Switchable authorization checks for RFC in SD, SAP security note 2023693

SAP security note 2023693, "Switchable authorization checks for RFC in SD", is a note released on 11.11.2014. Below are the symptom and the SAP recommended solution.

Description

Symptom

Remote calls to RFC function modules in SD are currently protected by checks on the authorization object S_RFC. However, these checks may not be sufficient to ensure secure execution, as many RFC function modules do not perform additional functional authorization checks.

Solution

The SAP Note outlines the implementation of new switchable authorization checks that are initially inactive to ensure compatibility with existing processes. These checks can be activated via transaction SACF. The implementation involves the following steps:

• Create the authorization scenario definition: use transaction SACF to verify if the scenario definition (e.g., SD_RFC_CUST) exists. If not, download the corresponding .TXT file from the SAP Note attachments. Upload the file using transaction SACF_TRANSFER and assign it to the appropriate development package.
• Activate the productive authorization scenario: in transaction SACF, select the scenario definition and transfer it to a productive scenario. Choose the initial status as “Active” (activates both the authorization check and logging to the Security Audit Log) or “Logging” (activates logging only, allowing authorization checks to pass temporarily for identifying required authorizations).
• Configure Security Audit Log: ensure that the Security Audit Log is activated via transaction SM19. Create and activate a new filter to capture relevant audit messages: non-critical successful and failed authorization checks (DUO, DUP); critical changes to the active scenario (DUQ).
• Adjust user roles: use report RSAU_SELECT_EVENTS to identify users needing additional authorizations. Update roles accordingly to comply with the new authorization scenarios.

References

• SAP Note 2078596 – Further improvements for RFC security