topic Re: Programs without authorization objects in Application Development and Automation Discussions

Programs without authorization objects

Former Member — Mon, 28 Jun 2010 14:36:29 GMT

Hi guys,

Do u know a way to list all SAP programs (standard and customized) that do not run authorization check when executed?

Thank you

Re: Programs without authorization objects

Former Member — Mon, 28 Jun 2010 15:35:49 GMT

Hi,

You can check these details through program RSABAPSC. However you need to check one report at a time.

With abap report RPR_ABAP_SOURCE_SCAN you can execute a 'bulk scan' on abap code context (such as "AUTHORITY-CHECK") but only within ABAP programs.

1. Goto transaction se16 --> enter table name usobt

2. and in the resultant screen enter transaction code (in this case me21n) and press F8.

3. you can find all the authorization objects checked for a particular transaction.

PS: Apart from that some authorization are attached in SE93 also.

http://sap.ittoolbox.com/groups/technical-functional/sap-security/how-to-get-a-list-of-custom-abap-programs-without-authoritycheck-3555570

Thanks,

Sri Sonia

Re: Programs without authorization objects

Former Member — Mon, 28 Jun 2010 17:36:08 GMT

Hi,

Please check this post

also there is a good post on ITTOOLBOX answered in June.

Debug mode might be the best task but if you have lot of Customized task that will be a time consuming activity.

Re: Programs without authorization objects

Former Member — Mon, 28 Jun 2010 18:20:22 GMT

There is no automated medication against this legacy ailment

Some checks are "remote" in function modules and ABAP OO methods, so you will not even necessarily see them in a code scan, nor whether and how the calling program reacts to the check result or "catches" it and then does something completely different ...

Even with tools (CodeInspector, CodeProfiler, etc) to analyze ABAP code, you need a programming guideline for developers to stick to and a human eye to spot security deviations or errors.

This is an [art form|/people/matthew.billingham/blog/2009/09/13/ancient-art-of-code-review] to do correctly and approach large numbers of programs in such a way that you can base it on risk and make "quick wins". For example, do you have generic includes?

Cheers,

Julius

Re: Programs without authorization objects

Former Member — Mon, 28 Jun 2010 18:33:57 GMT

This message was moderated.

Re: Programs without authorization objects

Former Member — Mon, 28 Jun 2010 18:43:47 GMT

Oops.... here is the correct link to the recording of [The ancient and noble art of code review|https://sap.emea.pgiconnect.com/p87357333/] by ABAP Guru Matt Billingham.

The other was the introduction song only...

FYI: Matt won the "Spot the security bug in the code" competition at the TechEd '09 in Vienna. He found more bugs in the code than what was intended to be found to win the prize

Cheers,

Julius