Security note Authorization check when executing reports, SAP security note 1012066

SAP security note 1012066, “Security note: Authorization check when executing reports”, was released on July 20, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note addresses the authorization checks required when executing executable programs (reports) via transactions SE38 or SE80 in the standard SAP system. Specifically, it ensures that the S_PROGRAM authorization object is checked only if an authorization group is assigned to the report.

• Execution permissions: Users with display or change authorization can execute a report if it’s not assigned to any authorization group.
• Navigation execution: Users can execute programs through various navigation steps in SE38 or SE80, provided the program isn’t assigned to an authorization group.
• Stricter authorization check: Implementation involves modifying the function module EXTENDED_AUTH_CHECK_FOR_REPS to enforce stricter authorization checks.

Solution

For SAP Releases 4.6B to 7.00:

• Use transaction SE91 to create message number 322 in the ED message class with the text: “You are not authorized to execute reports in SE80/SE38”.
• Create or modify the function module EXTENDED_AUTH_CHECK_FOR_REPS within function group S38E with specific import and export parameters.

For SAP Release 7.10 and later, the authorization check in EXTENDED_AUTH_CHECK_FOR_REPS is active by default. No manual changes are required.

Reason and prerequisites

This security note is obsolete and has been replaced by SAP Security Note 1596907. Refer to other SAP Notes such as 577048, 322234, 535404, etc.

References

• References To Note 338177

Affected components

• SAP_BASIS: 4.6B to 46C, 610 to 730