Switchable authorization checks for RFC in FI-FM and PSM-FM, SAP security note 2029077

SAP security note 2029077, “Switchable authorization checks for RFC in FI-FM and PSM-FM”, is a note. Below is the security information published by SAP for this note.

Description

This SAP Note introduces new switchable authorization checks for RFC function modules in Funds Management (FI-FM) and Public Sector Management Funds Management (PSM-FM).

Symptom

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. However, it was identified that S_RFC authorization checks might not be sufficient to ensure secure execution for certain RFC function modules in FI-FM and PSM-FM.

Solution

New switchable authorization checks have been implemented and are delivered inactive to ensure compatibility with existing processes. To activate these checks, follow the steps below:

### Step 1: Create Authorization Scenario Definition 1. Check Scenario Definition:

• Start transaction SACF in the development system.
• Verify if the scenario definition (e.g., PSM_MASTERDATA) exists.

2. Download Scenario Definition (if not present):

• Download the corresponding .txt file attached to this note from SAP Notes.

3. Upload Scenario Definition:

• Start transaction SACF_TRANSFER.
• Select the radio button "Upload".
• Choose the work area "Scenario Definition".
• Deselect work areas "Productive Scenarios" and "Test Mode".
• Execute (F8) and upload the downloaded .txt file.

4. Assign to Development Package:

• Assign the scenario definition to the development package FMBS.

### Step 2: Create Productive Authorization Scenario 1. Transfer to Productive Scenario:

• In transaction SACF, select "Scenario Definition" and execute.
• Double-click on the scenario definition and press the "Scenario" button (or press F5).

2. Set Scenario Status:

• Choose the initial scenario status:
• Active: Activates the authorization check and logging to Security Audit Log.
• Logging: Activates logging to Security Audit Log without enforcing authorization checks, allowing identification of users requiring specific authorizations.

### Step 3: Activate Logging in Security Audit Log 1. Ensure Security Audit Log is Active:

• Check transaction SM19 → Environment → Profile parameter (or the "Kernel Parameters" tab).

2. Create a New Filter:

• In the active, static Security Audit Log configuration, create a new filter:
• Other events – Non-Critical: DUO (Authorization check successful), DUP (Authorization check failed).
• Other events – Critical: DUQ (Active scenario changed).

3. Activate the New Filter.

### Step 4: Adjust Roles 1. Identify Users Requiring Authorizations:

• Use report RSAU_SELECT_EVENTS to identify users needing authorizations based on audit messages DUO and DUP.

2. Update Roles Accordingly:

• Provide necessary authorizations to users based on the identified requirements.

References

• SAP Note 2078596
• SAP Note 2032723
• SAP Note 2064102