An effective way to bring SAP Security Notes under control

Previously, SAP has regularly published current security updates to the SAP Support Portal and SAP Solution Manager once a month on what as known as patch day. This provides IT departments with information on relevant security vulnerabilities. They can then import this information into their SAP system environments in good time to prevent the vulnerabilities from being exploited by attackers. However, there are often technical or organizational reasons as to why it is not possible to import the information promptly. This is because importing all relevant Security Notes into all affected SAP systems would require a lot of effort. In addition, many companies defer patch implementation until the next system maintenance window in order to avoid unnecessary downtime. However, by this time, the affected SAP applications face even higher risks than before – when security updates are published, a large group of people learn about the existing security vulnerabilities and could exploit them specifically. For this reason, security experts call this the "window of exposure".

Urgency is the deciding factor

To enable IT departments to keep this window of exposure to risks as small as possible, the real-time security solution, SAP Enterprise Threat Detection (ETD), was enhanced to include functions for promptly monitoring SAP Security Notes. SAP ETD immediately sends an alert if a function with a known vulnerability is performed in an SAP system that has not been patched yet. The decision is made based on the urgency of the available patch installations: The more often an insecure SAP function is executed, the sooner the affected security update should be imported to avoid potential risks. SAP ETD does not just check the execution of critical software code points – in many cases, it also checks whether the vulnerability itself is being exploited, for example by evaluating program parameters.
By monitoring reported SAP vulnerabilities in real time, IT departments benefit from being able to import highly critical Security Notes in good time or eliminating the risks temporarily at another level. For example, this may involve blocking an RFC module or a port that is not critical to business processes. Less critical Security Notes can continue to be imported during the scheduled maintenance window. This approach saves time and effort. The other vulnerabilities that have not yet been patched are monitored in real time, allowing a direct response to other potential risks. 

Essential approach for project success   

When the new ETD functions for monitoring SAP Security Notes are introduced, the success of the project depends on taking a structured and efficient approach.
In general, the following applies: The more heterogeneous the existing system landscapes and release statuses, the more effort will be involved in the roll out. It is also important to keep the current backlog of SAP security updates in mind. In our experience, many SAP customers do not have a security team tasked with systematically and exclusively taking care of importing the current SAP patches. As a result, a sizable backlog of security updates has built up from previous patch days and must be processed first.   

The core project requirements include the following:

1. "Get clean" for the patch backlog
The first step is to "triage" the existing backlog by sorting it by urgency. This is done by analyzing the security updates as to when and in what sequence they should be imported into the SAP systems. The goal is to bring the backlog that has built up down to an acceptable starting situation for future evaluations on every patch day.
2. "Stay clean" by taking an efficient approach to Security Notes
Next, companies should perform an evaluation of the current security updates on every patch day in order to achieve permanent protection for the SAP systems. Considering the large quantities of patches and affected systems, we recommend focusing on the critical Security Notes and integrating the rest into ETD monitoring based on defined checking rules. The basis for this is how the company specifically defines its what it understands as a risk.
3. Create an appropriate alert level
If ETD sent alerts every time an insecure SAP function is called, its acceptance would immediately plummet because a flood of alerts are not manageable in the context of day-to-day work. Thus, which alerts are relevant for a company and at what threshold values the alerts should be displayed must be defined for the Security Notes to be integrated into ETD monitoring on every patch day.

Combine expertise in security and SAP

This information shows that SAP customers who want to benefit from the new ETD functions must prioritize their triaging efforts. Because many companies do not have enough personnel, we recommend bringing in a external security provider, whether this involves one-time support for the roll out project or ongoing services for each patch day. It is vital for the consulting partner to have the required expertise in SAP and security, and specifically experience in implementing patches, an understanding of different SAP releases and upgrade methods, and knowledge in threat detection – both in general in terms of SIEM solutions (Security Information and Event Management) and particularly in terms of SAP ETD.

Complete with a preventative approach

One way to further boost SAP security is to round out the ETD real-time monitoring of unpatched systems with a preventative approach. This monitoring already identifies vulnerabilities in custom source code or in the SAP system settings. A current edition of the Business Code Quality Benchmark shows just how great the risk potential is. According to this, anonymized scans at over 300 SAP customers worldwide showed that customer-specific SAP applications contain, on average, 2,000 critical security errors in internal ABAP code that make a company vulnerable to attacks.
Special SAP security software can be used to automatically identify these vulnerabilities in SAP custom code and – to the extent possible – correct this. What is more, the software also provides the option to integrate these vulnerabilities into ETD monitoring until they are fixed. A similar option is available for known vulnerabilities in third-party applications used by many SAP customers: ETD sends an alert here, too, when an insecure function is called.

ABAP for the Modern Age A Look at the Latest ABAP Enhancements in SAP NetWeaver 7.5

SAP NetWeaver 7.5 — unveiled in October 2015 at SAP TechEd in Las Vegas — is the latest iteration of SAP’s well-known technology and integration platform for SAP environments. It is the logical continuation of the widely adopted SAP NetWeaver 7.4, and serves as the on-premise foundation for SAP Business Suite (as of the planned enhancement package 8 for SAP ERP 6.0) and the on-premise edition of SAP Business Suite 4 SAP HANA (SAP S/4HANA). Its enhancements include support for emerging technologies such as the Internet of Things (IoT), expanded support for SAP HANA, enhanced integration with cloud-based and mobile environments, support for Java 8, and a new, common ABAP codeline for delivering the same innovations across on-premise and on-demand editions of solutions such as SAP S/4HANA.
Some of the most significant innovations in SAP NetWeaver 7.5 are in this new codeline, especially in the ABAP programming model within SAP NetWeaver Application Server (SAP NetWeaver AS) ABAP. This article focuses on a set of particularly useful features included with ABAP 7.5, including new ABAP language features for enabling more concise code and enhancements that further optimize ABAP application development for SAP HANA, such as new features for developing SAP Fiori front ends based on core data services (CDS) and a new tool for debugging ABAP-managed database procedures (AMDPs). 
New ABAP Language Features
The ABAP language has always evolved to keep pace with changing requirements for modern development languages — for example, past releases added object-orientation and Open SQL features that work closely with ABAP internal tables.
To meet the need for simplicity in modern applications designed for complex requirements, SAP NetWeaver 7.4 introduced several innovations for ABAP, including enhancements that make it easy to write very compact ABAP code using expressions. Let’s look at how this might work. The left side of Figure 1 shows a procedural code excerpt that defines a work area called wa1 and an internal table it1 that contains multiple line items, just like the work area. Two lines are then added to the internal table with the INSERT statement. Next, the field symbol <wa1> is used to loop over the internal table to create a second internal table called it2. Finally, a record is read from internal table it1, which has key field a set to 3, assigning the field symbol <wa1> that is used as a parameter to a method call.

Figure 1 — ABAP expressions enable compact, concise procedural code

The right side of Figure 1 shows how this procedural code can be very compactly written using ABAP expressions. First, the internal table is initialized with the VALUE operator. Next, the second internal table is created with the VALUE operator implicitly looping over it1. Finally, an object reference class1 is created with a NEW operator and the method do_something is invoked using the b field of internal table it1 at key field a set to 3. This example shows how ABAP 7.4 is far more compact compared to the more verbose style of previous releases. With ABAP 7.5, these expressions have been extended further. ABAP 7.5 includes support for type inference, where the type of a variable is determined based on the logic evaluation of the expression — see the DATA(it1) declaration shown on the right in Figure 1, which declares a variable it1 whose type is determined by the evaluation of the VALUE tt1(...) expression. It also supports type inspection operators, such as INSTANCE OF and CASE TYPE OF, which can be used to query the type information of a variable during runtime.
In addition to new features for expressions, ABAP 7.5 includes several other ABAP language enhancements. It introduces a new data type (INT8) that enables eight-byte integers, which helps in big data scenarios by extending the number range significantly. It also enables T100 error messages to be raised using class-based exceptions, which makes it easier to handle exceptions on a higher level. And “test seams” are a new feature that help make unit testing easier by enabling the replacement of a block of production code by a block of test code when unit tests are executed (when test runs depend on existing database records, for example). 
New ABAP Development Tool Features
CDS1 is a feature of the Eclipse-based ABAP development tools for SAP NetWeaver (known as ABAP in Eclipse). It is an infrastructure for defining and consuming data models — represented in ABAP as CDS views, which provide access to the data represented in the model — on the SAP HANA database rather than on the ABAP server. Introduced with SAP NetWeaver 7.4 SPS 05, CDS includes a variety of features to support modern development, including support for SAPUI5 (SAP’s interpretation of the HTML5 standard) to enable the development of responsive and elegant SAP Fiori applications.
SAP NetWeaver 7.5 builds on these capabilities with several new enhancements for CDS. You can now use associations, which define the relationships between CDS views and other tables and views they reference, when extending SAP standard CDS views. You can also embed table functions into CDS views that call ABAP-managed database functions that return fields and table values for SAP HANA-specific breakout scenarios (similar to ABAP-managed database procedures for managing procedures in ABAP that execute in SAP HANA). Another new feature is the data control language (DCL), which allows you to add authorization checks that reflect your transaction PFCG role profiles when accessing CDS data.
To better understand the potential of CDS in ABAP 7.5, and to see how easy it is to build attractive SAP Fiori user interfaces on top of CDS, let’s walk through a simple, practical example that highlights two particularly useful new features: an intuitive graphical modeling tool and the ability to easily expose CDS views as services for consumption by SAPUI5. We will build a simple sales order application using the SAP Web IDE, a browser-based development environment available with SAP HANA Cloud Platform for rapidly developing SAP Fiori applications.2 Sales orders are common SAP objects that consist of sales order headers and positions (order line items typically represented by a product or quantity); business partners, such as customers who have posted the sales order; and invoices that will be sent to the customer once the sales order is fulfilled. 
Data Definitions in the CDS DDL Editor
First, we’ll look at the CDS data model that we’ll use for the example SAP Fiori application. To access the CDS view, launch ABAP in Eclipse and log on to an ABAP 7.5 back-end system (H74 in the example). On the left side, displayed in the Eclipse project explorer (see Figure 2), is the usual ABAP project structure, which contains your favorite ABAP packages and their associated data definitions based on CDS. On the right side is the DDL editor, where you can see the source code for the sales order CDS view (ZDDLS_DEMO_EPM_I_SALESORDER). Comments preceded with the @ symbol are CDS annotations, which provide semantics and interpretation — for example, field labels for the user interface that are used to quickly prototype screens. Here, we’ll focus on the CDS view itself.

Figure 2 — A CDS view displayed in the DDL editor

The CDS view is based on a left outer join between the sales order table (snwd_so) and the business partner table (snwd_bpa). Next, you see the list of associations, prefixed with an underscore to distinguish them from value-oriented fields: business partner (_Customer); the contact person (_CustomerContact); the invoice (_Invoice); and the sales order items (_Item). Then you see a list of result columns that make up the view, such as sales order ID and key; customer ID; gross, net, and tax amount of the order, including the currency; sales order status; and creation and change date. Press the F8 key to display the results of this view in the data browser (Figure 3).

Figure 3 — The result set generated by the example CDS view

From the data browser, you can follow the associations (see Figure 4) to their related entities, such as business partner or sales order items, for testing and analysis purposes. You can also display the contents of the table or view referred to by an association, such as the related sales order items (Figure 5) or customer (Figure 6).

Figure 4 — Following CDS associations in the data browser

Figure 5 — The contents of the associated sales order items table

Figure 6 — The contents of the associated customer information table

SAP NetWeaver 7.5 also includes a new CDS graphical modeler tool that shows a graphical representation of the CDS view, the underlying base table, and associations (see Figure 7), to enable a quick and easy understanding of the view and its relationships to other views.

Figure 7 — The CDS graphical modeler provides a graphical rendering of CDS view implementations

To use the CDS when we build our simple SAP Fiori application with the SAP Web IDE, we need to expose the CDS view as a service using the OData protocol3 so that SAPUI5 can consume the CDS data. To enable these OData services with ABAP 7.4, you had to create complex SAP Gateway implementations using transaction SEGW. ABAP 7.5 provides a much easier way: We simply specify the annotation @OData.publish: true in the source code using the DDL editor. The corresponding OData service is automatically generated for SAP Gateway and can be inspected in the technical properties by pressing the F2 key (see Figure 8). Clicking on the OData-Service link included in the technical properties displays an XML document describing the SAP Gateway service (see Figure 9). We will use this service when building our SAP Fiori application based on SAPUI5 using the SAP Web IDE.

Figure 8 — The generated SAP Gateway service displayed in the CDS technical properties

Figure 9 — The XML document describing the generated SAP Gateway service

SAP Fiori Development Based on CDS
The SAP Web IDE is SAP’s web-based development environment for SAPUI5-based development, and it is particularly well suited to quickly developing SAP Fiori applications. Available via SAP HANA Cloud Platform,4 it uses a multi-tabbed editor environment with a project navigation tree on the left, a workspace tab on the right, and menus and sidebar tools (see Figure 10).

Figure 10 — The SAP Web IDE development environment

To create our simple SAP Fiori application, we’ll use the SAP Web IDE project wizard (see Figure 11). This wizard offers many different UI templates for SAP Fiori development. For our simple example, we’ll use the SAP Fiori Master Detail Application template, which creates an SAP Fiori application that displays data from an OData service in a master-detail pattern (see Figure 12). The screenshot on the right of the template selection screen previews the layout of the application based on the selected template, where the master section (the white bar on the left) contains a list of records and the detail section on the right provides information for a selected record.

Figure 11 — Launching the SAP Web IDE project wizard

Figure 12 — The SAP Web IDE project wizard template selection screen

First, we specify a project name (kk100 in the example), which serves as a container for all the required SAPUI5 artifacts (see Figure 13). Next, we specify a connection to a back-end system (see Figure 14). We use the same back end that was visible in ABAP in Eclipse (H74 in the example). After logon, the system responds with the list of available OData services that can provide the source data for our application, and we select the sales order CDS from the list (see Figure 15). The system expands the display to include the top-level OData artifacts for the chosen service, but we can disregard these for our purposes here.

Figure 13 — Specify a project name for the application

Figure 14 — Specify a connection the ABAP backend system

Figure 15 — Select the CDS service to provide the source data for the application

Next, we start to populate the master section of the template (see Figure 16). We choose the OData collection zdev201_sales_order, which corresponds to our CDS view, and we assign the other master fields, such as sales order ID, gross amount, and transaction currency (see Figure 17). Then we populate the detail section with fields for the delivery status of the order, net amount, and tax amount, including currency, and we specify the navigation section using the OData navigation property to_Customer along with the value fields BP_ID (business partner ID), BP_ROLE (business partner role), and COMPANY_NAME (see Figure 18). The template offers 1:1 associations from the CDS view, meaning you can pick and choose fields from any master records referenced in the associations available with the view.

Figure 16 — Select the OData collection to use for populating the template

Figure 17 — Populate the master section of the template

Figure 18 — Populate the detail and navigation sections of the template

With all of the fields specified, we can generate the project, which creates an SAPUI5 project outline in the SAP Web IDE project navigation tree, with all the required artifacts (see Figure 19). To load the completed master detail application, select the Run menu item, which previews the application in a browser (see Figure 20). As specified by our template selections, the application contains sales order ID and gross amount in the master section on the left, and net and tax amount plus delivery status, represented by the character “D” under the amount, in the detail section on the right. Clicking on the navigation icon () in the detail section displays the business partner information (see Figure 21).

Figure 19 — The source code for the generated project

Figure 20 — The master detail application previewed in an browser

Figure 21 — Using the navigation icon to display the business partner information

When it comes to creating an SAP Fiori application, the biggest improvement in SAP NetWeaver 7.5 is the ability to easily expose OData services without the need to develop complex SAP Gateway implementations. In addition, more sophisticated templates (called smart templates) have been added to the SAP Web IDE that come with many pre-built interaction capabilities such as sorting, searching, and grouping, similar to the extensive functionality included with the ABAP List Viewer. All of this is also possible with SAP NetWeaver 7.4 and SAPUI5, but you would have to manually implement most of the functionality. 
New Debugging Features
A very useful ABAP feature introduced in SAP NetWeaver 7.5 is Eclipse debugging support for AMDPs — a SQLScript-based framework introduced in SAP NetWeaver 7.4 (SPS 05) that allows developers to manage database procedures in ABAP just like standard ABAP classes while they execute in the SAP HANA database. AMDPs are represented by ABAP classes that implement the AMDP interface.
AMDP debugging was supported in SAP NetWeaver 7.4 SPS 05, but you had to work with two debuggers in parallel — the ABAP debugger for setting breakpoints on the ABAP level and the SQLScript debugger of the SAP HANA studio for setting breakpoints on the SAP HANA level — which is very cumbersome. In ABAP 7.5, you can debug the SQLScript code contained in AMDPs directly within the source code editor of ABAP in Eclipse as if it were ABAP code. Let’s take a look at an example to see how this works.
Figure 22 shows a list of ABAP classes representing AMDPs in the project explorer of ABAP in Eclipse. The source code editor displays the implementation of the ZCL_DEV201_CUSTOMER_INFO_201 class, with the SQLScript code marked in yellow. (The background color can be customized in your Eclipse font and color preferences.) By double-clicking on a source line, you can set a breakpoint (in the example, we set it at line 61 so that execution stops at the first SQL command), which is marked with a green circle. Now you can test the class by pressing the F8 key, which takes you to the test environment (Figure 23).

Figure 22 — Setting a breakpoint in the ABAP in Eclipse source code editor

Figure 23 — The debugger test environment

The test environment shows the outline of the ZCL_DEV201_CUSTOMER_INFO_201 class, including its interfaces, attributes, and methods. Here, we invoke the GET_CUSTOMER_INFO method, which displays basic information, such as the customer’s ID and name, and an aggregate of the gross amount of open orders, which requires some calculations carried out in the method GET_CURR_CONV_RELEVANT_ITEMS. Invoking this method displays a prompt for input parameters for the client and customer ID to identify a particular customer (see Figure 24). After specifying this information, switch back to the debug perspective in Eclipse and run the method by pressing the F8 key again.

Figure 24 — Specify the input parameters for the method

The Eclipse debugger halts in the SQLScript code at the location of the set breakpoint (see Figure 25).

Figure 25 — Hitting the set breakpoint

Now you can single step through the code, examine the variables and tables referenced in the method (see Figure 26), and then resume execution of the method until it returns its results (see Figure 27) — in the example, the record corresponding to the key (the customer ID in this example). You can then drill down into the details of this record and view the fields, for example, in order to display the customer name and the aggregated gross amount (see Figure 28).

Figure 26 — Examining the variables and tables referenced in the method

Figure 27 — Executing the method results in the location of a single record entry

Figure 28 — Drilling down into the details of the found record

Despite the comfort provided by this new debugging feature, bear in mind that AMDPs are encapsulations of SAP HANA-specific code. SAP’s recommendation is always to write portable ABAP code to ensure portability across database platforms, which is facilitated by CDS principles, and to only use AMDPs where absolutely necessary, such as in analytical scenarios where you also leverage other SAP HANA-only frameworks, such as geospatial and application function library frameworks. AMDPs are seamlessly managed on the ABAP layer, however, so when you do need to use them, you do not need to leave the ABAP level during design and runtime — and debugging. 
Summary
SAP NetWeaver 7.5 includes many new features for developers that demonstrate the continued strength of the ABAP stack. The ability to write more concise code combined with state-of-the-art development tools that support SAPUI5 and SAP HANA makes it easy to build innovative applications with responsive SAP Fiori interfaces that can run on any device. A traditional development infrastructure facilitates easy-to-configure developer workplaces in widespread SAP solution landscapes, enabling effective application development for modern business needs.


1 For a detailed introduction to the CDS features included in ABAP 7.4, see my article “Enhanced ABAP Development with Core Data Services (CDS)” in the October-December 2015 issue of SAPinsider (SAPinsiderOnline.com). [back]
2 For a detailed look at creating SAP Fiori applications with the SAP Web IDE, see the article “SAP Fiori Application Development in the Cloud” by Monika Kaiser and myself in the April-June 2015 issue of SAPinsider (SAPinsiderOnline.com). [back]
3 Learn more about the Open Data (OData) protocol at www.odata.org[back]

4 A trial edition of SAP HANA Cloud Platform, along with a trial SAP HANA Cloud Platform developer account, is available athttps://account.hanatrial.ondemand.com[back]

Introducing ABAP 7.51 A New ABAP Model for Transactional Application Development

Since its release in October 2015, SAP NetWeaver 7.5 has seen a rapid adoption rate, with more than 1,000 productive customer systems as of September 2016. SAP NetWeaver 7.5 delivers an array of innovation for the ABAP stack, including advanced support for core data services (CDS) and features for the corresponding ABAP development tools for Eclipse (known as ABAP in Eclipse), which together enable rapid development of SAP Fiori-based analytical and reporting applications. Support for Java 8 and end of maintenance for SAP NetWeaver 7.0 in 2017 have also been significant drivers of adoption.1
With all of the innovation in 7.5, and its eager adoption by customers, it might be surprising to learn that SAP is already delivering version 7.51 in Q4 2016. Why is SAP doing this, and why should you upgrade to this new version? The main driver for 7.51 is to provide ABAP enhancements that support the transition from SAP Business Suite to SAP S/4HANA, and for this reason, it is not a full SAP NetWeaver delivery — it consists solely of SAP NetWeaver Application Server (SAP NetWeaver AS) ABAP, supported by the 7.49 ABAP kernel, and related development tools. So, does that mean this a release only for SAP S/4HANA customers?
The answer is no. ABAP 7.51 delivers an enhanced ABAP programming model that extends CDS to include transactional as well as analytical application development and supports custom code management. Not only do these enhancements provide a structured approach for transitioning from a traditional SAP Business Suite implementation to SAP S/4HANA along with powerful custom development capabilities, they also extend the advantages of CDS modeling to the development of any custom ABAP-based transactional applications.
This article provides an overview of the ABAP features included in an upgrade to 7.51 (see the sidebar “Upgrading to 7.51” for more on upgrading), and walks through an example that demonstrates how these features work together to help you create sophisticated SAP Fiori-based transactional applications.

Upgrading to 7.51
So, will only SAP S/4HANA customers get the 7.51 version as an indirect shipment? Fortunately, the answer is no. SAP is also releasing SAP NetWeaver Application Server (SAP NetWeaver AS) ABAP 7.51 as a standalone development and runtime environment, meaning that any SAP customer with a valid SAP NetWeaver license can download it from SAP Service Marketplace (http://service.sap.com) or run a cloud image via the SAP Cloud Appliance Library.
Upgrade options for ABAP 7.51 are offered for SAP NetWeaver start releases 7.4 and 7.5 when the usage type is restricted to ABAP development and execution. Java usage types can skip the 7.51 release and later upgrade to a successor version (not yet planned) offering Java 9 support. Similarly, SAP Business Suite (enhancement package 8) usage types, which run on the full SAP NetWeaver 7.5 release, can skip 7.51 and upgrade to a (not yet planned) later release.
In parallel to the 7.51 shipment, SAP has released a couple of add-ons for 7.4 and 7.5, including a governance, risk, and compliance (GRC) add-on (SAP Note 2323497 documents the available add-ons). These add-ons require only an SAP NetWeaver AS ABAP release, underscoring the value of 7.51. Other add-ons that require a full SAP NetWeaver stack, similar to the SAP Business Suite usage type, can skip 7.51 and wait for a later release.

The 7.51 ABAP Programming Model
CDS is a layer for defining and consuming data models on the ABAP abstraction level on top of the SAP HANA database. Introduced with SAP NetWeaver 7.4, support package stack 05, the CDS model is represented in ABAP as CDS views. These views are defined using a SQL-based data definition language (DDL) and can be exposed as OData services, without the need to write SAP Gateway code, to provide SAPUI5-based SAP Fiori applications with easy access to the data represented in the CDS model. The CDS paradigm for ABAP development has significantly accelerated the development of SAP Fiori applications, enabling the semantic modeling of data and making it easy to write analytical and reporting applications.
But what about typical transactional applications that perform insert, update, and delete operations? Technically, you can use Open SQL for transactional applications on the 7.4 or 7.5 ABAP stack. You can extend SAP Fiori applications consuming CDS with manually coded SAPUI5 applications that access manually coded SAP Gateway services, which in turn call manually coded ABAP methods that execute the Open SQL statements accordingly. For each of these tasks, there is a corresponding development tool: SAP Web IDE for SAPUI5, transaction SEGW for SAP Gateway projects, and ABAP in Eclipse for implementing the ABAP methods that carry out the Open SQL commands.
While technically possible, this manual approach to the CDS-based development of transactional applications is time consuming and does not leverage the modeling abstraction that is essential for CDS development. To bring the advantages of CDS modeling and SAP Fiori-based user interfaces to transactional scenarios, ABAP 7.51 extends the CDS-based ABAP program model to integrate transactional services on the CDS level. The natural way to do this is to provide meaningful annotations that bridge the analytical world of CDS and the transactional Business Object Processing Framework (BOPF) model.2

CDS Modeling Support for Transactional Applications
BOPF is a model-driven persistence framework for custom ABAP development. It provides an application framework of generic services and functionalities that developers can then customize to their particular needs, enabling transaction-oriented development based on a stable application architecture. The BOPF model is not new. It resides in the ABAP stack as an ABAP-based repository and runtime framework and is used by several SAP Business Suite applications, including newer solutions such as SAP Transportation Management.
A BOPF model consists of a root node and child nodes that represent a business object and its related fields. For example, a sales order would consist of a root node that holds the header information and sales order items as descendent nodes with 0 to n cardinality. Each BOPF model exposes a certain behavior based on different methods, including validations to check for the consistency of a business object, determinations to change the state and the attributes of a business object, and actions that carry out operations on a business object. Technically, these methods are implemented by ABAP classes, so you can think of the BOPF model as an object-based framework. Central services such as transaction control, commit to the database, locking, and buffering are handled inside the BOPF framework, which shields the details of the implementation from the developer.
In ABAP 7.51, the semantic link between the CDS definition and its corresponding BOPF representations is established by a set of well-defined annotations that are added using the DDL editor — the tool within ABAP in Eclipse used for defining CDS views — similar to the way annotations are created to describe the use of data in a user interface, for instance. Since annotations define a certain facet of the underlying view data for user interface, analytical, or search purposes, you can think of BOPF as the transactional facet of a CDS definition.
When a CDS view is activated, the corresponding underlying view definitions on the SAP HANA database are activated. When the CDS contains BOPF annotations, a corresponding BOPF model and definitions are automatically activated in the background, as if you had used the BOPF editor tool included in ABAP in Eclipse to build it. In fact, you can use the BOPF editor to display the results of the activation and then dive into the ABAP-based implementation of the BOPF methods.
Let’s look at a use case that demonstrates how the different bits and pieces — CDS, BOPF, and SAP Fiori — all work together in ABAP 7.51 to bring CDS features and an elegant and responsive user interface to transactional application development.

Putting It All Together: An Example
CDS and BOPF development can be easily combined in the user interface layer, where the analytical and transactional parts of an application appear side by side in many scenarios. Here, using the well-known Enterprise Procurement Model, we’ll walk through the development of an example application that combines these two types of development in the user interface.

Developing the CDS View
Our first goal is to develop a sales order invoice CDS view containing a list of invoice numbers together with the usual fields, such as customer ID, company name, timestamp of creation, transaction currency, and gross amount of the invoice. The development of CDS views has been covered in depth in previous articles, so here we will take a high-level look at the steps.3
Figure 1 shows the source code for the CDS view (Zdev210_C_SlsOrdInv_Sol) that generates this list, displayed in the DDL editor of ABAP in Eclipse. This view is a simple projection view that is mapped to the base view SEPM_I_CustomerInvoice_E, which has an association to a customer view to retrieve the company name. You can display all of the associations and related information for the base view by pressing F2 (see Figure 2). 

Figure 1 — The source code for the example sales order invoice CDS view

Figure 2 — Press F2 to view the technical information, including associations, for the base view

Executing the view (by pressing F8) displays a list of the specified fields and retrieved data in a table format (see Figure 3).

Figure 3 — The results displayed by executing the example sales order invoice CDS view

CDS offers a variety of built-in functions for customizing the resulting data set, including calculation functions and extensibility options for adding fields. For example, you can use the CreationDateTime data to determine how many days a particular invoice has been open — by calculating the difference between the creation and the actual date and time in seconds (function tstmp_seconds_between) and dividing by 86400 (the product of 60*60*24) — and add a field (DaysOpen) to display the results (see Figure 4). Figure 5 shows an added field convGrossAmount that is calculated by the currency_conversion function, which converts the actual currency to US dollars. 

Figure 4 — Use built-in functions to customize the results display — for example, use a calculation function to calculate the number of days an invoice is open

Figure 5 — Adding a field to the results display that shows the converted gross amount for an invoice

Figure 6 shows the results.

Figure 6 — The modified results display for the example sales order invoice CDS view

Creating an Application Based on the CDS View
Once the CDS view is complete, we are ready to create an SAP Fiori application based on the CDS view. For this task, we use SAP Web IDE, SAP’s web-based environment for SAPUI5 application development, which is available via SAP HANA Cloud Platform or as a standalone on-premise version. As with CDS view development, SAP Fiori application development has been covered in detail in previous articles, so here we will focus on the key steps.4
SAP Web IDE offers a smart template approach to developing SAP Fiori applications. After selecting Smart Template Application on the Template Selection screen (see Figure 7), specify the connection to the back-end ABAP system (in the example, M35) and select the SAP Gateway service that was automatically published with our sales order invoice CDS view (ZDEV210_C_SLSORDINV_SOL_CDS in the example). Figure 8 shows the view selected for the example — Sales Order Invoice - Consumption View — with the metadata of the service expanded below it.

Figure 7 — Select a smart template for developing the SAP Fiori application

Figure 8 — Select the SAP Gateway service that will provide the application with access to the back-end ABAP system

We then generate the SAP Fiori development project and run it. The result is shown in Figure 9. It shows sales order invoices grouped by company, and shows all the aggregated columns such as average open days, gross amount, converted amount, and creation date. All the grouping and sorting capabilities are built into the template automatically, meaning no need to write any code for it.

Figure 9 — The generated SAP Fiori sales order invoice application

To view the details of a particular line item, select the item and click on Show Details, which takes you to a display that groups the details into general information on the upper half and all the positions of the sales order on the lower half (see Figure 10). Again, all this functionality is automatically provided by the template and requires no additional manual coding efforts.

Figure 10 — The detail display for a selected sales order invoice

Now, let’s see how the transactional services capabilities provided with ABAP 7.51 come into play.

Developing a CDS View with Transactional Services
Customer feedback via product reviews can be of significant value to suppliers and to other customers seeking recommendations. To add this capability to our example application, we create a new CDS view (ZDEV210_I_PRODREVIEW_SQL), shown in Figure 11. The view displays all reviews collected to date. The reviews are managed as records made for a particular product by a contact person, who provides a rating (number) at a given time. The view contains an association to a product information view.

Figure 11 — The source code for the example product review CDS view

In the annotations of this CDS view, you see several lines that start with the prefix @ObjectModel to indicate that BOPF-based transaction services will be linked to this view. While many of these annotations are self-explanatory, such as createEnabled and updateEnabled, you can always open the online help by pressing F1 on the annotation. You can open the technical properties by clicking on the spiral (spiral icon) icon displayed in the leftmost column of the editor, which shows that a BOPF business object has been generated for this view (see Figure 12). Clicking on the hyperlinked Business Object text takes you to the BOPF editor in ABAP in Eclipse (see Figure 13).

Figure 12 — Press F2 to view the technical information, including any generated business objects, for the view

Figure 13 — The business object displayed in the BOPF editor in ABAP in Eclipse

The BOPF editor manages all the components of a business object definition, most notably the structure of the object, which consists of a root node (in the example, the product review records) and any child nodes (none are shown in the example, but these would be similar to sales order positions, for instance). From the Business Object Overview in the BOPF editor, you can quickly navigate to overview information about the root node of the business object by clicking on the hyperlinked text (Go to the ROOT node). On the Node Overview screen (see Figure 14), you find various technical artifacts, such as the underlying physical database table, structures and table types for business object processing, and semantic information such as BOPF associations, alternative keys, and properties. The overall BOPF framework offers a wide range of options, but for our example, we need only a small subset of artifacts.5

Figure 14 — The Node Overview information for the root node of the business object

The Node Behavior section on the Node Overview screen lists Actions, Determinations, and Validations that provide programmatic access through predefined method interfaces. We are interested in the Determinations, which change the state and attributes of a business object, so we click on the hyperlinked Determinations text, which takes us to a list of the determinations configured for this node (see Figure 15). In the example, we have a determination that is implemented as an UPDATE_ATTRIBUTES method in the implementation class ZCL_DEV210_D_ATTRIBUTES_SOL whenever a new business object is created. This behavior is controlled by triggers, which enables you to apply fine-grained control and include only triggers that are required by your application context. From here, you can navigate to a Determination Overview display (see Figure 16) where you can view general information for a determination and configure any triggers.

Figure 15 — Determinations configured for the example node

Figure 16 — The Determination Overview displays general information about the node’s determination and configured triggers

From the overall list of determinations, you can navigate to the implementation class by clicking on the name of the class. This takes you to the ABAP class editor (see Figure 17) where the code for the implementation class is executed, during which time the BOPF framework will transfer control to the methods implementing the business object. Since the code is regular ABAP code, you can manually modify it, but following the BOPF philosophy of standardized development, you mainly just want to enforce consistency of the business object and ensure proper error handling. There is not much to do in the case of our product review example since these records are simply inserted into the persistent table of product reviews in the underlying database. The corresponding SQL commands and commit work statements are executed by the BOPF framework, meaning no manual coding is required.

Figure 17 — The source code for the BOPF implementation class

Creating an Application Using the BOPF-Based CDS View
With the BOPF definitions complete, you can build a new smart template application in SAP Web IDE pretty much the same way as before. The product review overview screen for the generated application will be initially empty (see Figure 18). To add a review, click on the + symbol, which opens a general information screen (Figure 19) where you can select a product name from the dropdown list. 

Figure 18 — The completed product review overview screen

Figure 19 — Select a product to add a review

On the product detail screen that follows (Figure 20), you can enter a rating (such as 2), which populates the overview screen with the review (see Figure 21).

Figure 20 — Add a rating for the product

Figure 21 — The completed product review overview screen with a product rating displayed

Refining the Original CDS View Using BOPF Definitions
Let’s now refine our original sales order invoice CDS view by using our BOPF definitions to add fields for the standard deviation and for the average rating per customer. For the standard deviation, we add a table function (see Figure 22) to the CDS view source code that is implemented as a SQLScript procedure via the SAP HANA function stddev (see Figure 23). The blue background color indicates the SQLScript code embedded inside an ABAP method (known as an ABAP-managed database function). For the average rating, we add a standard function that requires no SQLScript. 

Figure 22 — Add a table function to the sales order invoice CDS view to add a field for the standard deviation

Figure 23 — The SQLScript code for implementing the standard deviation table function

The average rating and standard deviation are then computed and displayed in the overview screen (see Figure 24).

Figure 24 — The display results of the sales order invoice CDS view with fields added for the average rating and standard deviation

Summary
The example described here has demonstrated how ABAP 7.51 enables you to combine all the various technologies and artifacts that make up the modern ABAP programming model in a simple, streamlined, and standardized way using ABAP in Eclipse (for the back-end part) and SAP Web IDE (for the front-end part). You start with CDS views, expose them to the OData protocol, and consume them with SAP Fiori smart templates. You add transactional services based on the BOPF framework and then create new records that can be aggregated with the help of the many built-in functions from CDS or, if necessary, natively on SAP HANA.
To be successful, an innovative programming model must meet customer needs with the right development tools and methodologies. With its focus on both analytical and transactional capabilities and its support for ABAP in Eclipse and SAP Web IDE, ABAP 7.51 delivers.

1 For more on SAP NetWeaver 7.5, see my SAPinsider articles “A Foundation for the Future: What’s Coming Next with SAP NetWeaver 7.5” (July-September 2015) and “ABAP for the Modern Age: A Look at the Latest ABAP Enhancements in SAP NetWeaver 7.5” (January-March 2016), available at SAPinsiderOnline.com[back]
2 Learn more about BOPF on SAP Community Network at http://scn.sap.com/community/abap/bopf[back]
3 For more on CDS development, see my SAPinsider articles “Enhanced ABAP Development with Core Data Services (CDS)” (October-December 2015) and “ABAP for the Modern Age: A Look at the Latest ABAP Enhancements in SAP NetWeaver 7.5” (January-March 2016), available at SAPinsiderOnline.com[back]
4 For more on SAP Fiori development, see my SAPinsider articles “ABAP for the Modern Age: A Look at the Latest ABAP Enhancements in SAP NetWeaver 7.5” (January-March 2016) and, with Monika Kaiser, “SAP Fiori Application Development in the Cloud” (April-June 2015), available at SAPinsiderOnline.com[back]
5 The overall BOPF framework is documented in detail at the SAP Help Portal site at help.sap.com[back]