Switchable authorization checks for RFC in SLCM(Student Life cycle Management), SAP security note 2030144

SAP security note 2030144, "Switchable authorization checks for RFC in SLCM (Student Life Cycle Management)", is a program error note released on August 13, 2019. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP note introduces new switchable authorization checks for RFC function modules within the Student Life Cycle Management (SLCM) application. Remote calls to RFC function modules are protected by the authorization object S_RFC, which must be restricted to the minimum necessary authorizations to maintain system security. However, it was identified that S_RFC checks alone might not suffice for certain RFC function modules covered by this note.

Solution

New switchable authorization checks have been implemented and are delivered in an inactive state to ensure compatibility with existing processes. These checks can be activated manually in transaction SACF following the attached manual correction instructions. The activation process involves:

• Creating Authorization Scenarios: define PIQ_APPRAISAL_AUTH and PIQ_OBJID_BP_AUTH scenarios in SACF. Upload scenario definitions using the provided .TXT files if they do not exist.
• Activating Authorization Scenarios: transfer the scenario definitions to productive scenarios with status Active or Logging. Active activates authorization checks and logs to the Security Audit Log. Logging activates logging to identify users requiring new authorizations without enforcing the checks.
• Configuring Security Audit Log: ensure Security Audit Log is activated via transaction SM19. Create filters for relevant audit messages.
• Adjusting User Roles: update roles to include the new authorization objects (P_CM_PROC and B_BUPA_ATT). Use report RSAU_SELECT_EVENTS to identify users needing new authorizations.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Affected components

• IS-HER-CM (Student Lifecycle Management) – SAP Basis versions 600 to 617