Unified Connectivity (UCon) framework part 2

I wrote about the UCon already few years ago see here: NetWeaver Unified Connectivity (UCON).
This post has refreshed info on the topic.

I introduced whitening / blacking (list) features of SAP in my older blog spot: White / Black Lists. In SAP terminology a securing of some of SAP objects is also called in as Unified Connectivity (UCON). It was introduced on NetWeaver platform in version 74. Very high level speaking the UCON is all about logging and blocking. By using the UCON only those of remote enabled function modules (RFM or BAPI) that are used in deployed scenarios are allowed to be executed. Execution of rest of them is forbidden and thus the NetWeaver system is secured on server side because possible attack to the system is reduced. 

To identify which RFMs are to be exposed and which are to blocked there are three phase process and toolset provided by the UCON. 

First of all, a system parameter ucon/rfc/active needs to be set in tcode RZ11 – system profile parameters. 

In 1^st phase (Logging) you need to identify objects that ae accessed from outside systems. Here a tool called ”Phase Tool Unified Connectivity” (tcode UCONPHTL, prog UCON_PHASE_TOOL) is used. Also CCMS contains SAP Unified Connectivity Monitor Templates that are supporting the tool. 

Now in 2nd phase (Evaluation) it checks whether objects are not interrupting deployed business scenarios by being blocked.  Also tcode UCONPHTL is used in here.

And finally in 3^rd phase (Activation) it needs to be confirmed that UCON checks will become effective. 

There is also possibility to override blocking settings of some RFM delivered by SAP. This is of course at your own risk. The ABAP program RS_RFC_BLACKLIST_CUSTOM can be used for that. By giving the RFM name to the program you can see what were original settings of the RFM. No need to add that all changes to the settings are logged. So by this way blacklisted RFM can be unblocked. The settings done by the program are transportable.

More information:

UCON documentation

UCON wiki

White / Black Lists

In general similar to any other industry or area of people's interests also in terms of SAP we talk about white and black lists.

Basically anything which is on the white list is approved or recognized or just simply speaking it is considered to be safe. On other hand anything which is on the black list is forbidden, unknown or just not safe.

In terms of SAP we can talk similarly here in here about programming objects. It can be also an access to certain objects where there are some objects that can be accessed (while list) and objects to which an access is denied (black list).

Let focus on e.g. RFC function modules. Some of them can be protected by authorization and therefore are on the white list. Access to some other RFC FM can be forbidden and they are put to black list. Usually the RFC FM are protected by authorization object S_RFC.

last update: 07/08/2018

Related information:
Unified Connectivity Framework - UCON

1664340 - Documentation of authorization object S_RFC is unclear

NetWeaver Unified Connectivity (UCON)

See also part two of UCon here: Unified Connectivity (UCon) framework part 2

UCON is new connection framework in SAP NetWeaver aiming to deal also with security aspects of RFC (Remote Function Calls) calls from outside systems into SAP NetWeaver systems. The UCON framework reduces no of Remote Function Modules (RFM) which can be accessed or let say called from outside systems.

SAP ERP solution contains approximately 38k of RFMs. By default one can call all of them without any issues. As typically in customers production systems only few of them are needed so by utilizing UCON one can limit those RFMs which are needed.

What needs to be done in order to deploy the UCON?

- NetWeaver system where UCON will be used must have following system profile parameter UCON/RFC/ACTIVE set to 1.

- Set up and generate communication assembly (CA) in TA UCONPHTL.

- Schedule batch job SAP_UCON_MANAGEMENT to collect RFC statistic recording.

Notice that UCON is only available as of SAP NetWeaver version 7.4.

Further information:

UCON online docu

How-to videos

SCN doc about UCON

UCON overview presentation