Switchable authorization checks for RFC in Intellectual Property Management, SAP security note 2248790

SAP security note 2248790, "Switchable authorization checks for RFC in Intellectual Property Management". Below are the symptom and SAP recommended solution.

Description

Symptom

Remote Function Call (RFC) function modules in IPM are now protected with additional authorization checks using the S_RFC authorization object. This update addresses potential security gaps by limiting access to the necessary minimum authorizations required for users, ensuring that only authorized personnel can execute specific RFC functions.

Solution

The implementation involves activating new switchable authorization checks via transaction SACF. These checks are initially inactive to maintain compatibility with existing processes and can be enabled manually as needed.

• Use transaction SACF to verify if the scenario CRM_IPM_1 exists; if absent, download the CRM_IPM_1.txt file and upload it using transaction SACF_TRANSFER, then assign the scenario to the development package CRM_IPM_GENERAL
• In transaction SACF, convert the scenario definition to a productive scenario, choosing between Active or Logging status to activate authorization checks and enable logging to the Security Audit Log
• Identify and grant necessary authorizations to users based on audit messages using report RSAU_SELECT_EVENTS, and use system traces (STAUTHTRACE or ST01) for detailed analysis
• Update default authorization values for relevant RFC function modules in transaction SU22

References

• SAP Note 2008727