Switchable authorization checks for RFC in FS-CD, SAP security note 2026641

SAP security note 2026641, "Switchable Authorization Checks for RFC in FS-CD", is a note. Below are the symptom and the SAP recommended solution.

Description

Symptom

Previously, remote calls to RFC function modules were secured using the S_RFC authorization object. However, this method might not have been sufficient for certain RFC functions, potentially compromising system security.

Solution

Activate the new switchable authorization checks in transaction SACF. These checks are inactive by default to maintain compatibility with existing processes. After activation, update the relevant roles if the RFC functions are included in S_RFC authorizations.

New authorization scenarios introduced:

• VVINFO_BFREE – determines benefit-free periods. Authorization objects F_KKVK_BUK, F_KKVK_VKT, F_KKVK_BEG with ACTVT = ’03’ (Display).
• VKKITA_RESETTTAX – changes processing status for correcting obsolete tax documents. Authorization objects F_KKVK_BUK, F_KKVK_VKT, F_KKVK_BEG with ACTVT = ’02’ (Change).
• VIOBPAR_RE_GET – determines DIMAIOBPAR_RE entries of the insurance object. Authorization objects I_INS_OBJ, I_INSO_GRP with ACTVT = ’03’.

References

• SAP Note 2078596 – Further improvements for RFC security
• SAP Note 1624291 – Syntax error when implementing a security note