New authorization check for RFC in component WEC-APP-UM, SAP security note 2066943

SAP security note 2066943, "New authorization check for RFC in component WEC-APP-UM". Below are the symptom and the SAP recommended solution.

Description

Symptom

This SAP Note describes a new authorization check for the RFC function module COM_WEC_CHECK_SEQ_QTN in component WEC-APP-UM.

Solution

Implement the correction instructions and carry out the manual steps described below.

After creating the authorization object and implementing the corrections, update the Web Channel user roles for the service (technical) user. For Web Channel Experience Management, SAP delivers the example roles SAP_ERP_WEC_TU_ALL in ERP and SAP_CRM_WEC_TU_ALL in CRM.

• Create authorization object: call transaction SU21 and enter Object COM_WEC, Text “Web Channel User Activity Authorization Object”, Class AAAB, Authorization Field ACTVT with the permitted activities 01, 02, 03, 05, 06, 07, 16, 22, 23, 32, 37, 38, 39, 45, 60, 61, 63, 64, 88, 90, 95, 96, UL. Object documentation: definition “Generic Web Channel Authorization Object for checking user activities”; defined field ACTVT – User activity.
• Remove the “SAP_NEW authorizations” flag.
• Update message classes: call transaction SE80, select package COM_WEC_USER, open message class COM_WEC_USER_MSG and create two new self-explanatory messages: No. 007 “Error occurred; contact us for support” and No. 008 “User not authorized: RFC FM &1, Authorization object &2, Activity &3”.

Reason and prerequisites

External calls of RFC function modules are protected by authorization checks against the object S_RFC. Authorizations for S_RFC must be reduced to a minimum for all users to ensure system security. A large number of function modules can be sufficiently protected by S_RFC authorization checks. Often, these RFC function modules do not perform any additional authorization checks. Refer to SAP Note 2008727 for more information about RFC security.

It has been noted that the S_RFC authorization check may not be sufficient to ensure a secure execution of the function module COM_WEC_CHECK_SEQ_QTN. Implement the correction instructions and update the relevant roles if this function module is used in the S_RFC authorizations of your system.