Switchable authorization checks for RFC in Rule Builder BRFplus, SAP security note 2255642

SAP security note 2255642, "Switchable authorization checks for RFC in Rule Builder BRFplus". Below are the symptom and SAP recommended solution.

Description

Symptom

Before applying this note, remote calls to RFC function modules were primarily protected by the S_RFC authorization object. However, this alone might not be sufficient to ensure secure execution for certain RFC function modules used in BRFplus.

Solution

The note implements new switchable authorization checks that are delivered inactive to maintain compatibility with existing processes. Administrators can activate these checks using transaction SACF.

• Use transaction SACF to check for the existence of the scenario definition CRM_FDT_1; if absent, download the CRM_FDT_1.TXT attachment and upload it via SACF_TRANSFER
• Transfer the scenario definition to a productive scenario in SACF, choosing Active or Logging status based on your security requirements
• Identify users requiring new authorizations using report RSAU_SELECT_EVENTS and update roles accordingly
• Use transaction SU22 to check and update authorization objects for the affected RFC function modules