Authorizations for the system user (WF-BATCH), SAP security note 1251255

SAP security note 1251255, "Authorizations for the system user (WF-BATCH)". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

You use a system user to execute and manage workflows. This system user is defined in the RFC destination WORKFLOW_LOCAL_<client>, typically named WF-BATCH, though a different user can be specified.

The authorization profile SAP_ALL is assigned to the system user. You may want to restrict the authorizations of this system user for enhanced security.

Solution

This note provides a correction and introduces a new PFCG role to address the issue.

1. Apply the Correction:

• After implementing the correction from this note, the system ensures that the SAP_ALL profile is never assigned to the user WF-BATCH when using the ‘Perform Automatic Workflow Customizing (F9)’ function.
• The correction is available from SAP_BASIS version 610 onwards. In versions below 610, the function ‘Configure RFC Destination’ is not available, preventing the assignment of SAP_ALL when using transaction SWU3.

2. Utilize the New PFCG Role:

• Role Name: SAP_BC_BMT_WFM_SERV_USER
• Availability: Delivered for SAP_BASIS 640 and higher releases.
• Functionality: Contains all necessary authorizations required by the workflow runtime to execute and manage workflows. It does not include application-specific authorizations, which are typically required for using SAP Business Workflow within applications.

3. Restricting Authorizations:

• Set the Plan Version: Assign your active plan version to the Plan Version field in the role SAP_BC_BMT_WFM_SERV_USER and generate the authorization profile.
• Assign the Role: Use user maintenance to remove all existing role and profile assignments from the system user and assign only the SAP_BC_BMT_WFM_SERV_USER role.
• Add Application-Specific Authorizations: Identify active workflows and their underlying applications, assign existing roles for these applications to the system user, use the system trace (transaction ST01) to identify any missing authorizations, and verify correct execution of workflows afterward.

Reason and prerequisites

Creating the RFC destination WORKFLOW_LOCAL_<client> using transaction SWU3 (Automatic Workflow Customizing), specifically the activity ‘Configure RFC Destination’. If you use the function ‘Perform Automatic Workflow Customizing (F9)’, the system automatically creates the user WF-BATCH if it does not already exist, and assigns all profiles of the user executing SWU3 to WF-BATCH, which may include the SAP_ALL profile.

Additionally, there is no existing PFCG role to restrict the authorizations of the system user, posing a security risk.

Affected components

• SAP_BASIS: 610 to 640
• SAP_BASIS: 700 to 702
• SAP_BASIS: 710 to 720