Switchable authorization checks for RFC in Internet Service, SAP security note 2252568

SAP security note 2252568, "Switchable authorization checks for RFC in Internet Service", is released on October 11, 2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

S_RFC authorization checks may not sufficiently secure RFC function modules, potentially allowing unauthorized access and insecure executions of these modules.

Solution

The solution involves activating the new switchable authorization checks through transaction SACF. The checks are initially inactive to maintain compatibility with existing processes and can be activated manually as needed.

• Create authorization scenario definitions CRM_ICSS_1 and CRM_ICSS_CR_1, uploading the CRM_ICSS_1.TXT and CRM_ICSS_CR_1.TXT files via transaction SACF_TRANSFER
• In transaction SACF, transfer the scenario definitions to productive scenarios and set the status to Active or Logging to enable authorization checks and logging
• Ensure Security Audit Log is activated in transaction SM19 and activate relevant message IDs (DUO, DUP, DUQ) for comprehensive auditing
• Update user roles to include the necessary authorizations based on the new scenarios, using report RSAU_SELECT_EVENTS to identify and assign required authorizations

Reason and prerequisites

Remote calls to RFC function modules are governed by the authorization object S_RFC. To maintain system security, authorizations for S_RFC should be limited to the essential minimum. While many RFC function modules are adequately protected using S_RFC checks, they often lack additional functional authorization checks. This note addresses the identified insufficiency by introducing switchable authorization checks that enhance security.

Ensure that SAP Note 2236076 is applied. Verify system compatibility with the supported software components.

Affected components

• BBPCRM 700, 701, 702, 712, 713, 714