Security Note Authority Check for Function Group SRFC, SAP security note 931252

SAP security note 931252, “Security Note: Authority Check for Function Group SRFC”, is a consulting note released on September 26, 2014. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Technical authority check for function modules of function group SRFC is requested.

Solution

The behavior is configured via the profile parameter auth/rfc_authority_check.

For versions 31I-45B:

• 0: No technical RFC check.
• 1: Technical RFC check active, but not for function group SRFC.
• 2: Technical RFC check active, also for function group SRFC.

For versions 46A-720 PL 415:

• 0: No technical RFC check.
• 1: Technical RFC check active, but not executed in single sign-on or for function group SRFC.
• 2: Technical RFC check active in single sign-on procedures, but not for function group SRFC.
• 9: Technical RFC check active in single sign-on procedures and for function group SRFC (requires user profile updates).

For 720 PL 416 and later:

• 0: No authorization check.
• 1: Authorization check active (no check for same user context and SRFC-FUGR).
• 2: Authorization check active (no check for SRFC-FUGR).
• 3: Logon required for all function modules except RFC_PING and RFC_SYSTEM_INFO (no authorization check).
• 4: Authorization check required for all function modules except RFC_PING and RFC_SYSTEM_INFO.
• 5: Logon required for all function modules except RFC_PING (no authorization check).
• 6: Authorization check required for all function modules except RFC_PING.
• 8: Logon required for all function modules (no authorization check).
• 9: Authorization check active (SRFC-FUGR also checked).

Default value: 1.

Reason and prerequisites

The technical authority check via authority object S_RFC shall be activated also for function modules in function group SRFC, because the security gain outweighs the performance impact of the authority check.

References

Affected components

• SAP_APPL: 31I, 40A to 40B, 45A to 45B
• SAP_BASIS: 46A to 46D, 610 to 640, 700 to 702, 710 to 730+