RFC hopping uses stored credentials to move between systems with a technical account’s privileges.
Source and target accounts are different
The initiating user may use an account stored in the destination. They do not need their own account or equivalent privileges in the target system: the function executes there as the stored user.
Destinations are defined at system level. Without appropriate protection, they can be used across clients. Restricting SM59 administration alone does not control the use of existing destinations.
Authorization groups trigger S_ICF checks
Assign the destination to an authorization group on the Logon & Security tab in SM59. The kernel then checks the source user’s S_ICF authorization when that group of destinations is used.
Destinations have no authorization group by default, so the described S_ICF check does not run until a group is assigned. For example, CUA connections to managed systems can be restricted to CUA administrators.
Test execution also provides access
SE37 can test a function locally or through a destination. Test execution checks S_DEVELOP; a destination assigned to an authorization group also triggers S_ICF.
Strictly control test execution in production and in systems containing connections to critical environments. Provide a controlled emergency access procedure for justified support work.
Review checklist
- Identify destinations storing credentials for critical systems.
- Check their SM59 authorization groups.
- Restrict group use through S_ICF.
- Review S_DEVELOP and SE37 test execution access.