Security about BAPI's - user access

[Former Member]

Hi,

We just finished to develop a few BAPI´s in order to access it using a Java Program.

We mark BAPI´s as remote enabled module and we think that we should use a internet user to access the BAPI's.

My question is: how can i certified that that user only access to the BAPI´s i create. I revised the java code and anyone can use that code to access to another BAPI.

Can you tell me some comments about this issue?

Best Regards

João Fernandes

[Jelena_Perfiljeva]

According to the BAPI development guidelines, it is developer's responsibility to add the authority check.

Each BAPI must have all the applicable authorization checks coded inside, so that even if anyone runs the BAPI, they won't be able to get far if they don't have authorization for the business transactions. Naturally, the remote user IDs should have adequate (usually minimum and display-only) authorizations in SAP.

[mvoros]

Hi,

I assume that you use JCo to call BAPI from your Java program. JCo uses RFC for this purpose. Hence you have all possibilities of RFC to secure it. You can create a new user for this RFC. This user will have only access to your BAPI (authorization object S_RFC). YOu can get additional information about securing RFC [here.|http://help.sap.com/saphelp_nw04s/helpdata/en/37/1a9b6a338cca448508f3a48d2d1e2d/frameset.htm]

Cheers