SAP Standard Report RSUSR003 Secuirty Voilation and Fix

SCN Blog Post for SAP ABAP Report RSUSR003 Security Violation And Fix

Changing SAP Transport Request Number Range in SAP landscape

There could be a requirement in your client side to change SAP transport request number range and they would ask you to change/block certain range of transport request number in your sap landscape.

As a basis administrator you must know how to get this done and I will tell you below how to do it.

SAP standard table E070L is the place where your last transport request are stored and referred by sap while creating new transport request.

TRKORR is the filed which contains last transport request of your landscape or in your development system where we will create transport requests.

Say for an example you have requirement to change/block next 1000 transport request in your landscape, so in this case you need to block next 1000 transport requests

Normally transport requests will be like below.

<SID>K90xxxx ex: R47K900015

We should update TRKORR table value to required number/TR value so next time when there is a TR creation request SAP will refer E070L table and TRKORR filed value and it will create next TR based on TRKORR field in it.

Here I will block R47K900015 to R47K901015

After update screen shots:

To achieve this we can follow 3 options since it’s a SAP standard table and it will not allow you to update it directly using table maintenance option tcodes like SE16, SE16N & SM30

1.  Get help from a ABAP programmer to help out on this to update the table value via program
2. Update the table filed value at OS level by small SQL query like how do you lock and unlock SAP* password reset activities
3. This is something backdoor method and its not recommended by sap, to do it go to SE16N tcode and enter E070L table and hit enter then you need to execute &SAP_EDIT in the tcode command box then it will enable edit option directly on table level, but you may face some security audit issues and this option is removed in EHP series

Above steps I performed in SAP 4.7 and used OS level SQL queries

SQL query for ORACLE DB:

update SAPR47.E070L set TRKORR='LEDK901012' where LASTNUM='TRKORR';

SQL query for MSSQL DB:

update <SID>.E070L set TRKORR = 'SIDK905223' where LASTNUM = 'TRKORR';

SAP Generate Access key

Sometimes we need to generate access key to make some changes/implement SAP note

You need to pop up screen shot or installation number, PgmID, Type and Object name details from the person who requested access keys

Go to service.sap.com and select “Keys & Requests” and click SSCR Keys like below screen shot

Once you navigated to new location, you will get below screen and select Register Object 

Select the installation number and enter PgmID, Type and Object name, click register to generate access key

You will get new access key based on above details which you got it from requester

SAP Post Installation Steps

Below are the steps needs to be performed as part of SAP post installation activities

1. Login to ddic username and execute SICK tcode

2. Goto RZ10 tcode and import the new profiles and add profile parameters according to your requirements

3.Execute slicense and install license for your system

4. Go to SE06 and select Standard Installation option hit execute, Click yes to initialize your CTS settings

5. Now goto STMS tcode and configure TMS

6. You can configure current system as DC(domain controller) or you can include into another domain, in this case I configure as domain controller

7. Now install SGEN i.e SAP load generator

8. Now go to SCC4 tcode and create a new client and perform client copy

9. After you created new client and make sure you copy ddic username and create new admin username and lock SAP* and DDIC usernames

10. Additionally you need to perform SAP Kernal upgrade as well as patching for OS and DB and check official installation guide in market place

SAP System Profile Parameter for SAP Security

Login System Profile paramenter for SAP Security:

Here is a set of system profile parameter required for SAP security and it will enhance the protection and we can have control over SAP login and below profile parameters are useful to implement SAP security in your landscape.

This is a 1st set of profile parameters and i will post next set of system profile paramter which is required for Basis and Security in upcoming post.

Profile parameter	Description	Default value	Recommended value
login/min_password_lng	Minimum password length for user password	3	3
login/password_expiration_time	Number of days between forced password change	0	90
Login/fails_to_session_end	Number of invalid logon attempts allowed before the SAP GUI is disconnected	3	3
Login/fails_to_user_lock	Number of invalid logon attempts within a day before the user id is automatically locked by the system	12	5
rdisp/gui_auto_logout	Time, in seconds, that SAPGUI is automatically disconnected because of in-activity	0	30
Auth/test_mode	Switch to report RSUSR400 for authority check	N	N
Auth/system_access_check_off	Switch off automatic authority check	N	N
Auth/no_check_in_some_cases	Special authorization checks turned off by customer	N	Y
Login/ext_security	Security access controlled by external software	N	N
Auth/rfc_authority_check	Permission for remote function calls from within ABAP programs	0	1
Login/failed_user_auto_unlock	Disable system function for automatic unlock of users at midnight	0	1
Login/no_automatic_user_sapstar	Disable ability to logon as SAP* with PASS of password when SAP* deleted	0	1
Auth/no_check_on_tcode	Disable check of S_TCODE on non-basis transactions	N	N
Auth/auth_number_in_userbuffer	Number of authorizations allowed in the user buffer	800	1000
Auth/authorization_trace	Every trace will be logged once in table USOBX	N	N
Auth/check_value_write_on	Write value for SU53 security checking/authorization failure	Y	Y

 Hope this document is helpful to you.

How To Implement SAP Note

How to implement SAP Note:

As a Basis administrator we need to implement SAP notes where there is a requirement from technical team or from functional team to fix an bug in a program.

SAP note is nothing but an program fix which is released by SAP to all users or specific users

There are some consideration/prerequisites check needs to be performed while you do SAP note implementation because.

For an example below note 1896115 used to fix an LSMW error, so we should know or check whether this note is compatible with our SAP release hence check component release provided in the SAP note document.

Follow below steps to implement sap note:

1. Go to SNOTE tcode and select “Goto” from the menu bar and select “SAP Note browser”  and enter the note number which you want to implement to check whether this note is already available in your system or not

2. Enter the note number which you want to implement and press F8 or click execute button and you will get above button which shows note number, description, component version, status, and importantly “Implementation Status”

3. You need to check all the above details and check Implementation Status whether this note can be implemented to your SAP release its compatible if it shows “Can be implemented” or it can be implemented and you need to notify concern team about the status

4. So above note can be implemented and now we need to proceed further to implement SAP note

5. Select the line which shows note number and details and go to “SAP Note” from the menu bar

6. Select “Implement SAP note” from SAP Note menu and you will get below screen

7. You will get a notification window which ask you whether you want to implement the SAP note and click “Yes” to continue

8. An pop up window will appear which shows what kind of fix its going to perform in your SAP system or it will ask you to do some series of steps(like step 10) to implement your SAP note you can click continue like below

9. It will ask you to create a TR which can be moved across your landscape and note down the TR

10. Then it will ask you to click the check box and click continue to perform the fix like below screens will appear

11. Click continue  and it will show you “active object generated” which means your SAP note is implemented in your system

12. You will redirected to below screen once it completed sap note implementation here you will notice status “In Progress” and “Implementation Status” as “Completely implemented” and you will see an message in the status bar “object activated”

13. Now double click the SAP note and you will get below screen to change status to completed

14. Click “Set Processing Status” to change “completed”, select completed option in the below window and hit continue

15. Now you can see Processing Status as “Finished”

16. Then come to initial screen of SNOTE tcode and browse the sap note number which we implemented and hit execute to double check the status and you will get below screen and status as “Completely Implemented”

17. That’s it you have done with SAP note implementation and make sure you release the TR which you created while implementing your SAP note to move the changes to landscape, now send an confirmation email to concern team about SAP note implementation completion

Please post your comments and share with your friends if you like this post.