Hello folks,
i'm about to gather information about SLT for non-SAP source systems from a security perspective and couldn't get
answers for the following issues:
1. I'm wondering if there is a possibility to limit the tables which can be replicated from an oracle or mssql source system ,
as it is done in SAP source systems via IUUC_TAB_ALLOWED.
Is there any similar functionality for non-SAP source systems?
2. I investigated that it's really hard to adjust the authorizations in terms of "least privilege" in the source db.
As mentioned in "note 1771460 - SAP LT Replication Server: Using ORACLE as non-SAP source" the following authorizations are necessary:
- Select from the specific table
- Create a table in the given schema (in order to successfully create the logging table)
=> Since the logging tables are created with the ID of next number in SNUM: IUUC_TABID its hard to adjust the authorizations
- Select from the logging table
=> same as above, hard to adjust the select privileges
- Delete the logging table
=> same as above
- Create database triggers for the specific table
=> which means in term of Oracle guide:
"To create a trigger in any schema on a table in any schema, or on another user's schema (schema.SCHEMA),
you must have the CREATE ANY TRIGGER system privilege.
In addition to the preceding privileges, to create a trigger on DATABASE, you must have the
ADMINISTER DATABASE TRIGGER system privilege."
So the user can create triggers on any table and probably get data which he is not allowed to read!
- Delete the database triggers
"The trigger must be in your schema or you must have the DROP ANY TRIGGER system privilege.
To drop a trigger on DATABASE in another user's schema, you must also have the ADMINISTER DATABASE TRIGGER system privilege."
So the user can drop any trigger on any table
- Create synonyms and views for the specific table
=> Since the synonyms and views are created with the ID of next number in SNUM: IUUC_TABID its hard to adjust the authorizations
- Delete the synonyms and the views
=> same as above
In MSSQL it is similar to that.
How can we make sure to apply the "least privilege" principle in the source db?
3. For HANA Source systems we use encrpyted db connections (connection string with parameter ";CON_PARAM=ENCRYPT=TRUE,sslHostNameInCertificate=")
Is there a similar option for Oracle and MSSQL DBs?
Thanks for your input
Joe