Switchable authorization checks for RFC in CA-JVA, SAP security note 2023335

SAP security note 2023335, “Switchable authorization checks for RFC in CA-JVA”, is a note released on 11.11.2014. Below is the security information published by SAP for this note.

Description

This SAP Note introduces new switchable authorization checks for RFC function modules in the CA-JVA component. Remote calls to RFC function modules are secured using the S_RFC authorization object. However, it was identified that S_RFC checks might not be sufficient for certain RFC function modules, potentially compromising system security. This note provides instructions to activate enhanced authorization checks to ensure secure execution.

Solution

New switchable authorization checks have been implemented and are delivered inactive by default to maintain compatibility. To enhance security, follow these steps to activate the authorization checks:

1. Create the Authorization Scenario Definition:

• Start transaction SACF in the development system.
• Verify if the scenario definition JV_RFC exists.
• If not, download the JV_RFC.txt attachment.
• Use transaction SACF_TRANSFER to upload the scenario definition.
• Assign JV_RFC to the development package GJVA.

2. Create the Productive Authorization Scenario:

• In transaction SACF, select Scenario Definition and execute JV_RFC.
• Transfer the scenario definition to a productive scenario by clicking the Scenario button or pressing F5.
• Choose the status:
• Active: Activates authorization checks and logs to the Security Audit Log.
• Logging: Activates logging without enforcing authorization checks, useful for identifying required authorizations.

3. Activate Logging in the Security Audit Log:

• Ensure Security Audit Log is activated via transaction SM19.
• Create a new filter to log relevant audit messages:
• Non-Critical: DUO, DUP
• Critical: DUQ
• Activate the new filter.

4. Adjust Roles for New Authorizations:

• Use report RSAU_SELECT_EVENTS to identify users needing additional authorizations.
• Analyze authorization checks using transactions STAUTHTRACE or ST01.