Fiori Security Part 2: Activating OData Services and ICF Nodes

📌 KEY POINTS
✅ OData V2 services are registered and activated in /IWFND/MAINT_SERVICE.
✅ OData V4 service groups are published in /IWFND/V4_ADMIN.
✅ System aliases route services to the right back end in hub scenarios.
✅ ICF nodes for the services must be active for HTTP access.
⚠️ Activating services manually in each system leads to differences between DEV, QA and PROD.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 1 explained layers. Part 2 makes services available.

━━━━━━━━━━━━━━━━━━━━
▶ 1. V2 SERVICE ACTIVATION
For OData V2, the service is registered on the gateway hub with /IWFND/MAINT_SERVICE: you add the service from the back-end system via a system alias, and activation creates the ICF node. RAP service bindings for V2 can publish services directly in the ABAP environment.

━━━━━━━━━━━━━━━━━━━━
▶ 2. V4 SERVICE GROUPS
OData V4 services are grouped in service groups and published with /IWFND/V4_ADMIN, again using system aliases. RAP service bindings for V4 can be published from the development environment. Unpublished groups result in 'service not found' errors.

━━━━━━━━━━━━━━━━━━━━
▶ 3. SYSTEM ALIASES AND ROUTING
In hub deployments, system aliases define which back end a service call goes to. Wrong aliases lead to data from the wrong system or errors. Embedded deployments typically use a local alias.

━━━━━━━━━━━━━━━━━━━━
▶ 4. ICF NODES
Each service has nodes in the Internet Communication Framework (SICF). They must be active, and inactive nodes produce HTTP 403 or 404 errors. Activation in MAINT_SERVICE usually handles this, but manual deactivation or transports can break it.

━━━━━━━━━━━━━━━━━━━━
▶ 5. LANDSCAPE CONSISTENCY
Record service activations as part of transports or deployment tasks, and compare active services between systems before go-live. Tools and task lists from SAP can activate services for business roles in bulk, which reduces manual errors.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

1. Activate a test V2 service in /IWFND/MAINT_SERVICE.
2. Publish a V4 service group in /IWFND/V4_ADMIN.
3. Check the ICF node status in SICF.
4. Compare active services between two systems.

✅ CHECKPOINT: services needed by apps are active and consistent across DEV, QA and PROD.

Apps worked in QA but failed in production with 'service not found'. Two OData services had been activated manually in QA but never in production. The team added service activation to the deployment checklist and used SAP task lists to activate services for business roles consistently.

• Manual activations not recorded.
• Wrong system aliases.
• Inactive ICF nodes after transports.
• No comparison before go-live.

• Activation as a deployment step.
• Bulk activation via task lists for roles.
• Alias documentation.
• Pre-go-live service comparison.

Interviewers ask how OData V2 and V4 services are activated, what system aliases do and why apps may fail only in one system.