## 13.8.3  Other Security-Relevant Information
## Open Catalog Interface
## Use
The Open Catalog Interface (OCI) incorporates external product catalogs into SAP S/4HANA applications using Hyper Text Transfer Protocol (HTTP). This way, the data required to create purchasing document items in SAP S/4HANA can be transferred directly from the external catalog to the SAP S/4HANA application.
## Reason and Prerequisites
SAP S/4HANA and the catalog communicate via HTTP/HTTPS URL parameters. It is possible for an end user to identify these parameters and also change them using specialized tools. Security depends heavily on the fact whether the catalogue system resides before or behind the firewall.
## Solution
SAP recommends the following to the customers who wish to integrate SAP S/4HANA and catalogs using Open catalog Interface (OCI):
- Double check the values transferred from the catalogue into the SAP S/4HANA application manually. Check whether the values are the same one as the one in the catalogue.
- In addition to that, authority checks are happening on SAP S/4HANA side: the application checks whether the user is allowed to change the data on SAP S/4HANA side which is transferred from the catalogue. Example: if a price is transferred from the catalogue into the purchasing document, the system checks whether the user has the authority to change the price in the purchasing document in general.
- To prevent end users from sniffing the catalog login data (User names, password), avoid specifying the login information in the OCI Catalog configuration in Customizing. Instead, configure the catalog to accept individual user authentication information from the end user. This can be done in the form of SSO (Single Sign-On) tools, Digital Certificates or Individual Login Information (User name/password). These features are dependent upon whether the Catalog provider supports the above mentioned features to logon.
You define the setting for the OCI in Customizing for Materials Management under Purchasing Environment Data Web Services: ID and Description .
## Security-Relevant Logging and Tracing
Use
Purchasing uses change documents to track changes made to purchasing documents. This includes changes to security-sensitive data such as prices. The following authorization objects specific to purchasing documents
allow the restriction of the visibility of those change documents using the value 08 of the authorization field ACTVT (Activity):
| Authorization Object   | Description                                             |
|------------------------|---------------------------------------------------------|
| M_ANFR_BSA             | Document Type in RFQ                                    |
| M_ANFR_EKG             | Purchasing Group in RFQ                                 |
| M_ANFR_EKO             | Purchasing Organization in RFQ                          |
| M_ANFR_WRK             | Plant in RFQ                                            |
| M_ANFR_LGO             | Storage Locations in RFQ                                |
| M_ANGB_BSA             | Document Type in Quotation                              |
| M_ANGB_EKG             | Purchasing Group in Quotation                           |
| M_ANGB_EKO             | Purchasing Organization in Quotation                    |
| M_BANF_BSA             | Document Type in Purchase Requisition                   |
| M_BANF_EKG             | Purchasing Group in Purchase Requisition                |
| M_BANF_EKO             | Purchasing Organization in Purchase Requisition         |
| M_BANF_FRG             | Release Code in Purchase Requisition                    |
| M_BANF_WRK             | Plant in Purchase Requisition                           |
| M_BANF_LGO             | Storage Location in Purchase Requisition                |
| M_BEST_BSA             | Document Type in Order                                  |
| M_BEST_EKG             | Purchasing Group in Purchase Order                      |
| M_BEST_EKO             | Purchasing Organization in Purchase Order               |
| M_BEST_WRK             | Plant in Purchase Order                                 |
| M_BEST_LGO             | Storage Location in Purchase Order                      |
| M_EINF_EKG             | Purchasing Group in Purchasing Info Record              |
| M_EINF_EKO             | Purchasing Organization in Purchasing Info Record       |
| M_EINF_WRK             | Plant in Purchasing Info Record                         |
| M_LFM1_EKO             | Purchasing Organization in Vendor Master Record         |
| M_LPET_BSA             | Document Type in Scheduling Agreement Delivery Schedule |
| Authorization Object   | Description                                                  |
|------------------------|--------------------------------------------------------------|
| M_LPET_EKG             | Purchasing Group in Scheduling Agreement Delivery Sched- ule |
| M_LPET_EKO             | Purchasing Org. in Scheduling Agreement Delivery Schedule    |
| M_ORDR_EKO             | Purchasing Organization in Source List                       |
| M_ORDR_WRK             | Plant in Source List                                         |
| M_QUOT_EKO             | Purchasing Organization (Quotas)                             |
| M_QUOT_WRK             | Plant (Quotas)                                               |
| M_RAHM_BSA             | Document Type in Outline Agreement                           |
| M_RAHM_EKG             | Purchasing Group in Outline Agreement                        |
| M_RAHM_EKO             | Purchasing Organization in Outline Agreement                 |
| M_RAHM_WRK             | Plant in Outline Agreement                                   |
| M_RAHM_LGO             | Storage Location in Outline Agreement                        |
| M_RAHM_STA             | Status in Contract                                           |