Fiori ActivationRunbook
<host>:44300
SAP_BASIS 816 · S/4HANA 2025 · SP 0000
ALL 32 STEPS COMPLETE · 09 SEP 2026
Your sequence is right, with one split. Gateway and the workflow runtime genuinely do belong ahead of content activation — that is the documented order, not just a preference. Content activation assumes a working OData layer and writes catalogs, tiles and target mappings on top of it. Run it first and you get tiles pointing at services that were never started.
My Inbox is the exception that splits in two. Its backend — the workflow runtime, the Task Gateway service, task visualisation — can and should be proved before activation. Its tile cannot: My Inbox is itself Fiori content, so the UI check only becomes possible in Phase 5. Phase 2 proves the data is reachable over OData without a launchpad at all.
Dependency ladder — each rung consumes the one above
Six phases, strict order
Client & transport frame
Set change recording the way you want it, and pre-create the requests before anything asks for one mid-run.
Gateway & OData foundation
ICF tree, system alias, embedded Gateway, the two foundation task lists, certificate. Nothing above this rung works until it does.
Workflow runtime & Inbox services
Close the remaining SWU3 reds, publish Task Gateway and the notification channel, then read your work item straight off the service.
Content activation
The seven business roles, prefix Z, plus the create-and-assign-users tasks that were skipped last run.
Index & cache
Content exists but does not render until the app index is rebuilt and the caches are dropped.
Verify as a persona
Log on as a generated Z-role user — never HANADEMO. SAP_ALL proves authorisation and proves nothing about content.
Why the order is what it is
The stack you are building
Read it bottom-up: every layer is only as good as the one beneath. Content activation writes the third layer from the top — which is exactly why running it first produced one activated role and an empty launchpad.
The one thing that cannot sit entirely before activation
My Inbox, split across the gate
Prove the service
- Workflow runtime green in SWU3, including the two remaining reds.
SAP_WORKFLOW_SYSTEMscheduled and running in client 000./IWPGW/TASKPROCESSINGpublished against alias LOCAL.- SWFVISU entries present for the flexible-workflow tasks.
- The proof: GW_CLIENT reads
TaskCollectionand your verification work item comes back as JSON. No launchpad required.
Prove the tile
- My Inbox tile appears on a generated Z-role user's launchpad.
- The same work item is listed, opens, and shows its decision buttons.
- Notification badge counts it — the bell needs the APC push node live.
- Approve or reject completes the item and it leaves the list.
Consequence of recording changes
What transport recording costs you here
Set the requests up before the task list runs, not during it
With Automatic recording of changes on, the activation task lists will ask for a transport request as they write catalogs, groups and role assignments — and a task list running in background has no one to answer the popup. Create one Customizing request and one Workbench request in Phase 0, keep both numbers on screen, and fill them into the task parameters wherever a request field is offered. Run the first pass in dialog so anything unexpected can still be answered.
Keep cross-client changes set to Changes to Repository and cross-client Customizing allowed. ICF node and OData service activation are cross-client operations — restrict that setting and Phase 1 fails before it starts.
Execution
Client and transport frame
4 steps- SE06
Open System Change Option. Global setting must be Modifiable, and the software components you will touch (SAP_BASIS, S4CORE, SAP_UI, plus namespace
/UI2/,/IWFND/,/IWPGW/) must not be locked.Expect Global setting Modifiable; no component set to "not modifiable". - SCC4
Double-click client 100. Set Changes and Transports for Client-Specific Objects to Automatic recording of changes. Set cross-client to Changes to Repository and cross-client Customizing allowed. Client role: Customizing.
Expect Saved without a protection warning; client 100 shows role C. - SE10
Create a Customizing request named
FIORI ACTIVATION CLNT 100and a Workbench request namedFIORI FOUNDATION OBJECTS. Add HANADEMO as owner. Write both numbers down — Phases 1 to 3 will ask for them.Expect Two modifiable requests, each with one task under HANADEMO. - SU53
Sanity-check authorisation once, from HANADEMO, after a first SCC4 save. SAP_ALL should cover it — you are confirming nothing was stripped in the handover build.
Expect No authorisation failure recorded.
Gateway and OData foundation
9 steps- SICF
Activate the service tree, node and subtree, for each of:
/sap/bc/ui5_ui5,/sap/bc/ui2,/sap/bc/bsp/sap,/sap/public/bc,/sap/opu/odata,/sap/opu/odata4,/sap/bw/ina,/sap/bc/webdynpro/sap. Right-click → Activate Service → choose the option that includes subnodes.Expect Every node black, not grey, in the hierarchy view. - SICF
Separately activate
/sap/bc/apc/iwngw/notification_push_api— the WebSocket channel behind the launchpad notification bell. It is easy to miss because it sits outside the UI5 tree.Expect APC node active; needed again in Phase 2. - STRUST
Fix the certificate mismatch that makes the browser flag
<host>:44300as Not secure. The SSL server PSE common name must match the public hostname, not the build-time internal one. Same defect class as the HTTPURLLOC issue on the 2023 box.Expect Certificate CN matches the public host; restart ICM from SMICM after applying. - SMICM
Confirm the HTTPS service on port 44355 is active and that URL generation is not being rewritten to an internal host. Check the HTTPURLLOC table on this system too — the same vendor shipped both appliances.
Expect Generated URLs carry s4hana2025.<host>. - SPRO
SAP NetWeaver → SAP Gateway → OData Channel → Configuration → Activate or Deactivate SAP Gateway. Then define the system alias: alias
LOCAL, RFC destinationNONE, local Gateway flagged, client 100.Expect "SAP Gateway is active" message; alias LOCAL saved as default. - STC01
Run task list
SAP_GW_FIORI_ERP_ONE_CLNT_SETUP— the embedded single-client Gateway setup. Supply the Phase 0 request numbers in any task parameter that offers a request field.Expect All tasks green; no task left in status "not executed". - STC01
Run task list
SAP_FIORI_FOUNDATION_S4. This lays down launchpad services, the/UI2/service set, the notification channel and the foundation roles. It is a prerequisite of content activation, not an alternative to it.Expect Green run; foundation roles SAP_UI2_* present in PFCG. - /IWFND/V4_ADMIN
Publish the OData V4 service groups. Several 2025 maintenance and analytical apps are V4-only, so a V2-only landscape looks healthy right up until a tile returns nothing.
Expect Service groups published against alias LOCAL. - /IWFND/GW_CLIENT
The gate. Call
/sap/opu/odata/IWFND/CATALOGSERVICE;v=2/ServiceCollectionwith GET. Then clear/IWFND/ERROR_LOGand/IWBEP/ERROR_LOGso the next phase starts from a clean log.Expect HTTP 200 with a service list. Anything else — stop and fix before Phase 2.
Workflow runtime and Inbox services
7 steps- SWU3
Clear the two remaining reds: Classify Scenario Tasks (Flexible Workflow) as General and Maintain HR control tables. Run each with the execute icon, then Recheck the whole tree. The runtime RFC destination is already correct after the
WORKFLOW_REFERENCE_100repair.Expect Entire SWU3 tree green. Message 5A378 on classification is cosmetic on a sandbox. - SM37
Confirm
SAP_WORKFLOW_SYSTEMis released and running — in client 000, not 100. Search with user*, job*, 30-day window, all statuses, or you will get BT145 again.Expect Recent successful runs; no cancelled entries. - /IWFND/MAINT_SERVICE
Add and activate
/IWPGW/TASKPROCESSINGagainst alias LOCAL. In the same pass add the/IWNGW/notification services listed in the catalog. Check the ICF node status turns green in the service detail.Expect Both service groups show ICF node active and system alias LOCAL. - SWFVISU
Check task visualisation entries exist for the flexible-workflow tasks you will use — this is what tells My Inbox which UI to open for a work item. A missing entry gives a work item that lists but will not open.
Expect Entries present for the SES approval and PM notification tasks. - SWI1
Create or locate one live work item to test with. The verification item you already completed proves the runtime; generate a fresh one so there is something open for the OData call to return.
Expect At least one work item in status READY for your user. - /IWFND/GW_CLIENT
The gate. GET
/sap/opu/odata/IWPGW/TASKPROCESSING;v=2/TaskCollection. The open work item should come back in the payload with its task title and decision options.Expect HTTP 200 and your work item in the response. Inbox is proved at the service layer. - SWI2_FREQ
Glance at work item frequency and check
/IWFND/ERROR_LOGis still empty after the calls. A silent 500 here becomes a mysterious empty Inbox in Phase 5.Expect No new gateway errors logged.
Content activation
4 steps- STC01
Generate a task list run for
SAP_FIORI_CONTENT_ACTIVATION. Before executing, walk every task's parameters and fill in the Phase 0 request numbers. Run in dialog, not background, for this first pass.Expect Run generated with no task in error before execution starts. - STC01
At Select/Confirm SAP Business Roles for FLP content activation, select the seven roles below and keep prefix Z. Leave the OData, ICF and catalog activation sub-tasks ticked — that work is what SUPC mass generation would not have given you.
Expect Counter reads 7 of 613 selected, not 1. - STC01
Tick the two tasks skipped last time: Create Users with generated Business Roles (SU01) and Assign generated Business Roles to Users (SU01). Then execute and let it run — this one takes a while.
Expect Run log green throughout; save the log before leaving the screen. - PFCG
Spot-check that the generated
Z*roles exist and carry generated profiles, menus and catalog assignments — not empty shells.Expect Seven Z-roles, each with a Fiori catalog and group in the menu.
| Business role template | Why it is on the list |
|---|---|
| SAP_BR_EMPLOYEE | Base tile set and self-service apps — every trainee needs it underneath their persona role |
| SAP_BR_ADMINISTRATOR | Your own admin launchpad, including the launchpad and app-index tools |
| SAP_BR_MAINTENANCE_PLANNER | Order and notification planning apps — the core of the training scenario |
| SAP_BR_MAINTENANCE_TECHNICIAN | My Job List and confirmations — the execution side of the same scenario |
| SAP_BR_MAINTENANCE_SUPERVISOR | Supervisor persona; confirm the exact name this release ships in the list |
| SAP_BR_ANALYTICS_SPECIALIST | Satisfies the "build analytical reports" requirement in the sandbox spec |
| SAP_BR_BPC_EXPERT | Business process configuration — needed later for the Lean SES workflow definition |
Index and cache
3 steps- /UI2/APP_INDEX_CALCULATE
Run via SE38 as a full re-index, not a delta. Review the output for inconsistencies — unresolved target mappings surface here rather than in the browser.
Expect Completed with zero inconsistent apps reported. - /UI2/INVALIDATE_GLOBAL_CACHES
Run the global cache invalidation, then
/UI2/INVALIDATE_CLIENT_CACHESfor client 100. Order matters less than doing both.Expect Both reports complete without dumps. - SE38
Run the launchpad health check report — search
/UI2/FLP_HEALTH*in SE38, as the exact name shifts slightly between support packages. Work through anything it flags before logging on as a trainee.Expect No red findings on services, roles or caches.
Verify as a persona
5 steps- Browser
Open
https://<host>:44300/sap/bc/ui2/flpand log on as one of the users the task list created. Certificate should now be clean after Phase 1.Expect Launchpad renders with populated groups or spaces — not an empty home page. - My Inbox
Open the My Inbox tile. The work item from Phase 2 should be listed, open cleanly, and show its decision buttons. This is the UI half of the Inbox check.
Expect Item opens via its SWFVISU-mapped UI and can be actioned. - Bell icon
Check the notification badge counts the open item. If the bell is silent but the Inbox works, the APC push node from Phase 1 is the suspect.
Expect Badge count matches the number of open items. - Search
Use the launchpad search bar for a known equipment number and a functional location. The EAM connectors are already active — this confirms the InA nodes and the search UI are wired to them.
Expect Equipment 10002984 and FL TEST both return. - Analytics
Open one analytical app from the analytics specialist role. If the tiles are present but data is empty, the BW client setup task list is the next thing to run — not a content problem.
Expect At least one analytical app renders a chart with data.
Standing constraints for this system
Do not do these
No SFW5 activation for Lean Services
No business function exists for Lean Services, several neighbouring ones are irreversible, and the real gate is Enhanced Procurement Mode in SPRO — which is not retroactive. That is why it has to be switched on before you create any service order you intend to keep, and why it sits in a later phase of its own rather than here.
Equally: do not verify anything on this system as HANADEMO once Phase 3 is done, and do not take a baseline snapshot until Phase 5 passes — a snapshot of a half-activated launchpad is worse than none.
Session log — 08 September 2026
Phases 0–2 complete
What was proved
- Phase 0 — system Modifiable; client 100 already on automatic recording with cross-client changes allowed. Requests
S4HK903329(customizing) andS4HK903331(workbench). - Phase 1 — ICF tree open, Gateway active, alias
LOCALcorrect, both task lists green, V4 groups published, foundation roles generated. Gate: catalog service returned 200 with a full list. - Phase 2 — SWU3 clean but for AIF;
SAP_WORKFLOW_SYSTEMcycling every minute in client 100;ZTASKPROCESSINGv1 and v2 both correct (not duplicates). Gate:TaskCollectionreturned the verification work items over OData, 12 KB payload. - Phase 3 — content activation run for 14 business roles, prefix Z, package
$TMP.Z_BR_AA_ACCOUNTANTspot-checked: Menu, Authorizations and User tabs all green, users assigned including <user> and <basis-user>. - Phase 4 —
/UI5/APP_INDEX_CALCULATEindexed 3,096 repositories; global and client caches invalidated. - Phase 5 — launchpad renders, Maintenance Request opens, value help returns the 38-object compressor hierarchy. Notification 10000741 created on equipment 217100001, order 4001560 generated and approved through the phase model.
Open items
- Repeat the create test as <user> or <basis-user>. Everything in Phase 5 was done as HANADEMO. That proves content, not authorisation — and authorisation gaps only appear on a user without SAP_ALL.
- Define a flexible workflow for maintenance order approval. Order 4001560 auto-approved because no scenario exists, so the approval phase is currently decorative. Use Manage Workflows for Maintenance Orders (ships with
SAP_BR_BPC_EXPERT). Same machinery as the Lean SES approval, so build this simpler case first. - Decide the org structure. This box is the delivered SAP structure — plant
1710, planner group920, work centreRES-0100. Your prior sandbox and handover notes use company code 1030 and plants 102A/103A. Train on delivered, or build Teck-named objects. - Still unverified: My Inbox tile, notification bell count, Enterprise Search from the launchpad bar, one analytical app.
Corrections and gotchas worth keeping
What this system taught us
Evidence for the vendor — one pattern, six objects
Instance-01 build residue
Five of the six carry instance-01 values. The appliance was built as instance 01 and re-homed to 55 without a cleanup pass — which justifies asking the vendor to sweep for the rest rather than fixing them one at a time as they surface. S4HCLNT100 is the one that mattered: it made the Task Gateway service fail with a CPIC error, which would have presented in training as an empty My Inbox with no obvious cause.
09 September — solved, and reusable
Apps assigned but invisible
Five checks that split the problem
- PFCG → role → Applications. Apps present and Active? Then content activation worked and it is not a role problem.
- App Finder. Apps findable and launchable? Then catalogs, authorisation, OData and the app index are all fine. What remains is placement.
- Content Manager → catalog → Display Usages in Pages. "Not used in any page" is the smoking gun.
- Roles tab → Show Spaces on the failing role and on a working one. 0 versus 1 proves whether it is systemic or a single gap.
- Fiori apps reference library. Technical Catalog, Business Catalog, Business Group, Business Role — and no Space or Page. SAP's own documentation confirming the omission.
Build what SAP didn't ship
- SICF → activate
/sap/bc/ui5_ui5/sap/sui_space_man;/IWFND/MAINT_SERVICE→ add/UI2/FDM_SPACE_REPOSITORY_CUST_SRV. Same pattern for the Pages app. - Manage Launchpad Pages →
Z_RSH_MAINT_PLANNER, sections holding the RSH tiles. Merge ID blank for a standalone tab. - Manage Launchpad Spaces →
Z_RSH_SCHEDULING→ assign the page → assign the space toZ_BR_MAINTENANCE_PLANNER_RSHandZ_BR_MAINT_SUPERVISOR. /UI2/INVALIDATE_CLIENT_CACHES, then log out and in.
Groups are invisible on a spaces-enabled client
SAP ships Resource Scheduling as catalog plus business group, with no page and no space. Groups are the legacy rendering model; with SPACES = true the launchpad ignores them entirely. The apps were assigned, authorised, indexed and launchable the whole time — nothing placed them on a page, so nothing rendered.
Resolved the same day. The tiles first showing Out of role context — Manage Maintenance Planning Buckets, Schedule Output for Maintenance Job Packs, Manage Teams and Responsibilities — came from SAP_TC_EAM_COMMON, which neither role held. Assigning that content to both roles cleared them. The Maintenance Schedulling tab now renders all three sections in full.
Two tidies left, cosmetic: the section heading has a double L, and Manage Maintenance Planning Buckets (Old Version) is still on the page beside the new one — worth removing before trainees see both and ask which to use. Also worth a ten-minute sweep of the remaining twelve Z roles with Show Spaces; anything reading 0 has the same gap this section describes.
Deferred — before training, not today
Pre-training actions
Five items carried forward
1 · Certificate. Vendor must supply one issued for s4hana2025.<host> by a public CA. Every trainee currently meets a full-page security warning, and a managed Teck laptop may not let them click through.
2 · Batch capacity. Cut the workflow job in clients 200 and 400 to roughly every 30 minutes — two unused clients are each consuming a work process every minute. Separately, ask the vendor for more BTC processes.
3 · Residue sweep. SM59 for any destination carrying <app-server> or :44301, and the /UI2/ alias tables.
4 · AIF monitoring. Left red deliberately — no interfaces in scope. Recorded as a decision so a later reader doesn't treat it as an oversight.
5 · System time zone. Confirm the offset in STZAC. Server time runs UTC−5:30, which affects how every log timestamp reads and matters when scheduling anything around a training session.
6 · Phase model and approval. Maintenance orders enter an approval phase and currently auto-approve. Either define the workflow scenario so trainees see a real approval step, or confirm the auto-approve behaviour is what you want in class — but decide deliberately rather than discovering it during a session.
English (United States)