Explain SAP Fiori Launchpad & Role-Based Access in SAP

38 / 65

S/4HANAbeginner

SAP Fiori Launchpad & Role-Based Access

How the Fiori Launchpad aggregates apps into catalogs and groups, and how PFCG roles control which tiles a user sees.

The Launchpad is the home page: tiles for the apps a user is allowed to use. Its configuration is a frequent go-live problem, because a user sees nothing or sees far too much.

A catalog is like a restaurant's full kitchen menu of everything the chefs can prepare (what's technically available and authorized); a group is the specific printed menu handed to one type of customer (the actual tiles a user sees), and both the kitchen's willingness to cook a dish and the printed menu listing it have to align before a customer can actually order it.

Key Concepts

The chain from app to user.

    app  ->  catalog  ->  PFCG role  ->  user
                  and
    tiles ->  group   ->  PFCG role  ->  user

Catalog and group are different things, and this is the confusion.A catalog is technical: which apps a role is permitted to launch. Maintained by IT, usually one per business area.

A group is visual: how tiles are arranged on the user's home page. Organised for how a person works, and often personalisable by them.

Both are assigned to the same PFCG role, so one assignment controls permission and layout. A user with the catalog but not the group can run the app — by search or a direct link — but sees no tile. That is the most common "my tile is missing" case, and it is not an authorisation problem.

Target mappings and intent-based navigation. A tile does not point at an app directly. It points at an intent:

    semantic object   "SalesOrder"
    action            "manage"
    -> resolved to whichever app is configured for this user

So a link to "manage a sales order" resolves to different concrete apps depending on the user's role and system. One app can be replaced by another without editing any link that leads to it.

This is elegant and initially disorienting for anyone used to typing a transaction code, which goes to exactly one place.

Troubleshooting a missing tile, in order.

  1. Is the role assigned to the user?
  2. Does the role contain the catalog, and the group?
  3. Is the target mapping in that catalog?
  4. Is the OData service activated and authorised?
  5. Does the user have the underlying authorisation objects?

The order matters, because each layer fails independently and they produce similar symptoms. Working bottom-up wastes time on authorisations when the group was never assigned.

Where the Launchpad runs. On-premise it is served by a front-end server. In S/4HANA Cloud and in multi-system landscapes it is the Launchpad service on SAP BTP, which aggregates apps from several backends into one home page. Same concepts, different hosting — and worth knowing which one you are configuring.

What the interviewer is probing.1. "How does a tile reach a user?" Probing: the chain. Stalls: "You assign an app." *Moves up:* catalog holds the tile and target mapping, group arranges it, a PFCG role references the catalog and group, and the role is assigned to the user.

2. "What is the difference between a catalog and a group?" Probing: the distinction. Stalls: "None." Moves up: the catalog grants authorisation to the app; the group only decides what appears on the home page.

3. "What is a target mapping?" Probing: the mechanism. Stalls: "A link." Moves up: it maps a semantic object and action to the actual app implementation, which is what makes cross-app navigation possible.

4. "A user has the role but sees no tile — what do you check?" Probing: the practical skill. Stalls: "The role." Moves up: the group assignment, whether the catalog is in the role, the OData service authorisations, and the launchpad cache.