Set up SAP S/4HANA

By setting up your SAP environment, you can ensure that Collibra has the necessary permissions to synchronize SAP S/4HANA metadata.

Complete these two steps in the following order to set up SAP S/4HANA:

  1. Create the integration role.
  2. Assign the role to the integration user.

Create the integration role

The integration role is a technical role. It lets the SAP S/4HANA driver read metadata and table data over RFC. The role is read-only: it grants only Display and Execute activities.

The role contains three authorization objects, each with a separate job:

  • S_RFC (class AAAB): which function modules the user may call remotely.
  • S_TABU_DIS (class BC_A): which table authorization groups the user may display.
  • S_TABU_NAM (class BC_A): which individual tables the user may display.

To create the integration role:

  1. In SAP, run transaction PFCG, enter the role name, and click Single Role. Add a description and save. Role names are normally in the customer namespace (Z* or Y*), confirm that the name is intentional.
  2. Open the Authorizations tab and click Change Authorization Data. If prompted about templates, choose Do not select templates, because all objects are added manually.
  3. Click Manually and add S_RFC, S_TABU_DIS, and S_TABU_NAM. Object classes AAAB and BC_A are added automatically.
  4. Click the pencil icon next to each field and enter the values shown in the Authorization objects section below.
  5. Click Save, and then click Generate (red/white diamond icon). The header should show Data Status: Saved and Profile Status: generated. Without generation, the role grants nothing.

Authorization objects

S_RFC: Authorization check for RFC access

Controls which function modules the driver may call over RFC. Each RFC_NAME row is a From/To interval; entering the same function module in both columns allows exactly that one. The list scrolls in the popup.

Field Value Meaning
RFC_TYPE Function Module (FUNC) Object type being called
RFC_NAME DDIF_FIELDINFO_GET Read field information of dictionary objects
RFC_GET_FUNCTION_INTERFACE Read the interface of a function module
RFC_GET_STRUCTURE_DEFINITION Read structure definitions
RFC_GET_SYSTEM_INFO Read system information
RFC_GET_UNICODE_STRUCTURE Read Unicode structure details
RFC_METADATA_GET Read RFC metadata
RFC_READ_TABLE Read table contents
SLDAG_CHECK_FOR_UNICODE Check Unicode status
ACTVT 16 Execute

S_TABU_DIS: Table maintenance by authorization group

Every table is assigned to an authorization group (stored in table TDDAT), for example FI for finance or HR for HR tables. This object grants access to whole groups of tables. Tables with no assignment fall under the group &NC&. Question it answers: may this user display tables in group X?

Field Value Meaning
DICBERCLS * Table authorization group. * means all groups, so every table.
ACTVT 03 Display (02 would be Change)

S_TABU_NAM: Table access by table name

Grants access to individual tables by name, which is more granular than S_TABU_DIS. It is checked when a program checks by table name, or as a fallback when the group check does not pass. Question it answers: may this user display table X?

Field Value Meaning
TABLE * Table name. * means all tables. A specific value such as MARA or T001* would limit access.
ACTVT 03 Display

How S_TABU_DIS and S_TABU_NAM work together

When a program checks table access, passing either check is normally enough. Granting both covers either style of check. With the values above (* and 03), the user can display every table in the system, and RFC_READ_TABLE exposes that over RFC.

Assign the role to the integration user

To assign the role to the integration user, in SU01:

  1. Run SU01, enter the user ID, and click Change.
  2. On the Logon data tab, set User Type to System or Communication (not Dialog) and set the password.
  3. On the Roles tab, add the role with valid-from and valid-to dates, then save.
  4. On the Profiles tab, confirm the generated profile appears.

Tip Alternative: in PFCG, open the role, go to the User tab, enter the user ID, run User Comparison, and save.

Checks and caveats

  • Failed calls: run SU53 as the user, or ST01 (authorization trace), to identify the missing authorization or function module.
  • Function groups: some releases and connectors also need S_RFC with RFC_TYPE = FUGR and function group names (for example RFC1, SDIFRUNTIME, SYST, SRFC). Add them if calls fail despite the FUNC entries.
  • Security: DICBERCLS = * and TABLE = * with RFC_READ_TABLE let this user read any table, including sensitive HR and financial data. Narrow DICBERCLS to only the groups the connector reads (check TDDAT), or replace the TABLE * with a list of required tables (find them with an ST01 trace while the connector runs).
  • Transport: build roles in DEV and transport them. After import, regenerate the profile if needed (PFCG, or SUPC for mass generation).

What's next

You can now create an SAP S/4HANA connection to an Edge or Collibra Cloud site.