Switchable Authorization checks in SAP Supplier Relationship Management, SAP security note 2877226

SAP security note 2877226, “Switchable Authorization checks in SAP Supplier Relationship Management”, released on March 12, 2020. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

S_RFC authorization checks are insufficient for secure execution of RFC function modules covered by this note. New switchable authorization checks have been implemented for RFC function modules in SAP Supplier Relationship Management (SRM).

Solution

Activate the new switchable authorization checks via transaction SACF. The checks are inactive by default to ensure compatibility and can be enabled as needed. Follow these high-level steps:

• 1. Create Authorization Scenario Definition:
  • Use transaction SACF.
  • If scenario BBP_PUR_REQ doesn’t exist, download the attached BBP_PUR_REQ.TXT file.
  • Use transaction SACF_TRANSFER to upload the scenario definition.
  • Assign it to the development package BBPA.
• 2. Create Productive Authorization Scenario:
  • In SACF, select the scenario definition and set it to “Active” or “Logging”.
  • Use report RSAU_SELECT_EVENTS to identify users requiring authorizations.
• 3. (Optional) Activate Logging of SACF Relevant Audit Messages:
  • Ensure Security Audit Log is active via transaction SM19.
  • Activate message IDs DUO, DUP, and DUQ in the Security Audit Log configuration.
• 4. Adjust Roles:
  • Update roles to include the necessary authorizations based on the authorization scenario.

Additional support packages and patches are available for various software components and versions. Refer to the Support Package section in the note for detailed information.

Reason and prerequisites

Remote calls to RFC function modules are protected by S_RFC authorization checks, which should not be deactivated. This note introduces new switchable authorization checks to enhance security. Ensure that authorization for S_RFC is limited to the minimum required to maintain system security. Refer to SAP Note 2216306 for recommended settings of profile parameter auth/rfc_authority_check and the white paper “Securing Remote Function Calls (RFC)” attached to SAP Note 2008727 for more information.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected components

• SAP_APPL (Releases 600 to 618)
• S4CORE (Releases 100 to 104)