Which secure options exist for version compare of workbench objects between DEV and PROD?

[matt]

A while ago, I asked a question related to the different behaviour of version compare in SE38 after we had upgraded from NW750 SP07 to NW750 SP13 (EHP8). The RFC-connections needed for version compare have been closed off to generally prevent RFC-access from dev to prod for security reasons.

I looked through the security information provided in this guide, but didn't find specific enough recommendations there. And earlier questions in SAP Community don't quite match our current situation.

We have the rule in our development guidelines that version comparison between DEV and PROD should be done before new development gets started for an object. This obviously needs to be possible to do as easily and quickly as possible as it otherwise just won't get done.

I therefore have the following questions:

• Do you routinely use version compare from DEV to PROD for workbench objects to e.g. ensure that all earlier changes have already made it into PROD or are there other/better options to do this?
• How large is the risk of unauthorized activities in PROD if version compare is done via the standard functionality offered by the ABAP Workbench i.e. via SE38/SE80/SE39/SE11 for which RFC-connections need to be set up?
• How can this risk be eliminated?
• Are there recommendations of how RFC-connections and authorizations for version compares between DEV and QA/PROD should be defined or should they just not be defined at all?
• Would setting up a separate client in PROD which then only contains client independent workbench-objects be helpful and could it be used for version compares?
• Is there a means to do this easily and safely via Eclipse? (* see footnote below)

Thanks for any feedback - or even additional questions I haven't thought of yet!

Cheers

Bärbel

(*) Footnote: As of right now, Eclipse is not yet used much if at all and most development work happens via SAP GUI and the workbench transactions. When I tried a remote compare between the program versions in DEV and QA it sort of worked but several false hits where reported where e.g. the German Umlaut "ä" in my name was "butchered" in the displayed QA-code (as if the retrieval had a Unicode-issue). The fact, that Eclipse is in edit-mode by default is also a bit of an issue (I think).

[matt]

You should add the security tag. Possible Netweaver Administration.

[BaerbelWinkler]

Thanks for your comment, Matt! I'd like to add more tags but don't see an option to actually do that under "Actions". Some missing auths perhaps or is it because there's already your answer and the question can therefore no longer be edited?

[matt]

Just edit, I think. Or notify a helpful moderator.

[BaerbelWinkler]

Not sure why, but all of a sudden, the edit option was available under "Actions" and I could add tags.

[Jelena_Perfiljeva]

You might want to pimp this post on Twitter or in CC. It's a good question and I'm sure others could chime in as well. But the way the "unanswered questions" filter has been changed to include only questions with 0 answers I feel is actually hurting good questions that merit a longer discussion. As soon as any answer is given they drop from the radar. I just stumbled upon it by accident.

[matt]

If the system isn't open, then eclipse is read only. Same as with a dev system and sap objects.

[matt]

• Do you routinely use version compare from DEV to PROD for workbench objects to e.g. ensure that all earlier changes have already made it into PROD or are there other/better options to do this?

No. Probably because we don't release our dev transports until it's time to go to production.

• Is there a means to do this easily and safely via Eclipse? (* see footnote below)

I use Eclipse for version compare for preference. With classes it's especially useful as you can compare them nearly all at once - whereas in SAPGui, you can only do method by method. I've never had an issue. We also have umlauts and other special characters. (Off topic: Eclipse also keeps local versions, so you can easily revert to the version of an object you saved three hours earlier. Saved my life a couple of times!).

For comparison within SAPGui, the userid specified for the RFC should have its authorisations locked down as much as possible. This can be done via the authorisation trace. SAP offer a service for this note 1682316 if you don't want to do it yourself.

I like your idea concerning a configuration-less client for comparisons.

[BaerbelWinkler]

matthew.billingham

Thanks for your feedback, Matt!

You mention comparison of classes, but what about enhancements? We have one particularly large enhancement where developers very often rely on version comparisons across systems to avoid overtaking each others changes or to find out what went wrong with a recent change (I had a question related to that a while ago). When I try to open the enhancement in Eclipse all it does is to open it in a GUI-window. So, at a guess and corroborated by this thread from 2015 and nothing newer, enhancements cannot yet be really handled via Eclipse.

Are there other options to do version comparisons for enhancements apart from e.g. SE84 with RFC-connections?

[matt]

Sorry. I don't have wide experience of enhancements.

But using the factory pattern and multiple interface implementations you can usually remove dependencies between transports and not have to worry about any overtaking transports.

[BaerbelWinkler]

matthew.billingham

Hi Matt,

well, to put it mildly, we are lightyears away from "... using the factory pattern and multiple interface implementations...." when it comes to that particular enhancement (last I checked it had ~35,000 lines of code). 🙂

[matt]

Well to summarise... With objects you can decouple the different functionality, so they don't interfere. You can do the same with function modules, so long as they're in seperate fn groups.

You maintain a dB table with the fm you want to run, and use that to call them dynamically. Probably too late now, but you could do it for future requirements.

[Jelena_Perfiljeva]

As someone also "light years away" I'd actually be curious to read more how the factory pattern and stuff can help with the transport conflicts. A blog, perhaps? 🙂

[matt]

It's how badis work. Each implementation is independent.

Actually you can just create your own multiple use Badi.