C_SEC_2405 Leak Questions

Context:Identity Authentication Service (IAS) supports secure user authentication and enables Single Sign-On (SSO) across systems.

Solution Descriptions:

Authentication: Verifies user credentials and identity.

Single Sign-On (SSO): Allows seamless login across SAP and third-party systems without requiring multiple authentications.

SAP Security References:

SAP Identity Authentication Service (IAS) Guide

SAP SSO Configuration Documentation

To enforce an additional authorization check when a user starts an SAP transaction, you need to assign the specific authorization object to the transaction code. This ensures that the system performs an extra check against the user's authorizations before allowing access to the transaction.

Use Transaction SU24:

SU24 is the transaction used to maintain authorization default data for transactions and other executables. It allows you to assign authorization objects to transactions and set the check indicators.

Assign Authorization Object S_START:

Authorization Object S_STARTis used to control the start of transactions. By assigning this object to a transaction code, you can specify additional checks based on the Program ID and Object Type.

In SU24, navigate to the desired transaction code and add S_START to its list of authorization objects.

Specify Program ID and Object Type:

Within the authorization object S_START, set theProgram IDandObject Typefields to define the scope of the check.

This setup ensures that when a user attempts to start the transaction, the system checks for the specified authorizations in their user profile.

SAP Security References:

SAP Help Portal:Authorization Checks and SU24 Maintenance

SAP Documentation:Using Authorization Object S_START for Transaction Start Checks

SAP Note:Best Practices for Maintaining Authorization Data with SU24

Context:SAP Security Baseline provides a framework for securing SAP systems. Identifying baseline gaps requires solutions designed for configuration, performance, and system hardening insights.

Solution Descriptions:

SAP Code Vulnerability Analyzeris designed to detect vulnerabilities in application code but does not assess the Security Baseline directly.

SAP EarlyWatch Alert,SAP Security Optimization Service, andSAP Security Notesdirectly provide recommendations or insights relevant to the baseline.

SAP Security References:

SAP Security Baseline Documentations

SAP Help Portal for Security Optimization and Notes Guidelines

Context:Transaction SU24 is used to maintain the link between transactions and authorization objects, ensuring automated role generation.

Solution Explanation:

By setting theDefault Status to "Yes"in SU24, the system automatically includes required authorizations when the custom transaction is added to a role in PFCG.

SAP Security References:

SAP SU24 Maintenance Guide

SAP Custom Transaction Authorization Guidelines