When doing BW Extractions can ALEREMOTE bypass authorizations?

Question

I was sitting in a meeting today about how a consultant wanted/required access to every table in R/3 for his BW extraction.  My first response was no and he said that if they had access to ALEREMOTE they could extract all tables.  I explained that ALEREMOTE did not have access to all tables either and he said that using this ID allows them to do extractions without doing any authorization checks.
I've been searching SAP Marketplace  and  SNC for this information but have not found any data to back this up.  My assumption is that he assumed ALEREMOTE had SAP_ALL (which it doesn't).  Has anyone ever come across an issue with ALEREMOTE bypassing authorization checks?
Edited by: Bree Woodruff on Jun 9, 2011 9:00 PM

Answer 1

My assumption is that he assumed ALEREMOTE had SAP_ALL (which it doesn't).
Sounds like this is the case, however note that S_TABU_DIS is an application layer control and if not coded then there is no check.
More likely is that reporting authorizations were not checked on the BW side for developer access to the DSOs, but analysis authorizations now are.
Anyway... my recommedation would be to break all RFC connections from non-PROD to PROD systems and restrict his authorizations in BW PROD system (e.g. only use applications, and not the test environment of SE37 etc (see SAP note 587410). That way there is a client side restriction, even although the destination does have some powers...
Cheers,
Julius
ps: ALEREMOTE is a configuration default. You can change it and hardcoding of a user ID would be a bug.
Edited by: Julius Bussche on Jun 13, 2011 9:32 PM