Programs without authorization objects

[Former Member]

Hi guys,

Do u know a way to list all SAP programs (standard and customized) that do not run authorization check when executed?

Thank you

[Former Member]

Hi,

You can check these details through program RSABAPSC. However you need to check one report at a time.

With abap report RPR_ABAP_SOURCE_SCAN you can execute a 'bulk scan' on abap code context (such as "AUTHORITY-CHECK") but only within ABAP programs.

or

1. Goto transaction se16 --> enter table name usobt

2. and in the resultant screen enter transaction code (in this case me21n) and press F8.

3. you can find all the authorization objects checked for a particular transaction.

PS: Apart from that some authorization are attached in SE93 also.

http://sap.ittoolbox.com/groups/technical-functional/sap-security/how-to-get-a-list-of-custom-abap-p...

Thanks,

Sri Sonia

[Former Member]

Hi,

Please check this post

also there is a good post on ITTOOLBOX answered in June.

Debug mode might be the best task but if you have lot of Customized task that will be a time consuming activity.

[Former Member]

There is no automated medication against this legacy ailment

Some checks are "remote" in function modules and ABAP OO methods, so you will not even necessarily see them in a code scan, nor whether and how the calling program reacts to the check result or "catches" it and then does something completely different ...

Even with tools (CodeInspector, CodeProfiler, etc) to analyze ABAP code, you need a programming guideline for developers to stick to and a human eye to spot security deviations or errors.

This is an [art form|/people/matthew.billingham/blog/2009/09/13/ancient-art-of-code-review] to do correctly and approach large numbers of programs in such a way that you can base it on risk and make "quick wins". For example, do you have generic includes?

Cheers,

Julius

[Former Member]

This message was moderated.

[Former Member]

Oops.... here is the correct link to the recording of [The ancient and noble art of code review|https://sap.emea.pgiconnect.com/p87357333/] by ABAP Guru Matt Billingham.

The other was the introduction song only...

FYI: Matt won the "Spot the security bug in the code" competition at the TechEd '09 in Vienna. He found more bugs in the code than what was intended to be found to win the prize

Cheers,

Julius