Switchable authorization checks for RFC in EHS, SAP security note 2066956

SAP security note 2066956, “Switchable authorization checks for RFC in EHS”, is a note. Below is the security information published by SAP for this note.

Description

Symptom

This SAP note introduces new switchable authorization checks for RFC function modules in Environment, Health & Safety (EHS). Remote calls to RFC function modules are protected by the authorization object S_RFC, but it was identified that S_RFC checks might not be sufficient for certain RFC function modules. This could potentially lead to unauthorized access if not properly managed.

Reason and prerequisites

The new authorization checks ensure that RFC function modules included in S_RFC authorizations are further secured by additional authorization objects. To implement this, activate the new switchable authorization checks via transaction SACF as described in the correction instructions.

Solution

The solution involves activating the new switchable authorization checks which are delivered inactive by default to maintain compatibility. The activation process includes:

1. Implementation of the Switchable Authorization Check

• Import the scenario definitions using the attached files EHS_IH_OH_BP.TXT and EHS_IH_OH_HR.TXT via transaction SACF_TRANSFER.
• Assign the scenario definitions to the respective development packages (CBHR).

2. Generating a Productive Authorization Scenario

• Use transaction SACF to convert scenario definitions to productive scenarios.
• Choose the appropriate scenario status: Active or Logging.

3. Activating Security Audit Logging

• Ensure the security audit log is active using transaction SM19.
• Activate relevant message IDs (DUO, DUP, DUQ) in a static security audit log profile.

References

• SAP Note 2078596 – Further improvements for RFC security
• SAP Note 2105936 – Incident/Accident Log: Incomplete display of absences