Missing Auth. Check in IS-OIL, SAP security note 2029561

SAP security note 2029561, "Missing Authorization Check in IS-OIL", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Remote calls to RFC function modules in IS-OIL were found to lack sufficient authorization checks, potentially allowing unauthorized access and actions within the system.

Solution

• Implement new authorization checks: activate new authorization checks in transaction SACF. Update roles to include the new authorization objects O_DS_TXN for transaction control and O_OIJ_SPTP for modification controls related to rundown and rack forecasts.
• Manual activities: if authorization object O_DS_TXN does not exist, create it in transaction SU21 with authorization fields TCD and ACTVT. Use transaction SACF_TRANSFER to upload the scenario definitions from the attached files, assign the scenarios to the appropriate development packages, and activate them in productive mode (Active or Logging).
• Adjust roles: analyze audit logs using report RSAU_SELECT_EVENTS and update user roles to include the necessary authorizations based on the new scenarios.
• Activate Security Audit Log: ensure security audit logging is enabled via transaction SM19 and configure filters to capture relevant authorization events.

Reason and prerequisites

The existing authorization object S_RFC may not provide adequate security for certain RFC function modules in IS-OIL. To mitigate this, new authorization checks are introduced that must be activated and configured appropriately.

References

Affected components

• IS-OIL (versions 600 to 617)