PFCG Authorization maintenance for object S_RFCACL, SAP security note 1416085

SAP security note 1416085, "PFCG: Authorization maintenance for object S_RFCACL", is a program error note released on 07.10.2013. Below are the symptom and SAP recommended solution.

Description

Symptom

Every RFC function call requires a logon to the called system. If the RFC connection is defined as trust (transaction SM59, "Logon & Security" tab), the target system checks for the requested function and the authorization object S_RFCACL. The user under which these checks are executed depends on the RFC connection definition.

Improper entries in the fields RFC_SYSID, RFC_CLIENT, or RFC_USER for S_RFCACL can allow logons from any system, client, or user, leading to significant security risks.

Solution

Implement the correction instructions using transaction SNOTE or import the relevant Support Package provided in the note.

After applying the solution:

• Full authorization assignments for RFC_SYSID, RFC_CLIENT, and RFC_USER remain possible but require manual intervention in transaction PFCG.
• An additional dialog box will alert administrators of the security risks, requiring confirmation.
• Automatic methods for assigning full authorizations are disabled to prevent unauthorized access.

The profile SAP_ALL does not include S_RFCACL unless explicitly added using the customizing switch ADD_S_RFCACL = YES in table PRGN_CUST. This setting also applies when inserting SAP_ALL into a role.

Reason and prerequisites

This issue is triggered by a missing function related to authorization checks during RFC logons.