Installing a correction that delivers a switchable check does not mean the check is already enforced in a productive scenario.
Definitions and productive scenarios
SACF separates a check definition from its active use. SAP supplies scenario definitions and calls in the code; customers create productive scenarios in their own landscapes.
New switchable checks are delivered inactive to avoid interrupting processes when corrections are implemented. Checks using the same scenario are switched together. Maintain their configuration in SACF.
Log before enforcing
Configure SAL in RSAU_CONFIG, or SM19 and the applicable parameters in older releases. Include the relevant events for all users and clients.
| Event | Meaning |
|---|---|
DUO | Successful switchable authorization check. The last character is the letter O. |
DUP | Unsuccessful switchable authorization check. |
DUQ | Change to a productive authorization scenario. |
Review events in RSAU_READ_LOG or release-appropriate tools such as SM20. Adjust affected users’ roles before enabling enforcement.
New installations and upgrades
For a new installation, SACF_COMPARE can create active productive scenarios. After an upgrade, start new definitions in logging mode, assess use and impact, then activate the required checks.
SACF integrates with SU25 in supported releases. Combine the SACF review with S_RFC cleanup and repeat the assessment for upgrades and new installations.
Review checklist
- Distinguish delivered definitions from productive scenarios.
- Verify DUO, DUP and DUQ logging.
- Identify users affected by new checks.
- After adjusting roles, activate required scenarios and verify business processes.