Hello People,
i have a small security issue that i need to solve, and currently i don't know how i should do it, but i'm sure you people can help : )
I have a Java Webservice that connects via JCo to my SAP System. For the JCo-Connection I made a config-File with a SAP-User Name to logon to the SAP System. This SAP-User has only permissions to write to specific tables etc, thats all good. The problem is that it should be checked by the SAP System who is calling the RFC Function, so that only certain users can execute the RFC Functions from the Webservice, but no one else. So for example if i change the username in my Webservice Config-File and the call a completely different RFC Function, SAP should block this call. Currently I am looking in the SNC but i'm not sure if setting SCN-Names for the webservice etc. is what I am looking for.
I hope i wrote my problem clearly and maybe you guys have some ideas!
Thank you very much,
Michael