Switchable Authorization checks for RFC in FS-CD, SAP security note 2534991

SAP security note 2534991, "Switchable Authorization Checks for RFC in FS-CD", is released on August 27, 2019. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

S_RFC authorization checks are not sufficient to ensure secure execution of RFC function modules covered by this SAP Note. New switchable authorization checks have been implemented for RFC function modules in FS-CD to enhance security.

Solution

New switchable authorization checks are delivered inactive by default to maintain compatibility with existing processes. To enhance security, these checks can be activated using transaction SACF as outlined in the detailed manual correction instructions provided with this note.

• Create the Authorization Scenario Definition: Start transaction SACF in the development system. Verify if the scenario definition FSCD_MD_IO_RE exists. If not, download the attachment FSCD_MD_IO_RE.TXT and upload it using transaction SACF_TRANSFER. Assign the scenario definition FSCD_MD_IO_RE to the development package FSCDMAD_IO.
• Activate the Switchable Authorization Checks: After system updates, use transaction SACF_COMPARE to activate the required authorization checks. Follow SAP Note 1922808 for guidance on ensuring authorized users have the necessary permissions and how to activate the checks collectively.

Reason and prerequisites

Remote calls to RFC function modules are by default protected by checks on the authorization object S_RFC. However, these checks may not be adequate for certain RFC function modules. This SAP Note addresses these shortcomings by introducing new switchable authorization checks that must be activated and corresponding roles updated to ensure system security.

Prerequisites: ensure that authorization for S_RFC is limited to the required minimum for all users. Review SAP Note 2216306 for recommended settings of the profile parameter auth/rfc_authority_check. Refer to the white paper "Securing Remote Function Calls (RFC)" attached to SAP Note 2008727 for more information on RFC security.

CVSS

Score 6.3 Vector: CVSS:/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• 2828588 – Adding a business partner from FS-RI: Insurance object was not found (side effect of this note)

Affected components

• INSURANCE – Release 600 (SAPK-60030ININSURANC)
• INSURANCE – Release 602 (SAPK-60220ININSURANC)