A destination that stores a highly privileged account can provide a path from a less protected environment into production.
Three connection models
RFC destinations may contain only technical connection settings, stored logon credentials, or trusted-system logon configuration. These recommendations primarily concern ABAP connections of type 3 in SM59.
The direction of trust matters. Stored credentials and trusted logon should lead from a system with the same or higher security classification to a system with the same or lower classification. As a general rule, a DEV → PRD connection should require user authentication on access.
Ownership, purpose and least privilege
Assign an owner and a documented business purpose to every destination. Use SRTM or ST03N to review usage and remove connections that are no longer needed. RSRFCCHK helps analyze destinations containing stored user names and passwords.
Use the System user type for stored technical accounts, minimum target-system privileges and, wherever possible, a dedicated user per destination. S_RFC_ADM primarily controls authorization to maintain SM59 destinations.
Exceptions need justification
Transport-management destinations are an exception to the general direction rule when their stored users have minimal authorizations. Other connections from lower to higher security classifications require risk analysis and appropriate safeguards. Callback protection remains relevant even when the destination follows the expected direction.
Review checklist
- Record each destination’s purpose, owner, source system and target system.
- Identify stored accounts and trust relationships leading to critical systems.
- Compare technical account privileges with actual integration needs.
- Verify usage before retiring destinations and review S_RFC_ADM access.