catalog please follow this SAP blog post.
Roles and Authorizations for the OData Connection
We highly recommend to set up a service or technical SAP user for the OData connection.
To create or change a corresponding user, you need authorizations for the following transactions:
- PFCG: maintain or create authorization role
- SU01: maintain or create users
Transaction Authorizations
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_TCODE | TCD | ODQMON | Allows access to the ODQ monitor transaction (Delta Queue Monitor) |
Service Catalog / SData Service Authorizations
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_SERVICE | SRV_NAME | * | Authorization Defaults Hash Key Name |
| S_SERVICE | SRV_TYPE | * | Authorization Defaults Hash Key Type |
| S_TCODE | TCD | SICF | Allows access for Service Implementation |
| /IWFND/SRV | /IWFND/SRG | * | Technical Service Document Name |
| /IWFND/SRV | /IWFND/SRV | * | Version of Meta Model Entity |
Administration / Background Processing Authorizations
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_ADMI_FCD | S_ADMI_FCD | NADM (Network administration-related value shown in role) | Administrative function authorization |
| S_BTCH_ADM | BTCADMIN | D (Authorization to Display Jobs from Other Clients) P (Authorization to Create Periodic Jobs (SAP Note 1716340)) Y (Background Adminsitrator Authorization) | Background job administration |
| S_BTCH_JOB | JOBACTION | DELE (Delete Background Jobs) PROT (Display Job Processing List) RELE (Release Jobs (Released Automatically When Scheduled)) SHOW (Display Job Queue) | Background job operation |
| S_BTCH_JOB | JOBGROUP | * | Background job group |
Dataset / Trace File Authorization
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_DATASET | PROGRAM | CL_RODPS_REPLICATION==========CP | Program authorization for ODP replication trace handling |
| S_DATASET | ACTVT | 06 (Delete) 33 (Read) 34 (Write) | Allows file operations required for trace/log processing |
| S_DATASET | FILENAME | RODPS_REPL_TRACE.TXT | Trace file used by ODP replication testing |
Program Execution Authorization
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_PROGRAM | P_ACTION | BTCSUBMIT (Schedule programs for background processing) | Allows execution of relevant background programs |
| S_PROGRAM | P_PROGNAM | ODQ_TASK | Program name related to ODQ task processing |
Application Log Authorization
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_APPL_LOG | ALG_OBJECT | ODQ | Application log object for ODQ |
| S_APPL_LOG | ALG_SUBOBJ | * | All ODQ log subobjects |
| S_APPL_LOG | ACTVT | 03 (Display) 06 (Delete) | Allows viewing/deleting ODQ-related application logs |
ODP / DHCD Authorization
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_DHCDSTP | DHCDCSBTYP | ODP (Operational Data Processing) | ODP-related authorization |
| S_DHCDSTP | ACTVT | 01 (Create or generate) 02 (Change) 03 (Display) | Allows required ODP-related processing actions |
ODP Source Authorization
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_RO_OSOA | OLTPSOURCE | * | Allows access to ODP source objects |
| S_RO_OSOA | OSOAAPCO | * | Allows access to ODP application components |
| S_RO_OSOA | OSOAPART | DATA (Data Access) DEFINITION (Matadata Access) | Allows access to ODP source metadata and data |
| S_RO_OSOA | ACTVT | 03 (Display) 23 (Maintain) | Allows viewing and maintaining ODP source access |
CDS Extraction Authorization
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_RS_CDS_X | DDLXTRNAME | * | Allows access to CDS extraction objects |
| S_RS_CDS_X | DDLXTRPART | DATA (Data Access) | Allows data access for CDS extraction |
| S_RS_CDS_X | DDLXTRRELS | C1 (released (C1)) | Restricts access to released CDS extraction objects |
| S_RS_CDS_X | ACTVT | 03 (Display) | Allows display access |
Program and Application Authorizations
| Authorization Object | Field | Value | Description |
|---|---|---|---|
| S_START | AUTHPGMID | R3TR | Program ID |
| S_START | AUTHOBJTYP | G4BA | Object Type |
| S_START | AUTHOBJNAM | * | Object Name |
Authorizations for data extraction
As we only described the authorizations for a technical connection with OData, you have to add the necessary authorizations for CDS views, tables, etc. by yourself. If a extraction fails, you can check the SAP transaction STAUTHTRACE for authorizations that may be missing.
- open the transaction STAUTHTRACE in your SAP system
- start an authorization trace for the technical SAP user
- reproduce the failed OData request or data extraction
- stop the trace and check it for failed authorization checks
- identify missing authorization objects, fields and values
- add these to the appropriate SAP role
- regenerate the role profile
- retest the OData connection or data extraction
This ensures that only the required object-level and data-level authorizations are added.