Community
Application Development and Automation Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Read only

Trusted RFC - Difference between actual user and batch user

sebastian_konrad
Explorer

‎2013 Sep 16 4:23 PM

0 Likes
3,805

Hello everybody,

we discuss at the moment the opportunity to use only Trusted RFC Conenction between our sap-systems.

In the most cases we want to use a Trusted connection with the actual user. This mean i need my user also in the target system with the authorizations.

The other setting is, that we use Trused with a batchuser - not actual user.

In this case it looks like a connection without trusted - Only difference is for me that i do not have to assign a password into the rfc and the user needs authorizations for trusted (S_RFCACL).

Is this correct or do you have some more informations regarding the difference.

From my first understanding the difference between trusted with a batchuser and non trusted with a batchuser is only the password topic - You do not need to assign a password into the rfc, the authorization topic with trusted rights and you have to connect the systems via Trusted/Trusting.

But maybe iam wrong 😉

How do you see this topic from security points?

Thank you very much.

Best regards,

Sebastian Konrad

Hello Sebastian,

the user stored in the RFC destination must not be a dialog user, otherwise anybody with access to the destination (SM59) can logon with this user to the target system. In a trusted/trusting connection the trusted dialog user must have a trusting dialog user connected by S_RFCACL and can only logon as the user which is connected to his trusted user.

Regards,

Endre Udvaros.

Reply
3 REPLIES 3
Read only

Former Member

‎2013 Sep 17 2:36 PM

0 Likes
2,122

Hello Sebastian,

the user stored in the RFC destination must not be a dialog user, otherwise anybody with access to the destination (SM59) can logon with this user to the target system. In a trusted/trusting connection the trusted dialog user must have a trusting dialog user connected by S_RFCACL and can only logon as the user which is connected to his trusted user.

Regards,

Endre Udvaros.

Read only

sebastian_konrad
Explorer
In response to Former Member

‎2013 Sep 18 7:22 AM

0 Likes
2,122

Hello Endre,

Thanks for your answer - If i understand it correct it is no difference which way i use? Only the authorizations (S_RFCACL <-> Instead of only S_RFC).

Is it a problem when someone uses such configurations with trusted and a batch user in an ALE szenario?

What are your settings and why?

Thanks & Regards,

Sebastian Konrad

Read only

Former Member
In response to Former Member

‎2013 Sep 18 8:10 AM

2,122

Hello,

S_RFCACL and S_RFC are two separate authorization objects. The user needs S_RFC in the RFC server system to get authorizations to run server functions called through RFC. The S_RFCACL is to attach the trusting user to the trusted user. In a trusted/trusting connection the trusting user must have both authorization objects, S_RFC and S_RFCACL.

In ALE scenarios it is suggested to use a communication type user like "ALREMOTE". As it is not a dialog user nobody can logon with this through SM59 but it can be used for RFC.

Regards, Endre.