/sap-abap-cds

Access Control (DCL) Template

Template for creating CDS access control definitions.

Basic DCL Template

@EndUserText.label: 'Access Control for <View Name>'
@MappingRole: true
define role <DCL_NAME> {
  grant select on <CDS_VIEW_NAME>
    where <condition>;
}

PFCG Authorization Template

@EndUserText.label: 'Access Control for Z_VIEW'
@MappingRole: true
define role Z_VIEW_DCL {
  grant select on Z_VIEW
    where (<cds_field>) = aspect pfcg_auth(
      <AUTH_OBJECT>,
      <AUTH_FIELD>,
      ACTVT = '03'
    );
}

Multiple Field Authorization

@EndUserText.label: 'Sales Organization Access Control'
@MappingRole: true
define role Z_SALES_DCL {
  grant select on Z_SALES_VIEW
    where (vkorg, vtweg, spart) = aspect pfcg_auth(
      V_VBAK_VKO,
      VKORG,
      VTWEG,
      SPART,
      ACTVT = '03'
    );
}

Combined Conditions Template

@EndUserText.label: 'Combined Access Control'
@MappingRole: true
define role Z_COMBINED_DCL {
  grant select on Z_VIEW
    where
      -- Authorization check
      (bukrs) = aspect pfcg_auth(F_BKPF_BUK, BUKRS, ACTVT = '03')

      -- Literal condition
      and status <> 'DELETED'

      -- Date condition
      and valid_to >= $session.system_date;
}

User-Based Access Template

@EndUserText.label: 'Own Records Only'
@MappingRole: true
define role Z_OWN_DATA_DCL {
  grant select on Z_USER_DATA
    where created_by ?= aspect user;
}

Note: ?= allows NULL values.

OR Condition Template

@EndUserText.label: 'Public or Own Records'
@MappingRole: true
define role Z_PUBLIC_OR_OWN_DCL {
  grant select on Z_DOCUMENTS
    where visibility = 'PUBLIC'
       or created_by ?= aspect user;
}

Multi-Level Authorization Template

@EndUserText.label: 'Multi-Level Authorization'
@MappingRole: true
define role Z_MULTILEVEL_DCL {
  grant select on Z_MATERIAL_DATA
    where
      -- Plant authorization
      (werks) = aspect pfcg_auth(M_MATE_WRK, WERKS, ACTVT = '03')

      -- Material type authorization
      and (mtart) = aspect pfcg_auth(M_MATE_MAR, MTART, ACTVT = '03');
}

Common Authorization Objects Reference

Finance

Sales

Materials

Controlling

Important: Authorization object names and fields may vary by SAP release and customization. Always verify the correct object name and fields in your system using transaction SU21 (Maintain Authorization Objects) before implementing DCL rules.

HR

Activity Values (ACTVT)

Example: Finance Document Access

@EndUserText.label: 'Finance Document Access Control'
@MappingRole: true
define role Z_FIN_DOC_DCL {
  grant select on Z_FINANCE_DOCUMENTS
    where
      -- Company code check
      (bukrs) = aspect pfcg_auth(F_BKPF_BUK, BUKRS, ACTVT = '03')

      -- Business area check (optional)
      and (gsber) ?= aspect pfcg_auth(F_BKPF_GSB, GSBER, ACTVT = '03')

      -- Only posted documents
      and posting_status = 'POSTED';
}

Example: Sales Order Access

@EndUserText.label: 'Sales Order Access Control'
@MappingRole: true
define role Z_SALES_ORDER_DCL {
  grant select on Z_SALES_ORDER
    where
      -- Sales organization structure
      (vkorg, vtweg, spart) = aspect pfcg_auth(
        V_VBAK_VKO,
        VKORG,
        VTWEG,
        SPART,
        ACTVT = '03'
      )

      -- Order type
      and (auart) ?= aspect pfcg_auth(V_VBAK_AAT, AUART, ACTVT = '03')

      -- Exclude cancelled orders
      and vbtyp <> 'K';
}

Example: Own Records with Admin Override

@EndUserText.label: 'User Tasks with Admin Access'
@MappingRole: true
define role Z_USER_TASKS_DCL {
  grant select on Z_USER_TASKS
    where
      -- Own tasks
      assigned_to ?= aspect user

      -- OR admin authorization
      or (admin_flag) = aspect pfcg_auth(Z_TASK_ADMIN, ADMIN, ACTVT = '03');
}

Testing Checklist

• DCL name follows naming convention
• @MappingRole: true is set
• Correct CDS view name referenced
• Authorization objects exist (check SU21)
• Field names match CDS view exactly
• Activity value appropriate (usually '03')
• Test with authorized user
• Test with unauthorized user
• Test edge cases (NULL values)

Debugging

Check User Authorization (SU53)

After access denied, run SU53 to see missing authorization.

Authorization Trace (ST01)

1. Start trace in ST01
2. Execute query
3. Analyze trace for auth checks

Verify DCL Assignment

" Check if DCL exists and is assigned to view
SELECT ddlname, as4local, as4vers
  FROM ddddlsrc
  WHERE ddlname = 'Z_VIEW_DCL'
  INTO TABLE @DATA(lt_dcl).

" Alternative: Check DCL source for specific view reference
SELECT ddlname, source
  FROM ddddlsrc
  WHERE source LIKE '%Z_CDS_VIEW%'
    AND ddlname LIKE '%_DCL'
  INTO TABLE @DATA(lt_dcl_refs).

Tip: In ADT, right-click the CDS view and select Open With → Dependency Analyzer to see associated DCL objects.