How to restrict access to ABAP CDS

[aalexis]

Hello All,

We have built lot of ABAP CDS views, but we don't want all our team to be able to open and change it. So we want to restrict access to who can view and who can change it. We have implemented data level access and I am not talking about that. How can we restrict certain users can see the view but cannot make changes to it.

if anyone has done this kind of Authorization (most probably using roles created using PFCG) please let me know.

Thanks in advance,

Arthur.

[aalexis]

I think I have SAP_ALL Access so it does not show any restriction. But when I assigned it to a new user, the user does not have access to create ABAP CDS View. (Not even able to add ABAP project from ABAP Perspective). What are the roles that are to be assigned to a user to have access and able to create ABAP CDS from HANA Studio.

Thanks,

Arthur.

[Föß · Accepted solution]

Hi,

it should be possible with:

Authorization Object: S_DEVELOP

OBJTYPE = DDLS (=CDS View)

OBJNAME= ZABC* (= all ZABC* CDS Views)

ACTVT=01 (01 Create, 02 Change, 03 Display )

lg

[aalexis · Accepted solution]

Johann,

This seem like what I expected, Thank you for the answer, I will try it out and will close the question.

Arthur.

[aalexis · Accepted solution]

Johann,

I used the auth object as below but it still lets me edit the CDS and Activate it too. All my custom CDS as in Z001 Package, and my CDS name starts with ZB_* and the ABAP Catalog name is ZB*. Is there anything wrong the way I have defined or used the object in my role?

Let me know whether what should I do additionally,

Thanks,

Arthur.

[aalexis · Accepted solution]

All,

S_DEVELOP is part of the role required for this authorization to restrict the Display of CDS views. additionally S_RFC, S_ADT_RES also required to create a complete role that can restrict the CDS access to display only.

I am closing this question and Mark it as complete.

Thank you,

Arthur.

[shanthi_bhaskar]

and to add Johann you would be restricting the SQL view of an CDS not the DDL names