Switchable Authorization checks for RFC in Accounts in SLcM, SAP security note 2471736

SAP security note 2471736, "Switchable Authorization Checks for RFC in Accounts in SLcM", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

Remote calls to RFC function modules are typically safeguarded by the S_RFC authorization object. However, it has been identified that S_RFC checks alone may not be sufficient for certain RFC function modules within SLcM, potentially compromising secure execution.

Solution

The note provides a mechanism to activate additional authorization checks via the Switchable Authorization Check Framework (SACF). These checks are initially inactive to maintain compatibility with existing processes and can be activated manually to enhance security.

Implementation steps:

• Support Package Installation: ensure that the appropriate support packages are applied across the different software component versions.
• Manual Post-Implementation Activities, to be performed in each system after importing the note:
  • Create Authorization Scenario: execute transaction SACF in the development system and verify if the scenario definition PIQ_ACCOUNTS_AUTH exists. If absent, download the attachment PIQ_ACCOUNTS_AUTH.TXT and upload it via transaction SACF_TRANSFER.
  • Activate Authorization Checks: use transaction SACF_COMPARE after system updates to activate the necessary authorization checks.
  • Update Table T7PIQPROCESS: in transaction SM30, maintain view V_T7PIQPROCESS and add the entries ACC1 (Display Student Accounting data), ACC2 (Create/Maintain Student Accounting data), GRA1 (Display Student Grant Assignment data) and GRA2 (Create/Maintain Student Grant Assignment).
  • Create Messages in Message Class HRPIQ00ACCOUNTING: in transaction SE91, add message 204 ("RFC error: Note 1882417 must be implemented including kernel requirements").

Authorization scenario details: scenario name PIQ_ACCOUNTS_AUTH; affected RFC function modules include CMAC_RFC_INDIVIDUAL_FEE_CREATE and HRIQ_STUDENT_GRANTS_ADD, among others. Required authorizations: users need P_CM_PROC with activities ACC1, ACC2, GRA1 and GRA2 to create, maintain, or display fee and grant assignment data.

References

• SAP Note 2216306 – Recommended and deprecated settings for auth/rfc_authority_check
• SAP Note 1922808 – Information on the Switchable Authorization Check Framework (SACF)