Switchable authorization checks for RFC in CRM Counters, SAP security note 2266687

SAP security note 2266687, "Switchable authorization checks for RFC in CRM Counters", is a program error note released on 11.10.2016. Below are the symptom and SAP recommended solution.

Description

Symptom

This SAP note describes new switchable authorization checks for RFC function modules in CRM Counters.

Solution

New switchable authorization checks have been implemented. The checks are delivered inactive to ensure compatibility with your running processes. They can be activated in transaction SACF as described in the attached manual correction instructions. See SAP Note 1922808 for additional information on the switchable authorization check framework (SACF).

• New authorization scenario: CRM_MPK_RFC_1, authorization check for CRM Measuring Point (1)
• Affected business process: remote creation and modification of CRM Counters and readings
• Affected RFC function module CRM_COUNTER_MD_LIST_BY_OBJECT, authorization object CRM_MPOINT, ACTVT=45
• Affected RFC function module CRM_COUNTER_MD_RFC_CREATE_REF, authorization object CRM_MPOINT, ACTVT=45
• Affected RFC function module CRM_MPK_RFC_MPOINT_UPDATE, authorization object CRM_MPOINT, ACTVT=45
• Affected RFC function module CRM_MPK_RFC_MPOINT_GETDETAIL, authorization object CRM_MPOINT, ACTVT=45
• Affected RFC function module CRM_MPK_RFC_MPOINT_GETLIST, authorization object CRM_MPOINT, ACTVT=45
• Create the authorization scenario definition in transaction SACF (upload via SACF_TRANSFER if CRM_MPK_RFC_1 does not yet exist) and assign it to package CRM_MPK_COMM
• Create and activate the productive authorization scenario as described in SAP Note 1922808

Reason and prerequisites

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. Authorizations for S_RFC must be limited to the required minimum authorizations for all users to ensure system security. Many RFC function modules can be sufficiently protected using S_RFC authorization checks without additional functional authorization checks. Refer to SAP Note 2008727 for more information on RFC Security.

It was identified that S_RFC authorization checks might not be sufficient to ensure secure execution for RFC function modules covered by this note. Activate new switchable authorization checks and update corresponding roles if these RFC function modules are included in S_RFC authorizations in your system.

CVSS

Score 0