Skip to Content
0
Former Member
Jan 02, 2008 at 05:42 PM

Dangers for full S_RFC authorization - for all function groups

653 Views

Hi,

I have recently received a stern warning about all the bad things that can happen if you give users full authorization for S_RFC. This allows the user to use all function modules that use RFC (remote function calls).

As all our standard reporting users need at least some RFC function modules, I simply awarded them all of them. Tracing this (running, changing, creating, deleting queries, planning, consolidation) in Excel and Web would have been too tedious.

Apparently, full authorization together with the table browser transaction (SE16) would allow a user to read all available data!?

The same result is said to be possible if you create some special excel macros which would in turn call an RFC function module.

Is this true?

How could it be done?

Has anybody a complete list of all the RFC function modules needed for reporting an planning in SAP BI?

Any advice on these issues will be very much appreciated.

Martin