Switchable authorization check in FI-LA in S_XB7_96000248, *249, *239, SAP security note 1989060

SAP security note 1989060, “Switchable authorization check in FI-LA in S_XB7_96000248, *249, *239”, is a note. Below is the security information published by SAP for this note.

Description

Symptom

An authenticated user can use functions of FI-LA to which access should be restricted. This may result in an escalation of privileges.

Reason and prerequisites

Mentioned FI-LA transactions do not contain authorization checks for verifying an authenticated user's authorization to access its list of results. The provided check verifies the authorization of a certain user for a defined company code.

You must have implemented the switchable authorization check framework (SACF) in your system to use this check. For information about the installation of the SACF workbench, see SAP Note 1908870.

For further information about the SACF functionality, please refer to the SAP Online Help: http://help.sap.com/saphelp_nw74/helpdata/en/a9/a721a34a4b4e2fa5c12947022c7d76/content.htm

Solution

New switchable authorization checks have been implemented. The checks are delivered inactive to ensure compatibility with your running processes. The checks can be activated in transaction SACF as described in the attached manual correction instruction.

#### New Authorization Scenario(s)

The following new authorization scenarios can be maintained in transaction SACF after implementing this SAP note:

• Scenario FI_ACE_REPORT

With this note and the SACF scenario FI_ACE_REPORT, checks on authorization object F_L_ACCRUL can be activated, improving the accuracy of authorization checks for the mentioned transactions.

#### Affected Business Processes and Roles

All roles in your system covering the above-mentioned FI-LA related accrual transactions should be reviewed. The corresponding new authorization should be set for the roles accordingly before activating the SACF scenario.

#### Activation of the Switchable Authorization Check

Follow the post-processing activities below after technical implementation to activate the authorization checks.

1. Create the Authorization Scenario Definition:

• Start transaction SACF in the development system. If SACF is not available, implement SAP Note 1908870.
• Check if scenario definition FI_ACE_REPORT exists. If it does, proceed to step 2.
• If not, download the file FI_ACE_REPORT.TXT attached to this note.
• Start transaction SACF_TRANSFER.
• Select "Upload", choose "Scenario Definition", deselect "Productive Scenarios" and "Test Mode", then execute.
• Select the FI_ACE_REPORT.TXT file and confirm the upload.
• Assign the scenario definition to the development package FI_LA_ACE.

2. Create the Productive Authorization Scenario:

• In transaction SACF, select "Scenario Definition" and the "Scenario Name" created above, then execute.
• Double-click the scenario definition and press the "Scenario" button to transfer it to a productive scenario.
• Choose the initial scenario status "Active" or "Logging":
• Active: Activates the authorization check and logs to the Security Audit Log.
• Logging: Activates logging to the Security Audit Log without enforcing the authorization check, allowing you to identify users needing authorizations.

3. Activate Logging of Relevant Audit Messages:

• Ensure Security Audit Log is activated by checking in transaction SM19 under Environment > Profile parameters.
• Create a new filter in the active, static Security Audit Log configuration:
• Other events – Non-Critical: DUO (Authorization check successful), DUP (Authorization check failed)
• Other events – Critical: DUQ (Change in active scenario)
• Activate the new filter.

4. Adjust Your Roles:

• Use report RSAU_SELECT_EVENTS to identify users needing additional authorizations.
• Analyze events DUO and DUP to adjust roles accordingly.
• Authorization checks for productive scenarios can also be analyzed using the system trace for authorizations (transactions STAUTHTRACE or ST01).