topic Security about BAPI's - user access in Application Development and Automation Discussions

Security about BAPI's - user access

Former Member — Wed, 18 Feb 2009 18:15:52 GMT

Hi,

We just finished to develop a few BAPI´s in order to access it using a Java Program.

We mark BAPI´s as remote enabled module and we think that we should use a internet user to access the BAPI's.

My question is: how can i certified that that user only access to the BAPI´s i create. I revised the java code and anyone can use that code to access to another BAPI.

Can you tell me some comments about this issue?

Best Regards

João Fernandes

Re: Security about BAPI's - user access

Jelena_Perfiljeva — Wed, 18 Feb 2009 22:10:58 GMT

According to the BAPI development guidelines, it is developer's responsibility to add the authority check.

Each BAPI must have all the applicable authorization checks coded inside, so that even if anyone runs the BAPI, they won't be able to get far if they don't have authorization for the business transactions. Naturally, the remote user IDs should have adequate (usually minimum and display-only) authorizations in SAP.

Re: Security about BAPI's - user access

mvoros — Thu, 19 Feb 2009 01:32:43 GMT

Hi,

I assume that you use JCo to call BAPI from your Java program. JCo uses RFC for this purpose. Hence you have all possibilities of RFC to secure it. You can create a new user for this RFC. This user will have only access to your BAPI (authorization object S_RFC). YOu can get additional information about securing RFC [here.|http://help.sap.com/saphelp_nw04s/helpdata/en/37/1a9b6a338cca448508f3a48d2d1e2d/frameset.htm]

Cheers