An insecure trust relationship combined with broad S_RFCACL authorizations may enable impersonation in the target system without knowing the user’s password.
Trusted and trusting systems
The trusted system is the identity source accepted by the trusting system. Trust is directional: A trusting B does not imply B trusting A. The trusted system should have at least the same security classification as the trusting system.
Maintain relationships in SMT1. Administrative controls depend on the system release; S_RFC_TT and S_ADMI_FCD apply to the earlier maintenance model. Review the related TRUST baseline control for S_RFC_ADM_TT. Mutual trust requires specific justification.
S_RFCACL in the trusting system
| Scenario | Authorization setting |
|---|---|
| Same user name | RFC_EQUSER = Y; leave RFC_USER empty. |
| Different user name | RFC_EQUSER = N; RFC_USER identifies the permitted source user. |
| Restricted source | Use specific RFC_SYSID and RFC_CLIENT values. |
Do not use wildcard * in RFC_USER, RFC_SYSID, RFC_CLIENT or RFC_EQUSER. Do not add S_RFCACL to SAP_ALL through ADD_S_RFCACL in PRGN_CUST. RFC_TCODE is checked only after enabling the corresponding SMT1 option.
Authentication method and relationship data
Use the improved trusted-logon authentication mechanism and migrate both the relationship and its corresponding destination. RS_SECURITY_TRUST_RELATIONS and RS_UPDATE_TRUST_RELATIONS support review and migration. Apply the required kernel and ABAP changes to both systems.
Assign RFCSYSACL to authorization group TTRL, verify the assignment in SE54, and restrict S_TABU_DIS and S_TABU_NAM access. Setting rfc/selftrust = 0 disables implicit cross-client trust within the same system. Required cross-client relationships then need explicit configuration.
Review checklist
- Check the direction and classification of every SMT1 relationship.
- Review S_RFCACL in the trusting system, including wildcards and user mapping.
- Verify the authentication method and RFCSYSACL access.
- Identify required cross-client relationships before changing selftrust.