Switchable authorization checks for RFC in FI-AP-AP, SAP security note 2030997

SAP security note 2030997, "Switchable authorization checks for RFC in FI-AP-AP", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. However, it was identified that S_RFC authorization checks might not be sufficient to ensure secure execution for RFC function modules covered by this note. This necessitates the activation of new switchable authorization checks to enhance system security.

Solution

New switchable authorization checks have been implemented and are delivered as inactive to maintain compatibility with existing processes. To activate these checks:

• Technical Implementation: upload the scenario definition using transaction SACF_TRANSFER and assign it to the development package WLIF.
• Activation: use transaction SACF to create a productive authorization scenario from the scenario definition; choose between "Active" or "Logging" statuses to activate the checks and configure logging as needed.
• Post-Activation Steps: activate logging of relevant audit messages in the Security Audit Log using transaction SM19, and adjust user roles to include the necessary authorizations based on the new authorization scenario.

Reason and prerequisites

Ensure that remote calls to RFC function modules are limited to the required minimum authorizations.

Existing authorization object S_RFC checks might not fully secure certain RFC function modules.

Relevant prerequisites include having the appropriate SAP_APPL and SAP_BASIS components installed as specified in the note.

References

• SAP Note 2078596 – Further improvements for RFC security