Switchable authorization checks for RFC in CRM-MW-SRV, SAP security note 2264948

SAP security note 2264948, "Switchable authorization checks for RFC in CRM-MW-SRV", is a note released on 06.10.2017. Below are the symptom and SAP recommended solution.

Description

Symptom

This SAP note introduces new switchable authorization checks for RFC function modules within middleware flow services and queue processing. It addresses scenarios where the existing S_RFC authorization checks may not be sufficient to ensure secure execution of certain RFC function modules.

Solution

The note implements new switchable authorization checks that are inactive by default to maintain compatibility with existing processes. These checks can be activated using transaction SACF. Detailed steps for activation are provided below.

New Authorization Scenarios:

• CRM_MW_QPROC – Scenario for middleware queue processing modules. RFC Function Modules: SMOENQUEUE_RFC (Auth. Object: CRM_MW_AC, ACTVT=16), SMO_ACENQUEUE (Auth. Object: CRM_MW_AC, ACTVT=16), SMOH_SITE_RELEASE (Auth. Object: CRM_MW_AC, ACTVT=2), SMOH_EXTRACTREQUEST_RFC (Auth. Object: CRM_MW_AC, ACTVT=16)
• CRM_MW_MFLOW – Scenario for middleware flow modules. RFC Function Module: SMW3_MFLOW_QPROCESSMBDOC (Auth. Object: CRM_MW_FC, ACTVT=16)

Implementation Steps:

• Create Authorization Scenario Definition: Use transaction SACF to check for the existence of CRM_MW_QPROC and CRM_MW_MFLOW. If not present, apply Note 2264948 via SNOTE and execute the report Note_2264948_ver1 in transaction SE38.
• Create Productive Authorization Scenario: In SACF, select the scenario definition and transfer it to a productive scenario. Choose the initial status as Active or Logging. Active activates authorization checks and logs to Security Audit Log. Logging activates logging only; authorization checks will pass regardless of user authorizations.
• Activate Logging in Security Audit Log: Ensure Security Audit Log is active via transaction SM19. Activate message IDs: DUO (Authorization check successful), DUP (Authorization check failed), DUQ (Change in active scenario).
• Adjust User Roles: Use report RSAU_SELECT_EVENTS to identify users needing additional authorizations. Update roles accordingly to comply with the new authorization scenarios.

Reason and prerequisites

Remote calls to RFC function modules are protected using the S_RFC authorization object. However, some RFC function modules require additional authorization checks to enhance system security. This note provides switchable authorization checks to ensure that these function modules are adequately protected. Ensure that S_RFC authorizations are limited to the minimum necessary for all users. Ensure that SAP Note 2040612 and 2236076 are implemented as applicable to your system’s release version.