Secure Multi-Tenant App Integration in Fiori Launchpad
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing SAP FIORI Launchpad solution is not compatible with database/cloud-computing environments like SAP HANA XS Advanced and HANA Cloud Platform, where Multi-Target Applications need to add their own content to a shared FIORI Launchpad without downtime, and existing solutions fail to securely integrate independent applications with different access restrictions.
Innovation Solution
A method is implemented to deploy user interface content from Multi-Target Applications to a shared FIORI Launchpad using an OAuth Client Secret and FLP Config data, with an App Router accessing a FLP Repository to read content and OAuth Client Secrets, and exchanging user tokens for application-specific tokens to ensure secure authentication and filtering of UI elements based on scopes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a shared FIORI Launchpad is used to host multiple applications, then resource utilization and user access are improved, but security and access control for independent applications deteriorate
Solution Approach 1:
The patent segments the authentication process by introducing application-specific authorization tokens that are distinct from the shared FLP authentication mechanism. Each application maintains its own token validation, creating segmented security zones within the shared FLP environment. This allows multiple applications to coexist securely with independent access controls.
Solution Approach 2:
The patent introduces an intermediary token exchange mechanism where a generic authentication token from the shared FLP is exchanged for application-specific authorization tokens. This intermediary process acts as a mediator between the shared FLP authentication system and individual application security requirements, enabling both shared access and application-specific control.
2Productivity
If UI content is added to an existing shared FIORI Launchpad without re-deployment, then downtime is avoided and productivity is improved, but integration complexity and security configuration worsen
Solution Approach 1:
The patent implements preliminary action by pre-configuring the FLP Deployer application with OAuth client secrets and authentication mechanisms before applications need to add their content. The deployment infrastructure is prepared in advance with the necessary security configurations, allowing applications to self-register and add UI content without requiring FLP re-deployment or causing downtime.
Solution Approach 2:
The patent enables self-service by allowing applications to automatically register themselves with the shared FLP through the FLP Deployer. Applications can autonomously add their UI content and configure their authentication parameters without manual intervention or FLP re-deployment. The system serves itself by automatically managing the integration of new applications into the existing FLP infrastructure.
Data Source
AI summary
An Open Authorization (OAuth) Client Secret of an application associated with a Multi-Tenant Application (MTA) deployed in a cloud-computing environment if read with a Fiori Launchpad (FLP) Deployer. The FLP Deployer writes, as content to a FLP Repository, the OAuth Client Secret and FLP Config data for the application read from a FLP Config data store. An App Router/shared FLP (App Router/FLP) accesses the FLP Repository to read content and OAuth Client Secrets for the application that has deployed to the App Router/FLP. A User Account and Authentication (UAA) service associated with the App Router/FLP is accessed to fetch an authorization token for a user after receiving a user connection to the App Router/FLP. An original user authorization token obtained for the user is exchanged with an application-specific authorization token. User interface elements displayed in the FLP are filtered based on scopes read from the exchanged application-specific authorization token.