The document discusses SAP authorizations and access management. It notes that while SAP systems have over 150,000 transaction codes, access is actually managed through around 1,000 authorization objects. If a user has access to a core authorization object, they have potential access to many transactions and functions. The document advocates simplifying authorizations by grouping them based on the types of master data, like vendor, customer, or material, rather than individual transactions. This allows for more flexibility in defining access policies at the data level rather than the transaction level. It also warns that authority checks can be disabled, leaving the system vulnerable.

1. SAP Authorizations:
Is it now difficult or easy?
Johan Hermans
CEO
johan.hermans@csi-tools.com
SAP Security 2014 – Protecting Your SAP Systems
Against Hackers And Industrial Espionage

2. ©CSItools.AllRightsReserved.
2
Johan Hermans
Licentiate commercial and financial sciences, 1992,
EHSAL, specialization accountancy
Certified Information Systems Auditor (CISA), 1997
Certified BBP mySAP.com Consultant, 2000
Certified SAP NetWeaver Security Consultant, 2004
Certified Information Security Manager (CISM), 2005
Certified in Risk and Information System Control
(CRISC) 2011
Founder of CSI tools in 1997
Assisted over 400 companies and organizations to
improve the access rights in SAP environments

3. ©CSItools.AllRightsReserved.
3
SAP authorizations
The basics of SAP authorizations are not understood
People make it way to complex
Let us start with some eye-openers

4. ©CSItools.AllRightsReserved.
4
Demonstration in SAP R/3
Parameter Transactions

5. ©CSItools.AllRightsReserved.
5
Demonstration in SAP R/3
You can post an A/P document with an A/R transaction

6. ©CSItools.AllRightsReserved.
6
Also with Enjoy transactions
You can post an A/P document with an A/R transaction

7. ©CSItools.AllRightsReserved.
7
Report Tree Transactions
Give Access
OB52: C FI Maintain Table T001B
S_ALR_87003642: IMG Activity: SIMG_CFMENUORFBOB52
PFCG: Role Maintenance
S_ALR_87003541: IMG Activity: ORIP_SU01
S_ALR_87003755: IMG Activity: SIMG_CFMENUORK1PFCG
S_ALR_87005766: IMG Activity: SIMG_CFMENUORKEPFCG
S_BCE_68000373: IMG Activity: PROF_GEN_PFCG
…

8. ©CSItools.AllRightsReserved.
8
Start transaction code SE37
Execute function module ‘SUPRN_INS_OR_DEL_PROFILE ‘
Enter user-id, profile (here SAP_ALL) to add and action
Required Authorizations or
S_TCODE = SE37
S_DEVELOP
ACTVT = 03, 16
OBJTYPE = FUGR
OBJNAME = SUPRN
Demonstration in SAP R/3

9. ©CSItools.AllRightsReserved.
9
Execute any ABAP, function module, …
via SM37
Start transaction SM37
Select a Job
Select a Step
Select a Program
GoTo Program
Other Object (Shift + F5)
Test (F8)

10. ©CSItools.AllRightsReserved.
10
Demonstration in SAP R/3
using RFC you can download all table content without SE16

11. ©CSItools.AllRightsReserved.
11
Two Core Elements in SAP Application Security
Key questions: Transaction codes Authorization Objects
How many … exist in an
SAP ECC 6.0 system?
Purpose?
Transaction codes Authorization Objects
Typical reply by security
administrators
20.000 A multiple of 20k
Purpose? To manage access rights To restrict on organizational
levels
Transaction codes Authorization Objects
Reality + 150.000 1.000
for “R/3” functionality
Purpose! Only first line of defense To manage access rights

12. ©CSItools.AllRightsReserved.
12
Manage with +1 000 SAP authorization
objects and not +150.000 transactions
9 for posting FI documents  F_BKPF_...
9 for vendor master data  F_LFA1_...
9 for customer master data  F_KNA1_...
24 for material master data  M_MATE_...
2 for payments  F_REGU_...
_____________________________________________
1.000 objects are grouped into  300
example: company code: BUKRS
your authorizations requirements
can be simplified into 300 one-liners

13. ©CSItools.AllRightsReserved.
13
+ 150 000 transaction codes: nobody can
know them all, which is THE risk
TSTCA check
S_TCODE:
transaction code check
!! only once !!
authority check on
authorization objects
command
field
DATA
tables
transaction
code
menu
ABAP
programs

14. ©CSItools.AllRightsReserved.
14
Most applications audit only on +500
transaction codes with a path defined
Data to be protected
User interface
Database server
Application ServerF-22
Program SAPMF05A
Authority Check F_BKPF_
ACTVT = 01 !
FB01
Program SAPMF05ATOP
150.000 possible
entries
300 kind of
objects
Million
combinations

15. ©CSItools.AllRightsReserved.
15
Authority checks are sequential: you
cannot tell which path will be followed!

16. ©CSItools.AllRightsReserved.
16
reveal inconsistencies: who has access to the
data, who can start transaction
Data to be protected
User interface
Database server
Application ServerF-22
Program SAPMF05A
Authority Check F_BKPF_
ACTVT = 01 !
FB01
Program SAPMF05ATOP
150.000 possible
entries
300 kind of
objects
Million
combinations

17. ©CSItools.AllRightsReserved.
17
find inconsistencies in what people can
do, did and can almost do
command
field
DATA
tables
transaction
code
menu
ABAP
programs
Confidentiality
Integrity
Availability
Authorizations ?
F_BKPF_*
FB01
F-22
ABAD
F-91
F.43
F.18
FB60
FB75
…
……

18. ©CSItools.AllRightsReserved.
18
Role Concept Challenges
Multiple
Users
need
Multiple
Transactions
Users need only
access to
Specific Data in
Display or
Maintenance
mode.
They use
Transactions to
get there.
SAP has some
100.000
Transactions
The Number of
Users can Vary
from 20
to 1.000.000
Average number of
Used Transactions
within a Company
Can Vary Over
Time from 2000
to 8000
600 users
3000
tcodes
Let’s make a case …

19. ©CSItools.AllRightsReserved.
19
Possible Scenarios : Extreme Cases
600 Users 3000 Transactions
Organizational Technical
600 Roles
3000 Roles
what where
12000 Roles
what where
what
1 role / transaction

20. ©CSItools.AllRightsReserved.
20
Possible Scenarios : 1 Role per User
Advantages Disadvantages
Technical
Easy to Build :
Group Transactions and
Create Role
Cannot Separate
“create for company code 1000” and
“display for company code 3000”
without breaking PFCG best practices
Functional
Nice Overview of all
Transactions per User
• Complex and often long interviewing
cycles
• Nightmare from
change management perspective
• unclear ownership
(access to multiple (sub)processes and
organizational data in one the role)
• SoD Rules Changes have
major impact on the roles
600 Users 600 Roles

21. ©CSItools.AllRightsReserved.
21
Possible Scenarios : 1 Role per Transaction
Advantage Disadvantage
Technical
Very Easy to build: put
each transaction in
separate role
• Huge Amount of Roles to initially
create and to maintain after data
restriction changes
• User cannot have not more than
300 assigned roles (*)
Functional
Very Transparent ;
all is at user
assignment level
• Heavy User Request Procedure:
user needs to request 300 to 400 roles
and does not have this knowledge
(*) Simplified: real limit is 312 profiles in user-id
3000 Transactions 3000 Master Roles

22. ©CSItools.AllRightsReserved.
22
Possible Scenarios : Solution in Between
600 Users 3000 Transactions
Organizational Technical
600 Roles
3000 Roles
what where
12000 Roles
what where
what
1 role / transaction
what where

23. ©CSItools.AllRightsReserved.
23
Possible Scenarios :
Intermediate Conclusion
A SAP role concept is built
based on the technical view
Grouping of
transactions
is needed
A SAP role concept is built
based on the organizational
view
Roles should be
transparent for
business,
easy-to-manage and
flexible
Intelligent grouping of transactions
and authorizations is needed

24. ©CSItools.AllRightsReserved.
24
Try to Group 2 Transaction Codes in 1 Role
FK01 FB03
F_LFA1_APP ACTVT 01
F_LFA1_APP APPKZ F
F_LFA1_BUK ACTVT 01
F_LFA1_BUK BUKRS $BUKRS
F_LFA1_GEN ACTVT 01
F_LFA1_GRP ACTVT 01
F_LFA1_GRP
F_BKPF_BUK ACTVT 03
F_BKPF_BUK BUKRS $BUKRS
F_BKPF_KOA ACTVT 03
F_BKPF_KOA KOART K
F_LFA1_APP ACTVT 01
F_LFA1_APP APPKZ F
F_LFA1_BUK ACTVT 01
F_LFA1_BUK BUKRS $BUKRS
F_LFA1_GEN ACTVT 01
F_LFA1_GRP ACTVT 01
F_LFA1_GRP
F_BKPF_BUK ACTVT 03
F_BKPF_BUK BUKRS $BUKRS
F_BKPF_KOA ACTVT 03
F_BKPF_KOA KOART K
FK01 and FB03
$BUKRS = 1000 $BUKRS = *
$BUKRS = ????
technical issue: * vs 1000
create vendor for company code 1000 display all A/P postings
create vendor for company code 1000 and display all A/P postings
what
where
Different Business Processes
use Same Master Data:
so process based grouping
is NOT the Solution

25. ©CSItools.AllRightsReserved.
25
Possible Scenarios : Data Level Based !
9 for posting FI documents  F_BKPF_...
9 for vendor master data  F_LFA1_...
9 for customer master data  F_KNA1_...
24 for material master data  M_MATE_...
2 for payments  F_REGU_...
_____________________________________________
1.000 objects are grouped into  300
example: company code BUKRS
your authorizations requirements
need to be simplified into 300 one-liners

26. ©CSItools.AllRightsReserved.
26
Possible Scenarios : Data Level Based ?
post FI docs: FB01
F_BKPF_... ACTVT 01
BUKRS 1000
display vendor master data
F_LFA1_... ACTVT 03
BUKRS *
update customer master data
F_KNA1_... ACTVT 02
BUKRS 2000
display material master
M_MATE_... ACTVT 03
WERKS 3000
Full Flexibility on and andwhat where

27. ©CSItools.AllRightsReserved.
27
Conclusion
Identify who can do what is extremely difficult:
Million ABAPs, +150k transaction codes, RFC and web
dynpro’s … nobody knows all possibilities!
SAP authorizations is extremely easy:
If you have the core authorization, you have potential
access
If you should not have access, remove the core
authorization
And do not forget that authority checks is a complete
different story !
Use applications that focus on authorizations and not
on transaction codes

28. ©CSItools.AllRightsReserved.
28
Small last remark
Do not forget that you can disable authority checks!

29. Thank you!
Any Questions?
Johan Hermans
CEO
johan.hermans@csi-tools.com