Creating roles via MDM Java API

[martin_schffler]

We have some coding that sets AccessPermissions when creating users and roles. I know that this is deprecated and we had to use some of the internal API but that is why I am posting here instead of opening an OSS message

With SP09 a new constructor was added to class com.sap.mdm.security.AccessPermission. It takes a new parameter called fieldIdPath. The documentation on that new value is non-existent, so I am not sure what it is about. Has anybody got an idea what this parameter is?

We discovered that because the old constructor with only 3 parameters is not working anymore. If we keep using it we get the following error when creating/updating the role:

Caused by: com.sap.mdm.MdmNullPointerException: Input parameter 'string' must not be null 
at com.sap.mdm.data.RegionalString.<init>(RegionalString.java:54) 
at com.sap.mdm.data.RegionalString.<init>(RegionalString.java:44) 
at com.sap.mdm.internal.commands.SecurityCommandHelper.convertFrom(SecurityCommandHelper.java:310) 
at com.sap.mdm.internal.commands.SecurityCommandHelper.convertFrom(SecurityCommandHelper.java:400) 
at com.sap.mdm.security.commands.CreateRoleCommand.executeImpl(CreateRoleCommand.java:71) 
at com.sap.mdm.commands.AbstractCommandBase.execute(AbstractCommandBase.java:129) 
at xxx.xxx.xxx.CatalogRoleBean.createRole(CatalogRoleBean.java:212) 

So it seems the old constructor is not properly handling the missing parameter. When reading existing roles from the repository the fieldIdPath is always the empty string "" which led us to implement a workaround by using the new 4-parameter constructor and passing the empty string for the fieldIdPath.

So if anyone from the SAP development team is reading this: go fix the 3-parameter constructor!

To all others: if you have any idea what the fieldIdPath is about please respond here.

Message was edited by: Martin Schöffler

[Former Member · Accepted solution]

Hello Martin,

fieldIdPath was implemented in SP09 in order to allow access rights on tuples.

This feature allows you to edit in console tuple members fields to be read only for a certain role. In order to provide this in the JavaAPI side a field id path was needed for checking the access rights for those tuple member fields.

Example for the use of this feature, in MDM iViews Item Details we do not want all fields to be editable, in order to check if a field is editable we need to get the access rights for it. Until SP09 only the tuple field could be changed to read only which means not editable in UI, from SP09 we can configure this for the tuple member fields as well, so when editing them they would be not editable or editable according to what is defined in Console.

Please refer to SP09 release SAP Note # 1628176 which contains more information about the release and its features.

Have you opened an OSS for this issue?

Thank you & Best Regards,
Roxana

[martin_schffler · Accepted solution]

Hi Roxana,

many thanks for the detailed explanation of the new parameter.

I have not opened an OSS message yet. As I explained in the beginning of my question we are using deprecated API and even some stuff from the internal API packages and those OSS messages usually get closed quickly because using the internal API packages is not supported.

That is why I posted the issue here instead.

If you have a way of keeping the OSS message open or if you think it would be helpful anyway then just let me know and I will open an OSS.

Best regards,

Martin