Which secure options exist for version compare of workbench objects between DEV and PROD?

[matt]

A while ago, I asked a question related to the different behaviour of version compare in SE38 after we had upgraded from NW750 SP07 to NW750 SP13 (EHP8). The RFC-connections needed for version compare have been closed off to generally prevent RFC-access from dev to prod for security reasons.

I looked through the security information provided in this guide, but didn't find specific enough recommendations there. And earlier questions in SAP Community don't quite match our current situation.

We have the rule in our development guidelines that version comparison between DEV and PROD should be done before new development gets started for an object. This obviously needs to be possible to do as easily and quickly as possible as it otherwise just won't get done.

I therefore have the following questions:

• Do you routinely use version compare from DEV to PROD for workbench objects to e.g. ensure that all earlier changes have already made it into PROD or are there other/better options to do this?
• How large is the risk of unauthorized activities in PROD if version compare is done via the standard functionality offered by the ABAP Workbench i.e. via SE38/SE80/SE39/SE11 for which RFC-connections need to be set up?
• How can this risk be eliminated?
• Are there recommendations of how RFC-connections and authorizations for version compares between DEV and QA/PROD should be defined or should they just not be defined at all?
• Would setting up a separate client in PROD which then only contains client independent workbench-objects be helpful and could it be used for version compares?
• Is there a means to do this easily and safely via Eclipse? (* see footnote below)

Thanks for any feedback - or even additional questions I haven't thought of yet!

Cheers

Bärbel

(*) Footnote: As of right now, Eclipse is not yet used much if at all and most development work happens via SAP GUI and the workbench transactions. When I tried a remote compare between the program versions in DEV and QA it sort of worked but several false hits where reported where e.g. the German Umlaut "ä" in my name was "butchered" in the displayed QA-code (as if the retrieval had a Unicode-issue). The fact, that Eclipse is in edit-mode by default is also a bit of an issue (I think).

[matt]

You should add the security tag. Possible Netweaver Administration.

[BaerbelWinkler]

Thanks for your comment, Matt! I'd like to add more tags but don't see an option to actually do that under "Actions". Some missing auths perhaps or is it because there's already your answer and the question can therefore no longer be edited?

[matt]

Just edit, I think. Or notify a helpful moderator.

[BaerbelWinkler]

Not sure why, but all of a sudden, the edit option was available under "Actions" and I could add tags.

[Jelena_Perfiljeva]

You might want to pimp this post on Twitter or in CC. It's a good question and I'm sure others could chime in as well. But the way the "unanswered questions" filter has been changed to include only questions with 0 answers I feel is actually hurting good questions that merit a longer discussion. As soon as any answer is given they drop from the radar. I just stumbled upon it by accident.

[matt]

If the system isn't open, then eclipse is read only. Same as with a dev system and sap objects.

[Jelena_Perfiljeva]

We don't do DEV to PROD version comparison in current environment and didn't do in my old job either. We simply check the preceding transport's log in the version control. I think 1-2 times we had to do the version comparison but there was some technical issue with a transport or upgrade. Some exceptional situation, routinely we don't do that.

I honestly don't understand at all what's all that broohaha is about RFC access from DEV to PROD. RFC has specific user ID, just give that user limited authorization. Although I'm neither a security expert nor a clever criminal, so must be missing something. 🙂

I also like your idea about a separate client, at least in theory. This might make some things more difficult for Basis folks, so YMMV.

[BaerbelWinkler]

Thanks, Jelena! The idea with a separate client actually came from our basis team so it's not me potentially making more work for them!

We have users who only can access DEV and QA but not PROD, but in order to do comparisons with PROD e.g. via Eclipse, they'd need to have access there as well. So, if we had a client which doesn't have any transactional but only client-independent data in it, they could get access to that.

[matt]

I believe its a single transaction to do a client copy without configuration or data. And quite quick.