Using HTTP/external debugging, SAP security note 668256

SAP security note 668256, “Using HTTP/external debugging”, is a program error note released on 08.10.2009. Below are the symptom and SAP recommended solution.

Description

Symptom

This security note provides guidance on using HTTP debugging or external debugging to debug RFC or HTTP/HTTPS/SMTP sessions within SAP systems.

Solution

Use SAPGUI to log on to the server from which RFC or HTTP/HTTPS/SMTP calls are made, preferably with the same user for both the RFC/HTTP logon and the debugging session. Debugging with load distribution is not supported; reconfigure the application to route calls to a specific server during debugging. Avoid debugging collective user sessions due to high simultaneous calls; use a dedicated user for executing the application during debugging.

To activate debugging, access the Development Workbench (DWB) transactions (e.g., SE37, SE38, SE80), navigate to Utilities, Settings, ABAP Editor, Debugging, enter the user session to be debugged, activate the “Active” checkbox, and deactivate the “IP Matching” checkbox. Ensure the user has the necessary authorizations to activate and set breakpoints in ABAP reports, see SAP Note 668252. In the ABAP report (methods, function modules, includes, etc.), select “HTTP/external debugging” when setting breakpoints.

• Debugging sessions must remain active; otherwise, the debugging engine cannot establish a connection for new SAPGUI sessions.
• The validity period for HTTP/external debugging is limited to 2 hours; reactivate breakpoints for longer debugging sessions.
• External breakpoints are stored in the database and persist after logging off, but external debugging must be reactivated upon each login.
• Known issue: activating external debugging for usernames that are substrings of other usernames (e.g., ‘POWERUSER’ affects ‘POWER’) may create unintended breakpoints.

HTTP/external debugging was introduced in Release 620 with patch level 1186 under the patch text “HTTP/External Debugging for RFC (II)”. Subsequent corrections address known issues: patch text “HTTP/External Debugging for RFC (III)” for Release 620 with patch level 1320, and for Release 640 with patch level 2. Additional support and descriptions for the rfc/ext_debugging profile parameter can be found in Support Package SAPKB62031 for Release 620.

References

• Implement additional commands for AP7.00 configuration
• Problem analysis with HTTP or external debugging
• Authorization check for HTTP/external debugging