Switchable authorization checks for RFC in IS-U, SAP security note 2026939

SAP security note 2026939, "Switchable Authorization Checks for RFC in IS-U", is a note. Below are the SAP recommended solution and the affected software components.

Description

Solution

The new authorization checks are delivered inactive to maintain compatibility. To activate them, follow the steps below using transaction SACF:

• Create authorization scenario definition: start transaction SACF and check for the scenario definition ISU_CA_GETLIST. If it doesn’t exist, download the attached file ISU_CA_GETLIST.TXT and upload it via SACF_TRANSFER. Assign the scenario ISU_CA_GETLIST to the development package EE03. Repeat for ISU_UCES_CA_GET_BANKDATA using ISU_UCES_CA_GET_BANKDATA.TXT and assign to EWEBIAC.
• Create productive authorization scenario: in transaction SACF, select the scenario definitions and transfer them to productive scenarios. Choose the initial status: “Active” (activates authorization checks and logs to the Security Audit Log) or “Logging” (logs attempts without enforcing checks, useful for identifying required authorizations).
• Activate Security Audit Log: ensure Security Audit Log is active via transaction SM19. Create a new filter for relevant audit messages: non-critical DUO (successful authorization), DUP (failed authorization); critical DUQ (changes to authorization scenarios).
• Adjust user roles: use report RSAU_SELECT_EVENTS to identify users needing additional authorizations. Update roles accordingly to comply with the new authorization scenarios.

References

• SAP Note 2078596: Further improvements for RFC security
• SAP Note 1624291: Syntax error when implementing a security note

Affected components

• IS-UT: Versions 600, 602, 603, 604, 605, 606, 616, 617