Risk
Unrestricted trust can extend source-system access into a critical target system.
ABAP
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Critical | SMT1 ; SM59 | Required relationships and trusted destinations only Remove unused trust after confirming dependencies. |
| ABAP Critical | Trust authentication method | Migrate relationships and corresponding destinations Cover both the calling and called systems. |
| ABAP Critical | S_RFC_ADM_TT | Small, authorized administrator group Controls maintenance of trust relationships. |
| ABAP Critical | S_RFCACL | No * in source system ID or client Separate same-user and technical-user authorizations. |
| ABAP Standard | rfc/selftrust | 0 Disables implicit trust between clients of the same system. |
| ABAP Extended | rfc/allowoldticket4tt | no Blocks old trusted tickets. |
| ABAP Extended | SNC/TLS ; S_ICF ; RFC_TCODE | Additional connection and destination protection Controls transport, destination use and the transaction-code field. |
How to verify
- Review SMT1 in the called system and SM59 in the calling system.
- Verify migration at both ends of each relationship.
- Separate technical-user and same-user scenarios.
- Review administrative privileges and S_RFCACL.
Related topics
RFC · RFC client-side controls ↗