topic Re: restrict fun module in Application Development and Automation Discussions

restrict fun module

Former Member — Wed, 28 Apr 2010 13:45:51 GMT

Hi all,

I need to restrict the function module to run only from proxy. It should not be allowed to run independently. Can you guys give some suggestion

Re: restrict fun module

Former Member — Wed, 28 Apr 2010 14:27:46 GMT

hi,

You can use a "AUTHORITY-CHECK" or you can develope a test code, testing who runs the RFC.

I advice to use SY variables.

Re: restrict fun module

Sandra_Rossi — Wed, 28 Apr 2010 14:46:57 GMT

who else could call this function module? do you mean external RFC calls? in that case, protect all the other RFC function modules too!

Re: restrict fun module

Former Member — Wed, 28 Apr 2010 14:54:37 GMT

Hi,

We do not want any one to run the FM independently.

Thnx

Re: restrict fun module

Sandra_Rossi — Wed, 28 Apr 2010 16:26:06 GMT

in production, nobody can call a program or function module directly (unless you give them the authorizations!)

Nevertheless, you may think of developers who create a program and call this function module in a hidden manner, and transport it to production (like a kind of hacker attack). In that case, yes, add an authority-check, that should work unless the developer is a friend on an administrator. In that case, I suggest that you trace administrator's work. Moreover, you may revoke authorizations via S_DEVELOP authorization object in the development system so that nobody is able to change this function module. If a developer tries to overpass this authorization check by debug, administrators should be able to see that in the SM21 log.