Introduction
For a project-driven organization, managing employee timesheets across multiple teams and projects, while maintaining clear visibility of employee effort and approval status, can require information to be gathered from several places. While the required data is available within SAP S/4HANA Public Cloud, it is spread across different business applications.
To address this gap, a consolidated Timesheet Calendar application was built on SAP Business AI Platform. It provides Managers and Approvers with a single, secured view of recorded hours and approval status using live data from SAP S/4HANA Public Cloud, while also bringing in planned-hours information from Project Demand.
Solution Overview
The solution combines SAP Business AI Platform services – Cloud Foundry runtime, SAP Cloud Identity Services, SAP CAP, SAPUI5, and SAP Build Work Zone, with each component handling a specific part of the overall process:
- SAP Business AI Platform – Provides the application platform and Cloud Foundry runtime for the solution.
- SAP Cloud Identity Services (IAS) – Provides identity federation so users can authenticate through the organization's existing corporate identity.
- SAP CAP – Consolidates information from multiple SAP S/4HANA Public Cloud OData services, applies authorization, and enriches the data with planned hours.
- SAPUI5 and SAP Build Work Zone – Provide the Timesheet Calendar experience and the launchpad through which users access the application.
Together, these components take the process from corporate authentication and live data retrieval to secured data consolidation and calendar-based presentation.
SAP Business AI Platform Foundation
The application runs in a dedicated SAP Business AI Platform subaccount on Cloud Foundry, which provides the runtime environment and the services required to develop, deploy, connect, and secure the application. SAP Business Application Studio is used for application development and testing, while SAP Build Work Zone, standard edition provides the launchpad site through which end users access the application.
Supporting services such as the Destination service, HTML5 Application Repository, and XSUAA connect the different application components. The HTML5 Application Repository hosts the deployed SAPUI5 application, while Destination provides managed connectivity from CAP to SAP S/4HANA Public Cloud, and from SAPUI5 application to CAP. XSUAA (Extended Services for User Account and Authentication) provides the authentication and authorization foundation, supplying the user and role information needed to control access to the application.
With the application platform in place, the next requirement was to connect it to the identity users already rely on within the organization.
Identity Federation Through IAS
SAP Build Work Zone authenticates users through the SAP Cloud Identity Services tenant connected to the Business AI Platform subaccount, referred to as the Main IAS. Rather than creating another set of credentials for the Timesheet Calendar, the Main IAS was federated with the organization's existing Corporate IAS, allowing the application to use the corporate authentication process.
Establishing the Trust
The federation establishes trust between the two IAS tenants using SAML 2.0. On the Main IAS side, the Corporate IAS is registered as an Identity Provider, with Email used as the Name ID. Identity Federation uses the Identity Authentication user store so that the user's identity can be resolved consistently.
The Corporate IAS is then configured to recognize the Main IAS as a trusted Service Provider, with Email as the primary Subject Name Identifier and User ID as a fallback. The Business AI Platform subaccount application representation in the Main IAS is finally configured to use the Corporate Identity Provider as the default authentication provider.
The Result for the User
When a user opens SAP Build Work Zone, the authentication request is routed through the Main IAS to the Corporate Identity Provider. Once authentication is completed, the shared Email-based identity allows the application to recognize the user across the federation.
The result is a single sign-on experience, with no separate username or password required for the Timesheet Calendar application. Users can access the application through the existing corporate authentication environment without another login process.
Consolidating SAP S/4HANA Public Cloud Data with CAP
Once the user's identity is established, the next challenge is bringing together the information required by the calendar. The solution uses the SAP Cloud Application Programming Model (CAP) with Node.js as the central layer for retrieving, consolidating, enriching, and authorizing timesheet information before it reaches the SAPUI5 application.
The service runs on Node.js 20+ with CAP 9 and is deployed to Cloud Foundry as a Multi-Target Application. Business information is read live from SAP S/4HANA Public Cloud through OData services exposed by the system and reached through the Destination service. The individual services and entities used are listed in the next section. The application does not maintain a separate local copy of business data; the CAP data model is used for local and hybrid development testing, not as another system of record.
Creating the Consolidated Timesheet View
The central backend response is the ProjectTree. Instead of exposing multiple SAP S/4HANA Public Cloud services directly to the UI, CAP combines the required information into a structure matching how the calendar displays it, from the project and WBS/project elements down to employees and their daily recorded hours.
The CAP response brings together project, WBS, employee, cost-center, approver, and timesheet-status information using the following SAP S/4HANA Public Cloud OData services (Standard and Custom):
- Timesheet records – live timesheet rows carrying daily hours, status, and notes for each employee.
- Project Demand – planned hours per WBS/project element and resource.
- Projects and ProjectElements – projects and WBS/project elements, including the ProjectElement UUID used for the planned-hours lookup.
- CostCenters – the cost center assigned to each project element.
- ProjectManagers and TimesheetApprovers – the manager and approver used to apply authorization.
- Employees – employee names and IDs.
- TimesheetStatuses – status codes and texts (In process, Released for approval, Approved, Approval rejected).
Projects, ProjectElements, CostCenters, TimesheetApprovers, ProjectManagers, Employees, and TimesheetStatuses also provide the reference and value-help information required by the SAPUI5 application. The ProjectTree handler reads live timesheet rows, ignores zero or negative hours, and aggregates the remaining data in memory. Each employee entry carries daily hours with the relevant approver and timesheet status.
A trimmed sample of the ProjectTree returned by CAP is shown below (names, e-mail addresses, and identifiers have been replaced with sample values):
files/Blog Image/Building a Consolidated Timesheet Calendar on SAP BTP for SAP S4HANA Public Cloud/CODE 1.txt
The response follows the same hierarchy as the calendar: Projects contain WBS/project elements in Children, which in turn contain employee entries in their own Children. Each employee entry holds a Days object keyed by date, with the hours, approver, timesheet status code and text, and the note recorded for that day. Status codes 10, 20, 30, and 40 correspond to In process, Released for approval, Approved, and Approval rejected.
Authorization is also applied during this process. A Manager sees rows associated with projects where they are the default manager, while an Approver sees rows where they are the assigned approver. This filtering occurs within CAP rather than relying only on the SAPUI5 application, ensuring the response contains only records the user is entitled to access.
Planned-Hours Enrichment
Recorded hours show the effort employees have actually booked, while planned hours provide additional context. CAP enriches the ProjectTree response with planned-hours information from Project Demand in SAP S/4HANA Public Cloud.
For each WBS/project element, the service resolves the corresponding ProjectElement UUID and uses it to retrieve the relevant Project Demand records. The requested quantity is mapped to the corresponding task as planned hours, while project-demand resource information associates planned effort with the relevant employee or work assignment.
If planned-hours retrieval fails, the main timesheet data is still displayed. The failure is logged, while affected planned-hour values remain zero. This makes planned-hours information available through the same CAP response and provides a foundation for comparing recorded and planned effort as the calendar evolves.
Role-Based Authorization
Authorization is handled through XSUAA in dedicated-tenant mode. Separate application roles are defined for Managers and Approvers, and the exposed READ handlers verify that the caller has an appropriate role before providing the data.
The ProjectTree handler also applies a row-level check using the authenticated user's email to determine whether the user is the relevant project manager or approver. Keeping these checks in CAP means access control is consistently enforced rather than depending on the SAPUI5 application to decide which information should be visible.
SAPUI5 Calendar Experience
With the data consolidated and access controlled in CAP, the SAPUI5 application can focus on presenting it usefully for Managers and Approvers. The application is a freestyle SAPUI5 application, developed and tested in SAP Business Application Studio, and at runtime communicates only with the CAP OData V4 service rather than directly with SAP S/4HANA Public Cloud.
The consolidated ProjectTree is displayed through a sap.ui.table.TreeTable. A fixed Log Title column identifies the project, WBS/project element, or employee, while day columns are generated dynamically according to the selected date range. A Total column provides overall hours for the period. Recorded hours are shown in HH:MM format with status indicators for In Process, Released for Approval, Approved, and Rejected, while hours are rolled up from employees to WBS/project elements and then to projects.
The table is defined in the SAPUI5 XML view as a sap.ui.table.TreeTable. The excerpt below shows the table settings and the fixed Log Title column; the remaining columns are added to the same table, with the day columns generated dynamically for the selected date range.
files/Blog Image/Building a Consolidated Timesheet Calendar on SAP BTP for SAP S4HANA Public Cloud/CODE 2.txt
- Data binding – the table binds to the Projects array of the ProjectTimesheet model and uses Children as the array name, so the project, WBS/project element, and employee levels are rendered as expandable rows. The first two levels are expanded on load.
- Layout – the first column stays fixed while the day columns scroll horizontally, and the bottom row stays fixed to keep the Total row in view. The table sizes itself to the available height with a minimum of 14 visible rows.
- Read-only behavior – row selection is disabled, and alternating row colors and set row and header heights keep dense calendar data readable.
- Log Title column – the header carries an Expand / Collapse All button, and each row shows its DisplayText with a style class derived from the row Type through a formatter.
Selecting a day opens a read-only details view containing the project, WBS element, employee, booked hours, approver, status, and notes associated with that entry. Hovering over a booked-hours cell also displays a popup with the details of that entry.
Filtering and Date Selection
The calendar includes filters for Date Range, Employee, Project, WBS Element, Cost Center, and Timesheet Status. Date selection supports Day, Week, Month, and Range modes, while Employee, Project, WBS Element, and Cost Center use a shared Value Help Dialog configured for each field. Timesheet Status supports multiple selections.
For responsiveness, the application initially loads the ProjectTree and required value-help data and maintains a master copy in memory. Subsequent filtering and date changes work against that data instead of sending a new request to CAP for every selection. Non-matching branches are removed and displayed totals recalculated.
Work Zone and SAP S/4HANA Public Cloud Integration
The SAPUI5 application is deployed as an HTML5 application and stored in the HTML5 Application Repository. Its connection to CAP is provided through a destination configured at the site or content level rather than a hard-coded CAP URL.
The application is registered with a Fiori Launchpad inbound semantic object/action pair so it can be exposed as a tile in SAP Build Work Zone. Work Zone provides the launchpad shell, navigation, and login experience, while SAPUI5 handles the Timesheet Calendar.
The same application is accessible from the SAP S/4HANA Public Cloud launchpad. The Work Zone application URL is configured as an application tile, allowing users to search for “Timesheet” and select “Timesheet Application - Display.” Because the IAS federation is already established, users do not need another username or password when moving from the SAP S/4HANA Public Cloud launchpad to the Timesheet Management application.
This creates a connected experience where the Timesheet Calendar can be reached through the existing SAP landscape while continuing to run as an SAP Business AI Platform extension.
Why This Architecture Was Used
The architecture was shaped by three requirements that the standard landscape alone did not address together.
First, users needed to authenticate through their existing corporate identity rather than maintain separate credentials for the Business AI Platform application, which led to the use of IAS federation.
Second, the information required for the calendar is distributed across multiple SAP S/4HANA Public Cloud OData services. CAP provides a central place to combine that information, enrich it with planned hours, and apply authorization before returning a single response to the UI.
Finally, the requirement was not simply a list of timesheet records. The application needed dynamic daily columns, date-range modes, hierarchy, status indicators, totals, and day-level details. A purpose-built SAPUI5 application therefore provided the flexibility required for the calendar experience.
Together, these choices keep the responsibilities clear: IAS handles identity, CAP handles data and authorization, and SAPUI5 provides the user experience.
End-to-End Process
Project Outcomes
- Single sign-on: Managers and Approvers can access the application through their existing corporate identity, without maintaining separate application credentials.
- Consolidated visibility: Project, WBS, employee, daily hours, and approval information are brought together in one calendar, reducing the need to cross-reference multiple applications and reports.
- Controlled access: Manager and Approver responsibilities are enforced in CAP, ensuring users receive only the records they are authorized to view.
- Live business data: Information is retrieved directly from SAP S/4HANA Public Cloud without creating a separate application-managed store for business data.
- Planned-hours foundation: Project Demand information is available through the same CAP response, providing a foundation for future recorded-versus-planned views.
- Reusable CAP layer: CAP centralizes data aggregation, enrichment, and authorization, providing a foundation that can support future extensions as timesheet and project-management requirements evolve.
Conclusion
The Timesheet Calendar brings together information that was previously distributed across SAP S/4HANA Public Cloud services and turns it into a single, secured experience for Managers and Approvers. By combining corporate SSO through IAS, live SAP S/4HANA Public Cloud data with CAP-based consolidation and authorization, and a purpose-built SAPUI5 calendar, the solution reduces manual cross-referencing while keeping the underlying business data where it belongs.
More importantly, the solution demonstrates how SAP Business AI Platform can extend SAP S/4HANA Public Cloud without creating another system of record. Identity, data consolidation, authorization, and user experience each have a clear place in the architecture, while the planned-hours foundation leaves room for the Timesheet Calendar to evolve with future business requirements.