Switchable authorization checks for RFC in External List Management (CRM-MKT-EAL), SAP security note 2271802

SAP security note 2271802, “Switchable authorization checks for RFC in External List Management (CRM-MKT-EAL)”. Below are the symptom and SAP recommended solution.

Description

Symptom

Remote calls to RFC function modules were previously protected by checks on the authorization object S_RFC. However, it was identified that these checks might not be sufficient to ensure secure execution for certain RFC function modules within External List Management.

Solution

The SAP Note implements new switchable authorization checks that can be activated as needed. These checks are delivered inactive by default to maintain compatibility with existing processes. Here’s how to implement and activate the new authorization checks:

• Step 1: Create the authorization scenario definition in your landscape. Use transaction SACF to check for the existence of CRM_MKT_EAL_1. If not present, download the CRM_MKT_EAL_1.TXT attachment and upload it via transaction SACF_TRANSFER. Assign the scenario definition to the development package CRM_MKTLIST_ADMIN.
• Step 2: Create the productive authorization scenario. In transaction SACF, select the scenario definition and transfer it to a productive scenario. Choose the initial scenario status (Active or Logging).
• Step 3: Activate logging of SACF relevant audit messages in the Security Audit Log. Ensure Security Audit Log is active in transaction SM19. Activate message IDs DUO, DUP, and DUQ.
• Step 4: Adjust roles to provide necessary authorizations. Use report RSAU_SELECT_EVENTS to identify users needing authorization adjustments. Analyze audit messages DUO and DUP.
• Step 5: Maintain RFC Function Modules default values. In transaction SU22, check and add the authorization object CRM_LIST_H with default value (ACTVT=02) if it doesn’t exist.