Security Note Authority Check for Function Modules, SAP security note 931251

SAP security note 931251, “Security Note: Authority Check for Function Modules”, is a consulting note released on October 8, 2009. Below are the symptom and SAP recommended solution.

Description

Symptom

Error message RFC_NO_AUTHORITY.

Solution

The authority check on the technical layer has been extended to function modules. The authority object S_RFC can now be maintained for authority checks for:

• Function Group: RFC_TYPE = "FUGR", RFC_NAME = <name of the function group>, ACTVT = "16"
• Function Module: RFC_TYPE = "FUNC", RFC_NAME = <name of the function module>, ACTVT = "16"

At runtime, the first check is for the executed function group. If this check fails, a second check for the function module is executed. This behavior does not require changes during upgrades but allows for a more granular authority check to be activated as needed. Note that the authority check is performed only once with the first execution of the function module for the particular RFC session.

Reason and prerequisites

When calling RFC functions, the authority check is performed on both the technical layer in RFC and the business layer (AUTHORITY-CHECK in ABAP). Currently, authorization checks on the technical layer are only performed for function groups (R3TR FUGR), which may pose a security risk. For functions of the function group SRFC, refer to Note 931252.

References

• 931252 – Security Note: Authority Check for Function Group SRFC
• 1844452
• 1718059 – New functions for the trace evaluation
• 1640733 – PFCG: Additional S_RFC Authorization
• 1248596 – S_RFC authorizations for sales order management
• 1248401 – S_RFC authorization for CRM Incentives and Commission Mgmt
• 1246841
• 1246838 – S_RFC authorization for CRM Entitlement Management
• 1246837 – S_RFC authorization for CRM rebate processing
• 1246835 – S_RFC authorization for CRM billing
• 1168772 – Minimum authorization profile for JRA