Sap Ag

Sap Se

Sap Portals Europe Gmbh

Peter Bittner

Thorsten Vieth

Bernhard Drittler

Juergen Heymann

Sven Schwerin-Wenzel

Stefan Kusterer

Roman Hayer

Jürgen Heymann

Matthias Vogel

Rainer Brendle

Bernd Schmitt

Udo Offermann

Markus Kupke

Jens-Christoph Nolte

Gerhard Bosch

Eckart Liemke

Sterfan Kusterer

Meinolf Block

Bernhard Drabant

Ingo Deck

Martin Dauer

Roland Lucius

Sultan Ucar

Ralf Ehret

Carmen Oestringer

Barbara Jochum

Volker Mueller

Markus Fritz

Gadi Melamed

Ori Assaraf

Ilan Perez

Ronen Eyal

Barak Hershkovitz

Yossi Tamari

Martin Schmid

Juergen Heyman

Mechanisms for allowing allow multi-session capability and session-return enabling stateful web applications include providing a start URL of a requested portal page with an 'External Session ID' (ESID). The ESID is an argument that is different between the two instances of the application (on the same page), and leads to different/independent sessions in the server. When a user returns to the same page, the ESIDs are passed again with the individual application requests, and the server can then logically reconnect to the proper session and allow the user to continue. The ESID can be used to return to an application after the user has previously left to go to another application and then desires to come back, or even when the user closed the browser and restarts the application later.

Session-return enabling stateful web applications

Embodiments manage user authorization to access multiple grouped software applications, via a catalog mechanism. Functionality of related software is divided into semantically meaningful catalogs, representing tasks or sub-processes within a business scenario. These catalogs represent a unit of functionality utilized to structure work and authorization. Functionality and authorizations are associated to system entry points, and assigned to catalogs bundling applications and services. Responsibilities may be defined statically or dynamically in terms of rule-based access restrictions to data structure (e.g., business object) instances. Catalogs may be assigned to business roles, and business roles assigned to users. Based on such assignments, corresponding authorizations are generated and linked to users at compile or deployment time. At run time, access decision and enforcement is granted based on these authorizations and restrictions. Decision and enforcement points are associated with the system entry points within software applications belonging to catalog(s).

Catalog-based user authorization to access to multiple applications

Systems, methods and techniques relating to managing process logs are described. A described technique includes identifying an end-to-end business process from a first system; identifying a plurality of systems that execute at least a portion of the end-to-end business process based on a definition of the end-to-end business process within the process registry; identifying a plurality of local process logs associated with the end-to-end business process for the a plurality of systems as defined by the process registry; and generating a federated process log based on at least a portion of each of the a plurality of local process logs.

Managing process logs

Various embodiments of systems and methods for providing business process visibility at real time are described herein. One or more business activity events are received at a local business activity event manager. Further, business process binding information associated with the one or more business activity events is retrieved at the business activity manager from a business process model manager. A relationship of the one or more business activity events with a business process using the business process binding is identified at the business activity event manager. Upon determination, a business process log manager is triggered for logging a business activity log of a business process instance at real time. Furthermore, the business activity log is extracted to monitor and analyze the business process instance at real time.

Business process visibility at real time

The object based navigation is an intelligent user interface that uses a source object to determine which target information is to be presented to the user. This is done by associating an object to one or more operations, so that selection of a given source object would result in a predefined operation to be activated. The role of the user may also affect the predefined operation that is activated. If multiple operations are associated with a given source object, these operations may be prioritized, so that the one with the highest priority is performed as a default operation.

Object based navigation

In a computer system () that launches application services for predetermined roles, a service-to-role assignment is customized in a target table. The user inserts a CD-ROM with master and reference tables, and the system automatically provides the target table. The master table () stores a first assignment () of application services (S,-) to roles (RO), and stores a second assignment () of service attributes (SA), such as language or industry branch, of the application services (S). The reference table () stores reference attributes (REA) for each application service (S) in the master table. The service representations for each role (RO) are forwarded from the master table () into the target table () if service and reference attributes match.

Method, computer program product and article of manufacture for providing service-to-role assignment to launch application services in role-based computer system

A graphical user interface (GUI) for presenting representations of selected objects in a computer system. The GUI presents an object selected from a collection of objects using a selected visual representation selected from at least first and second visual representations to be initiated using different initiation techniques. A first input control causes the selected object to be presented using another visual representation instead of the selected visual representation. A second input control causes another object to be presented instead of the selected object using any visual configuration that is currently used in presenting the selected object. The first and second input controls may be located in an object header area that remains essentially unchanged when changing between the at least first and second visual representations.

User interface for presenting object representations

Systems and techniques to generate a virtual hierarchy for navigating in and between object hierarchies. In general, in one implementation, the technique includes: flagging nodes in one or more object hierarchies as entry points and generating a virtual hierarchy including a virtual root and the nodes flagged as entry points depend directly from the virtual root.

Entry points for navigation of hierarchical information structures

A role-based computer system has a first processor with a computer program () and has further processors with application systems (Sy, Sy, Sy) and application services (Se). The program generates a start instruction for the further processors to execute the services by consecutively receiving a log-in identification from the user and looking up in a first assignment table () for a role (Ro), looking up in a second assignment table () to determine logical services (LSe) assigned to the role; and looking up in a second assignment table to determine a pointer (P(Sy/Se)) to the services (Se) that are assigned to the logical service. The pointer has first and second portions to identify the application system (Sy) and the application service (Se), respectively, and becomes part of the start instruction ().

Computer program product method and computer in role-based application systems

Techniques are described for automating the generation of access control information that identifies users that are permitted to access particular business objects used by a computer application. The generation of access control information is based on a characteristic that is shared by the user and the business object to be accessed. The characteristic may be an attribute. The characteristic also may be the identification of a process to determine a characteristic of a user and/or a characteristic of a business object.

Managing access control information

Data structures for use in controlling access to data objects by users of a computer system or computing device are described. The data structures include an access control group data structure, a user access data structure, and a data object access data structure. The access control group data structure stores access control group data. The user access data structure stores user access data. The user access data relates to at least one entry in the access control group data structure. The data object access data structure stores data object access data, which relates to at least one entry in the access control group. Additional data structures described include an access control rule data structure and a characteristic method data structure.

Data structure for access control

Systems and techniques to derive virtual objects at run-time from persistencely stored objects. In general, in one implementation, the technique includes receiving a request for a target object from a requesting application. It is determined whether a delta link is associated with the target object. The delta link includes a location of the target object and information describing a desired difference between the target object and a derived object to be returned to the requesting application. The target object is located and a derived object is generated from the target object and the information in the delta link. The derived object is then returned to the requesting application. The target object, and derived object, may include a number of elements. The elements may be name-value pairs, or 'properties', or a number of child objects in an object hierarchy.

Generic layer for virtual object resolution

A client computer and a server computer communicate via a network; the server computer receives user identification via the client computer that is selectively a first device or a second device. The server computer stores at least first and second application services for a single predetermined application class, wherein the first and second application services are adapted to client computer type. Upon receiving user identification, the server computer further receives a device attribute from the client computer, compares the device attribute with reference attributes, and selectively sends a representation of the first application service or of the second application service to the client computer according to the device attribute.

Automatically selecting application services for communicating data

The present invention discloses a method, computer program product and system for adjusting roles in a computer system () that launch application services (-) by a first user who is assigned to at least one role. A first role () calls a second role () by reference (). Both roles comprise representations of applications services () and (). When representations in the second role are modified, for example, application services are added (), a delta list () for the first reference is automatically created to conditionally prevent the first role () from referencing to at least some of the modified representations of the second role (). This is achieved by using a rule database () containing rules about application services that are mutually exclusive and checking for conflicts between the representations of the first role and modified, second role. A second user, e.g. a system administrator, can accept or reject automatically created delta entries () in the delta list ().

Growing community of inventors

Walldorf, Germany

Bernhard Drittler