Switchable authorization checks for RFC in FI-CAX, SAP security note 2027715

SAP security note 2027715, "Switchable authorization checks for RFC in FI-CAX", is a note released on November 11, 2014. Below is the SAP recommended solution.

Description

Solution

Activation of authorization checks:

• Upload the scenario definition files FKK_DM_CASEITEMSH_MODIFY.txt and FKK_CA_ABWVK_GETLIST.txt: go to transaction SACF and select SACF_TRANSFER, choose the “Upload” option and select the downloaded .txt files, then assign each scenario definition to its respective development package (FKKB_DM and FKKV).
• Create productive authorization scenarios: in transaction SACF, navigate to “Scenario Definition”, select the uploaded scenario and transfer it to a productive scenario by setting the status to either “Active” (activates the authorization check and enables logging to the Security Audit Log) or “Logging” (enables logging without enforcing the authorization check, useful for identifying required authorizations).
• Configure Security Audit Log: ensure that the Security Audit Log is active by checking transaction SM19. Create a new filter to capture relevant audit messages: non-critical DUO (authorization successful) and DUP (authorization failed); critical DUQ (scenario changes).
• Adjust user roles: use report RSAU_SELECT_EVENTS to identify users affected by the new authorization scenarios. Update roles to include the necessary authorizations based on the audit logs and system traces (STAUHTRACE or ST01).

References

• SAP Note 2078596: Further improvements for RFC security