Which secure options exist for version compare of workbench objects between DEV and PROD?

[matt]

A while ago, I asked a question related to the different behaviour of version compare in SE38 after we had upgraded from NW750 SP07 to NW750 SP13 (EHP8). The RFC-connections needed for version compare have been closed off to generally prevent RFC-access from dev to prod for security reasons.

I looked through the security information provided in this guide, but didn't find specific enough recommendations there. And earlier questions in SAP Community don't quite match our current situation.

We have the rule in our development guidelines that version comparison between DEV and PROD should be done before new development gets started for an object. This obviously needs to be possible to do as easily and quickly as possible as it otherwise just won't get done.

I therefore have the following questions:

• Do you routinely use version compare from DEV to PROD for workbench objects to e.g. ensure that all earlier changes have already made it into PROD or are there other/better options to do this?
• How large is the risk of unauthorized activities in PROD if version compare is done via the standard functionality offered by the ABAP Workbench i.e. via SE38/SE80/SE39/SE11 for which RFC-connections need to be set up?
• How can this risk be eliminated?
• Are there recommendations of how RFC-connections and authorizations for version compares between DEV and QA/PROD should be defined or should they just not be defined at all?
• Would setting up a separate client in PROD which then only contains client independent workbench-objects be helpful and could it be used for version compares?
• Is there a means to do this easily and safely via Eclipse? (* see footnote below)

Thanks for any feedback - or even additional questions I haven't thought of yet!

Cheers

Bärbel

(*) Footnote: As of right now, Eclipse is not yet used much if at all and most development work happens via SAP GUI and the workbench transactions. When I tried a remote compare between the program versions in DEV and QA it sort of worked but several false hits where reported where e.g. the German Umlaut "ä" in my name was "butchered" in the displayed QA-code (as if the retrieval had a Unicode-issue). The fact, that Eclipse is in edit-mode by default is also a bit of an issue (I think).

[matt]

You should add the security tag. Possible Netweaver Administration.

[BaerbelWinkler]

Thanks for your comment, Matt! I'd like to add more tags but don't see an option to actually do that under "Actions". Some missing auths perhaps or is it because there's already your answer and the question can therefore no longer be edited?

[matt]

Just edit, I think. Or notify a helpful moderator.

[BaerbelWinkler]

Not sure why, but all of a sudden, the edit option was available under "Actions" and I could add tags.

[Jelena_Perfiljeva]

You might want to pimp this post on Twitter or in CC. It's a good question and I'm sure others could chime in as well. But the way the "unanswered questions" filter has been changed to include only questions with 0 answers I feel is actually hurting good questions that merit a longer discussion. As soon as any answer is given they drop from the radar. I just stumbled upon it by accident.

[matt]

If the system isn't open, then eclipse is read only. Same as with a dev system and sap objects.

[SimoneMilesi]

In a former customer's system, we implemented a routine/exit (i do not remember which one is, sorry!) that, if you are editing an object (class/FM,report) without an open TR, invokes an rfc read to check if the last cr is already in PROD.

We need it because there were a lot of different consultants managed by different teams so the risk to bring in PROD something still in QA was high.

I do not understand which kind of security issue you see in doing a comparision between enviroment 🙂

[BaerbelWinkler]

Thanks, Simone!

The fear is that any defined RFC-connection between DEV and PROD could be misused for other activities than version compares. Which is why at the moment (and different to earlier) no such connections are available for us.