Switchable authorization checks for RFC in CRM-IU, SAP security note 2271839

SAP security note 2271839, “Switchable Authorization Checks for RFC in CRM-IU”, is a note released on October 11, 2016. Below are the symptom and the SAP recommended solution.

Description

Symptom

This SAP note introduces new switchable authorization checks for RFC function modules in CRM-IU to enhance system security. Remote calls to RFC function modules are now protected by additional checks on the authorization object S_RFC. These checks are delivered inactive by default to ensure compatibility and can be activated manually via transaction SACF.

Affected RFC function module: ECRM_GET_ALL_POSDATA_UC.

Solution

To implement the switchable authorization checks, follow these steps:

• Ensure that the authorization scenario CRM_IU_ORDER exists in transaction SACF. If not, download the CRM_IU_ORDER.TXT attachment from the note and upload it using transaction SACF_TRANSFER.
• Create the productive authorization scenario and activate the switchable authorization checks as detailed in the attached manual correction instructions.

References

• SAP Note 1922808