Guide: CPO Fiori Setup

jueves, 15 de junio de 2017 12:30 p. m.

Customer Number:

Customer pre-requisites

1. User access to Customer Clients to be configured with SAP_ALL/Administrator profile

Environment Product SID User Pass
Development Web Dispatcher
Development Fiori Front End + SAP GW
Development S/4 HANA Back End

2. Service Market Place S-User for AMS, user must have rights for creating and updating tickets/incidents in Service Market Place.
User Id:
Password:

HEC pre-requisities

1. Provide following information:

Environment Product SID Hostname Instance Number Customer Clients URL to web dispatcher admin page
Development Web Dispatcher https://<HOSTNAME>:44379/sap/wdisp/admin
Development Fiori Front End + SAP GW https://<HOSTNAME>:44300/sap/public/ping?sap-client=<CLIENT>
Development S/4 HANA Back End https://<HOSTNAME>:44300/sap/public/ping?sap-client=<CLIENT>
Production Web Dispatcher https://<HOSTNAME>:44379/sap/wdisp/admin
Production Fiori Front End + SAP GW https://<HOSTNAME>:44300/sap/public/ping?sap-client=<CLIENT>
Production S/4 HANA Back End https://<HOSTNAME>:44300/sap/public/ping?sap-client=<CLIENT>

1. Frontend and Backend ABAP systems configured for OSS for Note download.
2. Customer tinyproxy gateway (vh<CID><DC>gwa) configured for allowing connections from MCD America/Europe to ICM/Webdispatcher ports vhCIDDCgwa
3. Frontend, Backend and web dispatcher Customer systems configured for SAP remote support connection (STFK).
a. R3 Connection
b. HTTP connection
c. Automatic remote connection opening option enabled
4. Transport Management System (TMS) infrastructure setup:
a. OS level shared transport filesystem configured.
b. Transport Domain Controller configured.
c. ABAP system registration for each system into Domain Controller
5. SAP Web Dispatcher configured for URL access with following proposed configuration:
a. Friori Front End
a. wdisp/system_0 SID=<FioriSID>, MSHOST=<FioriHost>, MSPORT=8101, SRCSRV=*:443, SRCURL=/sap/bc/opu/;/sap/opu/;/sap/public/;/sap/bc/ui5_ui5/;/sap/bc/ui2/;/sap/bc/lrep;/sap/opu/odata/;/sap/bc/nwbc/;/sap/saml2/;/sap/ca_kpi/,SSL_ENCRYPT=1
b. S/4 HANA Back End
a. wdisp/system_1 SID=<S4SID>, MSHOST=<S4Host>, MSPORT=8101, SRCSRV=*:443, SRCURL=/sap/bc/webdynpro/;/sap/es/;/sap/bc/gui/;/blweb/;/sap/epm/bpc/;/sap/bc/apc;/sap/bw/ina;/sap/bw/Mime/DS/Content;/sap/es/ina/;/ENTERPRISE_SEARCH/,SSL_ENCRYPT=1
c. HANA XS engine
a. wdisp/system_2 SID=<HanaSID>, EXTSRV=https://<HanaPort>:30015, SRCSRV=*:443, SRCURL=/sap/hba/;/sap/hana/;/sap/ui5/,SSL_ENCRYPT=1, SSL_IGNORE_HOST_MISMATCH=true
6. SSL, SSO and HTTPS enabled, Customer SSL certificate loaded for:
a. Web Dispatcher
b. Fiori Front End (Gateway)
c. Back End
7. Shared memory parameter in Fiori front end server with following value:
a. abap/shared_objects_size_MB = 1024
8. Fiori components installed with required SP levels:
a. Front end (Fiori)
SAP FIORI FRONT-END SERVER 3.0 - SPS 01 (02/2017)
SAP Fiori for SAP S/4HANA 1610 - 02 (05/2017) FP:
-UIS4HOP1 200 - SP 0002
-UIX01CA1 200 - SP 0004
-UIAPFI70 400 - SP 0002
b. Back end (S/4 HANA)
SAP S/4HANA 1610 - 02 (05/2017) FP:
S4CORE 101 - SP 0002
SAP_BASIS 751 - SP 0002

Fiori apps to be installed

• Settings for WebServices

• Database Table Growth
• G/L Account (S/4HANA)
• Cost Centers - Plan/Actual
• Upload File

Tickets
299832 / 2017 Install Fiori components on FID
286525 / 2017 / CPO Setup - Fiori Enablement
286505 / 2017 / CPO Setup - TMS Configuration
321781 / 2017 Error activating S/4 HANA Finance Embedded BW Reporting

Notes
[S/4] 2441166 - Error in length of of the variable to hold "Database Schema name" [Fixes Monitor Database Table Growth app issue that freezes the app at load time]
[Fiori] 2435153 - Response SubNode empty for deep insert #2
[S/4] 2515854 - Task list: Activation of '/sap/opu/odata/sap/esh_search_srv' unsuccessful: Node does not exist [Fixes ESH task list SICF node issue]

1. Transport Management System Setup

• Transport Management System was configured for ECC and Fiori systems
• Domain controller was setup on Development environment of each system

• Transport routes were configured with three system landscape mode

2. Configuration user preparation

1. Create a role Z_CPO_ROL_RFCACL as copy of SAP_S_RFCACL (authorization object S_RFCACL) in back end and front end servers, specify in authorization data trusted system information

CPO Page 1
1. Create a role Z_CPO_ROL_RFCACL as copy of SAP_S_RFCACL (authorization object S_RFCACL) in back end and front end servers, specify in authorization data trusted system information

2. Assign the created role, SAP_ALL and SAP_NEW profiles to the user that is going to configure Fiori apps in back and front end systems

1. Fiori Front End technical configuration

Following configuration tasks list were executed using transaction STC01

Task List Description Target

SAP_BASIS_SSL_CHECK Check SSL profile parameters and ICM configuration Front End
Back End
SAP_GATEWAY_BASIC_CONFIG Activate Netweaver Gateway basic configuration Front End
SAP_FIORI_LAUNCHPAD_INIT_SETUP Activating Fiori Launchpad Odata and HTTP services Front End
SAP_SAP2GATEWAY_TRUSTED_CONFIG Creating trusted connection between back end and front end servers Back End
SAP_GATEWAY_ADD_SYSTEM Connecting back end server to gateway front end Front End
SAP_BASIS_ACTIVATE_ICF_NODES Activate required ICF services for Fiori Front End
Back End

• SAP_BASIS_SSL_CHECK (Front End - Back End)

• SAP_GATEWAY_BASIC_CONFIG (Front End)

• SAP_FIORI_LAUNCHPAD_INIT_SETUP (Front End)

• SAP_SAP2GATEWAY_TRUSTED_CONFIG (Back End)

Important: Run this task list in back end system

a. Before running this task, it is needed to configure the name of RFC to be created for trusted connection: <SID>_TRUST_<CLNT>
b. Validate that the user executing this task has RFCACL customized role
c. Run this task in Dialog mode not Background. This is because, target system logon attempt is performed.

CPO Page 2
 SAP_GATEWAY_ADD_SYSTEM (Front End)
a. Before running this task, it is needed to configure the name of RFC to be created for trusted connection: <SID>_TRUST_<CLNT>
b. Validate that the user executing this task has RFCACL customized role
c. Run this task in Dialog mode not Background. This is because, target system logon attempt is performed.

SAP_BASIS_ACTIVATE_ICF_NODES (Back End and Front End)

a. Activate the following nodes using task list, use SICF for bold services:
[Common]
[Front end] [Back end]
/sap/public/icf_info
/sap/bc/ui5_ui5/sap/fin_acc_userpar /sap/bc/webdynpro/sap/FIS_FPM_OVP_IPCC1
/sap/public/icf_info/logon_groups
/sap/es/ina/GetServerInfo /sap/bc/ui2/nwbc
/sap/public/icf_info/urlprefix
/sap/es/ina/GetResponse /sap/bc/gui/sap/its/webgui
/sap/public/icf_info
/sap/bc/ui5_ui5/sap/MM_CCS_MAINTS1
/sap/public/icf_info/icr_groups
[Manual]
/sap/public/icf_info/icr_urlprefix
/sap/bc/ui5_ui5/sap/bas_dagobj_mon
/sap/bc/bsp/sap
/sap/bc/ui5_ui5/sap/bas_dtg_mon
/sap/bc/bsp/sap/system
/sap/bc/ui5_ui5/sap/fin_fs_glacct
/sap/bc/bsp/sap/public/bc
/sap/bc/ui5_ui5/sap/fin_fs_glacdoc
/sap/public/bc
/sap/public/bc/ur
/sap/public/bsp/sap/public
/sap/public/bsp/sap/public/bc
/sap/public/bsp/sap/system
/sap/public/bsp/sap/htmlb
/sap/public/bsp/sap
/sap/bc/bsp/sap/system
/sap/public/bsp/sap/public
/sap/public/bsp/sap/system
/sap/bc/bsp/sap/it00
/sap/bc/bsp/sap/sbspext_htmlb
/sap/bc/bsp/sap/sbspext_xhtmlb
/sap/bc/bsp/sap/htmlb_samples
/sap/bw/BEx
/sap/bw/Mime
/sap/public/bc
/sap/public/bc/icons
/sap/public/bc/icons_rtl
/sap/public/bc/webicons
/sap/public/bc/pictograms

2. Testing Fiori Launchpad URL

URL:

CPO Page 3
 https://<HOSTNAME>:44300/sap/bc/ui2/flp?sap-client=400 [Directly]
https://<HOSTNAME>:44380/sap/bc/ui2/flp?sap-client=400 [Web dispatcher]

3. Configure Back End system to trust Front End issued logon tickets

a. Ensure that in the Front End system the parameter login/ticket_only_to_host si 0.

b. At Front End system in STRUSTSSO2, export self signed System certificate in base64
c. Enter to Back End STRUSTSSO2 and import the Front End certificate, then add it to ACL specifying the work client

4. Create RFC´s in front end for consuming catalogs containing SAPGUI or Webdynpro apps (Front End)

a. Create ABAP RFC connection pointing to back end system, with trusted option and current user enabled. No Client or language specified. Name: <Back end SID>_RFC
b. Create HTTP "H" RFC connection pointing to back end system, with SSL option and current user enabled. No Client or language specified. Name: <Back end SID>_HTTPS
a. If neccesary load Fiori SSL Client certificate into trusted list of S/4 HANA
c. Create HTTP "H" RFC connection pointing to back end system, with SSL option and current user enabled. No Client or language specified. Name: SAP_ECC_Financials
d. Maintain /UI2/V_ALIASMAP view with SM30, in source field put the list of business catalogs, in target system put the <SID> of backend system that must be resolved as <Back end SID>_RFC or <Back end SID>_HTTPS

NW
S4CA
S4CMD
S4EAM
S4ECCSE
S4EHS
S4FIN
S4FICA
S4FICAX
S4LO
S4MDG
S4PLM
S4PP
S4PRC
S4PS
S4PSS
S4QM
S4SCM
S4SD
S4SLL
S4TRV
S4FSCM
S4ISA
S4ISAD
S4ISEC
S4ISPSCA
S4ISU
S4OIL
S4PSM
S4RFM
S4CPM
S4PPM

CPO Page 4
 S4PPM
S4GTS
e. Execute the following report to replicate from back end system /UI2/GET_APP_DESCR_REMOTE_ALL
f. If you get errors related to the following catalogs, you can dismiss

5. Setup of Enterprise Search (Back End)

a. In back end execute the task list SAP_ESH_INITIAL_SETUP_WRK_CLIENT

b. Confirm first manual task and ensure that you have enough rights
c. In "Set TREX Destination or SAP HANA DB Connection" select DEFAULT
d. In "Select Models to Create Connectors", select EAAPPLH
e. Run the task list in background. Will take a while.

a. If task list gets and error on "Update Software Components" or "Create and Index Connectors" continue with next step
b. Run task list SAP_ESH_CREATE_INDEX_SC
c. In "Select Models to Create Connectors", select EAAPPLH"
d. Run the task list and then re execute the failed one

Run transaction ESH_COCKPIT and check that all created connectors are in status ACTIVE using combo boxes. Use Chrome to avoid performance issues.

If you get a messsage on the top of the page like in the image follow next steps:

a. Call transaction SPRO

b. Navigate to SAP Netweaver -> Search and Operational Analytics -> Enterprise Search -> Search Configuration -> Set Parameters for Federated Search
c. In the screen look for "Model Authorization" combo and set it to "Check"
d. Check that the message has gone

6. Update Fiori Applications index (Front End)

Run ABAP report /UI5/APP_INDEX_CALCULATE for al components. Aproximate execution time: 20 minutes

CPO Page 5
7. Activate Fiori applications specific services (Front End)

a. Enter to Fiori Applications Library and locate 5 planned aplications to enter agregated mode.

• Front End tasks

○ Activate the required oData services using STC01 SAP_GATEWAY_ACTIVATE_ODATA_SERV task list. Select back end system alias.
CB_ACCOUNTING_DOCUMENT_SRV
CB_GL_ACCOUNT_SRV
DAAG_DTG_SRV
DAAG_MONOBJ
MMPUR_PROC_CAT_MAINT_SRV
FIN_USER_DEFAULTPARAMETER_SRV

○ Check that activated Odata services are working in /IWFND/MAINT_SERVICE. Check that the services have a proper answer in the option "Call Browser" of the transacion.

8. Configure BW Client for Analytical apps content (Back End)

CPO Page 6
 a. Execute FM RS_MANDT_UNIQUE_SET in SE37 to set the BW client to use
b. Check SCC4 and ensure that there is a Logical System Name defined
c. In the System Change Option screen SE03, select the namespaces with the prefixes /BI0/ and /BIC/as modifiable.
d. For DDIC user enter parameter RSWAD_SKIP_JAVA and value 'X'
e. Plan program RSBATCH_WRITE_PROT_TO_APPLLOG as a periodic job using report RSSM_PLAN_PROTWRITE_TO_APPLLOG every 5 minutes.
f. RSA1: In the Replicate Metadata dialog box, choose Only Activate. A message appears that the background job BI_TCO_ACTIVATION is scheduled.
g. Call transaction RSTCO_ADMIN and execute Installation status is green. Click Display Logs and check that the log does not contain any red error messages.

Important: Seen a green light "Activation Successful" without performing mentioned steps doesn´t mean that content is already activated, it is neccesary run the activation.

9. Configuring Bex queries for applications (Back End)

Some Fiori Apps require Bex queries activation:

a. Enter to transaction RSORBCT
b. At the top of the right frame, choose "Grouping" and select "Only Necessary Objects".
c. At the top of the right frame, choose "Collection Mode" and select "Collect Automatically".
d. In the left frame, select "Object Types".
e. In the middle frame, expand "Query Elements", expand "Query" and double-click "Select Objects".
f. In the Selection of Query Objects dialog box, find the BI Query (/ERP/SFIN_M01_Q2001) via search and Choose Transfer.
g. Select BW source system client who corresponds to the data will be extracted
h. At the top of the right frame, choose "Install" and select Install in Background.
i. On the Install Business Content in the Background dialog box choose Yes.

If you get a dump when selecting Bex query for activation, look at the dump the variable I_IOBJNM and activate it using report RSDG_IOBJ_ACTIVATE
Exception: If you see failure activating object 0BWTCT_PLAN, then activate 0TXTMD

10. Create Fiori test user and assign applications (Front End)

a. Open /UI2/FLPD_CUST (Launchpad Designer) and create a group that will contain the 5 Fiori apps. Z_CPO_GRP_APPS
b. For each Fiori App search by Business Catalog/Technical Catalog and add them to the created group as a tile:

• Settings for WebServices - SAP_TC_PRC_COMMON

• Monitor Database Table Growth - SAP_BASIS_TCR_T
• Cost Centers - Plan/Actual - SAP_TC_FIN_CO_COMMON
• Upload File - SAP_CA_BC_COM

11. Adding G/L Account (S/4HANA) application to the role.

This application does not appear on catalog search because it is a Fact Sheet and it is neccesary to perform the following steps:

a. Create a catalog Z_CPO_CAT_APPS

b. Locate the standard target mapping for the G/L Account app in the Fiori App Library technical/business catalog (SAP_TC_FIN_ACC_COMMON)

CPO Page 7
 c. Create a Reference to the created Z_CPO_CAT_APPS catalog from the Target Map option
d. Create a new static tile into Z catalog
Title: GL Account (S/4 HANA)
Subtitle: for General Ledger Accountant
Semantic Object: GLAccount
Action: displayFactSheet
e. Add the created tile to Z_CPO_GRP_APPS

12. Configuring In-App help plug-in

a. Go to Fiori Launchpad Designer

b. Create a new catalog Z_CAT_CPO_APPHELP
c. In the recently created catalog, create a new Target Mapping with following parameters

d. Add to the Z_ROL_CPO_APPS role the created catalog Z_CAT_CPO_APPHELP

e. Check that the following icon has been added to the existing Fiori Apps

13. Configuring Fiori Role

a. Create a PFCG role Z_CPO_ROL_APPS, in the "Menu" tab add the following:
○ Fiori CPO Group Z_CPO_GRP_APPS
○ Fiori Business/Technical catalog of the apps added to the group Z_CPO_GRP_APPS
○ Assign the catalog Z_CPO_CAT_APPS

b. Save and generate the role

c. Create FIORI_CPO user as Dialog type and assign:
a. Z_CPO_ROL_RFCACL role created during trusted configuration
b. SAP_ALL and SAP_NEW profiles
c. Z_CPO_ROL_APPS

14. Performing cache clean up

Front end
a. In SE38 execute /UI2/INVALIDATE_GLOBAL_CACHES
b. In SE38 execute /UI2/INVALIDATE_CLIENT_CACHES
c. In SMICM goto HTTP plugin -> Server cache -> Invalidate Locally and Globally
d. In /IWFND/CACHE_CLEANUP execute report
e. *In /IWBEP/CACHE_CLEANUP execute report
f. In SE38 execute /UI2/CHIP_SYNCHRONIZE_CACHE
g. In SE38 execute /UI2/DELETE_CACHE_AFTER_IMP
h. In SE38 execute /UI2/DELETE_CACHE
i. In SE38 execute /UI5/APP_INDEX_CALCULATE [Takes 15 min]

Back end

CPO Page 8
 Back end
a. *In /IWBEP/CACHE_CLEANUP execute report [Together with step e in Front End]

15. Tools

• For Odata errors in front/back end /IWFND/ERROR_LOG

• For Odata maintenance /IWFND/MAINT_SERVICE
• For HTTP logon method issues analysis SEC_TRACE_ANALYZER

16. Gateway is deactivated

In some rare cases when calling launchapd directly from Front End you will see "Failure - Unable to load groups" error.
Check /IWFND/ERROR_LOG
If you encounter that gateway is deactivated, execute /n/IWFND/IWF_ACTIVATE

17. Deactivate password change option for SSO in back end system

login/password_change_for_SSO = 0

18. Front and back end systems using different client number

SSO When both systems use different client numbers, there is a problem with /sap/es/ina/ service that takes client number from SSO cookie and attempts to login into backend system using such client
To prevent this situation, add to web dispatcher profile, in the back end prefixes the following parameter: CLIENT=<your backend client>

19. Configuring Fiori for additional clients

a. Create the new client based on Fiori working one.

b. Ensure that configuration user has RFC_ACL and SAP_ESH* authorizations in both systems.
c. In Front End Server, edit the flp "SICF" service to show Client field on logon screen.

d. Execute the following task lists:

Task List Description Target Comments

SAP_GATEWAY_BASIC_CONFIG
SAP_FIORI_LAUNCHPAD_INIT_SETUP
SAP_SAP2GATEWAY_TRUSTED_CONFIG Creating trusted connection between back end and front end servers Back End Deselect tasks:
SAP_GATEWAY_ADD_SYSTEM
Activate Netweaver Gateway basic configuration Front End Deselect tasks:
• Activate HTTP Services for NW Gateway (SICF)
Activating Fiori Launchpad Odata and HTTP services Front End Deselect tasks:
• Create / Select Customizing Request (SE09)
• Create SAP System Alias 'LOCAL'
• Activate HTTP Services for SAP Fiori Launchpad (SICF)
• Activate HTTP Services for UI5 (SICF)
• Activate HTTP Service for Cache Buster (SICF)
• Schedule job for calculation of SAPUI5 Application Index
• Add SAP System as trusted system (SMT1)
• Set Profile Parameter: login/accept_sso2_ticket=1 (RZ10)
• Set Profile Parameter: login/create_sso2_ticket=2 (RZ10)
!!Ensure authorization S_RFCACL in Frontend and Backend server
Connecting back end server to gateway front end Front End Deselect tasks:
• Set Profile Parameter: login/accept_sso2_ticket=1 (RZ10)
• Set Profile Parameter: login/create_sso2_ticket=2 (RZ10)

d. Execute the configuration step Setup of Enterprise Search (Back End)

a. If client is copy from another Fiori working client first execute task list SAP_ESH_RESET
e. If client is not copy of Fiori working one, activate ODataServices with SAP_GATEWAY_ACTIVATE_ODATA_SERV
f. Add to Backend´s ACL (STRUSTSSO2) the Frontend´s PSE certificate

CPO Page 9