We deployed our custom Fiori contract management apps via embedded deployment last week on S/4HANA 1809. Everything looked fine initially, but now users are getting blank screens when trying to access the apps through their custom launchpad roles.
The strange part is that when I assign standard SAP roles (like SAP_BR_PURCHASER), the same apps load perfectly. Our custom roles have been carefully configured with the required business catalogs, but something seems to be missing. I’ve checked the catalog assignments multiple times and they appear correct.
I also noticed that some OData services show as registered in /IWFND/MAINT_SERVICE but don’t have the green activation status. Could this be related? The error console in browser just shows “Failed to load application” without detailed logs.
This is blocking 40+ contract managers from their daily work. Has anyone encountered similar issues with custom roles after embedded app deployment?
Yellow status in /IWFND/MAINT_SERVICE means services are registered but not fully activated. You need to activate them properly. Go to /IWFND/MAINT_SERVICE, select each OData service for your contract apps, click ‘Activate and Maintain Services’, then choose ‘Add Service’. Make sure the system alias points to LOCAL or your correct backend system. After activation, the status should turn green. Also check ICF services are active in SICF for path /sap/opu/odata/.
Thanks Anna. I compared both roles in /UI2/FLPD_CUST and found that standard roles have additional technical catalogs like SAP_TC_CONT_MGT_OD that weren’t in our custom role. I added those catalogs but apps still won’t load. The OData services in /IWFND/MAINT_SERVICE still show yellow status instead of green. Do I need to manually activate each service?
Let me give you the complete resolution steps since you’re dealing with all three key issues here.
1. Complete OData Service Activation:
Go to /IWFND/MAINT_SERVICE and activate all contract management services:
- Select each service (ZCONT_MGT_SRV, ZCONTRACT_APPR_SRV, etc.)
- Click ‘Add Service’ button
- Set System Alias to LOCAL
- Click ‘Activate’ and verify green status
- Test service URLs in /IWFND/GW_CLIENT to confirm they respond
Also verify ICF services in SICF:
- Navigate to /sap/opu/odata/sap/
- Ensure all contract-related service nodes are active (green)
- Right-click and ‘Activate Service’ if needed
2. Add Missing Technical Catalogs:
In PFCG for your custom role, add these catalogs that standard roles include:
- SAP_TC_CONT_MGT_OD (OData service catalog)
- SAP_BC_UI2_START_FIORI (Fiori launchpad framework)
- Any app-specific technical catalogs shown in working standard roles
Compare your custom role with SAP_BR_PURCHASER in /UI2/FLPD_CUST to identify gaps.
3. Grant S_SERVICE Authorizations:
This is the critical missing piece. In PFCG:
- Edit your custom role
- Go to Authorizations tab
- Manually add authorization object S_SERVICE
- Add all OData service technical names found in SU53:
- ZCONT_MGT_SRV
- ZCONTRACT_APPR_SRV
- Any other services your apps consume
- Set TADIR_TYPE = IWSG (Service Group)
- Generate the role and assign to users
4. Clear Launchpad Cache:
After all changes:
- Run /UI2/FLP_CLEAR_CACHE
- Have users clear browser cache
- Log out and back in to refresh role authorizations
Why Standard Roles Work:
Standard SAP roles like SAP_BR_PURCHASER are pre-delivered with complete authorization sets including S_SERVICE objects for all related OData services. When you build custom roles, you must explicitly replicate these authorizations - catalog assignment alone is insufficient.
The root cause is that embedded Fiori apps require three layers:
- UI layer (catalogs) - you had this
- Service layer (OData activation) - partially missing
- Authorization layer (S_SERVICE) - completely missing
All three must be configured for custom roles. Test with one user first before rolling out to all 40 contract managers.