Authorization check for HTTP/external debugging, SAP security note 668252

SAP security note 668252, “Authorization check for HTTP/external debugging”, is a note released on 08.10.2009. Below are the symptom, reason and prerequisites, SAP recommended solution and references.

Description

Symptom

The activation of HTTP or external debugging for other users is not allowed.

Solution

As a system administrator, create the necessary authorizations for HTTP/external debugging of other users and assign them to the appropriate user profiles.

Manual Implementation Steps:

• Start transaction SU21 and double-click on the BC_C object class.
• Select the S_DEVELOP authorization object.
• Switch to change mode using the corresponding pushbutton.
• In the maintenance dialog, use the ‘allowed activities’ pushbutton to select the 90 transfer value.
• Enter all relevant usernames in the “Object name” field and save the changes.

Reason and prerequisites

For security reasons, an extended authorization check is performed when setting HTTP or externally debugging sessions of other users. To debug a <user_2> session as a <user_1> user, the following conditions must be met:

• User <user_2> requirements: must be a dialog user or a service user; must have debugging authorization, specifically the S_DEVELOP authorization object with OBJTYPE: DEBUG, ACTVT: 03.
• User <user_1> requirements: must have authorization to debug another user’s session; requires the S_DEVELOP authorization object with OBJTYPE: DEBUG, ACTVT: 90, OBJNAME: <user_2>.

The SUSR_CHECK_DEBUG_ABILITY function module can be used to verify if user <user_1> can execute a session of user <user_2> in the debugger.

References

• External breakpoint cannot be set for a user
• Implement additional commands for AP7.00 configuration
• Problem analysis with HTTP or external debugging
• Using HTTP/external debugging
• ABAP debugging authorizations