S/4HANA and Fiori Centralized vs Embedded System Errors – PFCG Troubleshooting with Real-Time Fixes

 

In modern SAP landscapes built on SAP S/4HANA, organizations implement SAP Fiori either using an Embedded deployment or a Centralized Hub deployment. While these architectures improve user experience, they also introduce complex authorization and configuration challenges.

Security consultants frequently face troubleshooting scenarios related to roles, catalogs, OData services, and backend authorizations, especially when roles are maintained in PFCG.

Below are real-time errors, troubleshooting approaches, and fixes commonly encountered in projects.

---

1. Fiori Tile Missing Due to PFCG Role Misconfiguration

Scenario

A user logs into SAP Fiori Launchpad, but the expected application tile does not appear.

Example:
User cannot see Manage Purchase Orders app.

Root Cause

The PFCG role may not contain the required Fiori catalog or group.

In centralized landscapes, the catalog is often assigned in the frontend server, while backend authorizations are maintained separately.

Troubleshooting Steps

1. Check user roles in SU01.

2. Verify role content in PFCG.

3. Confirm that the Fiori catalog is assigned.

Fix

Add the required catalog and group inside the role menu and execute:

PFCG → User Comparison

After role comparison, the tile appears in the launchpad.

---

2. Fiori Tile Visible But App Cannot Open

Scenario

User sees the tile but clicking it produces an error like:

“Application cannot be opened.”

Root Cause

The most common reason is that the OData service is not activated.

Fiori apps communicate with the backend system through OData services.

Troubleshooting Steps

1. Identify the OData service used by the application.

2. Check service activation in the system.

Fix

Activate the required service using:

/IWFND/MAINT_SERVICE

After activation, the application loads successfully.

---

3. Authorization Error Despite Correct PFCG Role

Scenario

User has the correct role but still receives authorization errors.

Root Cause

Backend authorization objects are missing.

Fiori apps require both:

• Frontend authorization (catalogs)

• Backend authorization objects

Example

User opens the Display Supplier Invoice app but receives authorization error.

Troubleshooting Steps

Run:

SU53

This shows the missing authorization object.

Fix

Maintain required authorization objects in the role and regenerate the authorization profile in PFCG.

---

4. Fiori Launchpad Not Loading

Scenario

User logs into the system but the launchpad shows a blank screen.

Root Cause

Common causes include:

• Missing launchpad role

• Cache inconsistencies

• Missing service activation

Troubleshooting Steps

Check:

• User role assignment

• Launchpad services

• Cache status

Fix

Run cache cleanup transactions and ensure launchpad services are active.

After clearing cache, users can access the launchpad normally.

---

5. Issues in Centralized Fiori Hub Architecture

In a centralized architecture, Fiori runs on a separate frontend server connected to the backend system.

This architecture introduces additional challenges.

Scenario

User can see tiles but app fails to retrieve data.

Root Cause

Backend system connection not properly configured.

Troubleshooting Steps

Consultant checks:

• RFC connections

• System alias configuration

• OData service mapping

Fix

Correct system alias configuration so that the frontend server can communicate with the backend system.

---

6. Embedded Deployment Authorization Issues

In embedded deployment, both Fiori and backend run on the same SAP S/4HANA system.

Scenario

User cannot access a Fiori app even though catalogs are assigned.

Root Cause

Authorization objects missing in backend roles.

Example

User accesses Create Sales Order app but system denies authorization.

Troubleshooting Steps

1. Execute SU53.

2. Check role authorizations.

3. Validate authorization fields.

Fix

Update the role authorization values in PFCG and regenerate the role.

---

7. Transport Issues Affecting Fiori Roles

Scenario

Roles transported from development to production but Fiori apps not working.

Root Cause

Transport did not include:

• Catalog assignments

• Authorization profiles

• OData configuration

Troubleshooting Steps

Verify role transport and repository synchronization.

Fix

Re-transport roles and perform user comparison.

---

8. Catalog Authorization Not Working

Scenario

Catalog is assigned but user still cannot access apps.

Root Cause

Catalog authorization object missing in the role.

Troubleshooting Steps

Consultant checks authorization object related to catalog access.

Fix

Maintain required authorization values in the role and regenerate profiles.

---

9. Fiori App Shows Data But Cannot Save Changes

Scenario

User can open the application but cannot save updates.

Example:
User edits purchase order but cannot save.

Root Cause

Display authorization exists but change authorization missing.

Troubleshooting Steps

Run authorization trace and check missing objects.

Fix

Add change authorization values to the role.

---

10. Cache Issues After Role Changes

Scenario

After assigning new roles, users still cannot see the apps.

Root Cause

Fiori launchpad cache not refreshed.

Troubleshooting Steps

Check if role comparison was executed.

Fix

Run cache invalidation and ask user to log out and log in again.

---

Conclusion

Troubleshooting SAP Fiori in SAP S/4HANA environments requires understanding both frontend configuration and backend authorization logic. Whether using a centralized hub architecture or embedded deployment, most issues arise due to:

• Incorrect PFCG role configuration

• Missing OData service activation

• Missing backend authorization objects

• Cache inconsistencies

• Transport configuration problems

A skilled SAP Security consultant must analyze issues across PFCG roles, services, system alias configuration, and authorization traces to resolve problems efficiently.