Switchable authorization checks for listing and site master data, SAP security note 2064637

SAP security note 2064637, "Switchable Authorization Checks for Listing and Site Master Data", is a note released on November 11, 2014. Below are the symptom and the SAP recommended solution.

Description

Symptom

Remote calls to RFC function modules are currently protected by checks on the authorization object S_RFC. However, these checks may not be sufficient to guarantee secure execution for certain RFC function modules. This note addresses the insufficiency by introducing additional authorization checks.

Solution

Implementation of authorization checks: New authorization scenarios LO_MD_PL_RFC and LO_MD_RA_RFC are introduced. These checks utilize authorization objects W_BETR_USR and W_ASORT to ensure users have the necessary permissions to display sites and manage listing conditions.

Activation steps: Activate the authorization checks manually using transaction SACF. Update roles to include the new authorization objects to maintain system compatibility and security.

Reason and prerequisites

The existing S_RFC authorization checks might not fully secure the execution of specific RFC function modules. To enhance security:

• New switchable authorization checks are activated.
• Corresponding roles need to be updated if these RFC function modules are included in your system’s S_RFC authorization.

References

• SAP Note 2008727 for additional information on RFC Security.
• SAP Note 2078596 on further improvements for RFC security.