Switchable authorization checks for RFC in Payroll, Time Management and ESS/MSS (SAP_HR), SAP security note 2046243

SAP security note 2046243, “Switchable Authorization Checks for RFC in Payroll, Time Management, and ESS/MSS”, is a program error note released on 11.11.2014. Below is the security information published by SAP for this note.

Description

This SAP security note introduces new switchable authorization checks for RFC function modules in Payroll, Time Management, and ESS/MSS. These checks enhance system security by ensuring that remote calls to RFC function modules are protected by the authorization object S_RFC.

Key Details:

• SAP Note Number: 2046243
• Type: SAP Security Note
• Released On: 11.11.2014
• Category: Program error
• Priority: Correction with medium priority
• Status: Released for Customer
• Component: Personnel Management > Personnel Administration > General Parts

Affected Business Processes and Roles:

1. Payroll

• Scenario: HR_PY: Authorization Check Payroll
• Business Process: Reading of Payroll results.
• Affected RFC Function Modules:
• HR_GET_CONVERSION_DATA
• RP_IMPORT_GARNISHMENT_LIST

2. Time Management

• Scenario: HR_TIM: Authorization Check Time Management
• Business Process: Reading of Time management data.
• Affected RFC Function Modules:
• BAPI_PTMGREXTTIMESPEC_GETSTATU
• HRTIM_AA_DOC_READ
• HR_TIM_READ_WFM_DATE

3. ESS/MSS

• Scenario: HR_XSS: Authorization Check ESS/MSS
• Business Process: Reading of MSS data.
• Affected RFC Function Modules:
• RP_GET_PERNR_FROM_USERID
• CRIF_GET_EMPLOYEE_FOR_USER

Solution

To activate the new switchable authorization checks, follow these steps:

1. Download the SAP Note:

• Download for SNOTE
• PDF Version

2. Implement Switchable Authorization Checks:

• Step 1: Create the authorization scenario definition in systems where they do not exist yet.
• Use transaction SACF to check and upload scenario definitions (HR_PY, HR_TIM, HR_XSS) using the attached .txt files.
• Step 2: Create the productive authorization scenario from the scenario definition.
• In transaction SACF, transfer the scenario definition to a productive scenario and choose the initial status (Active or Logging).
• Step 3: Activate logging of relevant audit messages in the Security Audit Log.
• Ensure Security Audit Log is active in transaction SM19 and configure the necessary filters.
• Step 4: Adjust your roles to provide the necessary authorizations.
• Use report RSAU_SELECT_EVENTS to identify and adjust user authorizations accordingly.

References

• SAP Note 2078596
• SAP Note 2188986