Switchable authorization checks for RFC in Environment, Health & Safety, SAP security note 2013153

SAP security note 2013153, “Switchable Authorization Checks for RFC in Environment, Health & Safety”, is a note. Below is the security information published by SAP for this note.

Description

Symptom

The system currently protects against unauthorized calls to RFC function modules using checks against the authorization object S_RFC. However, for certain RFC function modules in EHS, these checks alone are insufficient to guarantee secure execution as they often perform no additional authorization checks.

Reason and prerequisites

To ensure robust security, the authorizations for S_RFC must be minimized for all users. The new authorization checks address the shortcomings by implementing additional security layers for specific RFC function modules. This requires activating the new checks in transaction SACF and adjusting corresponding roles accordingly.

Solution

New Authorization Checks: The security note introduces several new authorization scenarios, each targeting specific business processes and function modules within EHS. These scenarios are delivered in inactive form to prevent disruptions to existing processes.

Activation Steps: 1. Load Scenario Definitions:

• Use the attached .TXT files provided in the SAP Note to load the new authorization scenarios into your system via transaction SACF_TRANSFER.

2. Create Productive Scenarios:

• Convert the loaded scenario definitions into productive scenarios using transaction SACF.
• Choose between "Active" or "Logging" status:
• Active: Activates authorization checks and logs successful and failed attempts.
• Logging: Only logs attempts without enforcing authorization checks, useful for identifying required authorizations.

3. Enable Audit Logging:

• Ensure the security audit log is active by configuring it in transaction SM19.
• Activate relevant message IDs (DUO, DUP, DUQ) to monitor authorization checks.

Implementation Instructions: Detailed step-by-step correction instructions are included in the SAP Note and can be accessed here.

References

• 2078596: Further improvements for RFC security
• 2008727: Securing Remote Function Calls (RFC)
• 1988903: Check whether a function module was called via external RFC