Switchable Authorization Checks for RFC in IS-B-BCA, SAP security note 1988565

SAP security note 1988565, “Switchable Authorization Checks for RFC in IS-B-BCA”, is a note. Below is the security information published by SAP for this note.

Description

Symptom

This SAP note describes new switchable authorization checks for RFC function modules in IS-B-BCA.

Reason and prerequisites

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. Authorizations for S_RFC must be limited to the required minimum authorizations for all users to ensure system security. Many RFC function modules can be sufficiently protected using S_RFC authorization checks. These RFC function modules often do not perform additional functional authorization checks. Please see SAP Note 2008727 for further information on RFC Security.

It was identified that S_RFC authorization checks might not be sufficient to ensure secure execution for RFC function modules covered by this note. Activate new switchable authorization checks and update corresponding roles if these RFC function modules are included in S_RFC authorizations in your system.

Solution

New switchable authorization checks have been implemented. The checks are delivered inactive to ensure compatibility with your running processes. The checks can be activated in transaction SACF as described in the attached manual correction instructions.

#### New Authorization Scenario BKK_MISC – *BKK: Miscellaneous Authority Checks in RFC Enabled Function Modules*

This scenario includes the following authorization objects that might be checked if one of the function modules listed below are called by a customer application via external RFC, provided they are applicable:

• F_BKKA_ATT
• F_BKKA_BKA
• F_BKKA_BPG
• F_BKKA_GRP
• F_BKKA_PRG
• F_PROD_GRP
• S_TABU_DIS

#### Affected Business Processes, Integration Scenarios, and Users This scenario might be relevant to integration scenarios developed by customers which involve one of the function modules listed below.

#### Implementation of the Switchable Authorization Check The switchable authorization scenario is provided via support package. It can also be pre-implemented via the correction instructions in systems with older support packages.

#### Activation of the Authorization Check Follow the post-processing activities below to activate the authorization scenario.

Affected RFC Function Modules:

• BKK_PRODUCT_CHECK_FUNCTION
• BKK_RFC_BANKACCT_BKKRS_COMCODE
• BKK_RFC_PROFIT_AND_LOSS_GET
• BKK_RFC_COND_GET_BKK9ACC (no longer RFC enabled)
• BKK_RFC_COND_GET_BKK9ACC_ACC (no longer RFC enabled)