Best practice usage of system users for different RFC functions execution

Question

Hello experts,
Could you guys share your thoughts on RFC type 3 - system userid usage:
Would it be recommended to use ONE RFC destination (type 3) for execution of various functions?
Is it recommended using the different RFC destinations (type 3) (with different system user ids) depending on the functions execution?
Thanks in advance for your thoughts.
Thanks
Himadama

Answer 1

Thanks Julius for your information.
Option 1: System user id / password:
Password is sent over the network. But SNC control would take care of this.
1 destination = 1 system userid
If the useru2019s password is compromised the risk would be limited to that destination function group (RFC_NAME in S_RFC auth object)
System users only need RFC authorizations (S_RFC).
Only monitoring System users would be enough.
Better password management if required.
Option 2: u201CCurrent Useru201D option:
One user may need access for more than one function groups access ( RFC_NAME).
Compromising user's password would result more damage than the system user. Since this user has broad access to execute multiple function groups.
Monitoring these users would be overloaded job in this case becoz of increased users numbers. 
The management of authorizations (roles) to these users may require strict approval process.
Option 3: Trusted system option:
u2022          RFC_SYSID :                                                             
u2022          RFC_CLIENT:                                                          
u2022          RFC_USER  : ' '                                                                      
u2022          RFC_EQUSER: Y (for Yes)                                                              
u2022          RFC_TCODE : *                                                              
u2022          RFC_INFO  :                                                          
u2022          ACTVT     : 16                                                             
Seems user requires both the auth objects S_RFCACL and S_RFC in this case.
Compromising user's password would result more damage than the system user. Since this user has broad access to execute multiple function groups.
Monitoring these users would be overloaded job in this case becoz of increased users numbers. 
The management of authorizations (roles) to these users may require strict approval process.
Would you say considering the system userid/password is better option than other methods with SNC control in place? Please share your thoughts.
Thanks
Himadama