Roles alone do not remove unnecessary functions from remote exposure. UCON adds an independent access-control layer.
An allowlist before authorization checks
UCON RFC Basic Protection checks whether a function module belongs to the default communication assembly, or default CA. When enforcement is active, a module outside that assembly is rejected. Allowed modules remain subject to S_RFC and any functional checks in their code.
The described UCON scenario is available for AS ABAP 7.4 and later. Configure it through UCONCOCKPIT, or UCONPHTL for the relevant earlier support-package levels. Internal RFC for asynchronous processing and load distribution is not restricted by this scenario.
Three rollout phases
- Logging. Collect usage without blocking calls. The default observation period is three months, but it must cover actual business cycles, period-end processing and administration.
- Evaluation. Simulate runtime checks. Calls outside the allowlist continue but generate alerts for review.
- Final. Enforce the control. Modules outside the allowlist are blocked regardless of user authorizations.
Ongoing maintenance
Do not rely solely on test-system observations: some integrations run only in production. UCON data helps identify the source system, initiator, destination, executing user and frequency of use.
Manage systems individually or transport the default CA and phase information. Newly introduced functions enter the logging phase. Large reductions in exposed functions are possible, but the achievable reduction depends on the system’s actual integration requirements.
Review checklist
- Start collecting data before finalizing the allowlist.
- Include infrequent processes and period-end activities.
- Review missing functions during evaluation.
- Include new modules and system updates in ongoing maintenance.