Switchable authorization checks for RFC in Internet Sales, SAP security note 2265976

SAP security note 2265976, “Switchable authorization checks for RFC in Internet Sales.” Below are the symptom and the SAP recommended solution.

Description

Symptom

SAP Note 2265976 introduces new switchable authorization checks for RFC function modules in Internet Sales, enhancing the security of remote calls by refining the authorization object S_RFC. This ensures that only users with the minimum required authorizations can execute specific RFC functions, mitigating potential security risks.

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. However, these checks might not be sufficient to ensure secure execution for certain RFC function modules in Internet Sales.

Solution

Activate the new switchable authorization checks in transaction SACF. The checks are delivered inactive by default to maintain compatibility with existing processes. Follow these steps to implement the solution:

• Create the authorization scenario definition: start transaction SACF and verify if the scenario definition “CRM_ISALES_1” exists. If not, download the CRM_ISALES_1.txt file attached to this note, then use transaction SACF_TRANSFER to upload and assign the scenario definition to the development package “CRM_ISALES”.
• Create the productive authorization scenario: in SACF, select “Scenario Definition” and execute, then transfer the scenario definition to a productive scenario by setting the status to “Active” or “Logging”.
• Activate logging of SACF relevant audit messages in the Security Audit Log: ensure Security Audit Log is activated in transaction SM19, and activate message IDs DUO, DUP, and DUQ in the static Security Audit Log configuration.
• Adjust roles to provide necessary authorizations: use report RSAU_SELECT_EVENTS to identify users requiring additional authorizations, and analyze audit messages DUO and DUP to update user roles accordingly.