Security Note Cache refresh with user change, SAP security note 1232259

SAP security note 1232259, "Security Note: Cache refresh with user change", is a workaround of missing functionality note released on 07.09.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1606282.

In PI 7.10 and 7.11, the PI messaging user (for example, PIAPPLUSER, PIAFUSER) and the PI directory service user (PIDIRUSER) require a large number of authorizations due to the configuration of the central Web service. For security reasons, you want to reduce the authorizations to a minimum.

Solution

As of PI 7.30, you can perform the cache refresh in the background using a user change. Therefore, you require only one local user with extensive authorizations in the back end. You can reduce the authorizations of the other users.

In a new PI 7.30 or 7.31 installation, the required steps for this are automatically performed on the Integration Server. However, if you perform an update from 7.10 or 7.11 to 7.30 or 7.31, manual steps are required. To carry out the relevant configuration, you must be an XI administrator.

• Call transaction SXI_CACHE_CONFIG in the Integration Server client.
• Enter the name and password of the user that is to execute the cache refresh in the background (default value PICACHEUSER). The system creates the user with all the required authorizations if this user does not already exist. Otherwise, the settings of the user are checked. If required, you can adjust the authorizations of the user if they are incomplete by selecting the "Adapt Authorizations" option. In the second step, create an ABAP destination SAPXICACHE<client> for the user change. The destination points to the local system.
• If the configuration program reports errors when setting this up, correct the errors by following the relevant instructions.
• In the last step, you can remove the role SAP_BC_WEBSERVICE_PI_CFG_SRV from the relevant users, particularly affecting the technical XI users (messaging users and integration directory service users).

Reason and prerequisites

The users mentioned above can start a cache refresh and require extensive authorizations as a result.

References

Affected components

• SAP_BASIS 730
• SAP_BASIS 731