Production system compliance-SOX

[Former Member]

Hi Experts,

Am raising this question for a SOX compliance issue in our ECC production system.

As per SOX compliance guideline we should not use DDIC user except transport and we are not using DDIC anywhere in our production environment.

Recently in transaction ST03N we have found that report/program sapstartsrv has been called out with user DDIC via RFC calls which includes function modules RFCPING & TH_GET_PARAMETER

Kindly give your suggestions on the below

1. Why program sapstartsrv has been called out with DDIC user with internal RFC destination?

2. How do we prevent this?

Thanks,

Preetha Balan

[matej_koudelka · Accepted solution]

Hi Preetha,

have you found answer to this DDIC log entry ?

We are currently investigating the same thing on our system.

Thanks,

Matěj

[Former Member · Accepted solution]

Hi Matej,

We have raised a OSS message to SAP and below is the response, hope this will help you

==========================================================

There are few web methods in sapstartsrv that

connect to the local ABAP instance

via RFC to call certain function modules.

Corresponding webmethods calling these function modules are:

GetProcessParameter, SetProcessParameter,

SetProcessParameter2, ABAPAcknowledgeAlerts, ABAPGetComponentList,

ABAPCheckRFCDestinations.

These webmethods are used for certain User actions in SAP MMC / MC and

sapcontrol.  In recent releases

a MYSAPSSO2 ticket for the user defined by profile parameter

#rdisp/start_service_user# (default 000/DDIC)

is used, or the caller of the webmethod needs to provide a different

ABAP user and password.

This is why you have seen DDIC in the ST03 statistics and SM20 logs.

===========================================================

Thanks,

Preetha Balan

[matej_koudelka · Accepted solution]

Thank you very much Preetha.

[matej_koudelka · Accepted solution]

Hello experts,

I would like to set parameter rdisp/start_service_user to different value than the default value DDIC.

Does anybody know what kind of permissions in ABAP would the user need to function properly?

Thank you,

Matěj

[Former Member]

Adding to the above post, we are getting the below trace details in the audit log

Regards,

Preetha Balan

[manumohandas82]

Hi Preetha ,

SAPMSSY1 is an event controlled program

Have you configured the solution manager system to communicate with the current system  ?.

If yes , Check the RFC connections ( in SM59 ) with the solution manager and check whether  using DDIC user  is used for the communication .

Thanks ,

Manu

[Former Member]

Hi Manu,

Yes the system is configured with solution manager, but there are no RFC connection with DDIC user.

Thanks,

Preetha Balan

[manumohandas82]

Hi Preetha ,

Have you scheduled any Background  Jobs  ( Basis Standard Jobs ) using the user DDIC  .  [ You might need to go through each  job -> step to find out this ]

Have you recently done any upgrade / Patching operations using the SUM tool

?

Thanks ,

Manu

[Former Member]

Yes Manu, we did upgrade from ehp4 to ehp7. But there are only import jobs that are running using DDIC.

Thanks,

Preetha Balan