SAP Community - Security

OData V4 URL Encoding Issue with SAP Web Dispatcher + Proxy (Sales Order Management App)

2026-02-06T16:09:11.380000+01:00

Hi SAP Community,

We are facing an issue with OData V4 URL encoding after activating the standard Sales Order Management application in S/4HANA.

Note: An SAP incident has already been created, and in parallel we are reaching out to the community to learn from experts who may have faced a similar issue.

Issue summary

The problem occurs because equal signs (=) in the OData V4 request URL are being URL-encoded (%3D) before the request reaches the S/4HANA ICM.

In the browser, the request URL is correct and the = signs are not encoded:

https://etgwdsp.etgworld.com/sap/opu/odata4/sap/c_salesordermanage_srv/srvd_f4/sap/c_orgdivisionvaluehelp/0001;ps='srvd-c_salesordermanage_sd-0001';va='com.sap.gateway.srvd.c_salesordermanage_sd.v0001.ae-c_salesordermanage.createwithsalesordertype.organizationdivision.SalesOrderManageType.X'/$metadata?sap-language=EN

However, when the request reaches the ICM, the raw HTTP request shows that:

= is encoded as %3D
%27 is converted back to '

Example from ICM level 3 trace:

GET /sap/opu/odata4/.../0001;ps%3D'srvd-c_salesordermanage_sd-0001';va%3D'com.sap.gateway.srvd.c_salesordermanage_sd.v0001.ae-c_salesordermanage.createwithsalesordertype.organizationdivision.SalesOrderManageType.X'/$metadata?sap-language=EN

The SAP Gateway expects the “=” characters to remain unencoded, and because of this encoding, the request fails.

Landscape and behavior

Middleware involved

SAP Web Dispatcher
Corporate HTTP Proxy

Observed behavior

All apps work when the proxy is bypassed (Web Dispatcher active)
All apps work when the Web Dispatcher is bypassed (proxy active)
The issue occurs only when both proxy and Web Dispatcher are active

This strongly indicates that the URL is being modified due to an interaction between the proxy and Web Dispatcher.

Troubleshooting performed

All required roles, authorizations, services, and ICF nodes are active
Web Dispatcher profile parameters adjusted to prevent URL encoding
Web Dispatcher mod file changes attempted for OData V4 handling
→ Issue still persists

As per internal network team analysis:

A change may be required in the Web Dispatcher index file
Neither the network team nor BASIS team has access to modify it
Only SAP can make changes at this level

Questions to the community

Has anyone experienced a similar OData V4 URL encoding issue with Web Dispatcher + proxy?
Is this a known limitation or defect in SAP Web Dispatcher for OData V4?
Are there any supported parameters, SAP Notes, or workarounds to prevent encoding of = in the URL?
Should this be handled via ICM settings, Web Dispatcher configuration, or proxy rules?
Is there any recommended architectural workaround until SAP provides a fix?

Any guidance, experiences, or references would be greatly appreciated.

Thanks in advance for your support.

Varsha J S

#SAP #S4HANA #ODataV4 #SAPGateway #SAPWebDispatcher #ICM #SAPBasis #SAPFiori #SAPCommunity
@SAP @SAPCommunity @SAPSupport

looking for clarification for auth object. If role has multiple entries

2026-02-13T15:51:57.007000+01:00

If a security role has F_BKPF_BLA has two entries one with ACTVT=03 BRGRU=* second has ACTVT=01,02 and BRGRU=ZDZ4. Is the finale combination be ACTVT=01,02,03 for BRGRU=*.

Does it make a difference if the same auth object is in One role vs two roles

XSUAA not getting the subject name identifier as ID

2026-03-11T07:57:57.377000+01:00

Hi,

We're trying to change `req.user.id` used from xsuaa to the User ID of IAS instead of the email.

BTP is connected to IAS with OpenID Connect (so "Default Name ID Format = Unspecified" as with SAML is not available).

In the IAS logs the sub is changed to the expected value `jwtPayload="{"sub":"`.

However the req.user.id we get in CAP / JWT token remains the email.

Not sure if it's related, but adding a custom atribute in `xs-security.json` and in IAS attributes also isn't reflected in `req.user.attr`. (it only shows the default value configured in `xs-security.json`)

Anyone have some insights on how to get the id ?

Is transaction S_ALR_87005540 a reporting tcode?

2026-03-14T13:47:45.379000+01:00

I have to create a role for tcode S_ALR_87005540. I asked my colleague to if this is a reporting tcode and he said yes it is however, chatgpt and copilot is saying it is not a reporting tcode.

ZBV / CUA is not working as expected

2026-03-23T13:40:39.929000+01:00

Hello experts,

I'm currently having a strange issue with the CUA. Everything is working perfectly in our CUA system. We don't have duplicate company addresses, and users are assigned the correct one. Our Q-system is also working as expected. We are currently on S4/HANA 2023 SP 03/2025.

But here’s the problem: We’re currently having issues with our P-system. In this system, there are several users assigned to a different company; for example, the correct company address would be 41000 – Standard Company, and now we have about 90 addressesSAP with a new number and a new description -> 41001 – Standard Company0000012345, etc.

We have deleted or corrected these incorrect company addresses in the CUA system, the Dev system, and the Q system, but we cannot delete them in the P system. Do you have any idea how we can delete these incorrect entries? I tried using transaction SUCOMP, but it doesn’t work. I receive the following error message when I try to delete a company address, and the address we want to use is the default address:

And even if I assign a new company to the user, I still can't delete that incorrect company.
Sincerely, Dominik 🙂

ECS broke our RISE PCE WAF 2 and ECS cannot fix it

2026-03-31T14:03:24.712000+02:00

After 4 years in RISE PCE (Azure) we finally were requested by SAP to raise a ticket with ECS to migrate from WAF v1 to WAF v2.

it looks like ECS have hand crafted the configuration - its not via a defined terraform, bicep or arm template. the WAF v2 rules are in restricted mode and nothing really works...

Fiori tiles won't work; icon image are missing

ECS won't provide an export of the WAF config so we can compare and review - even though its our tenant and a shared security model.

you will have to forgive my ignorance in that as RISE PCE the WAF should have a defined security template that doesn't need any tweaking.

we already know SAP don't follow MS best practice for SAP on azure; or i would have had WAF v2 4 years ago.

Anyone got any suggestions i can bat back into ECS?

Sap certification

2026-04-11T03:05:47.327000+02:00

Hello all

I want to schedule SAP certification exam security administrator C_sec_2601 exam , how should I prepare for it ? It's system based exam with new format.

Please guide

saprouter reverse invoke : Design guidelines and Performance best practices

2026-04-11T15:43:45.910000+02:00

Dear Community,

As per the security documentation, the usage of reverse invoke saprouter can offer better protection as ports dont have to be opened from DMZ to SAP network zones.

Using saprouter with reverse invoke would mean that all traffic that otherwise would go directly from frontend (e.g gateway) to backend (e.g S4) networks would now go via the two saprouter (one in DMZ acting as client one in backend acting as server).

There is little information in help.sap or sap notes on this topic. Please can you someone share your experience of using saprouter in this manner (i.e. reverse invoke)

around

best practices /
desgin recommendations /
throughtput and performance /
typical problems like stuck situations and
ofcourse the requirement to have high availability for saprouter as this now becomes the single point of failure for SAP end users etc

Thx

Agentic AI in SAP Landscapes: The Next Identity & Authorization Risk Frontier

2026-04-20T13:22:51.261000+02:00

The adoption of agentic AI across SAP BTP, SAP AI services, and enterprise integrations is introducing a new class of identity risk—one that traditional SAP authorization models were never designed to handle.

At the center of this shift is Agent Identity & Credential Exposure, driven by the rapid expansion of Non-Human Identities (NHIs) across SAP and non-SAP orchestration layers.

The Architectural Mismatch in SAP Environments

Modern SAP AI-driven architectures (e.g., SAP AI Core, automation agents, integration flows) are generating a growing identity surface:

Technical users in SAP S/4HANA
Communication users in SAP BTP
OAuth clients and service keys
API tokens in SAP Integration Suite
Destination service credentials
RFC users and background jobs

These identities are often:

Long-lived
Over-provisioned
Poorly governed across lifecycle

Where the mismatch happens

SAP’s traditional authorization model is built around:

Human users (business roles via PFCG roles)
Static authorization objects
Clearly defined transactions and scopes

However, agentic AI introduces:

No human-triggered execution context
Dynamic, multi-step workflows across systems
Runtime decision-making and tool chaining

Resulting Gap

Agents frequently:

Inherit technical user credentials or OAuth tokens
Operate with broad composite roles
Execute across multiple SAP systems without re-authorization

These credentials are then:

Passed through integration flows
Used across APIs and destinations
Embedded into orchestration logic or memory layers

…without re-validation of authorization scope.

NHI Sprawl in SAP Landscapes

This leads to a new class of SAP-specific identity risk:

Explosion of technical users across S/4, BTP, and integrations
Service keys and OAuth clients without ownership
Credentials embedded in: iFlows (Integration Suite) Destinations CI/CD pipelines AI orchestration layers

Key Characteristics

Long-lived RFC and API users
Overloaded roles (SAP_ALL-like risk patterns)
Lack of traceability between agent → action → business context

Attacker Perspective: Exploiting SAP Identity Weakness

Attackers don’t need to compromise SAP core directly.

They target the weakest integration or agent boundary.

Entry Points

Compromised SAP Integration Suite iFlow
Misconfigured BTP destination
Exposed service key or OAuth client
Prompt injection via AI retrieval (documents, knowledge bases)

Once inside:

A single technical user may have: Cross-module access (FI, MM, HR) Read/write across business data
Shared credentials mask identity: All actions appear as one “technical user”

Advanced SAP-Specific Attack Paths

Extracting credentials from: Integration logs CPI traces Application logs in BTP
Leveraging over-authorized roles: Triggering unintended transactions (e.g., mass data extraction)
Moving laterally across: S/4HANA → BTP → external APIs

Illustrative SAP Scenario

An AI agent on SAP BTP is orchestrating a workflow:

Uses a destination to connect to S/4HANA
Authenticates via a technical communication user
That user has broad access via composite roles

A sub-agent:

Inherits the same credentials
Processes data retrieved from a document store

A prompt injection occurs via retrieved content.

Outcome

Agent executes unintended API calls
Extracts sensitive business data (e.g., financial records, vendor data)
Data is pulled from CDS views or APIs
Activity appears as legitimate system behavior

No clear trace to which agent or task triggered the action.

Impact in SAP Context

Exposure of sensitive ERP data (FI, HR, supply chain)
Violations of SoD (Segregation of Duties) principles
Compliance breaches (GDPR, SOX)
Audit gaps due to shared technical identities
Complex forensic investigations across SAP + BTP

Mitigation: Re-Architect Identity for SAP AI

1. Per-Agent Identity in SAP

Assign unique identities per agent: Separate OAuth clients in BTP Distinct communication users in S/4
Avoid shared technical users
Enable traceability: Agent → Action → System

2. Task-Scoped Authorization (Critical for SAP)

Replace static roles with: Task-based access (least privilege)
Avoid: SAP_ALL Broad composite roles

Instead:

Generate dynamic, minimal authorization scopes per API/task
Use short-lived tokens for each interaction

3. Modernize SAP Authentication Patterns

Move away from static credentials:

Use OAuth 2.0 Client Credentials with scoped access
Implement Workload Identity Federation (BTP)
Avoid storing credentials in: Destinations iFlows Code repositories

4. Govern Technical Users & NHIs

Maintain real-time inventory of: Technical users (SU01) OAuth clients Service keys
Enforce: Short-lived credentials Automated rotation Immediate revocation

5. Strengthen Secret Management

Use secure vaults (e.g., BTP credential store)
Prevent secrets from appearing in: Logs (SLG1, CPI logs) AI prompts or memory
Enforce strict rotation policies

6. Enforce Authorization Context in SAP

Map agent actions to: Business roles Authorization objects
Ensure: No execution without explicit context
Align with Zero Trust principles

7. Monitoring & Detection Across SAP + BTP

Enable: Audit logs (S/4, BTP) Integration monitoring
Detect anomalies: Unusual API volume Cross-module access patterns Unauthorized data extraction

SAP-Aligned Maturity Model

Tier 1 — Foundational

Clean up technical users
Remove SAP_ALL access
Enforce least privilege (PFCG roles)
Secure destinations and service keys

Tier 2 — Hardening

Task-scoped OAuth in BTP
Continuous discovery of technical identities
Monitoring across Integration Suite + S/4

Tier 3 — Advanced

Agent-specific identities with cryptographic trust
Full traceability across SAP landscape
Elimination of shared credentials
Dynamic authorization aligned to runtime context

Closing Perspective

SAP landscapes were not designed for autonomous agents operating across:

Systems
APIs
Business processes

Applying traditional SAP authorization models to agentic AI leads to:

Over-privileged technical users
Invisible identity propagation
Undetectable cross-system risks

The future of SAP security will depend on:

Containing NHI sprawl
Enforcing task-level authorization in SAP
Integrating identity across S/4, BTP, and AI layers

AFO Queries with SAP HANA Analytical Privileges

2026-04-20T17:17:22.600000+02:00

Hi,

Id like to know if the following scenario is possible with SSO.

I have users logging into AFO to query reports. The reports in question are going to be using SQL Analytical privileges to secure them. The problem I currently have is the technical user SAPHANADB is querying the caluclation view, which means the auth check is being done on the technical user. I would like some sort of principal propagation SSO from AFO, through B4H and into HANA.

I have checked the DBMS tab in SU01 and both Logon Ticket and Assertion has been ticked. The Kerberos CN is updated in both B4H and HANA. The user also can log into HANA with SSO with Kerberos.

Is this actually possible with AFO using Analytical Privileges?

SAP Business ByDesign integration with SIEM

2026-04-24T18:02:32.579000+02:00

Hi

How can i receive events from SAP Business ByDesign in SIEM (Azure Sentinel)?
I want to receive mostly user login activity.

Thanks for the support.

CVSS 9.9 Auth Bypass in SAP BW/BPC — Patch or Mitigate Now (SAP Note 3719353)

2026-04-25T17:08:50.736000+02:00

Hi All,

Following is the security disclosure, I’ve summarized the critical vulnerability affecting our SAP landscapes. Unlike standard SQL injections, this is an Authorization Bypass that allows SQL execution through specific upload tools.

Vulnerability Detail: CVE-2026-27681 (SAP Note 3719353)

CVSS Score: 9.9 (Critical)
Nature of Risk: Authenticated users can bypass authorization checks within specific ABAP upload tools in SAP BPC and BW. This allows for the execution of arbitrary SQL statements, potentially leading to full database compromise (Read/Write/Delete).

Affected Components & Versions:

HANABPC: 810
BPC4HANA: 300
SAP_BW: 750 through 816

Required Action Plan:

Permanent Fix (Priority: High)We need to apply the corrections from SAP Note 3719353 to deactivate the vulnerable code. Please prioritize the following Support Packages for our upcoming maintenance window:

SAPK-75035INSAPBW
SAPK-81019INHANABPC
SAPK-30014INBPC4HANA

Immediate Mitigation (Interim)Until patching is complete, we should immediately restrict the S_GUI authorization object. Specifically, revoking Activity 60 (Upload) from standard end-user roles will block the attack vector by disabling the necessary upload functionality.

Thanks & Regards

HarshaTeja

Best Practices for JWT Validation and JWKS Caching in SAP API Management using KVM

2026-04-27T07:28:06.219000+02:00

Hi everyone,
I’m designing a JWT validation flow in SAP API Management for an integration project. The goal is to keep the proxy environment‑agnostic while ensuring high performance through JWKS caching. I’d appreciate feedback on the approach and any potential improvements.

Current Flow Summary:

Validate the request body to ensure it is well‑formed JSON.
Remove sensitive headers (e.g., Cookies) before further processing.
Read the IdP base URL from an environment‑specific KVM.
Normalize the URL using JavaScript for service callouts.
Look up JWKS in cache.
Call the IdP’s .well-known/jwks.json endpoint if the cache is empty.
Cache the JWKS (TTL: 120 seconds).
Verify JWT (RS256, scopes).
Validate the issuer claim against the KVM value.
Are there alternative or recommended ways to further externalize configuration (beyond KVMs) while keeping the proxy fully environment‑agnostic?
Looking forward to your insights on optimizing this zero‑touch setup.
Best regards,
Somya

S4 Post Upgrade - Profile Generator (SU25) Options

2026-05-01T20:57:51.868000+02:00

Hi All ,

While performing the security upgrade (SU25) as part of the S/4HANA system migration from S/4HANA 2022 SP03 to S/4HANA 2025 SP01, we observed that several new options were introduced in SU25. The impact of these changes is not clearly explained in the SAP documentation available to us. As a result, many of our roles are being affected—new authorization objects are being introduced, some existing ones are being removed automatically, and custom SU24 updates appear to be overwritten.

Before proceeding further, we would appreciate guidance on the impact of each selection under SU25 steps 2a, 2b, 2c, 2d, etc. If any detailed documentation or guidance is available, please share it.

As a precaution, we are also considering taking a User Master export post-upgrade, but before executing SU25, along with a backup of the SU24 customizing tables (USOBT_C and USOBX_C). We would like confirmation on whether these backups can be used to restore the system to its pre-SU25 state if required.

SAP Business Client 8.0 - SU01 tcode - roles tab

2026-05-18T15:59:56.424000+02:00

Hello Experts,

I am using SAP Business Client 8.0. In SU01 tcode, if we navigate to roles tab for any user, it shows only 3 lines of roles. This is very cumbersome to use. Can we increase the display lines in this roles tab?

Best Regards,

Ashwini Pingle

Feedback: Vulnerability Submission Form Needs Improvement (Attachments, Formatting)

2026-05-26T21:55:16.412000+02:00

Hi SAP Community,

I recently went through the process of reporting a security vulnerability via the SAP Trust Center's vulnerability submission form (https://dviform-live.c-527d15b.kyma.ondemand.com/), and while I appreciate that SAP provides this channel for external researchers, I wanted to share some honest feedback -- in the hope that it reaches the right people and leads to improvements.

The form currently feels quite bare-bones compared to what security researchers are used to from platforms like HackerOne or Bugcrowd. A few specific pain points:

1. Plain text only The "Steps to reproduce" field is a raw textarea with no formatting support whatsoever. No Markdown, no code blocks, no syntax highlighting. Writing a structured vulnerability report with technical details, request/response examples, and reproduction steps in a single unformatted text box is genuinely painful. A simple Markdown renderer or even basic formatting options would make a significant difference.

2. Attachment restrictions The form only accepts image files as attachments. For security researchers, the most important supporting materials are things like Proof-of-Concept scripts (.py, .js), PDF reports, or HTTP request logs — none of which can be attached. This forces researchers to use external workarounds like Dropbox or Pastebin links, which feels clunky for an official security channel.

I want to be clear:

I think having a dedicated reporting channel is the right thing, and I appreciate that SAP takes external reports seriously. These are not complaints - they are concrete suggestions that I believe would make the portal significantly more useful for both researchers and the SAP security team.

Has anyone else run into these limitations? And is there a better channel to pass this kind of product feedback directly to the team responsible for the form? I've seen that SAP also has a Bugcrowd page, but you can only report a bug there under very specific conditions (e.g., you must have previously reported at least one P3 bug).

Thanks for reading.

SAP NetWeaver: Verified Network & Outbound Connectivity Requirements

2026-06-10T10:53:48.372000+02:00

I’m currently documenting outbound network communication requirements for SAP NetWeaver and several related components. My goal is to ensure these services function correctly in a restricted, security‑hardened environment where all external traffic must be explicitly approved.

The components I’m focusing on are:

SAP GUI
Print Service
KPro (Knowledge Provider)
Crystal Reports

To complete this analysis, I’m looking for verified information about any required outbound Internet communication for these components. Specifically, I’m trying to confirm whether they need to reach external SAP services, licensing servers, cloud endpoints, or any other systems outside the internal network.

If anyone has experience configuring these components in a locked‑down environment, could you help clarify the following for each component?

Required ports — TCP/UDP ports needed for outbound communication
Protocols used — e.g., HTTPS, RFC, SOAP, proprietary protocols
External system names — official service names or destinations
Target IPs or hostnames — any Internet endpoints that must be reachable
Documentation references — SAP Notes, guides, or admin experience

I’m especially interested in real‑world configurations or SAP Notes that explicitly list connectivity requirements. Any insights from your own implementations would be extremely helpful.

Best practices on self service roles

2026-06-18T21:27:48.390000+02:00

Hello everyone,

I have an issue with security roles.
Introduction: With my team we are starting a self-service project where users will log into sap analytics cloud and can create their own stories.
Context: we have the "scoped user" role assig to these users, with this role they can see data from models in the "QA" and "PRD" spaces, because they need access to them to be able to see any data on the stories developed by the data engineers.
issue: With this self-service project, this role that I mentioned before (scoped user) lets them see and use all the models in the "QA" and "PRD" spaces in sap analytics cloud, and we only want them to be able to access the models on their own space (EG: If the user is from human resources area, they will only have access to the Human Resources space in datasphere for self service).

Is the issue explained clearly enough?

have a nice week.

Security Audit Log (RSAU_CONFIG) - Negative User Group Selection Not Excluding Users from SM20

2026-07-02T20:46:31.420000+02:00

Hello Everyone,

We are experiencing an issue with the Security Audit Log configuration and would like to know if anyone has faced a similar situation or if there are known limitations or SAP Notes related to this behavior.

Environment

SAP ECC EHP8
SAP_BASIS 750 SP30
SAP_ABA 750 SP30
Security Audit Log configured through transaction RSAU_CONFIG
Business Requirement
We want to reduce the volume of events generated by specific users in SM20.
To achieve this, we performed the following actions:
1. Created a user group called TECHNICAL_USERS.
2. Assigned the users we want to exclude from auditing to this group.
3. Configured a dynamic filter in RSAU_CONFIG using:
  User Group Selection (Negative)
  Group: TECHNICAL_USERS
  The expectation was that users belonging to this group would be excluded from logging for the selected audit classes.
  Configuration
  In RSAU_CONFIG:
  Dynamic Configuration
  Filter 02
  Client: XXX
  Selection by User Groups (Negative)
  User Group: TECHNICAL_USERS
  The filter is active for logging.
  The enabled audit classes include:
  - Dialog Logon
  - Transaction Start
  - Report Execution
  - User Master Record Changes
  - System Events
    Validation Performed
    1. Group Assignment Validation
      We confirmed that the users are correctly assigned to the group defined in the filter.
      The assignments can be verified in both SU01 and SUGR.
      1. Configuration Activation Validation
        After modifying the audit classes (flags) in RSAU_CONFIG, the Security Audit Log immediately started recording events corresponding to the newly selected audit classes.
        This indicates that:
        The configuration was saved successfully.
        The filter is active.
        The system is processing the new configuration.
        Changes to the audit classes are being applied correctly.
        New Event Generation
        Only events generated after the configuration change were analyzed.
        Historical log entries generated before the change were excluded from the analysis.
        SM20 Verification
        Despite the Negative User Group Selection being configured and active, events continue to be recorded for users belonging to the TECHNICAL_USERS group.
        This behavior occurs for all users assigned to the group, regardless of user type.
        We have observed users of the following types continuing to generate records in SM20 after being assigned to the exclusion group:
        Dialog
        System
        Communication
        Current Situation
        All validations indicate that:
        OK - The user group exists.
        OK - Users are assigned to the user group.
        OK - The RSAU_CONFIG filter is active.
        OK - New events are being generated.
        OK - Changes to the audit classes are applied correctly, and newly selected event types are being logged as expected.
        NOT OK - Negative User Group Selection does not exclude users belonging to the specified user group.
        Additional Information
        The changes made in RSAU_CONFIG are clearly being applied because modifications to the audit classes produce the expected results immediately after activation.
        However, although the system correctly respects the configured audit classes, it continues to log events for users assigned to the user group defined in the Negative User Group Selection criteria.
        Therefore, the only functionality that does not appear to be working as expected is the exclusion based on User Group Negative Selection.
        Question
        Has anyone experienced a similar issue with the "User Group Selection (Negative)" functionality in RSAU_CONFIG on SAP_BASIS 750?
        Are there any known limitations related to:
        Negative User Group Selection
        RSAU_CONFIG dynamic filters
        User group evaluation during Security Audit Log processing
        Is there any SAP Note or official documentation explaining why users assigned to a negatively selected user group continue to appear in SM20, even though other RSAU_CONFIG changes are applied successfully?
        Any guidance would be greatly appreciated.
        Thank you.

Force password change for Dialog user IDs on next login due to security policy change

2026-07-13T10:13:59.161000+02:00

Due to a change in Security policy, we have to force all the dialog user IDs to change the password in the next login. Is there any option available to force password change for Dialog user IDs on next login without a system restart?

------------------------------------------------------------------------------------------------------------------------------------------------
Learn more about the SAP Support user and program here.