Switchable authorization checks for RFC in CRM-MW-GEN, SAP security note 2264949

SAP security note 2264949, "Switchable authorization checks for RFC in CRM-MW-GEN". Below are the symptom and SAP recommended solution.

Description

Symptom

Prior to this update, authorization object S_RFC checks might not have been sufficient to secure the execution of certain RFC function modules within CRM-MW-GEN. This posed potential security risks by allowing unauthorized access through inadequate authorization checks.

Solution

The note provides new authorization scenarios and direct authorization checks for specific RFC function modules. The implementation involves the following steps:

• Implement the Support Package: Apply the support packages relevant to your BBPCRM component version.
• Activate Authorization Checks: In transaction SACF, verify if the scenario definition CRM_MW_BDM_GEN exists. If not, implement Note 2264949 via SNOTE and execute the report Note_2264949_ver1 in transaction SE38 to create the scenario definition. Create the productive authorization scenario from the scenario definition in SACF, choosing the initial status as Active to enforce authorization checks and logging. Activate logging of SACF-relevant audit messages in the Security Audit Log using transaction SM19, ensuring message IDs DUO (Authorization check successful), DUP (Authorization check failed), and DUQ (Scenario status change) are active. Adjust user roles to include the necessary authorizations identified through the new authorization scenario using reports like RSAU_SELECT_EVENTS.

Reason and prerequisites

The update addresses the insufficiency of S_RFC authorization checks by activating new switchable authorization checks. These checks are initially inactive to maintain compatibility with existing processes and require manual activation. Before implementing this note, ensure that SAP Note 2236076 is applied to avoid syntax errors when calling CL_RFC=>CHECK_EXTERNAL and CL_SACF=>AUTH_CHECK_SPEC.