RS_ABAP_SOURCE_SCAN
RFC interfaces
After clicking on this button, you will see the current ZBV status in the area of the same name and can release the selected system from the ZBV via the Run button. ZBV is no longer active for this subsidiary system. To avoid inconsistencies in the user master kits, you must reconcile the users in the daughter system after the ZBV is activated. You can do this in the transaction SCUG and transfer user data from the subsidiary system to the central system. Information on the technical requirements can be found in SAP Note 962457. To disable the ZBV completely, use the RSDELCUA report or the Delete button in the transaction SCUA. With this function you have the possibility to delete either only certain subsidiary systems from the ZBV or the complete ZBV.
Now the SAP system is basically able to encrypt emails. However, the system still lacks the recipient's public key. You can manage the required public key information in the Trust Manager's address book. You can find the address book in the Transaction STRUST menu under Certificate > Address Book. Here you can import individual certificates by selecting the corresponding certificate in Certificate > Import Certificate. To get the certificates for all relevant users in this address book via a mass import, use the example programme Z_IMPORT_CERTIFICATES appended in SAP Note 1750161 as a template for a custom programme.
SAP FICO Authorizations
In an SAP® system, authorizations are not the only focus of the auditor. Essential system parameters are also part of the audit. For this reason, it should also be ensured in advance that all parameters are set up in accordance with the company's specifications. The parameters concerned are all those that ensure system and client security. Among other things, it must be ensured that the production system is protected against any kind of changes and therefore no direct development is possible.
If you have created your own applications, we recommend that you always implement your own permission check and do not just rely on application startup permissions such as S_TCODE, S_START, S_SERVICE, and S_RFC. If you want to add your own checks to standard applications, you must first find the appropriate place to implement the check. To develop without modification, SAP offers user-exits or business add-ins (BAdIs) for such cases. Some SAP applications also have their own frameworks in place that allow customisation-free implementation of their own permission checks, such as the Access Control Engine (ACE) in SAP CRM.
During go-live, the assignment of necessary authorizations is particularly time-critical. The "Shortcut for SAP systems" application provides functions for this purpose, so that the go-live does not get bogged down because of missing authorizations.
You can also find some useful tips from practice on the subject of SAP authorizations on the page www.sap-corner.de.
Both the validity of the initial password and the maximum value for password login errors are set using profile parameters.
S_DATASET authorization object: The permissions for the access type, file name, and calling programme are checked.