Switchable authorization checks for RFC in IS-T-CA, SAP security note 2023207

SAP security note 2023207, "Switchable authorization checks for RFC in IS-T-CA", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

While the S_RFC authorization object provides a layer of security for RFC function modules, it may not be sufficient for all scenarios within IS-T-CA. Certain RFC function modules require additional authorization checks to ensure secure execution.

Solution

New authorization scenario FKK_IST_TDATA controls access to telco reference objects in the IST_TDATA table, using authorization objects F_KKVK_BUK, F_KKVK_VKT, F_KKVK_BEG with ACTVT values: IST_TDATA_DELETE – 02 (Change), IST_TDATA_INSERT – 01 (Create), IST_TDATA_SEARCH – 03 (Display), IST_TDATA_UPDATE – 02 (Change).

• Create the authorization scenario definition: in transaction SACF, check if FKK_IST_TDATA exists. If not, download FKK_IST_TDATA.TXT, use transaction SACF_TRANSFER to upload the scenario definition, and assign it to development package IST30.
• Create the productive authorization scenario: in transaction SACF, transfer the scenario definition to a productive scenario, with status “Active” (activates authorization check and logging) or “Logging” (activates logging only, allowing authorization checks to pass for identification purposes).
• Activate logging in Security Audit Log: in transaction SM19, ensure Security Audit Log is active and create a new filter for relevant audit messages: non-critical DUO, DUP; critical DUQ.
• Adjust user roles: use report RSAU_SELECT_EVENTS to identify and adjust user authorizations based on audit messages and system traces (STAUTHTRACE or ST01).

Reason and prerequisites

Identified that S_RFC checks alone might not guarantee secure execution for specific RFC function modules in IS-T-CA. Ensure that the system meets the software component requirements listed for the affected components.

References

• SAP Note 2078596: Further improvements for RFC security
• SAP Note 1624291: Syntax error when implementing a security note

Affected components

• IS-UT: 600, 602, 603, 604, 605, 606, 616, 617