Switchable authorization checks for RFC in Loyalty Management (CRM-LOY), SAP security note 2303421

SAP security note 2303421, "Switchable authorization checks for RFC in Loyalty Management (CRM-LOY)", is a program error note released on 11.10.2016. Below are the symptom and SAP recommended solution.

Description

Symptom

This SAP note introduces new switchable authorization checks for RFC function modules in Loyalty Management (CRM-LOY). Remote calls to RFC function modules are secured by checks on the authorization object S_RFC, which should be limited to the minimum required authorizations to ensure system security. However, it was identified that S_RFC authorization checks alone might not suffice for secure execution of certain RFC function modules in this component. Therefore, new switchable authorization checks have been implemented and can be activated to enhance security.

Solution

New switchable authorization checks have been delivered inactive to maintain compatibility with existing processes. To implement the security enhancements:

• Activate the new authorization checks in transaction SACF as per the attached manual correction instructions. Refer to SAP Note 1922808 for additional information on the switchable authorization check framework (SACF).
• Open transaction SACF and verify if the scenario definition “CRM_LOY” exists. If it doesn’t exist, upload the scenario definition file via transaction SACF_TRANSFER.
• Create a productive authorization scenario from the scenario definition in SACF, choosing the initial scenario status as Active or Logging based on your requirements.
• Activate logging of SACF relevant audit messages in the Security Audit Log using transaction SM19. Ensure message IDs DUO, DUP, and DUQ are activated.
• Adjust user roles to provide necessary authorizations based on the new authorization scenario. Use report RSAU_SELECT_EVENTS to identify and analyze users requiring additional authorizations.

Affected RFC function module: CRM_MKTPL_LOY_PROGRAM_READ_RFC, scenario CRM_LOY, Auth. Object CRM_LOY, Param1 ACTVT=03.

References

• 2236076 – Architectural change to avoid syntax errors when calling CL_RFC=>CHECK_EXTERNAL and CL_SACF=>AUTH_CHECK_SPEC (Component: CRM-BTX)
• 2261048 – Removing RFC flag (Component: CRM-LOY)