Switchable authorization checks for RFC in the IBAN maintenance, SAP security note 2069864

SAP security note 2069864, "Switchable Authorization Checks for RFC in IBAN Maintenance", is a note. Below is the SAP recommended solution.

Description

Solution

The solution involves activating the new switchable authorization checks through the SACF transaction. The checks are delivered inactive to maintain compatibility with existing processes and can be activated manually. Steps:

• Technical implementation: upload the scenario definition via transaction SACF_TRANSFER (select “Upload”, “Scenario Definition”, deselect “Productive Scenarios” and “Test Mode”) and assign the scenario definition CA_TIBAN to the development package BF_BANK.
• Create productive authorization scenario: in transaction SACF in the development system, select “Scenario Definition” CA_TIBAN, then press the “Scenario” button (F5) to transfer it to a productive scenario. Choose the initial scenario status: “Active” (activates both authorization checks and logging to the Security Audit Log) or “Logging” (activates only logging, allowing authorization checks to pass for identifying required authorizations).
• Configure Security Audit Log: ensure the Security Audit Log is activated in transaction SM19 under Environment > Profile Parameters, and create a new filter to capture relevant audit messages: non-critical events DUO (authorization check successful) and DUP (authorization check failed); critical event DUQ (active scenario for switchable authorization check was changed).
• Adjust user roles: use report RSAU_SELECT_EVENTS to identify users requiring new authorizations based on audit messages, and update user roles to include the necessary authorizations for the new authorization scenario.

References

• SAP Note 2078596: Further improvements for RFC security