Switchable Authorization checks for RFC in MM-PUR-GF, SAP security note 2537961

SAP security note 2537961, "Switchable Authorization checks for RFC in MM-PUR-GF". Below are the symptom and SAP recommended solution.

Description

Symptom

S_RFC authorization checks are not sufficient to ensure secure execution of RFC function modules covered by this SAP Note. New switchable authorization checks have been implemented for RFC function modules in MM-PUR-GF.

Solution

New switchable authorization checks have been implemented. The checks are delivered inactive to ensure compatibility with your running processes. The checks can be activated in transaction SACF as described in the attached manual correction instruction. See SAP Note 1922808 for additional information on the switchable authorization check framework (SACF).

The following new authorization scenario can be maintained in transaction SACF after implementation of this SAP Note: MM_PUR_BEST – Check for authorization Purchase order, switchable authorization checks for external RFCs.

• ME_SWP_SIC_DISP_FOR_MATERIAL – authorization object M_BEST_WRK, activity (ACTVT) 03 (Display)
• ME_SWP_SIC_SA_GET_DEL_SCHEDULE – authorization object M_BEST_WRK, activity (ACTVT) 03 (Display)
• ME_SWP_SIC_SR_GET_HEADERS – authorization object M_BEST_WRK, activity (ACTVT) 03 (Display)
• ME_SWP_SIC_SR_GET_ITEMS – authorization object M_BEST_WRK, activity (ACTVT) 03 (Display)

The switchable authorization scenario and the switchable authorization checks are provided via support package and can be technically pre-implemented via the correction instructions. After technical implementation via support package or correction instructions, the checks remain inactive until manual activation.

SAP Update Manager (SUM) informs you after system updates to run transaction SACF_COMPARE to activate switchable authorization checks required by your business processes.

Reason and prerequisites

Remote calls to RFC function modules are by default protected by checks on the authorization object S_RFC. These checks must not be deactivated. See SAP Note 2216306 for recommended and deprecated settings of profile parameter auth/rfc_authority_check. Authorization for S_RFC must be limited to the required minimum authorizations for all users to ensure system security. Many RFC function modules can be sufficiently protected using S_RFC authorization checks, and often do not perform additional functional authorization checks. Please see white paper “Securing Remote Function Calls (RFC)”, also attached to SAP Note 2008727, for further information on RFC Security.

It was identified that S_RFC authorization checks are not sufficient to ensure secure execution of RFC function modules covered by this SAP Note. Activate the new switchable authorization checks and update corresponding roles if these RFC function modules are included in S_RFC authorizations in your system.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L