Troubleshooting HTTP 403 Forbidden in SAP Fiori apps

What a 403 means in Fiori

HTTP 403 Forbidden means the request reached the server and the user was authenticated, but access was refused. In Fiori scenarios the refusal can come from several layers, so the same error message has different root causes.

Common causes

• Missing authorization for the OData service. Access to a service is checked with authorization object S_SERVICE; the service must be included in a role assigned to the user.
• Incomplete role content. The business catalog or app is assigned, but the back-end role with the underlying authorizations is missing, or the other way round.
• Missing start authorization. Some apps and services additionally check start authorizations such as S_START.
• Inactive ICF service. An inactive node in the Internet Communication Framework (transaction SICF) can also result in a 403 response.
• Business authorizations. The service call succeeds, but a business check (for example company code or sales organisation) rejects the specific data request.

A systematic approach

1. Reproduce the error and note the exact service and entity set from the browser network trace.
2. Check the gateway error log and the authorization trace for the user at that time.
3. Compare the user's roles with the catalog, the OData service and the back-end authorizations the app needs.
4. Verify that the ICF service is active in every system of the landscape.
5. Fix the role design, not the individual user, so the fix is transportable.

ERP Preflight's Fiori 403 Root-Cause Doctor correlates role exports, service definitions and trace data to name the missing link with evidence. See Operations.