Switchable authorization checks for RFC in Biller Direct, SAP security note 2069588

SAP security note 2069588, “Switchable Authorization Checks for RFC in Biller Direct”, is a program error note released on 23.12.2014. Below are the symptom and SAP recommended solution.

Description

Symptom

This SAP note introduces new switchable authorization checks for RFC function modules in Biller Direct to enhance system security.

Solution

New switchable authorization checks are delivered inactive to maintain compatibility with existing processes. They can be activated using transaction SACF as outlined in the manual correction instructions included with this note.

New authorization scenario: Scenario 1, BD_COCODEDATA_CHANGE, defines authorization checks for changing Biller Direct company code data.

Affected business processes and roles: users editing and posting bank statements must possess the additional authorization F_ACT_EBPP.

Affected RFC function modules:

• APAR_EBPP_KNB1_EXT_ADD
• APAR_EBPP_KNB1_EXT_CHANGE
• APAR_EBPP_KNB1_EXT_DELETE
• APAR_EBPP_KNB1_EXT_GET
• APAR_EBPP_LAST_UPLOADED_INVID
• EBPP_APAR_CHANGE_PAYMENT_ADV
• EBPP_APAR_GET_PAYMENT_ADVICES
• EBPP_GET_COMMFLAGS
• EBPP_SET_COMMFLAGS
• R_FARMATCH_READ_ALL_FDKMAIL
• R_FDKUSER_READ_DATA

Reason and prerequisites

Remote Function Call (RFC) modules are traditionally protected using the authorization object S_RFC. However, it has been identified that S_RFC alone may not suffice for securing certain RFC function modules. This note provides additional authorization checks to ensure secure execution. Ensure that your system includes these RFC function modules in the S_RFC authorizations before activating the new checks.