Home
Configure SAP iMaintenance Roles and Authorizations
Before iMaintenance can integrate with SAP, specific roles and authorizations must be configured. These roles control access to master data, transactional posting, and integration endpoints.
Use Pre-Defined SAP Roles for iMaintenance
Innovapptive provides specific roles for ECC, S/4HANA, and Gateway systems. These roles include all necessary authorizations to perform standard iMaintenance tasks.

Title and Copyright
Copyright and Terms of Use page for iMaintenance Installation.
Preface
Understand audience, know related documents and products and conventions followed in this document.
Introduction
The iMaintenance Deployment & Setup Guide gets iMaintenance running safely in your enterprise landscape.
Foundation Setup for iMaintenance Deployment
Before iMaintenance can connect to SAP and expose APIs, the core environment must be initialized. This setup includes seeding MongoDB with configuration data, enabling SAP inbound services, mapping dependencies, and starting the microservices that power the application.
Configure SAP iMaintenance Roles and Authorizations
Before iMaintenance can integrate with SAP, specific roles and authorizations must be configured. These roles control access to master data, transactional posting, and integration endpoints.
- Configure SAP iMaintenance Roles
  Innovapptive provides pre-defined SAP iMaintenance roles as transport requests. These must be imported into your SAP systems (ECC, S/4HANA, or NetWeaver Gateway) based on your deployment landscape.
- Define SAP iMaintenance Authorization Requirements
  Access to iMaintenance requires specific SAP authorizations. These are bundled within the Innovapptive-provided roles but may also need to be tailored to match your organization’s functional scope and security policies.
- Use Pre-Defined SAP Roles for iMaintenance
  Innovapptive provides specific roles for ECC, S/4HANA, and Gateway systems. These roles include all necessary authorizations to perform standard iMaintenance tasks.
- Deploy SAP iMaintenance Roles Using Transports
  Innovapptive provides pre-delivered transport requests containing the required iMaintenance roles. Importing these transports ensures consistent role configuration across ECC, S/4HANA, or Gateway systems.
- Handle Transport Dependencies (If Any)
  In some cases, the role transports provided for iMaintenance may have dependencies on base packages. To avoid import errors, transports must be applied in the correct order.
Secure API Access with IP Whitelisting
Secure connectivity for Innovapptive-hosted applications is enforced by restricting inbound traffic to trusted client IPs and permitting outbound traffic only to approved Innovapptive domains. This ensures that only authorized systems can exchange data with iMaintenance while preventing unauthorized access.
Install Supporting Systems and iCWP Integration Suite
Enable SAP NetWeaver Gateway and configure virus scan handling so iCWP OData services can run securely.
SAP BTP and On-Premise Integration via Cloud Connector
Set up secure connectivity between SAP BTP and your on-premise SAP systems with the SAP Cloud Connector. This enables iCWP OData services to be consumed on BTP without exposing inbound firewall ports.
Configure API Management in SAP BTP
Create an API Proxy in SAP BTP to expose iCWP OData services from your connected SAP system. The proxy uses the API Provider details from Cloud Connector and makes the service available for policy enforcement and external consumption.
Configure OAuth 2.0 Authentication
Enable OAuth 2.0 authentication in SAP API Management so external consumers can securely obtain and use access tokens when calling iCWP APIs.
Handle CSRF Tokens in API Management
Enable server-to-server authentication between SAP API Management and the backend system, so API consumers don’t need direct backend credentials.
Troubleshoot API Errors and Metadata Issues

Use Pre-Defined SAP Roles for iMaintenance

Innovapptive provides specific roles for ECC, S/4HANA, and Gateway systems. These roles include all necessary authorizations to perform standard iMaintenance tasks.

Table 1. Roles for SAP Systems (ECC/S/4HANA)
Role Name	Description	Transactions	Authorization Objects
ZINV_IMAINT_ECC_END_USER	Innovapptive - iMaintenance - End User - Ecc Authorizations	CAT2, CATS_APPR_LITE, CS03, CV01N, CV02N, CV03N, IA03, IA07, IB03, IE01, IE02, IE03, IH01, IH03, IK01, IK02, IK03, IK11, IK13, IW21, IW22, IW23, IW31, IW32, IW33, IW34, IW41, IW42, IW45, MIGO	S_RFC, S_RFCACL

Table 2. Role for SAP Systems (S/4HANA/Gateway)
Role Name	Description	Authorizations
ZINV_IMAINT_NWG_END_USER	Innovapptive - iMaintenance - End User - Gateway Authorizations	S_RFC, S_RFCACL, S_SERVICE, S_TABU_DIS, S_USER_GRP

You can use the provided roles as is or copy them to match your internal naming conventions before generating them for use.