Is S_RFCACL a critical Authorization Object ?

Hi All,
As we know that S_RFCACL (Authorization Check for RFC User (e.g. Trusted System)) is required for having access to the trusted systems.
In most of our roles for this authorization Object we have maintained the * value for the following fields:-
RFC_SYSID
RFC_TCODE
This has been made as an observation by the auditors as having this critical access with the users.
But my question is how can it be the critical access when the user should have id's in both the systems(trusted and trusting) to login to the called system.
Also even if the user logs into the called system he will only be able to execute the list activities/t-codes that he is authorized to in that system, it will override the * value maintained in RFC_TCODE.
What possibly could be the risk from this authorization object ?
Regards,
Parichay

Parichay Jain wrote:
In most of our roles for this authorization Object we have maintained the * value for the following fields:-
RFC_SYSID
RFC_TCODE
This has been made as an observation by the auditors as having this critical access with the users.
The object itself is certainly critical, but as you stated the trust itself has to have been setup at the system level for the authorization to be going anywhere.
These two fields are in all honesty only irritating and you can successfully defend putting a * into them.
RFC_SYSID values for a role means you unit test a role in DEV, integration test in in QAS and then use it live in PROD. Additionally the field RFC_INFO is actually the installation number and you can be fairly sure that will be the same in the landscape. So only adding the pairs of production system IDs means you cannot test the same roles, which is a bit silly.
RFC_TCODE is even sillier. The generic RFCs for starting transactions (eg. ABAP4_CALL_TRANSACTION) check the transaction code themselves again and that is then user specific roles relating to their job functions. Restricting S_RFCACL additionally in a system role (eg. common role for all users) means that you must double-discriminate against all possible transactions which can be called via RFC and list them all there and maintain the list. But the check happens later again and the application authorizations in the transaction are generally checked as well. Waste of time.
@ Alex: The RFC_EQUSER = Y field only means that if the calling and called user ID names are the same, then the field RFC_USER is not checked and therefore does not have to be maintained. But it is often misunderstood and the field RFC_USER gets a * value as well (which is where the real music is..) and the EQUSER setting has no further affect. Technically, it actually weakens the authority-check on the user field - which is correct because otherwise you have to maintain it and end up with personalized roles, which is most silly of all.
So you can quite safely tell you auditor that Julius agrees with you and they are barking up the wrong tree.. :-)
Cheers,
Julius

Similar Messages

BI authorization objects not appearing in RAR, error while generating role

Hi
I am facing certain problems relating to integration of BI module version 7 with GRC Access Controls version 5.3 and support package 06. I am describing the problems in details below:
(a) In Risk Analysis and Remediation (RAR) component, I am creating Functions and
      Risks for Business Intelligence (BI) module. For that I have downloaded the
      descriptive text and authorization object data from BI development system and
      uploaded the same in RAR. Then I have created 2 Function Ids DBI1 (having action
      RSA1) and DBI2 (having actions RSA11, RSA12, RSA13, RSA14, RSA15) and 1
      Risk Id for BI (having Function Ids DBI1 and DBI2) in RAR. But when I checked
      the permission tabs of the Function Ids DBI1 and DBI2, I could not find any
      authorization objects for the actions in them.
(b) In Enterprise Role Management (ERM), when I am trying to create a Role TEST-BI
       in DBI 100 and I put the BI transaction codes in authorization data , I get the
       authorization objects . Risk analysis is also being done successfully. But at the time
       of Role generation in background mode , it is giving an error message :
       Error generating role TEST-BI for system DBI 100: Unable to interpret * as a number.
       I am thus unable to generate any role in DBI 100.
(c) In Compliance User Provisioning (CUP), I have imported a standard role from DBI
      100. Then I have added Functional Area, Business Process, Subprocess and
      Criticality Level to this role in CUP. But when I try to assign this Role to an user, it
       gives an error Error creating request. But requests are getting created and roles are
       being assigned to users in ECC development systems using the same Initiator, CAD, stage
       and path.
Can anyone please help me ?

-

Authorization object for terms of payment in VA01

Dear Gurus,
we want that term of payment field on sale order should be in display mode for all user except authorised user, who has /have authority to change terms of payment.
Requirement
Authorization object (display, change) for terms of payment field at sale order creation and change level
whether object is available in stadard or ABAP solution, please advice
BR
sajida

Hi
Two suggestions:
1. In customizing, for credit managament, in tcode OVA8 you can lock the document in you change this field (see the helps for the flag 'critical fields')
2. Manage it with user-exits becuase if you run SU24 for tcode VA01, I cannot find any auth.object related with this field. See SAP Note 178328 - Problems due to incorrect user exits in SD for further information
I hope this helps you
Regards
Eduardo

Prompt for Authorization Object

Dear Experts,
I would like to have control on certain authorization objects which are common among the roles while creating them.
Is it possible that while maintaining or creating a role, if by mistake the administrator does not block the object OR add an entry which we do not authorize, the system should alert the administrator as a popup or alert message?
I am aware about the report "RSUSR008_009_NEW" for maintaing critical authorizations, however, running a report and giving a prompt are two different things.
Any possibility of an alert?
Thanks and Regards,

Hi J K
I take the following approach with SU24:
Complete Proposal - completely maintain an authorisation proposal when that values applies for any situation in PFCG role build. E.g. transaction FB03 for object F_BKPF_BUK has fields ACTVT and BUKRS. You can allow the value as ACTVT = 03 and BURKS = $BUKRS (org value) or each scenario
Partial Proposal - only maintain some of the fields where it will be consistent. E.g transaction OB52 for posting periods and S_TABU_DIS with field ACTVT and DIBERCLS. You leave ACTVT blank as sometimes you want change whilst DIBERCLS for auth group is static so you can enter a value there
Empty Proposal - leave the proposal values completely blank as the requirement will depend on the scenario. E.g transaction SM30 you might leave S_TABU_DIS empty as it will depend on the role for both fields.
If you take this approach, you minimise the need for deactivating object, copying/changing and manual objects in PFCG. You maximise role authorisation under status of Standard or Maintained.
Now if we set the proposals in su24, it will be applicable for other new roles as well for which we DO want the proposals to exist.
Yes if you change SU24 you should clean up all impacted roles but before you build roles you should review
At the end of the day your need to have competent security administrators who know what a display activity is and have attention to detail/meticulous enough to build the role with appropriate restrictions (i.e. do not put change access in a display role).
How can we avoid the "new authorizaiton objects" to be added to this display role.
To avoid this you are trying to avoid using SU24 integration. If you are tying to build a SAP display all role then you might as well copy SAP_ALL and go through and deactivate/remove any display access from the role. In this case you would not use the role menu.
Not all solutions are technical. It's why you need to have a clearly defined process that is adhered to.
My trick of display roles - I got the AGR_1251 role and look at the entire contents of the role and scan this list of objects and what's in the role. However, I do this as I know the objects relatively well and can identify the specific objects that are change/display but do not use ACTVT field (e.g. PLOG/P_ORGIN/P_PERNR)
Wonder why SAP prompts warning and errors messages doing a business/financial transaction and not security.
Exactly what would you want the system to prompt? How would SAP know what a display role is?
We noted that every time we add a t-code, the authorization object added is marked as "new" in the list. we jsut disable those and generate it
If you take this approach you cannot guarantee the transaction code will work. The user may need the underlying values and that is why SU24 has them marked as proposal.
My summary - defined your process to include a quality check after building a role and hire security administrators who know more than how to tick and click buttons in PFCG (i.e. they understand security objects and why some are sensitive).
Regards
Colleen

How to assign authorization objects to a cube

Hello,
My cube includes 0profit_ctr which is marked as authorization relevant. Still in RSSM my cube is not included in the list of infocubes for an authorization object (zprofit) linked to 0profit_ctr. I'm therefore not able to enable that authorization object for my cube. I have a few ODSs which are included in the list. Why is my cube missing? Is there something I must do to include it, or is it a bug?
When checking the infocube for authorization objects in RSSM this list is empty as well. I don't see any option to add authorization objects in that list.
I have read the following document:
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/b849e690-0201-0010-9b88-c00cca40736f
I'm using BW 3.5.
Regards,
Christoffer

Hi Christoffer,
In RSSM you will find a button "Update Check Status ( Authorization Objects, Info providers) ". After this update you should find your cube in the list.
Jaya

How to get all authorization objects for a certain authorization profile

Hi ABAP experts,
I have the following problem: for a certain authorization profile of a role (created with transaction PFCG) I would like to get all contained authorization objects: e.g. for the contained object PLOG I would like to know/read all corresponding parameter values.
So:
- where are these values stored (dictionary table)?
- is there already a FM or a report to read all authoriation values for a certain authorization profile?
Thanks in advance.
Best regards,
Oliver

Hi,
check the following it might useful for you:
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/a92195a9-0b01-0010-909c-f330ea4a585c
if helpful reward points are appreciated

Mass update to FILENAME field in S_DATASET authorization object

We are migrating to a new fileserver with a new hostname, and so I've been asked to update about 1900 instances of the S_DATASET authorization object for the new FILENAME value. I'd like to do this programmatically if possible.
What I've learned so far is that I need to update the value in table USR12, but the value is encoded. When I look at the table in SE16, I do not see the encoded value field. The value does show in UST12, but I'm told this is an unreliable table.
So I'd like to know..
1. How can I look at the value if not in SE16?
2. Is there an API I can use to encode/decode the value? If not, where is the specification on how to build it?
If this is better addressed in a different forum, which one should I try next?
Thanks,
Dan

Hi there,
Okay I started a few tests and made a bit of progress, but am running into the problem that if I don't check the authority first using the FM and want to test what happens when the user is not authorized, then the bugger dumps (as expected and mentioned in the note)...
But the behaviour as you have described:
>
> Path                   Saveflag Fs_noread Fs_nowrite Fs_Brgru
> =============================================================
> *                                 X         X            DUMY
> /temp/FI/..                       X         X            DUMY
> /temp/FI               X                                 FIFI
>
... is correct, and I found something interesting in the F1 on the spth-path field which explains this.
> Caution:
> - If you enter paths generically in the table SPTH, the most precise specification counts.
> - If you select the no-read or no-write fields in the table SPTH, this overrides the authorization group.
So, the DUMY is not needed as the check does not use it in those cases, and "/temp/FI/.." is anyway more specific than "*" so the system would have used it for DUMY anyway. But that is irrelevant... because if the begru field is empty in the FM, then the check is not performed.
So, the only check which is effective to protect the path, is:
Path                   Saveflag Fs_noread Fs_nowrite Fs_Brgru
=============================================================
/temp/FI               X                                           FIFI
... and the "fs_noread" and "fs_nowrite" flags should be understood as "no protectable authority to read" and "no protectable authority to write" and not the activity field which the authority is being checked against. This is coming from the S_DATASET check (which is already known at that time to the function module).
Using these flags, you can leave the entries in the table without having to delete them if you want to turn them off and on temporarily. Perhaps an "active / inactive" switch would have been clearer...
form CHECK_PERMISSION using ISPTH_HEAD type SPTH
                            MODE       type CLIKE
                            SUBRC      type SY-SUBRC.
data: ACTIVITY like AUTHB-ACTVT.
   SUBRC = 0.
   case MODE.
     when 'R'.
          ACTIVITY = '03'.
     when 'W'.
          ACTIVITY = '02'.
     when 'D'.
          ACTIVITY = '02'.
   endcase.
   if ISPTH_HEAD-FS_BRGRU <> SPACE. "Here it is... for BEGRU checks there must be a value...
      authority-check object 'S_PATH'
          id 'FS_BRGRU' field ISPTH_HEAD-FS_BRGRU
          id 'ACTVT'    field ACTIVITY.
       if SY-SUBRC <> 0.
          SUBRC = 3.
       endif.
   endif.
endform.
Cheers,
Julius

Authorization Object is not working when report is modified.

Hi BW Guru's
We have Company Code as Authorization Object .and we have 3 company Codes (xxxx,yyyy,zzzz).where the users under Company code xxxx are not supposed to view company code yyyy,zzzz data etc.
I modified an existing Report and transported to production.But the Authorization Object is not working for that report.The Report is defaultly displaying all the company codes data(xxxx,yyyy) for all the users.But for the other reports its(company code ) is working fine.
What could be the problem?Is theproblem in transporting the objects.But i transported all the objects inluding auhorization object.
Please send me the solution as it is very much urgent.
The solution will be def. awarded with full points.
Regards
Sanjay

hi Sanjay,
please don't post the same question again, check and response back from your previous thread
Re: Authorization Object is not working when report is Modified.
hope this helps.
would be nice if you reward for helpful answers to all of your previous postings, e.g
docs related to RRI

Report to check authorization object used in customized programs

Hi Guys,
An auditor came and he raised a question to us, he asked whether all of our customized transactions and programs are maintained with authorization checks? The question is how can we check what authorization objects are used for our customized programs and transaction codes? The developer did not maintain the objects used for that program in SU24 table. Is there a program or a report to show us all the authorization object used for a customised program or transaction? Example : T-code MIGO we can check in SU24 table for all the authorization object used. How do we check for customized tcodes? Please advise. Thanks!
Edited by: Jarod Tan on Nov 25, 2010 9:42 AM

Note that some programs are built in such a way that no (visible) auth check is necessary, or even desired at all.
To determine the necessity of an auth check, you should check that starting it has an entry point (tcode, rfc, service) which is appropriately restricted. The rest (whether and where and how a further check is evaluated) is entirely dependent to what the program actually does.
Well designed applications generally have centralized functions and methods, and the checks are in there or a "base check" they use.
Others again use the same in UI programming to determine the visibility of functions, to make the application more intuitive for the user. This on it's own is however not a sufficient auth check to rely on.
Code review is an art form!
Cheers,
Julius

Issue on authorization object

hi all,
in me52n transaction, in account assignment tab there is field called costcenter. its field name is kostl and strucutre is cobl. now i have requirement to create an authorization object on this costcenter. that is for example , if i try to make any changes in the cost center field it should allow me to do it. but if some others are using it should not allow them to make any changes. plz let me know the solution how to do step by step. points will be awarded . this is urgent requirement. plz reply fast.
thanking u in advance,
a.srinivas

Hi deniz,
Use this to set up the autherisation object
      AUTHORITY-CHECK OBJECT '<objectname>'
                      ID 'ID FIELD SY-UNAME.
      IF SY-SUBRC NE 0.
        MESSAGE S999 WITH 'You are not Authorised to change entries'.
        EXIT.
      ENDIF.
Inform the Basis team to assign the role only to ur id...so that no other person wil u autherized
Award points if useful
Regards
Gowri

Analysis Authorization Object not working

Hi Gurus,
I m working on BI 7.0, I have created an analysis authorization object zz_div for 0DIVISION characteristic.
For a given report i want a given user to view only data for '32' and '33' 0DIVISION.
I have followed the below steps but still the report shows all data instead of restricted one.
1)RSECADMIN -> Maintenance ->zz_div ->Create
2) Add 0DIVISION in Auth structure , and in details
I     EQ     32
I     EQ     33
3) Add 0TCAIPROV with I     EQ     0SD_C03
4) Add 0TCAACTVT, 0TCAKYFNM, 0TCAVALID, this having details as
I     CP     *
5) Then in User tab -> Assignment -> User -> Change-> Inserted ZZ_DIV-> Save
6) In Query created a Authorization variable(with no input prompt) and restricted 0DIVISION.
Following are the authorization object in that user's Role (Reporting Only)
S_RFC
S_TCODE
S_GUI
S_BDS_D
S_BDS_DS
S_OC_SEND
S_RS_AUTH - only having zz_div
S_RS_COMP
S_RS_COMP1
S_RS_ICUBE
S_RS_RSTT
S_RS_TOOLS
S_RS_PARAM
I have surfed lots of thread for this issue but not getting a solution
Tell me what i m missing in above or any additional setting need before creating analysis authorization
Edited by: Sonal Patel on Apr 18, 2009 8:10 AM

Hi
Thanks a Ton for ur reply
I have checked in SPRO : Analysis Authorization
where the authorization mode is " OLD obsolete Concept With RSR Authorization Objects "
We have to do the same in Production system .Can u please how its going to effect to others authorizations if change it to New Concept
Thanks
Sonal....

Authorization object for running a report in background

Good day experts,
I tried running a report in background, I choose immediately so that it doesn't have to be scheduled. But when I checked it in my own jobs, It remains at scheduled status. When I tried it on my admin account, It works and with status finished. It seems to be an authorization problem. What object could I be missing with my user account? I tried S_TCODE SMX and SP02 but still not working.
Thanks in advance!

Hi karshbax,
What you're looking for is authorization object S_BTCH_JOB. You need authorization for field JOBACTION = RELE.
In future use transaction SU53. It shows last error authorization error, so if this is authorization problem then after try of manual releasing of job you'll find in SU53 precise info what went wrong.
Best Regards
Marcin Cholewczuk

MRS - authorization objects (Multi Resource Scheduling)

Hello,
We are implementing MRS for a customer who does not have proper structural authorizations in place, and they would like to avoid using evaluation paths for the authorization check.
Is there a way to use cost centers to limit user access in MRS? We tried to use cost centers in auth. object MRSS/PB1, but it does not work.
Is it possible to modify the default MRS auth. objects and add some extra auth. fields? Would that auth. check work in planning board?
Is there any other way to limit user access in MRS planning board rather than using evaluation paths?
Thank you
Simon

Hi Simon,
I have checked the authorization objects related to MRSS in SU24 where I can see based on the T code. Did you find a way how to get relevant for SAP MRS only like the Resource Planner etc authorizations he need if you have found something like that please share.
Thank you

How to restrict provide to a single account(by authorization object)

Hello, i have two types of accounts.
Account range 1: 10000000 -19999999
Account range 2: 20000000 - 29999999
For range 1 i have assigned authorization group AUT1.
For range 2 i have assigned authorization group AUT2 (by transaction OB_GLACC12).
So the general idea is some users will have access only to group 1 , etc. i have used autorization object F_BKPF_BES in the role btw.
I have created 4 roles:
1) RANGE1_ALL (means user can create / modify delete GL from range 1)
2) RANGE1_DISP(means user can only disp GL from range 1)
3) RANGE2_ALL(means user can create / modify delete GL from range 2)
4) RANGE2_DISP(means user can only disp GL from range 1)
If i give RANGE1_ALL + RANGE2_DISP to the user, he can create/modify/delete for range1 and only display GLS from range2.
Now the problem is if i want user to create/modify/delete for range1 but only display a specific account from range 2 ; say GL 29999000.
Which authorization object can i use to specify the range 2 GL account directly?thx.

Hi,
The only option for you is to have a different authorisation object for that GL alone and assign it to the user. You dont assign RANGE2-DISPLAY object to that user.
From FS00, you have to change the Auth group of that specific GL.
Regards,
Mike

Error while generation of the Authorization object (

Hi Gurus,
I have created a Authorization object Z_CCTR3 for 0costcenter authorization.
but getting following error while generation of the Authorization object (type is Flat authorization)
"Error occurred when reading the data from DataStore object Z_CCTR3"
Any inputs will helpful...
Sonal.....

Hello everybody,
my problem is solved.For the UDConnect, whatever DATA SOURCES you create gets registered in a FUNCTION MODULE which has a capacity of only 99 enties, so to increase it implement the SAP NOTE 876340 - UDC Error available on SERVICE MARKET PLACE.
This problem occurs with BW version 3.5 level 17 or below.
Regards,
Priyanka
Edited by: Priyanka Joshi on Jun 10, 2008 11:03 AM

Is S_RFCACL a critical Authorization Object ?

Similar Messages

Maybe you are looking for