SAP Supply Chain Management 70 Security GuideE

Security Guide PUBLIC
)µr÷@uÖ Ð−|³(â*G–7ëW¹ó>Òt¡˛q7`·ð=‹u,TÅqMÉX‚ƒ¸yìÞåGìÐpcX›ñt—B™ä=®
SAP SCM 7.0 Component Security Guide

Release 700
© Copyright 2014 SAP AG or an SAP affiliate company. Alle Rechte vorbehalten. All rights reserved. Tous droits
réservés. Все права защищены.
Weitergabe und Vervielfältigung dieser Publikation oder von Teilen daraus sind, zu welchem Zweck und in welcher
Form auch immer, ohne die ausdrückliche schriftliche Genehmigung durch SAP AG nicht gestattet. In dieser
Publikation enthaltene Informationen können ohne vorherige Ankündigung geändert werden.
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express
permission of SAP AG. The information contained herein may be changed without prior notice.
Some software products marketed by SAP AG and its distributors contain proprietary software components of other
software vendors. National product specifications may vary.
These materials are provided by SAP AG and its affiliated companies (“SAP Group”) for informational purposes only,
without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect
to the materials. The only warranties for SAP Group products and services are those that are set forth in the express
warranty statements accompanying such products and services, if any. Nothing herein should be construed as
constituting an additional warranty.
SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or
registered trademarks of SAP AG in Germany and other countries.
Please see www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices.
Please see www.sap.com/corporate-en/legal/copyright/index.epx for disclaimer information and notices.
PUBLIC
© Copyright 2014 SAP AG or an SAP affiliate company.
2 All rights reserved. SAP SCM 7.0 Component Security Guide
Typographic Conventions
Table 1
Example Description
<Example> Angle brackets indicate that you replace these words or characters with appropriate entries to
make entries in the system, for example, “Enter your <User Name>”.
Example Example Arrows separating the parts of a navigation path, for example, menu options
Example Emphasized words or expressions
Example Words or characters that you enter in the system exactly as they appear in the documentation
www.sap.com Textual cross-references to an internet address
/example Quicklinks added to the internet address of a homepage to enable quick access to specific
content on the Web
123456 Hyperlink to an SAP Note, for example, SAP Note 123456
Example ● Words or characters quoted from the screen. These include field labels, screen titles,
pushbutton labels, menu names, and menu options.
● Cross-references to other documentation or published works
Example ● Output on the screen following a user action, for example, messages
● Source code or syntax quoted directly from a program
● File and directory names and their paths, names of variables and parameters, and names
of installation, upgrade, and database tools
EXAMPLE Technical names of system objects. These include report names, program names, transaction
codes, database table names, and key concepts of a programming language when they are
surrounded by body text, for example, SELECT and INCLUDE
EXAMPLE Keys on the keyboard
PUBLIC
SAP SCM 7.0 Component Security Guide © Copyright 2014 SAP AG or an SAP affiliate company.
Typographic Conventions All rights reserved. 3
Document History
Caution
Before you start the implementation, make sure you have the latest version of this document. You can find the
latest version at the following location: service.sap.com/securityguide.
The following table provides an overview of the most important document changes.
Table 2
Version Date Description
1.0 2008-11-21 New version
1.1 2010-03-26 Update of List of SAP Notes
1.2 2014-07-18 Addition of chapter Data Protection
PUBLIC
© Copyright 2014 SAP AG or an SAP affiliate company. SAP SCM 7.0 Component Security Guide
4 All rights reserved. Document History
Content
1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2 Before You Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3 Technical System Landscape . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4 User Administration and Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

4.1 User Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.2 User Data Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4.3 Integration Into Single Sign-On Environments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
5 Authorizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5.1 Standard Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5.2 Roles for SAP APO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.3 Authorizations for SCM Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.4 Maintaining Authorizations for SAP APO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.5 Authorizations for Service Parts Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
5.6 Maintaining Authorizations for SAP Forecasting and Replenishment . . . . . . . . . . . . . . . . . . . . . . . . 23
5.7 Maintaining Authorizations for Integration with SAP Components . . . . . . . . . . . . . . . . . . . . . . . . . . 23
5.8 Maintaining Authorizations for Enterprise Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
6 Network and Communication Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

6.1 Communication Channel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
6.2 Network Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
6.3 Communication Destinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
7 Data Storage Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
8 Data Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
8.1 Deletion of Personal Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
9 Security for Additional Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
10 Enterprise Services Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
11 Other Security-Relevant Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
12 Trace and Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
A Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
A.1 Related Security Guides . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
A.2 Related Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
B Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
B.1 The Main SAP Documentation Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
PUBLIC
Content All rights reserved. 5
PUBLIC
1 Introduction
Caution
This guide does not replace the daily operations handbook that we recommend customers create for their specific
productive operations.
This document is not included as part of the Installation Guides, Configuration Guides, Technical Operation Manuals,
or Upgrade Guides. Such guides are only relevant for a certain phase of the software life cycle, whereby the Security
Guides provide information that is relevant for all life cycle phases.
Why is Security Necessary

With the increasing use of distributed systems and the Internet for managing business data, the demands on security
are also on the rise. When using a distributed system, you need to be sure that your data and processes support
your business needs without allowing unauthorized access to critical information. User errors, negligence, or
attempted manipulation on your system should not result in loss of information or processing time. These demands
on security also apply to SAP Supply Chain Management (SAP SCM). To assist you in securing your SAP SCM
component, we provide this Component Security Guide.
Recommendation
We strongly recommend that you also consult the SAP NetWeaver Security Guide.
About This Document

This Security Guide provides an overview of the security-relevant information that applies to SAP SCM. It covers the
following parts of the component:
● SAP SCM 7.0 Server
○ SAP Advanced Planning and Optimization (SAP APO)
○ SAP SCM Optimizer (optional SAP APO component)
○ Embedded SAP BI 7.0 (only used and required for the SAP APO 7.0 component within SAP SCM 7.0)
● Third party software: PTV eServer for SAP SCM 7.0
Overview of the Main Sections

The Security Guide comprises the following main sections:
● Before You Start
This section contains information about why security is necessary, how to use this document, and references
to other Security Guides that build the foundation for this Security Guide.
● Technical System Landscape
This section provides an overview of the technical components and communication paths that are used by the
SAP SCM component.
● User Administration and Authentication
This section provides an overview of the following user administration and authentication aspects:
○ Recommended tools to use for user management.
PUBLIC
Introduction All rights reserved. 7
○ User types that are required by the SAP SCM component.
○ Standard users that are delivered with the SAP SCM component.
○ Overview of the user synchronization strategy, if several components or products are involved.
○ Overview of how integration into Single Sign-On environments is possible.
● Authorizations
This section provides an overview of the authorization concept that applies to the SAP SCM component.
● Network and Communication Security
This section provides an overview of the communication paths used by the SAP SCM component and the
security mechanisms that apply. It also includes our recommendations for the network topology to restrict
access at the network level.
● Data Storage Security
This section provides an overview of any critical data that is used by the SAP SCM component and the security
mechanisms that apply.
● Security for Third-Party or Additional Applications
This section provides security information that applies to third-party or additional applications that are used
with the SAP SCM component.
● Other Security-Relevant Information
This section contains information about:
○ User Frontend
○ Enterprise Services
○ Virus Check of Document Attachments
● Trace and Log Files
This section provides an overview of the trace and log files that contain security-relevant information, for
example, so you can reproduce activities if a security breach does occur.
● Appendix
This section provides references to further information.
PUBLIC
8 All rights reserved. Introduction
2 Before You Start
Fundamental Security Guides

This Component Security Guide provides references to other documentation. You can find this security-relevant
documentation for the SAP SCM component as follows:
Table 3: Fundamental Security Guides and Documentation
Guide/Documentation Full Path to the Guide
SAP NetWeaver Security Guide service.sap.com/securityguide SAP NetWeaver 7.0

Security Guides (Complete)
SAP NetWeaver Documentation help.sap.com SAP NetWeaver SAP NetWeaver 7.0

(2004s) English SAP NetWeaver Library SAP
NetWeaver by Key Capability
SAP SCM Master Guide service.sap.com/instguides SAP Business Suite

Applications SAP SCM SAP SCM Server Using SAP SCM
7.0 Server Master Guide SAP SCM 7.0
SAP SCM Documentation help.sap.com SAP Business Suite SAP Supply Chain
Management SAP SCM 7.0 Application Help EN SAP
Supply Chain Management (SAP SCM)
SAP SCM Installation Guide service.sap.com/instguides SAP Business Suite

Applications SAP SCM SAP SCM Server Using SAP SCM
7.0 Server Installation Documentation SAP SCM 7.0
Related Security Guides

The following table provides an overview of all related Security Guides for this component.
Table 4: Related Security Guides
SAP Extended Warehouse Management Security Guide service.sap.com/securityguide SAP Extended
Warehouse Management
SAP Supply Network Collaboration Security Guide service.sap.com/securityguide SAP Supply Network
Collaboration
SAP Event Management Security Guide service.sap.com/securityguide SAP Event

Management
SAP Forecasting and Replenishment Security Guide service.sap.com/securityguide Industry Scenario

Security Guides SAP Forecasting and Replenishment
Security Guides for SAP NetWeaver Products

For the Security Guides mentioned below, see SAP Service Marketplace at service.sap.com/securityguide SAP
NetWeaver 7.0 Security Guides (Complete) SAP NetWeaver 7.0 Security Guides .
PUBLIC
Before You Start All rights reserved. 9
Table 5
Topic See
Security Guides for SAP NetWeaver According to Usage Types
Application Server (AS) ● SAP NetWeaver Application Server ABAP Security Guide
● SAP NetWeaver Application Server Java Security Guide
● Internet Transaction Server Security
● Interactive Forms Based on Adobe Software Security

Guide
EP Core (EPC) Portal Security Guide
Enterprise Portal (EP) Knowledge Management Security Guide

Collaboration Security Guide
Business Information (BI) SAP Business Information Warehouse Security Guide
Mobile Infrastructure (MI) SAP Mobile Infrastructure Security Guide
Security Guides for Standalone Engines
SAP Content Server SAP Content Server Security Guide
Operating System and Database Platforms
Operating System and Database Platforms Security Guides for the Operating System and Database
Platforms
SAP Max DB Security Guide ● on SAP Service Marketplace at:

service.sap.com/securityguide SAP NetWeaver 7.0
Security Guides (Complete) SAP NetWeaver 7.0
Security Guides Security Guides for the Operating
System and Database Platforms Database Access
Protection Max DB Security Guide
● on SAP Help Portal at help.sap.com SAP

NetWeaver SAP NetWeaver 7.0 (2004s) SAP
NetWeaver 7.0 Library EN SAP NetWeaver Library
SAP NetWeaver by Key Capability Application Platform
by Key Capability Databases MaxDB
Note
For a complete list of the available SAP Security Guides, see SAP Service Marketplace at service.sap.com/
securityguide.
Important SAP Notes

The most important SAP Notes that apply to the security of the SAP SCM component are shown in the table below.
Table 6: Important SAP Notes
SAP Note Number Title Comment
25591 Changing the DBM, SYSDBA and DBA This note provides information on
user passwords changing the passwords.
PUBLIC
10 All rights reserved. Before You Start
SAP Note Number Title Comment
30724 Data protection and security in SAP

Systems
128447 Trusted/Trusting Systems
305634 RFC destination for working globally with

the liveCache
400434 Authorizations in APO Demand Planning A brief explanation of the concept behind
authorizations in SAP APO for Demand
Planning
447543 APO: Authorizations too

comprehensive/not user-specific
498627 Global ATP: No logoff of user

RFC_USER from APO system
506314 SAPHTTP and SSL This note provides information on setting

up a secure connection (SSL) to the Web
server, with SAPHTTP.
510007 Setting-up SSL on the Web Application

Server ABAP
598860 Browsers supported by BSP
616555 liveCache >= 7.4: Password change
637052 Missing authorization object for

database views
669496 SCM 4.1 upgrade: Additional

authorization checks
683528 @stake, iDefense, Heise: SAP DB/ This note provides information about the
MaxDB security breaches secure operation of SAP DB/MaxDB and
liveCache.
727839 Authorization role for the SAP SCM –

SAP R/3 integration
792366 Subsequent implementation of a security

level for documents
821200 Standard user must be known to the DBM

server
1072949 Role for managing the liveCache and LCA

routines
1235367 Missing authority check in APO

transaction
1262016 Missing authority check in APO

transaction
PUBLIC
Before You Start All rights reserved. 11
Note
For more SAP Notes about security, see SAP Service Marketplace at the following locations:
● service.sap.com/security SAP Security Notes
● service.sap.com/securitynotes
Additional Information
For more information about specific topics, see the addresses on SAP Service Marketplace as shown in the table
below.
Table 7: Quick Links to Additional Information
Content Quick Link on the SAP Service Marketplace or SDN
Security sdn.sap.com/irj/sdn/security
service.sap.com/security
Security Guides service.sap.com/securityguide
Related SAP Notes service.sap.com/notes
Released Platforms service.sap.com/pam

service.sap.com/platforms
Network Security service.sap.com/securityguide
SAP Solution Manager service.sap.com/solutionmanager
SAP NetWeaver sdn.sap.com/irj/sdn/netweaver
PUBLIC
12 All rights reserved. Before You Start
3 Technical System Landscape
The following table lists where you can find more information about the technical system landscape.
Table 8: More Information About the Technical System Landscape
Topic Guide/Tool Quick Link to the SAP Service Marketplace
Technical System Landscape SAP SCM Master Guide service.sap.com/instguides SAP Business Suite
Applications SAP SCM SAP SCM Server Using
SAP SCM 7.0 Server Master Guide SCM 7.0
Technical System Landscape & SAP SCM Installation Guide(s) service.sap.com/instguides SAP Business Suite
Installation Applications SAP SCM SAP SCM Server Using
SAP SCM 7.0 Server Installation Guides
Installation Guide for SCM 7.0
Technical Configuration, High Technical Infrastructure Guide service.sap.com/installNW70

Availability
Security Security Guide service.sap.com/security
PUBLIC
Technical System Landscape All rights reserved. 13
4 User Administration and Authentication
The SAP SCM component uses the user management and authentication mechanisms provided with the SAP
NetWeaver platform, in particular the SAP NetWeaver Application Server ABAP. Therefore, the security
recommendations and guidelines for user administration and authentication as described in the SAP NetWeaver
Application Server ABAP Security Guide also apply to the SAP SCM component.
In addition to these guidelines, we include information about user administration and authentication that specifically
applies to the SAP SCM component in the following topics:
● User Management [page 14]
This topic lists the tools to use for user management, the types of users required, and the standard users that
are delivered with the SAP SCM component.
● User Data Synchronization [page 18]
The SAP SCM component shares user data with SAP NetWeaver. This topic describes how the user data is
synchronized with these other sources.
● Integration Into Single Sign-On Environments [page 18]
This topic describes how the SAP SCM component supports Single Sign-On mechanisms.
4.1 User Management
User management for the SAP SCM component uses the mechanisms provided by the SAP NetWeaver Application
Server ABAP), for example, tools, user types, and password policies. For an overview of how these mechanisms
apply for the SAP SCM component, see the sections below. In addition, we provide a list of the standard users required
for operating the SAP SCM component.
User Administration Tools

The table below shows the tools to use for user management and user administration with the SAP SCM component.
Table 9: User Management Tools
Tool Detailed Description Prerequisites
User Management for the ABAP Engine Use the user management transaction
(transaction SU01) SU01 to maintain users in ABAP-based
systems.
Profile Generator (transaction PFCG) Use the Profile Generator to create roles
and assign authorizations to users in
ABAP-based systems.
Central User Administration (CUA) Use the CUA to centrally maintain users
for multiple ABAP-based systems.
Synchronization with a directory server is
also supported.
PUBLIC
14 All rights reserved. User Administration and Authentication
Tool Detailed Description Prerequisites
User Management Engine (UME) Use the Web-based UME administration

administration console console to maintain users, roles and
authorizations in Java-based systems
that use the UME for the user store, for
example, the SAP J2EE Engine and the
Enterprise Portal. The UME also supports
various persistency options, such as the
ABAP Engine or a directory server.
SAP J2EE Engine user management Use the Visual Administrator to maintain
using the Visual Administrator users and roles on the SAP J2EE Engine.
The SAP J2EE Engine also supports a
pluggable user store concept. The UME is
the default user store.
SAP NetWeaver Identity Management 7.1 For an overview of the information

necessary for securing operations with
SAP NetWeaver Identity Management,
see the Security Guide available on the
SAP Help Portal at help.sap.com/
nw71 SAP NetWeaver Identity
Management 7.1 .
Note
For a detailed description of the user management tools available in SAP NetWeaver, see the SAP NetWeaver
Security Guide on SAP Service Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0 Security
Guides (Complete) User Administration and Authentication User Management in the section User
Management Tools.
User Types
It can be necessary to specify different security policies for different types of users. For example, your policy may
specify that individual users who perform tasks interactively have to change their passwords on a regular basis, but
not those users under which background processing jobs run.
The user types that are required for the SAP SCM component include:
● Individual users:
○ Dialog users are used for individual, interactive system access.
● Technical users comprise the following types:
○ Service users are dialog users that are available to a larger, anonymous group of users.
○ Communication users are used for dialog-free communication for external RFC calls.
Note
For more information about these user types, see the SAP NetWeaver Security Guide on SAP Service
Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides (Complete)
User Administration and Authentication User Management in the section User Management Tools.
PUBLIC
User Administration and Authentication All rights reserved. 15
Standard Users
The following table shows the standard users that are necessary to operate SAP SCM 7.0:
Table 10: Standard Users
System User ID Delivered? Type Default Password Detailed Description
SAP SCM 7.0 <sapsid>adm Yes SAP System To be entered SAP SCM Installation
Server Administrator Guide Installation Document
– SCM Server 7.0 <Operating
System / DB> Installation
Documentation
SAP SCM 7.0 SAPService Yes SAP System To be entered SAP SCM Installation
Server <sapsid> Service Guide Installation Document
Administrator – SCM Server 7.0 <Operating
System / DB> Input for the
Installation
SAP Web AS SAP Standard Yes See SAP See SAP NetWeaver SAP NetWeaver Security
ABAP Users NetWeaver Security Guide Guide Security Guides for SAP
(SAP*, DDIC, Security Guide NetWeaver According to Usage
EARLYWATCH, Types Security Guide for
SAPCPIC) Usage Type AS SAP
NetWeaver Application Server
ABAP Security Guide User
Authentication Protecting
Standard Users
SAP Web AS SAP Standard Yes See SAP See SAP NetWeaver SAP NetWeaver Security
J2EE Users NetWeaver 7.0 7.0 Security Guide Guide Security Guides for SAP
(Administrator, Security Guide NetWeaver According to Usage
Guest, Types Security Guide for
Emergency) Usage Type AS SAP
NetWeaver Application Server
Java Security Guide User
Administration and
Authentication User
Administration and Standard
Users Standard Users and
Standard User Groups
SAP J2EE SAPJSF Yes Communication To be entered SAP SCM Installation

Engine user Guide Installation Document
– SCM Server 7.0 <Operating
System / DB> Installation
Process Input for the
Installation
SAP SCM 7.0 RFC No Communication The authorizations Communication

communication user of the user depend Destinations [page 28] and
users (you need on the business Authorizations [page 20]
an RFC case. For more
communication information, see
PUBLIC
user for each Authorizations

RFC destination [page 20] in this
in the section Security Guide.
Communication
Destination)
SAP SCM 7.0 Business No Dialog user To be entered SAP SCM 7.0 documentation
processing users and Authorizations [page 20]
(you need a user
in each
component, for
each employee
working with the
system)
SAP liveCache <lcid>adm Yes Operating system To be changed SAP SCM Installation Guide:
user Installation Document – SCM
Server 7.0 <relevant Operating
System / DB> Post
Installation Activities
Changing Passwords of Created
Users and SAP Notes 25591
and 616555.
SAP liveCache SAP<sapsid> Yes MaxDB database To be changed SAP SCM Installation Guide:
liveCache user Installation Document – SCM
database owner Server 7.0 <relevant Operating

System / DB> Post
and 616555.
SAP liveCache CONTROL Yes MaxDB database To be changed SAP SCM Installation Guide:
liveCache user Installation Document – SCM
database Server 7.0 <relevant Operating
manager System / DB> Post

operator Installation Activities
and 616555.
SAP liveCache SUPERDBA Yes MaxDB database To be changed SAP SCM Installation Guide:
user Installation Document – SCM
Server 7.0 <relevant Operating
System / DB> Post
PUBLIC
liveCache Users and SAP Notes 25591

administration and 616555.
user
Recommendation
We recommend that you change the user IDs and passwords that are automatically created during installation.
4.2 User Data Synchronization
To avoid administrative effort, you can use user data synchronization in your system landscape. Since the SAP
SCM component is based on SAP NetWeaver, all the mechanisms for user data synchronization of SAP
NetWeaver are available for SAP SCM.
Note
For information about user data synchronization, see the SAP NetWeaver 7.0 Security Guide on SAP Service
Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides (Complete) User
Administration and Authentication Integration of User Management in Your System Landscape .
4.3 Integration Into Single Sign-On Environments
The SAP SCM component supports the Single Sign-On (SSO) mechanisms provided by SAP NetWeaver. Therefore,
the security recommendations and guidelines for user administration and authentication as described in the SAP
NetWeaver Security Guide also apply to the SAP SCM component.
Note
For more information about integration into Single Sign-On environments based on SAP NetWeaver, see the SAP
NetWeaver 7.0 Security Guide on SAP Service Marketplace at service.sap.com/securityguide SAP
NetWeaver 7.0 Security Guides (Complete) User Administration and Authentication User Authentication and
Single Sign-On in the section Integration into Single Sign-On Environments.
For more information about authentication on the SAP Web application server ABAP, see the SAP NetWeaver
7.0 Security Guide on SAP Services Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0
Security Guides (Complete) Security Guides for SAP NetWeaver According to Usage Types Security Guide for
Usage Type AS SAP NetWeaver Application Server ABAP Security Guide User Authentication .
The most widely-used supported mechanisms are listed below.

● Secure Network Communications (SNC)
SNC is available for user authentication and provides for an SSO environment when using the SAP GUI for
Windows or Remote Function Calls.
For more information, see the SAP NetWeaver 7.0 Security Guide on SAP Service Marketplace at
service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides (Complete) SAP NetWeaver 7.0
PUBLIC
Security Guides Network and Communication Security Transport Layer Security Secure Network
Communications (SNC) .
● SAP logon tickets
The SAP SCM component supports the use of logon tickets for SSO when using a Web browser as the frontend
client. In this case, users can be issued a logon ticket after they have authenticated themselves with the initial
SAP system. The ticket can then be submitted to other systems (SAP or external systems) as an authentication
token. The user does not need to enter a user ID or password for authentication but can access the system
directly after the system has checked the logon ticket.
Security Guides User Administration and Authentication User Authentication and Single Sign-On .
● Client certificates
As an alternative to user authentication using a user ID and passwords, users using a Web browser as a frontend
client can also provide X.509 client certificates to use for authentication. In this case, user authentication is
performed on the Web server using the Secure Sockets Layer Protocol (SSL Protocol) and no passwords have
to be transferred. User authorizations are valid in accordance with the authorization concept in the SAP system.
Security Guides User Administration and Authentication User Authentication and Single Sign-On .
PUBLIC
5 Authorizations
The SAP SCM component uses the authorization concept provided by SAP NetWeaver. Therefore, the
recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP
also apply to the SAP SCM component.
The SAP NetWeaver authorization concept is based on assigning authorizations to users based on roles. For role
maintenance, you can use the Profile Generator (transaction PFCG) when using ABAP.
Note
For information about role maintenance and the Profile Generator, see SAP Help Portal at help.sap.com SAP
NetWeaver SAP NetWeaver 7.0 (2004s) English SAP Library SAP NetWeaver Library SAP NetWeaver by
Key Capability Security Identity Management Users and Roles (BC-SEC-USR) SAP Authorization
Concept Organizing Authorization Administration Organization if You Are Using the Profile Generator Role
Maintenance .
Note
For information about the authorization concept of SAP NetWeaver, see SAP Help Portal at help.sap.com
SAP NetWeaver SAP NetWeaver 7.0 (2004s) English SAP Library SAP NetWeaver Library SAP
NetWeaver by Key Capability Security Identity Management Users and Roles (BC-SEC-USR) SAP
Authorization Concept .
5.1 Standard Roles
With the SAP SCM component, SAP delivers SAP standard roles to cover the common business cases. These roles
can be used as examples, or as a copy master for your own roles.
Using input help, you can find the SAP standard roles in the Profile Generator (transaction code PFCG). You can use
search terms to restrict the selection to the required standard roles. For example, the search term *APO* lists all
APO-relevant SAP standard roles. The role short text helps you find the role for your business needs. The role
documentation provides you with a detailed description of the role content.
Some of the components in SAP SCM have additional authorization methods. The relevant components and
Customizing activities are shown in the following sections.
We strongly recommend that you conservatively assign the authorization profiles SAP_ALL and SAP_NEW to users
in your production system! If you are not careful, these profiles can weaken the overall security concept in your
production system.
PUBLIC
20 All rights reserved. Authorizations
5.2 Roles for SAP APO
For information about roles in SAP APO, see SAP Help Portal at help.sap.com SAP Business Suite SAP Supply
Chain Management (SAP SCM) SAP SCM 2007 Application Help EN SAP Supply Chain Management (SAP
SCM) SAP Advanced Planning and Optimization (SAP APO) Roles for SAP APO .
5.3 Authorizations for SCM Basis
Authorization object /SCMB/PESL – Define PSM Selection

The system uses the authorization object /SCMB/PESL on the Define Selection screen of the Planning Service
Manager. The authorization object enables users to save and delete their selections.
Defined fields
The fields ACTVT and USER are available to maintain the authorization object /SCMB/PESL.
● You can choose the following activities for the ACTVT fields:
○ 06 (Delete): Delete a Selection
○ 34 (Save): Save a Selection (Create and Change)
● In the USER field, you can enter the user for whose selection you want to execute the activities in the ACTVT
field.
5.4 Maintaining Authorizations for SAP APO
Procedure
This procedure allows you to maintain authorizations for SAP Advanced Planning & Optimization (SAP APO).
Maintaining Master Data

1. In Customizing for SAP SCM, to define iPPE user profiles, choose Advanced Planning and Optimization
Master Data Integrated Product and Process Engineering (iPPE) Settings for the iPPE Workbench
Professional Define User Profiles for the iPPE Workbench Professional .
2. Change the iPPE user profiles defined by SAP in this Customizing activity by changing, copying, renaming, or
creating new user profiles.
The SAP system includes the following user profiles:
Table 11: Standard User Profiles
User Profile Explanation
S_PPEALL (Total Display) This profile includes all the settings you need to work with
the iPPE Workbench.
S_ASTACT (Process Structure) Part of the S_PPEALL profile; calls up a process structure
as a selection tree in the detail area of the iPPE Workbench.
PUBLIC
Authorizations All rights reserved. 21
User Profile Explanation
S_ASTCMP (Product Structure) Part of the S_PPEALL profile; calls up a product structure
as a selection tree in the detail area of the iPPE Workbench.
S_ASTFLO (Factory Layout) Part of the S_PPEALL profile; calls up a line structure as a
selection tree in the detail area of the iPPE Workbench.
3. Change, copy, and rename the profiles, or create new profiles with the following options:
○ Model Definitions:
You define how the model definitions between the objects are displayed in the navigation area.
○ Product Lifecycle Management (PLM) Environment:
Here you define how objects from the PLM environment are displayed in the navigation area of the iPPE
Workbench.
○ Reports:
You define the reports to be available for this profile in the iPPE Workbench Professional. You can only
choose reports that you have already defined in the activity Define Reports for the Reporting Tree.
4. Save your entries.
Maintaining Authorizations for Supply Chain Planning

1. In Customizing for SAP SCM, to specify the person (planner) responsible, choose Advanced Planning and
Optimization Supply Chain Planning Specify the Person (Planner) Responsible .
2. To assign planning privileges to planners, you have to maintain the applications for which each planner is
responsible as follows:
1. Choose New Entries.
2. Enter an identifier and description for each planner.
3. Select each area for which you want the planner to have privileges.
Maintaining Authorizations for Supply Network Planning and Demand Planning

As of SAP SCM 4.1, planning books within Supply Network Planning (SNP) and Demand Planning (DP) have a new
authorization concept. The main advantage is that the creation of the modification of planning books is controlled
by authorizations and not by the system change option for the SAP APO component.
For more information about the authorization concept, see the SAP Note 400434.
Note
Passwords / RFC Interface SAP APO does not use passwords; access is granted using RFC interfaces.
Trace Reads / Gateway User

The optimizers of SAP APO write traces (or dumps) to the local hard disk of the optimization server. The log folder
of the local RFC Gateway is used. To protect this data, the read to the traces should be restricted to the gateway
user.
Passwords / RFC Interface

SAP APO does not use passwords; access is granted using RFC interfaces.
PUBLIC
5.5 Authorizations for Service Parts Planning
Assigning Planners in Service Parts Planning

In Service Parts Planning (SPP), you can assign users to various planners at the location product level. For more
information, see the SPP documentation on SAP Help Portal at help.sap.com SAP Business Suite SAP Supply
Chain Management SAP SCM 7.0 Application Help EN SAP Supply Chain Management (SAP SCM) SAP
Advanced Planning and Optimization (SAP APO) Service Parts Planning (SPP) Master Data and General Functions
for SPP Assigning Planners in Service Parts Planning .
Roles in Service Parts Planning

For information about roles in SPP, see the SAP SCM documentation on SAP Help Portal at service.sap.com
SAP Business Suite SAP Supply Chain Management SAP SCM 7.0 Application Help EN SAP Supply Chain
Management (SAP SCM) SAP Advanced Planning and Optimization (SAP APO) Roles for SAP APO Roles for
Service Parts Planning (SPP) .
5.6 Maintaining Authorizations for SAP Forecasting and

Replenishment
Procedure
For information about maintaining authorizations for SAP Forecasting and Replenishment, see the SAP Forecasting
and Replenishment Security Guide on SAP Service Marketplace at service.sap.com/securityguide Industry
Scenario Security Guides .
5.7 Maintaining Authorizations for Integration with SAP

Components
Procedure
Maintaining Authorizations for SAP APO – SAP ERP Integration

Using Standard Roles for SAP APO – SAP ERP Integration
To integrate SAP APO and SAP ERP / SAP DIMP, use the following authorization roles for the RFC destination users,
which are provided in SAP Note 727839:
● SAP_SCM_INTEGRATION_SCM.SAP Authorization role for the SAP SCM – SAP ERP / SAP DIMP integration for
background users in SAP SCM.
● SAP_SCM_INTEGRATION_R3.SAP Authorization role for the SAP SCM – SAP ERP integration for background
users in SAP ERP.
● SAP_SCM_INTEGRATION_DIMP.SAP Authorization role for the SAP SCM – SAP DIMP integration for
background users in SAP DIMP.
PUBLIC
Note
For more information about the authorization roles for SAP APO – SAP ERP integration, see SAP Note 727839.
Maintaining Authorizations for Available to Promise (ATP)

Available to Promise plays an important role in the integration of SAP APO and SAP ERP: The ATP check needs an
RFC connection with a dialog user to perform the check. Since a dialog user within RFC connections is a safety flaw,
you must minimize this flaw by performing the following steps:
1. Create a separate trusted system RFC connection for the ATP check.
Note
For more information about trusted system RFC connections, see the SAP NetWeaver Security Guide on SAP
Service Marketplace at service.sap.com SAP NetWeaver SAP NetWeaver 7.0 (2004s) English SAP
Library SAP NetWeaver Library SAP NetWeaver by Key Capability Security SAP NetWeaver
Security Security Guides for Connectivity and Interoperability Technologies RFC/ICF Security Guide
RFC Scenarios RFC Communication Between SAP Systems Network Security and Communication
Using RFC Trusted System Networks .
2. In Customizing for Integration with SAP Components, to assign the RFC connection to the ATP application,
choose Integration via Core Interface (CIF) Basic Settings for Creating the System Landscape Assign RFC
Destinations to Various Application Cases .
3. For each SAP ERP user, create a corresponding ATP user in SAP SCM.
4. Assign one or more of the following authorization roles to the user(s) in SAP SCM:
○ SAP_APO_ATP_CO (APO: ATP Controller)
○ SAP_APO_ATP_CU (APO: ATP Customizing User)
○ SAP_APO_ATP_EU (APO: ATP Expert User)
○ SAP_APO_ATP_SU (APO: ATP Standard User)
○ SAP_APO_ATP_RSP_ALL (APO: ALL ATP Authorizations)
5. Assign the authorization S_RFCACL_ALL to the users in SAP SCM.
This authorization is necessary to perform RFC calls.
Note
For more information about the role maintenance and the SAP Profile Generator, see the SAP NetWeaver
7.0 Security Guide on SAP Help Portal at help.sap.com SAP NetWeaver SAP NetWeaver 7.0
(2004s) SAP NetWeaver 7.0 Library SAP NetWeaver Library SAP NetWeaver by Key Capability
Security Identity Management Users and Roles (BC-SEC-USR) SAP Authorization Concept Organizing
Authorization Administration Organization if You Are Using the Profile Generator Role Maintenance .
Maintaining Authorizations for Data Transfer to SAP NetWeaver BI

Limiting Authorizations for Extraction
Note
You can exclude DataSources from the extraction to SAP NetWeaver BI. Data that is stored in the extract structure
of this DataSource cannot be transferred to SAP NetWeaver BI.
PUBLIC
1. In Customizing for Integration with SAP Components choose Data Transfer to the SAP Business Information
Warehouse General Settings Limit Authorizations for Extraction .
2. Choose New Entries.
3. Choose a DataSource that you want to exclude from the extraction.
4. Choose the SAP NetWeaver BI system for which you want no more data for this DataSource to be extracted.
5. In the field Excl. Extr., enter whether you want to exclude the DataSource from the extraction.
7. Specify a transport request.
5.8 Maintaining Authorizations for Enterprise Services
Accessing SAP functions via Web services follows the standard SAP authorization concept, which is based on
authorizations for specific authorization objects. During the execution of a Web service, the system checks for the
required authorization for an authorization object. If a user does not have this authorization, the execution is
terminated, and an error message is displayed.
Enterprise services use standard authorization objects, such as authorization default values for Web services, that
are available for SAP SCM. In addition, you need the authorization S_SERVICE to start external services. To create
and use Web services, you need the authorizations that belong to the role SAP_BC_WEBSERVICE_ADMIN and
authorization for the Internet Communication Framework (S_ICF_ADMIN).
For more information about authorizations for Web services, see the SAP NetWeaver documentation on SAP Help
Portal at help.sap.com SAP NetWeaver SAP NetWeaver 7.0 (2004s) Development Developer’s Guide in
SAP Library SAP NetWeaver Developer’s Guide Fundamentals Using JavaCore Development Tasks Providing
and Consuming Web Services Web Service Toolset Web Services Security Authorization .
PUBLIC
6 Network and Communication Security
Your network infrastructure is important in protecting your system. Your network needs to support the
communication necessary for your business and your needs without allowing unauthorized access. A well-defined
network topology can eliminate many security threats based on software flaws (at both the operating system and
application level) or network attacks such as eavesdropping. If users cannot log on to your application or database
servers at the operating system or database layer, then there is no way for intruders to compromise the machines
and gain access to the backend system’s database or files. Additionally, if users are not able to connect to the server
LAN (local area network), they cannot exploit well-known bugs and security holes in network services on the server
machines.
The network topology for the SAP SCM component is based on the topology used by the SAP NetWeaver platform.
Therefore, the security guidelines and recommendations described in the SAP NetWeaver Security Guide also apply
to the SAP SCM component. Details that specifically apply to the SAP SCM component are described in the following
topics:
● Communication Channel Security [page 26]
This topic describes the communication paths and protocols used by the SAP SCM component.
● Network Security [page 27]
This topic describes the recommended network topology for the SAP SCM component. It shows the appropriate
network segments for the various client and server components and where to use firewalls for access protection.
It also includes a list of the ports needed to operate the SAP SCM component.
● Communication Destinations [page 28]
This topic describes the information needed for the various communication paths, for example, which users
are used for which communications.
For more information, see the following sections in the SAP NetWeaver Security Guide on SAP Service Marketplace
at service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides (Complete) SAP NetWeaver Security
Guide :
● Security Guides for Connectivity and Interoperability Technologies
6.1 Communication Channel Security
Since communication channels transfer your business data, they should be protected against unauthorized access.
SAP offers general recommendations to protect your system landscape, which is based on SAP NetWeaver.
Caution
You should activate the Secure Network Communication (SNC) in all communication channels in SAP SCM to
achieve a secure system landscape.
For more information, see SAP Service Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0
Security Guides (Complete) SAP NetWeaver 7.0 Security Guide Network and Communication Security
Transport Layer Security Secure Network Communications .
PUBLIC
26 All rights reserved. Network and Communication Security
For a detailed description of all communication channels within the SAP SCM component, see SAP Service
Marketplace at service.sap.com/scm SAP SCM Technology Architecture Overview .
Note
For more information about the communication security of SAP NetWeaver, see the SAP NetWeaver Security
Guide on SAP Service Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides
(Complete) SAP NetWeaver 7.0 Security Guide Network and Communication Security .
For more information about security aspects for connectivity and interoperability of SAP NetWeaver 7.0, see the
SAP NetWeaver Security Guide on the SAP Service Marketplace at service.sap.com/securityguide SAP
Weaver 7.0 Security Guides (Complete) SAP NetWeaver 7.0 Security Guide SAPNet Security Guides for
Connectivity and Interoperability .
SAP SCM – SAP ERP

The integration of SAP SCM and SAP ERP is technically based on the Core Interface (CIF). Since CIF is technically
based on the RFC provided by SAP NetWeaver, we strongly recommend that you consult the SAP NetWeaver
Security Guide regarding communication channel security.
You should at least enable Secure Network Communication (SNC) while configuring the RFC destination for your
SAP SCM – SAP ERP integration.
Note
For more information about the integration of SAP SCM and SAP ERP, see the SCM Basis Documentation at
help.sap.com SAP Business Suite SAP Supply Chain Management SAP SCM 7.0 Application Help
EN SCM Basis Integration via Core Interface (CIF) Technical Integration .
6.2 Network Security
Your network infrastructure plays a key role in protecting your system. A well-defined network topology can eliminate
many security threats based on software flaws (at the operating system and application level) or network attacks
such as eavesdropping.
We offer general recommendations to protect your system landscape, based on SAP NetWeaver.
Note
For information about network security for SAP NetWeaver 7.0, see the SAP NetWeaver 7.0 Security Guide on
SAP Service Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides
(Complete) SAP NetWeaver 7.0 Security Guides Network and Communication Security .
A minimum security demand for your network infrastructure is the use of a firewall for all your services that are
provided over the Internet.
A more secure variant is to protect your systems (or groups of systems) by locating the system groups in different
network segments. Each system group has a firewall that protects it from unauthorized access. External security
attacks can also come from the inside, if the intruder has already taken control of one of your systems.
PUBLIC
Network and Communication Security All rights reserved. 27
Note
For information about the technical components of your SAP SCM component, see SAP Service Marketplace at
service.sap.com/scm SAP Supply Chain Management SAP SCM Technology .
Note
For information about access control using firewalls, see the SAP NetWeaver 7.0 Security Guide on SAP Service
Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides (Complete) SAP
NetWeaver 7.0 Security Guides Network and Communication Security Using Firewall Systems for Access
Control .
Network Security for Enterprise Services

For more information about network security for Web services, see the SAP NetWeaver documentation on SAP Help
Portal at help.sap.com SAP NetWeaver SAP NetWeaver 7.0 (2004s) SAP NetWeaver 7.0 Library EN SAP
NetWeaver Library SAP NetWeaver Developer’s Guide Fundamentals Using Java Core Development Tasks
Providing and Consuming Web Services Web Service Toolset Web Services Security .
6.3 Communication Destinations
Caution
If communication destinations are not implemented and used with care, their users and authorizations can cause
high security flaws.
The following is a list of the “Golden Rules” for connection users and authorizations:
● Choose user type: <system>.
● Assign only the minimum required authorizations to the user.
● Choose a secure and secret password for the user.
● Store only connection user log-on data for users of type <system>.
● Choose trusted system functionality whenever possible, rather than storing connection user log-on data.
The table below shows an overview of the communication destinations used by the SAP SCM 7.0 component.
Table 12: Connection Destinations
Destination Delivered Type User, Authorizations Description
SAPOSCOL_ Yes RFC – TCP/IP SAP SCM Customizing:

<DB_hostname> SCM Installation Guide –
SCM Server 7.0 Operating
(SAP SCM central instance
System Post-Installation
– DB instance)
Activities Checking the RFC
Destination .
SAP APO Supply Chain No RFC – ERP SAP SCM Customizing:

Cockpit (SCC) SAP Advanced Planning and
Business Warehouse Optimization Supply Chain
(BW) Cockpit (SCC) Define
PUBLIC
28 All rights reserved. Network and Communication Security
Destination Delivered Type User, Authorizations Description
Default BW Destination
(RFC) .
<SAP_SCM_name>CLNT No RFC – ERP Use the Profile Generator SAP SCM Customizing:
<client> (transaction code PFCG) to Integration with SAP
define an appropriate profile, Components Integration
SAP APO SAP ERP
and see SAP Notes 447543 via Core Interface (CIF)
and 727839. Basic Settings for Creating
the System Landscape
Assign RFC Destinations to
Various Application Cases .
SAP ERP SAP APO No RFC – ERP Use the Profile Generator Maintaining Authorizations
(ATP) (trusted system (transaction code PFCG) and for Integration with SAP
connection) assign one or more of the Components Maintaining
following roles: Authorizations for Available-
to-Promise (ATP) .
● SAP_APO_ATP_CO
● SAP_APO_ATP_CU
● SAP_APO_ATP_EU
● SAP_APO_ATP_SU
● SAP_APO_ATP_RSP_
ALL
<System_ID>CLNT No RFC – R/3 <liveCache_user_ID>; SAP Note: 305634

<Client_number> <liveCache_
(SAP liveCache) Authorization>
(see SAP Note 305634)
OPTSERVER_ No RFC – TCP/IP SAP SCM Customizing:

<Optimizer>01 Installation Guide – SAP
APO Optimizer for SAP SCM
Server 7.0 SAP APO
Optimizer Installation – How
To Post-Installation
Activities on the SAP Web AS
Host(s) Performing a
Setup Check of RFC
Gateway .
Note
For more information about communication destinations of SAP NetWeaver, see the SAP NetWeaver Security
Guide on SAP Service Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides
(Complete) SAP NetWeaver 2004s Security Guide Security Guides for Connectivity and Interoperability
Technologies .
PUBLIC
Network and Communication Security All rights reserved. 29
7 Data Storage Security
The data storage security of SAP NetWeaver and components installed on that base is described in the SAP
NetWeaver 7.0 Security Guide.
Note
For information about the data storage security of SAP NetWeaver, see the SAP NetWeaver 7.0 Security Guide
on the SAP Service Marketplace at service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides
(Complete) SAP NetWeaver 7.0 Security Guides Security Guides for Operating System and Database
Platforms .
All business data in SAP SCM is stored in the system database. If SAP liveCache is used, some business data is also
stored there. This business data is protected by the authorization concept of SAP NetWeaver and SAP SCM.
In some special cases, business-relevant data is stored in another location, such as a file system. The special cases
are listed below:
SAP SCM Optimizer

The SAP SCM Optimizer writes log files to the gateway file system. The log files are located in the following directory:
<Drive>:\usr\sap\<SID>\<Gxx>\log (for Windows)
or
\usr\sap\<SID>\<Gxx>\log (for Linux)
<SID> = Gateway-ID on the SAP SCM Optimizer server
<GXX> = Gateway number
You must protect this folder on your server against unauthorized, third-party access.
SAP Forecasting and Replenishment

SAP Forecasting and Replenishment (SAP F&R) works with the third party software Forecasting and Replenishment
Processor (FRP). The data exchange between SAP F&R and the FRP is carried out using file download and upload.
The directory for the file download and upload can be customized by the customer. You need to protect the folder
where the exchange data files are located on your server against unauthorized, third-party access.
Note
For information about the SAP F&R data exchange using file download and upload, see the Configuration Guide
for SAP Forecasting & Replenishment Processor on SAP Service Marketplace at service.sap.com/ibc Industry
Solution SAP for Retail Multilevel Replenishment / Forecasting and Replenishment .
PUBLIC
30 All rights reserved. Data Storage Security
8 Data Protection
Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance
with general data privacy acts, it is necessary to consider compliance with industry-specific legislation in different
countries. This section describes the specific features and functions that SAP provides to support compliance with
the relevant legal requirements and data privacy.
This section and any other sections in this Security Guide do not give any advice on whether these features and
functions are the best method to support company, industry, regional or country-specific requirements.
Furthermore, this guide does not give any advice or recommendations with regard to additional features that would
be required in a particular environment; decisions related to data protection must be made on a case-by-case basis
and under consideration of the given system landscape and the applicable legal requirements.
Note
In the majority of cases, compliance with data privacy laws is not a product feature.
SAP software supports data privacy by providing security features and specific data-protection-relevant
functions such as functions for the simplified blocking and deletion of personal data.
SAP does not provide legal advice in any form. The definitions and other terms used in this guide are not taken
from any given legal source.
Glossary
Table 13
Term Definition
Personal data Information about an identified or identifiable natural person.
Business purpose A legal, contractual, or in other form justified reason for the processing of personal
data. The assumption is that any purpose has an end that is usually already defined
when the purpose starts.
Blocking A method of restricting access to data for which the primary business purpose has
ended.
Deletion Deletion of personal data so that the data is no longer usable.
Retention period The time period during which data must be available.
End of purpose (EoP) A method of identifying the point in time for a data set when the processing of
personal data is no longer required for the primary business purpose. After the EoP
has been reached, the data is blocked and can only be accessed by users with special
authorization.
Some basic requirements that support data protection are often referred to as technical and organizational
measures (TOM). The following topics are related to data protection and require appropriate TOMs:
● Access control: Authentication features as described in section User Administration and
Authentication [page 14]
● Authorizations: Authorization concept as described in section Authorizations [page 20]
● Availability control as described in:
PUBLIC
Data Protection All rights reserved. 31
○ Section Data Storage Security [page 30]
○ SAP NetWeaver Database Administration documentation
○ SAP Business Continuity documentation in the SAP NetWeaver Application Help under Function-Oriented
View Solution Life Cycle Management SAP Business Continuity .
● Separation by purpose: Is subject to the organizational model implemented and must be applied as part of the
authorization concept.
Caution
The extent to which data protection is ensured depends on secure system operation. Network security,
security note implementation, adequate logging of system changes, and appropriate usage of the system are
the basic technical requirements for compliance with data privacy legislation and other legislation.
Configuration of Data Protection Functions

Certain central functions that support data protection compliance are grouped in Customizing for Cross-Application
Components under Data Protection.
Additional industry-specific, scenario-specific or application-specific configuration might be required. For
information about the application-specific configuration, see the application-specific Customizing.
8.1 Deletion of Personal Data
SAP SCM may process personal data that is subject to the data protection laws applicable in specific countries, as
described in SAP Note 1825544.
The SAP Information Lifecycle Management (ILM) component supports the entire software lifecycle, including the
storage, retention, blocking, and deletion of data. The ERP system from which customer or vendor is transferred to
SAP SCM as a location uses SAP ILM to support the deletion of personal data.
SAP delivers a where-used check (WUC) for customer/vendor locations in SAP SCM during the blocking of original
customers/vendors in ERP.
All applications register in ERP either a WUC or an end of purpose check (EoP) in the Customizing settings for the
blocking and deletion of the customer and vendor master. For information about the Customizing of blocking and
deletion for SAP SCM customer/vendor locations triggered from ERP, see Configuration: Simplified Blocking and
Deletion section below. For SAP SCM customer/vendor locations, just the WUC is implemented.
Features
Where-Used Check (WUC)

A where-used check is a simple check to ensure data integrity in case of potential blocking. The WUC in SAP SCM
checks whether any ERP customer/vendor is known to the SAP SCM system, that is to say, if it exists in table /
SAPAPO/LOCMAP. If dependent data (customer/vendor location) exists, the ERP system does not block the
customer/vendor master.
If you still want to block the customer/vendor data in ERP, both the location master data and all the dependent data
must be deleted in SAP SCM by using the existing archiving and deletion tools or by using any other customer-specific
solution.
PUBLIC
32 All rights reserved. Data Protection
Relevant Application Objects and Available Deletion Functionality
Table 14
Application Detailed Description Provided Deletion Functionality
SAP SCM customer/ For more information, see SAP Help You can run the report /SAPAPO/DELETE_LOCATIONS
vendor location Portal at help.sap.com under SAP from the SAP Easy Access menu, under SAP Menu SCM
Business Suite SAP ERP Security Basis Master Data Location Location ; select the
Information Security Guide . location, then choose Extras Delete Locations .
Relevant Application Objects and Available EoP/WUC Functionality

Table 15
Application Implemented Solution (EoP or WUC) Further Information
SAP SCM customer/ WUC WUC for table /SAPAPO/LOCMAP

vendor location
Process Flow
1. Before archiving data, you must define residence time and retention periods in SAP Information Lifecycle
Management (ILM) in ERP.
2. You choose whether data deletion is required for data stored in archive files or data stored in the database, also
depending on the type of deletion functionality available.
3. You do the following:
○ Run transaction IRMPOL and maintain the required residence and retention policies for the central business
partner (ILM object: CA_BUPA).
○ Run transaction BUPA_PRE_EOP to enable the EoP check function for the central business partner.
○ Run transaction IRMPOL and maintain the required residence and retention policies for the customer
master and vendor master in ERP (ILM objects: FI_ACCPAYB, FI_ACCRECV, FI_ACCKNVK).
○ Run transaction CVP_PRE_EOP to enable the EoP check function for the customer master and vendor
master in ERP.
4. Business users can request unblocking of blocked data by using the transaction BUP_REQ_UNBLK.
5. If you have the needed authorizations, you can unblock data by running the transactions BUPA_PRE_EOP and
CVP_UNBLOCK_MD.
6. You delete data by using the transaction ILM_DESTRUCTION for the ILM objects.
For information about how to configure blocking and deletion for SAP SCM customer/vendor locations transferred
from ERP, see Configuration: Simplified Blocking and Deletion section below.
Configuration: Simplified Blocking and Deletion

You configure the settings related to the blocking and deletion of customer and vendor master data in SAP ERP
Customizing, under Logistics - General Business Partner Deletion of Customer and Vendor Master Data .
PUBLIC
Data Protection All rights reserved. 33
9 Security for Additional Applications

SAP Forecasting and Replenishment (SAP F&R) includes the third party software Forecasting and Replenishment
Processor (FRP).
PTV eServer
SAP SCM comes with the optional third-party software PTV eServer. This software requires an RFC destination for
SAP SCM. This RFC is described in the section Communication Destinations [page 28]. For more information about
security issues regarding the PTV eServer software, see the third-party PTV eServer documentation.
SAP MaxDB
The SAP MaxDB Security Guide is also relevant for SAP SCM. For more information about the security of SAP MaxDB,
see the SAP MaxDB Security Guide.
PUBLIC
34 All rights reserved. Security for Additional Applications
10 Enterprise Services Security
The following chapters in the NetWeaver Security Guide are relevant for all enterprise services delivered with SAP
SCM:
service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides (Complete)
● User Administration and Authentification
● Security Guide for Usage Type PI
● Web Services Security
● Security Guide Communication Interfaces
● Security Guides for Operating System and Database Platforms
● Security Aspects for System Management
● Enabling Application-to-Application Processes: Security Aspects
● Enabling Business-to-Business Processes: Security Aspects
For more information about special security requirements for Web services, see the SAP NetWeaver Documentation
on SAP Help Portal at help.sap.com SAP NetWeaver SAP NetWeaver 7.0 (2004s) SAP NetWeaver 7.0
Library SAP NetWeaver Library SAP NetWeaver Developer’s Guide Fundamentals Using Java Core
Development Tasks Providing and Consuming Web Services Web Service Toolset Web Services Security .
PUBLIC
Enterprise Services Security All rights reserved. 35
11 Other Security-Relevant Information
User Front End

Web Browser as a User Front End
To use the Web browser as a user front end, you must first activate JavaScript (Active Scripting), to ensure a working
user interface. This could, however, conflict with your security policy regarding Web services.
RF Device as a User Front End

To use an RF device as a user front end, you can use a mobile PC running SAP Front End, or a character-based device
using SAP Console.
Note
SAP Console is part of the SAP Front End installation.
In addition, a third-party Telnet server is necessary. For security issues regarding the Telnet server software, consult
the third-party software documentation.
For more information about SAP Front End, see SAP Service Marketplace at service.sap.com/instguides SAP
NetWeaver SAP NetWeaver 7.0 (2004s) Installation Installation – Clients Installation – SAP Frontend 7.1 .
SAP NetWeaver Business Client as a User Front End

For more information about SAP NetWeaver Business Client (SAP NWBC) with PFCG connection, see the SAP
NetWeaver documentation on SAP Help Portal at help.sap.com SAP NetWeaver SAP NetWeaver 7.0 Library
English SAP NetWeaver Library SAP NetWeaver by Key Capability Application Platform by Key Capability
ABAP Technology UI Technology SAP NetWeaver Business Client 1.0 (with PFCG Connection) Business Client
Security Issues .
For more information about SAP NetWeaver Business Client (SAP NWBC) with PCD connection, see the SAP
NetWeaver documentation on SAP Help Portal at help.sap.com SAP NetWeaver SAP NetWeaver 7.0 Library
English SAP NetWeaver Library SAP NetWeaver by Key Capability People Integration by Key Capabilities SAP
NetWeaver Business Client (with PCD Connection) Business Client Security Issues .
Enterprise Services
For more information about special security requirements for Web services, see the SAP NetWeaver documentation
on SAP Help Portal at help.sap.com SAP NetWeaver SAP NetWeaver 7.0 (2004s) SAP NetWeaver 7.0
Library SAP NetWeaver Library SAP NetWeaver Developer’s Guide Fundamentals Using Java Core
Development Tasks Providing and Consuming Web Services Web Service Toolset Web Services Security .
For more information about enterprise services and security, see the SAP Business Suite: Service Provisioning
Documentation at service.sap.com/swdc Download Installations and Upgrades Entry by Application
Group SAP Application Components SAP SCM ES SAP SCM ES 5.0 Installation ESA SCM SE 5.0 Add-on
Installation 00_mySAPServiceProvisioning.pdf 2.6 Security .
For more information about the security of the exchange infrastructure, see the SAP NetWeaver Security Guide at
service.sap.com/securityguide SAP Process Integration Security Guides SAP NetWeaver Process Integration
(PI) Security Guide .
PUBLIC
36 All rights reserved. Other Security-Relevant Information
Virus Check of Document Attachments
Use of SAP SCM allows you to check documents using a virus scanner before they are uploaded to the SCM system.
Prerequisites
You must have a virus scanner that is correctly installed and configured.
Note
For more information, in Customizing for SAP SCM, choose SAP Web Application Server System
Administration Virus Scan Interface .
PUBLIC
Other Security-Relevant Information All rights reserved. 37
12 Trace and Log Files
SAP systems keep a variety of logs for system administration, monitoring, problem solving, and auditing purposes.
Audits and logs are important to monitor the security of your system and to track events, in case of problems.
For more information about auditing and logging for the SAP SCM component, see the SAP NetWeaver 7.0 Security
Guide on SAP Help Portal at help.sap.com SAP NetWeaver SAP NetWeaver 7.0 (2004s) SAP NetWeaver 7.0
Library EN SAP NetWeaver Library SAP NetWeaver by Key Capability Security SAP NetWeaver Security
Guide Security Aspects for System Management Auditing and Logging .
There are several options for auditing in SAP SCM. We recommend to use the application log in SAP SCM, which you
can access via transaction SLG1. For more information, see the SAP NetWeaver 7.0 Security Guide on SAP Help
Portal at help.sap.com SAP NetWeaver SAP NetWeaver 7.0 (2004s) SAP NetWeaver 7.0 Library EN SAP
NetWeaver Library SAP NetWeaver by Key Capability Security SAP NetWeaver Security Guide Security
Aspects for System Management Auditing and Logging Logging of Specific Activities Application Logging .
Security Audit Log Triggered by Virus Scan Interface (VSI)

The class CL_VSI automatically creates entries in the Security Audit Log for infections and scanned errors, with the
following information:
● Profile
● Profile step allowing the detection of the scanner-group
● Kind of virus found, with internal virus ID of the scan engine, if available
● User name and timestamp
The messages logged are located in the message class VSCAN, using the system log messages BU8 and BU9 (created
in SE92). The severities are set to High and Medium, respectively. The severity of the audit class is set to
Miscellaneous.
Audit Information System (AIS)

For more information about auditing and logging for the Audit Information System (AIS), see the SAP NetWeaver
7.0 Security Guide on SAP Help Portal at help.sap.com SAP NetWeaver NetWeaver 7.0 (2004s) SAP
NetWeaver 7.0 Library EN SAP NetWeaver Library SAP NetWeaver by Key Capability Security SAP NetWeaver
Security Guide Security Aspects for System Management Auditing and Logging The Audit Info System
(AIS) .

All changes related to order proposals are logged in the respective history tables of ODM (xxx stands for the client
number):
● /1OT/FDA11HDRxxx
● /1OT/FDA12IT2xxx
● /1OT/FDA17MP2xxx
● /1OT/FDA1HREFxxx
● /1OT/FDA1IREFxxx
● /1OT/FDA1OPH1xxx
PUBLIC
38 All rights reserved. Trace and Log Files
● /1OT/FDA1OPI1xxx
This data can, for example, be transferred to SAP NetWeaver Business Intelligence. Here, the process automation,
in terms of percentage of manually changed order proposals, can be tracked in the respective reports. This logging
is set to ON by default in the respective delivered BC sets.
To check the logging settings, in Customizing for SAP SCM, choose SCM Basis Order Document
Management Configure Order Document Management . In the list of the view ODM: Order Component -
Maintenance View, choose FROP and then folder ODM: Order Data Area, Assignment – Maintenance View.
The FRP modules communicate with a data environment on file system level. This data environment must be properly
secured. This means that you should grant only restricted access to this file system.
For more information, see chapter Maintain F&R Processor Administration Settings in the Configuration Guide.
PUBLIC
Trace and Log Files All rights reserved. 39
A Appendix
A.1 Related Security Guides
You can find more information about the security of SAP applications on the SAP Service Marketplace at
service.sap.com/security. Security guides are available at service.sap.com/securityguide.
A.2 Related Information
For more information about topics related to security, see the links shown in the table below.
Table 16
Content Quick Link on the SAP Service Marketplace
Master Guides, Installation Guides, Upgrade Guides, Solution service.sap.com/instguides

Management Guides
service.sap.com/ibc
Related SAP Notes service.sap.com/notes
Released platforms service.sap.com/platforms
Network security service.sap.com/securityguide
Technical infrastructure service.sap.com/installNW70
SAP Solution Manager service.sap.com/solutionmanager
SAP Supply Chain Management service.sap.com/scm
PUBLIC
40 All rights reserved. Appendix
B Reference
B.1 The Main SAP Documentation Types
The following is an overview of the most important documentation types that you need in the various phases in the
life cycle of SAP software.
Cross-Phase Documentation
SAPterm is SAP’s terminology database. It contains SAP-specific vocabulary in over 30 languages, as well as many
glossary entries in English and German.
● Target group:
○ Relevant for all target groups
● Current version:
○ On SAP Help Portal at help.sap.com Glossary
○ In the SAP system in transaction STERM
SAP Library is a collection of documentation for SAP software covering functions and processes.
● Target group:
○ Consultants
○ System administrators
○ Project teams for implementations or upgrades
○ On SAP Help Portal at help.sap.com (also available as documentation DVD)
The security guide describes the settings for a medium security level and offers suggestions for raising security
levels. A collective security guide is available for SAP NetWeaver. This document contains general guidelines and
suggestions. SAP applications have a security guide of their own.
● Target group:
○ Technology consultants
○ Solution consultants
○ On SAP Service Marketplace at service.sap.com/securityguide
Implementation
The master guide is the starting point for implementing an SAP solution. It lists the required installable units for
each business or IT scenario. It provides scenario-specific descriptions of preparation, execution, and follow-up of an
implementation. It also provides references to other documents, such as installation guides, the technical infrastructure
guide and SAP Notes.
● Target group:
PUBLIC
Reference All rights reserved. 41
○ Project teams for implementations
○ On SAP Service Marketplace at service.sap.com/instguides
The installation guide describes the technical implementation of an installable unit, taking into account the
combinations of operating systems and databases. It does not describe any business-related configuration.
● Target group:
Configuration Documentation in SAP Solution Manager – SAP Solution Manager is a life-cycle platform.
One of its main functions is the configuration of business scenarios, business processes, and implementable steps. It
contains Customizing activities, transactions, and so on, as well as documentation.
● Target group:
○ In SAP Solution Manager
The Implementation Guide (IMG) is a tool for configuring (Customizing) a single SAP system. The Customizing
activities and their documentation are structured from a functional perspective. (In order to configure a whole system
landscape from a process-oriented perspective, SAP Solution Manager, which refers to the relevant Customizing
activities in the individual SAP systems, is used.)
● Target group:
○ Project teams for implementations or upgrades
○ In the SAP menu of the SAP system under Tools Customizing IMG
Production Operation
The technical operations manual is the starting point for operating a system that runs on SAP NetWeaver, and
precedes the application operations guides of SAP Business Suite. The manual refers users to the tools and
documentation that are needed to carry out various tasks, such as monitoring, backup/restore, master data maintenance,
transports, and tests.
● Target group:
The application operations guide is used for operating an SAP application once all tasks in the technical operations
manual have been completed. It refers users to the tools and documentation that are needed to carry out the various
operations-related tasks.
● Target group:
PUBLIC
42 All rights reserved. Reference
Upgrade
The upgrade master guide is the starting point for upgrading the business scenarios and processes of an SAP
solution. It provides scenario-specific descriptions of preparation, execution, and follow-up of an upgrade. It also refers
to other documents, such as upgrade guides and SAP Notes.
● Target group:
○ Project teams for upgrades
The upgrade guide describes the technical upgrade of an installable unit, taking into account the combinations of
operating systems and databases. It does not describe any business-related configuration.
● Target group:
Release notes are documents that contain short descriptions of new features in a particular release or changes to
existing features since the previous release. Release notes about ABAP developments are the technical prerequisite for
generating delta and upgrade Customizing in the Implementation Guide (IMG).
● Target group:
○ Consultants
○ On SAP Service Marketplace at service.sap.com/releasenotes
○ In the SAP menu of the SAP system under Help Release Notes (only ABAP developments)
PUBLIC
Reference All rights reserved. 43
PUBLIC
www.sap.com

SAP Supply Chain Management 70 Security GuideE

Uploaded by

Copyright:

Available Formats

SAP Supply Chain Management 70 Security GuideE

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SAP Supply Chain Management 70 Security GuideE

Uploaded by

Copyright:

Available Formats

What is the purpose of this document?

What is the purpose of this document?

What typographic conventions are used in the document?

What typographic conventions are used in the document?

Security Guide PUBLIC

SAP SCM 7.0 Component Security Guide

Example Emphasized words or expressions

www.sap.com Textual cross-references to an internet address

123456 Hyperlink to an SAP Note, for example, SAP Note 123456

● Cross-references to other documentation or published works

● Source code or syntax quoted directly from a program

EXAMPLE Keys on the keyboard

1.0 2008-11-21 New version

1.1 2010-03-26 Update of List of SAP Notes

1.2 2014-07-18 Addition of chapter Data Protection

2 Before You Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

3 Technical System Landscape . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

4 User Administration and Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

6 Network and Communication Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

7 Data Storage Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

9 Security for Additional Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

10 Enterprise Services Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

11 Other Security-Relevant Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

12 Trace and Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Why is Security Necessary

About This Document

Overview of the Main Sections

Fundamental Security Guides

SAP NetWeaver Security Guide service.sap.com/securityguide SAP NetWeaver 7.0

SAP NetWeaver Documentation help.sap.com SAP NetWeaver SAP NetWeaver 7.0

SAP SCM Master Guide service.sap.com/instguides SAP Business Suite

SAP SCM Installation Guide service.sap.com/instguides SAP Business Suite

Related Security Guides

SAP Event Management Security Guide service.sap.com/securityguide SAP Event

SAP Forecasting and Replenishment Security Guide service.sap.com/securityguide Industry Scenario

Security Guides for SAP NetWeaver Products

Security Guides for SAP NetWeaver According to Usage Types

● SAP NetWeaver Application Server Java Security Guide

● Internet Transaction Server Security

● Interactive Forms Based on Adobe Software Security

EP Core (EPC) Portal Security Guide

Enterprise Portal (EP) Knowledge Management Security Guide

Business Information (BI) SAP Business Information Warehouse Security Guide

Mobile Infrastructure (MI) SAP Mobile Infrastructure Security Guide

Security Guides for Standalone Engines

SAP Content Server SAP Content Server Security Guide

Operating System and Database Platforms

SAP Max DB Security Guide ● on SAP Service Marketplace at:

● on SAP Help Portal at help.sap.com SAP

Important SAP Notes

30724 Data protection and security in SAP

128447 Trusted/Trusting Systems

305634 RFC destination for working globally with

447543 APO: Authorizations too

498627 Global ATP: No logoff of user

506314 SAPHTTP and SSL This note provides information on setting

510007 Setting-up SSL on the Web Application

598860 Browsers supported by BSP

616555 liveCache >= 7.4: Password change

637052 Missing authorization object for