Switchable authorization checks for RFC in CRM-Sales of Subscription based Series, SAP security note 2276601

SAP security note 2276601, "Switchable authorization checks for RFC in CRM-Sales of Subscription based Series". Below are the symptom, reason and prerequisites and SAP recommended solution.

Description

Symptom

Remote calls to RFC function modules are currently protected by checks on the authorization object S_RFC. However, it has been identified that these checks might not be sufficient to ensure secure execution for certain RFC function modules in the Sales of Subscription based Series. This could potentially allow unauthorized access or actions within the system.

Solution

New switchable authorization checks have been implemented and delivered inactive by default to ensure compatibility with existing processes. These checks can be activated using transaction SACF. Detailed manual correction instructions are provided within the note.

Affected business processes and roles: payment processing of Subscription based Series Sales. Affected RFC function modules:

• CRM_MPS_DECODE_REF_NUMBER
• CRM_MPS_PAYMENT_PROCESSING
• CRM_MPS_ORDER_PAYER_GET

To implement the switchable authorization check: ensure the scenario definition CRM_ISM_MPS exists in SACF; if not, upload it using transaction SACF_TRANSFER and assign it to the development package CRM_MEDIA_SALES_SERIES. Then create the productive authorization scenario and activate the switchable authorization checks. Refer to SAP Note 1922808 for detailed instructions on activating the checks and ensuring all required authorizations are in place.

Reason and prerequisites

To maintain system security, authorizations for S_RFC should be limited to the minimum necessary for all users. While many RFC function modules are adequately protected using S_RFC authorization checks, some do not perform additional functional authorization checks. Activating the new switchable authorization checks will provide an extra layer of security for these functions.

References

• SAP Note 2008727 – RFC Security
• SAP Note 1922808 – Switchable Authorization Check Framework (SACF)
• SAP Note 2236076