Re: Post Upgrade: Search for New Authorization Checks Implemented and Impact

Well.. in the case of custom code, SU25 will not help you because SAP will not deliver anything for your custom transaction proposals. At most you would be able to reuse some proposals for BAPIs, if they had proposals and you were using a BAPI - which is not the case.

So yes, your options to spot this sort of thing is either:

1) Testing - despite having missed this opportunity in the regression testing you should still point out to the "functional expert" that testing an application should be done with authorizations to use the application correctly. It is also a part of the test, otherwise this sort of thing will happen. You must provoke the error by getting someone to execute the code with the correct authorizations for it.

2) Code scan - there is however no standard tool in SAP which will deliver this information about authority-checks which changed between two versions of the same program. I also had a discussion with the developers of SAP's "Vulnerability Scanner" tool and authorizations with SU24 connection are not in scope or focus. They are too close to the application itself and not a technical defect or vulnerability per se.

So we built our own tool for it to scan a call-stack for such things starting at the top object being a role, without having to execute the code in a test. There was no other way of doing it - or at least we could not find one nor any tool on the market capable of such an analysis.

Disclaimer: it is not freeware, so you would have to contact me offline or via "Direct Message" if you are interested. SCN is not a platform for commercial topics.

Cheers,

Julius