topic Re: BAPI_ACC_DOCUMENT_POST + Authorizations in Application Development and Automation Discussions

BAPI_ACC_DOCUMENT_POST + Authorizations

Former Member — Sat, 13 May 2006 12:51:41 GMT

This is quite a popular BAPI for posting FI documents due to it's excellent speed in contrast to traditional call transaction or BDC processing for FI document creation.

Just wondered if many people using it have implemented appropriate security around it, as it does not perform any FI document posting authorization checks. So no Company code F_BKPF_BUK, GL Account F_BKPF_BES, Customer F_BKPF_BED, Vendor F_BKPF_BEK, etc. auth checks are done.

I've used the BADI called within the above and the BAPI_ACC_DOCUMENT_CHECK function, the ACC_DOCUMENT BADI to put tight checks in akin to the ones that occur in FB01. I added code within an implementation of BADI's CHANGE method, it works well as a solution.

Just wondering how other people have dealt with this BAPIs lack of auth checks ?

Message was edited by: Declan Kearney

Re: BAPI_ACC_DOCUMENT_POST + Authorizations

Former Member — Tue, 23 May 2006 14:49:42 GMT

Hi,

in those cases create a Wrapper RFC enabled FM, inside that you can check the Authorizations and call the BAPI .

Regards

vijay

Re: BAPI_ACC_DOCUMENT_POST + Authorizations

Former Member — Tue, 23 May 2006 14:52:10 GMT

Or Before calling the BAPI check the authorizations inside the Program and accordingly call the BAPI. if the BAPI call is inside the Program.

or if it is RFC Call then above suggestion works.

Regards

vijay

Re: BAPI_ACC_DOCUMENT_POST + Authorizations

Former Member — Tue, 23 May 2006 15:07:16 GMT

Creating a Wrapper RFC function to front a standard SAP BAPI (which itself is RFC enabled ) , would work but to me is just adding more layers and not solving the underlying weakness. So long as someone has S_RFC access they can still post when you would not want them to by calling this BAPI directly

Message was edited by: Declan Kearney

Re: BAPI_ACC_DOCUMENT_POST + Authorizations

Former Member — Tue, 23 May 2006 15:29:27 GMT

apart from s_rfc you will check other Authrization objects also. not simply one RFC access check. even you can create your own Authority objects and stop them to use before calling the BAPI by using Authority Check,.

Regards

vijay