Athorization of users in a SAPUI5 web application

[former_member675984]

hi experts

I have an oData entity called users with a role field, how can I authorize users to access the application pages depending on the role?.

[maheshpalavalli]

You can ask backend team to create an entity and send all the ui visibility details there, like an entity with fields section, property, visibility, mandatory.

So u can use this to control the visibility of the ui fields in ur app. And this way, backend team can maintain a configuration for user role and fields that needs to displayed. And you can avoid hardcoding of roles and visibility (of pages) in the ui.

[jhodel18]

Hi Andres,

I don't get the part where you say you have an OData entity with a role field. Roles should be assigned to the user's ID and should not be provided via an OData entity. For a web application like SAP Fiori (or SAPUI5), the roles and authorization are broken down into 2 parts, the frontend (web app) and the backend (OData service) application.

The frontend app is governed by the use of business catalogs type of roles. The backend service is governed by the authorization to use the OData service and execute certain operations like create, read, update, and delete (CRUD).