Check current situation
Correct settings of the essential parameters
This advanced functionality of the transaction SU53 is delivered via a patch. Please refer to SAP Note 1671117 for more information on the required support packages and technical background. Unsuccessful permission checks are now written to a ring buffer of the application server's Shared Memories. This will allow you to view failed permission checks in Web Dynpro applications or other user interfaces, which was not previously possible. Depending on the size of the ring buffer and system usage, up to 100 failed permissions checks per user can be displayed for the last three hours. The size of the ring buffer is calculated from the number of defined work processes. By default, 100 permission checks can be saved per workprocess. You can adjust this size using the auth/su53_buffer_entries profile parameter.
SNC secures communication with or between ABAP systems, but there are also many web-based applications in SAP system landscapes. They communicate via the Hypertext Transfer Protocol (HTTP). The data is also transmitted unencrypted when communicating via HTTP; Therefore, you should switch this communication to Hypertext Transfer Protocol Secure (HTTPS). HTTPS uses the encryption protocol Transport Layer Security (TLS) for secure data transfer on the Internet. You should therefore set up HTTPS for all users to access the Web. For communication between SAP systems, you should use HTTPS if you think the data transfer could be intercepted. You should either set up HTTPS on individual components of the infrastructure (such as proxies), or the ABAP systems should support HTTPS or TSL directly. Details of the configuration can be found in the SAPHinweis 510007.
SAP S/4HANA: Analysis and simple adjustment of your authorizations
Your compliance requirements specify that background jobs that are used should be maintained with permission proposals? We'll show you how to do that. Particularly in the banking environment, there are very strict guidelines for the permissions of background jobs used for monthly and quarterly financial statements, etc. Only selected users or dedicated system users may have these permissions. In order to clearly distinguish these permissions from the end-user permissions, it is useful to explicitly maintain the permissions for specific background jobs with suggestion values, so that these values can be used repeatedly to maintain permissions and are therefore transparent. You may have noticed that in the transaction SU24 you have no way to maintain background job credentials. So what's the best way to do that?
Authorization objects are defined with the help of transaction SU21. Each SAP transaction is equipped with the required authorization objects in SU24, which control access to specific functions within the respective program. Standard programs / transactions of an ERP system are already equipped with these objects during the initial installation. The same applies to other platforms such as CRM or Solution Manager.
However, if your Identity Management system is currently not available or the approval path is interrupted, you can still assign urgently needed authorizations with "Shortcut for SAP systems".
You know that changing your SU24 data involves mixing the roles in question.
This priority indicator helps you to identify whether a false positive or an actual security problem is present.