Trusted RFC - Difference between actual user and batch user

[sebastian_konrad]

Hello everybody,

we discuss at the moment the opportunity to use only Trusted RFC Conenction between our sap-systems.

In the most cases we want to use a Trusted connection with the actual user. This mean i need my user also in the target system with the authorizations.

The other setting is, that we use Trused with a batchuser - not actual user.

In this case it looks like a connection without trusted - Only difference is for me that i do not have to assign a password into the rfc and the user needs authorizations for trusted (S_RFCACL).

Is this correct or do you have some more informations regarding the difference.

From my first understanding the difference between trusted with a batchuser and non trusted with a batchuser is only the password topic - You do not need to assign a password into the rfc, the authorization topic with trusted rights and you have to connect the systems via Trusted/Trusting.

But maybe iam wrong 😉

How do you see this topic from security points?

Thank you very much.

Best regards,

Sebastian Konrad

[sebastian_konrad]

Hello everybody,

we discuss at the moment the opportunity to use only Trusted RFC Conenction between our sap-systems.

In the most cases we want to use a Trusted connection with the actual user. This mean i need my user also in the target system with the authorizations.

The other setting is, that we use Trused with a batchuser - not actual user.

In this case it looks like a connection without trusted - Only difference is for me that i do not have to assign a password into the rfc and the user needs authorizations for trusted (S_RFCACL).

Is this correct or do you have some more informations regarding the difference.

From my first understanding the difference between trusted with a batchuser and non trusted with a batchuser is only the password topic - You do not need to assign a password into the rfc, the authorization topic with trusted rights and you have to connect the systems via Trusted/Trusting.

But maybe iam wrong 😉

How do you see this topic from security points?

Thank you very much.

Best regards,

Sebastian Konrad

[Former Member]

Hello Sebastian,

the user stored in the RFC destination must not be a dialog user, otherwise anybody with access to the destination (SM59) can logon with this user to the target system. In a trusted/trusting connection the trusted dialog user must have a trusting dialog user connected by S_RFCACL and can only logon as the user which is connected to his trusted user.

Regards,

Endre Udvaros.

[sebastian_konrad]

Hello Endre,

Thanks for your answer - If i understand it correct it is no difference which way i use? Only the authorizations (S_RFCACL <-> Instead of only S_RFC).

Is it a problem when someone uses such configurations with trusted and a batch user in an ALE szenario?

What are your settings and why?

Thanks & Regards,

Sebastian Konrad

[Former Member]

Hello,

S_RFCACL and S_RFC are two separate authorization objects. The user needs S_RFC in the RFC server system to get authorizations to run server functions called through RFC. The S_RFCACL is to attach the trusting user to the trusted user. In a trusted/trusting connection the trusting user must have both authorization objects, S_RFC and S_RFCACL.

In ALE scenarios it is suggested to use a communication type user like "ALREMOTE". As it is not a dialog user nobody can logon with this through SM59 but it can be used for RFC.

Regards, Endre.