Impact of rfc/callback_security_method Setting on Optimizer Functionality

[SAPSupport]

We are experiencing issues with the parameter rfc/callback_security_method currently set to 3 in our SAP RISE environment.
Problem:

When the parameter is set to 3, the RCC_VERSION transaction and RCCF TM Optimizer do not work as expected.
The system generates an ABAP short dump with error:
CALLBACK_REJECTED_BY_WHITELIST
RFC callback call rejected by positive list

This prevents optimizer functionality, which is critical for planning and execution processes.

1. What is the best way to resolve this issue while keeping the system secure?

• • Should we configure the whitelist for required RFC callbacks?
  • Or is it acceptable to temporarily change the parameter value from 3 to 1?

2. What is the impact if we maintain the parameter value as 1?

• Are there any major security risks beyond allowing RFC callbacks?
• Will this affect other components or system stability?

------------------------------------------------------------------------------------------------------------------------------------------------
Learn more about the SAP Support user and program here.

[SAPSupport · Accepted solution]

Hello,

The recommendation is to set the rfc/callback_security_method parameter to 3 and adjust the allowlist per the CALLBACK_REJECTED_BY_WHITELIST dumps that are going to be generated.

The only impact the parameter has is on the RFC callback handling. You can read more about this on KBA 3349924 - Impacts of the parameter rfc/callback_security_method.

Best regards.