Which secure options exist for version compare of workbench objects between DEV and PROD?

[BaerbelWinkler]

A while ago, I asked a question related to the different behaviour of version compare in SE38 after we had upgraded from NW750 SP07 to NW750 SP13 (EHP8). The RFC-connections needed for version compare have been closed off to generally prevent RFC-access from dev to prod for security reasons.

I looked through the security information provided in this guide, but didn't find specific enough recommendations there. And earlier questions in SAP Community don't quite match our current situation.

We have the rule in our development guidelines that version comparison between DEV and PROD should be done before new development gets started for an object. This obviously needs to be possible to do as easily and quickly as possible as it otherwise just won't get done.

I therefore have the following questions:

• Do you routinely use version compare from DEV to PROD for workbench objects to e.g. ensure that all earlier changes have already made it into PROD or are there other/better options to do this?
• How large is the risk of unauthorized activities in PROD if version compare is done via the standard functionality offered by the ABAP Workbench i.e. via SE38/SE80/SE39/SE11 for which RFC-connections need to be set up?
• How can this risk be eliminated?
• Are there recommendations of how RFC-connections and authorizations for version compares between DEV and QA/PROD should be defined or should they just not be defined at all?
• Would setting up a separate client in PROD which then only contains client independent workbench-objects be helpful and could it be used for version compares?
• Is there a means to do this easily and safely via Eclipse? (* see footnote below)

Thanks for any feedback - or even additional questions I haven't thought of yet!

Cheers

Bärbel

(*) Footnote: As of right now, Eclipse is not yet used much if at all and most development work happens via SAP GUI and the workbench transactions. When I tried a remote compare between the program versions in DEV and QA it sort of worked but several false hits where reported where e.g. the German Umlaut "ä" in my name was "butchered" in the displayed QA-code (as if the retrieval had a Unicode-issue). The fact, that Eclipse is in edit-mode by default is also a bit of an issue (I think).

[matt]

You should add the security tag. Possible Netweaver Administration.

[BaerbelWinkler]

Thanks for your comment, Matt! I'd like to add more tags but don't see an option to actually do that under "Actions". Some missing auths perhaps or is it because there's already your answer and the question can therefore no longer be edited?

[matt]

Just edit, I think. Or notify a helpful moderator.

[BaerbelWinkler]

Not sure why, but all of a sudden, the edit option was available under "Actions" and I could add tags.

[Jelena_Perfiljeva]

You might want to pimp this post on Twitter or in CC. It's a good question and I'm sure others could chime in as well. But the way the "unanswered questions" filter has been changed to include only questions with 0 answers I feel is actually hurting good questions that merit a longer discussion. As soon as any answer is given they drop from the radar. I just stumbled upon it by accident.

[matt]

If the system isn't open, then eclipse is read only. Same as with a dev system and sap objects.

[BaerbelWinkler · Accepted solution]

Based on feedback provided in this thread (thanks, everybody!) and some more discussions with colleagues, we decided to - for now - define RFC-connections from DEV to QA and PROD which require login by the developer in the respective target system. So, it's at least ensured that they only have their own authorisation in the target system(s).

But, we'll also keep looking for other options which is why, I'll just mark this thread as answered but will leave it open to allow further answers getting added.

Thanks and Cheers

Bärbel

[matt]

• Do you routinely use version compare from DEV to PROD for workbench objects to e.g. ensure that all earlier changes have already made it into PROD or are there other/better options to do this?

No. Probably because we don't release our dev transports until it's time to go to production.

• Is there a means to do this easily and safely via Eclipse? (* see footnote below)

I use Eclipse for version compare for preference. With classes it's especially useful as you can compare them nearly all at once - whereas in SAPGui, you can only do method by method. I've never had an issue. We also have umlauts and other special characters. (Off topic: Eclipse also keeps local versions, so you can easily revert to the version of an object you saved three hours earlier. Saved my life a couple of times!).

For comparison within SAPGui, the userid specified for the RFC should have its authorisations locked down as much as possible. This can be done via the authorisation trace. SAP offer a service for this note 1682316 if you don't want to do it yourself.

I like your idea concerning a configuration-less client for comparisons.

[BaerbelWinkler]

matthew.billingham

Thanks for your feedback, Matt!

You mention comparison of classes, but what about enhancements? We have one particularly large enhancement where developers very often rely on version comparisons across systems to avoid overtaking each others changes or to find out what went wrong with a recent change (I had a question related to that a while ago). When I try to open the enhancement in Eclipse all it does is to open it in a GUI-window. So, at a guess and corroborated by this thread from 2015 and nothing newer, enhancements cannot yet be really handled via Eclipse.

Are there other options to do version comparisons for enhancements apart from e.g. SE84 with RFC-connections?

[matt]

Sorry. I don't have wide experience of enhancements.

But using the factory pattern and multiple interface implementations you can usually remove dependencies between transports and not have to worry about any overtaking transports.

[BaerbelWinkler]

matthew.billingham

Hi Matt,

well, to put it mildly, we are lightyears away from "... using the factory pattern and multiple interface implementations...." when it comes to that particular enhancement (last I checked it had ~35,000 lines of code). 🙂

[matt]

Well to summarise... With objects you can decouple the different functionality, so they don't interfere. You can do the same with function modules, so long as they're in seperate fn groups.

You maintain a dB table with the fm you want to run, and use that to call them dynamically. Probably too late now, but you could do it for future requirements.

[Jelena_Perfiljeva]

As someone also "light years away" I'd actually be curious to read more how the factory pattern and stuff can help with the transport conflicts. A blog, perhaps? 🙂

[matt]

It's how badis work. Each implementation is independent.

Actually you can just create your own multiple use Badi.

[Jelena_Perfiljeva]

We don't do DEV to PROD version comparison in current environment and didn't do in my old job either. We simply check the preceding transport's log in the version control. I think 1-2 times we had to do the version comparison but there was some technical issue with a transport or upgrade. Some exceptional situation, routinely we don't do that.

I honestly don't understand at all what's all that broohaha is about RFC access from DEV to PROD. RFC has specific user ID, just give that user limited authorization. Although I'm neither a security expert nor a clever criminal, so must be missing something. 🙂

I also like your idea about a separate client, at least in theory. This might make some things more difficult for Basis folks, so YMMV.

[BaerbelWinkler]

Thanks, Jelena! The idea with a separate client actually came from our basis team so it's not me potentially making more work for them!

We have users who only can access DEV and QA but not PROD, but in order to do comparisons with PROD e.g. via Eclipse, they'd need to have access there as well. So, if we had a client which doesn't have any transactional but only client-independent data in it, they could get access to that.

[matt]

I believe its a single transaction to do a client copy without configuration or data. And quite quick.

[chaouki_akir]

"Do you routinely use version compare from DEV to PROD for workbench objects to e.g. ensure that all earlier changes have already made it into PROD or are there other/better options to do this?"

Yes I do it, now and before. For me it is normal to have this possibility because as you said : "version comparison between DEV and PROD should be done before new development gets started for an object."

"The RFC-connections needed for version compare have been closed off"

What is the name of these RFC-connections ? I debugged and in my system and the is like [email protected]

"How large is the risk of unauthorized activities in PROD if version compare is done via the standard functionality offered by the ABAP Workbench i.e. via SE38/SE80/SE39/SE11 for which RFC-connections need to be set up?"

For me, the risk is that the developer is able to call from DEV, RFC enabled function modules. But user in PROD, should have lesser authorized objects.

[SimoneMilesi]

In a former customer's system, we implemented a routine/exit (i do not remember which one is, sorry!) that, if you are editing an object (class/FM,report) without an open TR, invokes an rfc read to check if the last cr is already in PROD.

We need it because there were a lot of different consultants managed by different teams so the risk to bring in PROD something still in QA was high.

I do not understand which kind of security issue you see in doing a comparision between enviroment 🙂

[BaerbelWinkler]

Thanks, Simone!

The fear is that any defined RFC-connection between DEV and PROD could be misused for other activities than version compares. Which is why at the moment (and different to earlier) no such connections are available for us.