orkungedik/SAP-basis-dataset huggingface dataset:
## 13.3.4.3.4.1.1  User Management
## Use
User management for Employee Self-Service (WDA) in SAP Business Client for HTML uses the mechanisms provided with the Application Server ABAP.
For an overview of how these mechanisms apply to Employee Self-Service, see the sections below.
## User Administration Tools
The table below shows the tools to use for user management and user administration with Employee SelfService.
User Management Tools
| Tool                                                          | Detailed Description                                                                                                                                                           | Comment                             |
|---------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------|
| User maintenance for ABAP-based sys- tems (transaction SU01 ) | You use the user maintenance trans- action to generate users in the ABAP- based systems and to assign authoriza- tion profiles.                                                | Used for all ESS deployment options |
| Role maintenance (transaction PFCG )                          | You use the role maintenance transac- tion to generate authorization profiles for your self-service users. For more information, see User and Role Administration of AS ABAP . | Used for all ESS deployment options |
##  Note
For the ESS business packages, you must perform user mapping for the users in the ABAP system and the Portal. For more information, see Assigning Portal Roles to Users .
##  Caution
Ensure that you give end users general reading permission for the SAP Enterprise Portal. For more information, see SAP Note 939412 .
## User Types
It is often necessary to specify different security policies for different types of users. For example, your policy may specify that individual users who perform tasks interactively must change their passwords on a regular basis, but not those users under which background processing jobs run.
User types that are required for Employee Self-Service include:
- Individual users:
- Dialog users (Used for SAP GUI for Windows or RFC connections)
- Internet users (Same policies apply as for dialog users, but used for Internet connections).
- Technical users:
- Service users .
For more information on these user types, see User Types in the AS ABAP Security Guide .
##  Note
For the Business Package for Employee Self-Service (up to and including 1.41), we recommend you set up the connection between the SAP Enterprise Portal and the connected systems (ECC system, J2EE Engine, BW system) so that each individual user has access. This does not apply to the Business Package for Employee Self-Service (WDA) .
## Standard Users
For Employee Self-Service, no standard users are delivered.
## 13.3.4.3.4.1.2  Integration into Single Sign-On Environments
## Use
Employee Self-Service supports the Single Sign-On (SSO) mechanisms provided by ABAP Platform. Therefore, the security recommendations and guidelines for user administration and authentication as described in the ABAP Platform Security Guide also apply to Employee Self-Service.
For more information about the available authentication mechanisms, see User Authentication and Single Sign-On .
## Configuration of Web Services with Client Certificates
For ESS applications of the Business Package for Employee Self-Service , the use of client certificates should be configured for authentication when users access the J2EE Engine using an end-to-end connection. To achieve this, follow the instructions under Configuring the Use of Client Certificates for Authentication .
## 13.3.4.3.4.3  Session Security Protection
## Use
To increase security and prevent access to the SAP logon ticket and security session cookie(s), we recommend activating secure session management.
We also highly recommend using SSL to protect the network communications where these security-relevant cookies are transferred.
## Session Security Protection on the AS ABAP
The following section is relevant for Employee Self-Service (WDA) :
To prevent access in javascript or plug-ins to the SAP logon ticket and security session cookies ( SAP\_SESSIONID\_&lt;sid&gt;\_&lt;client&gt; ), activate secure session management. With an existing security session, users can then start applications that require a user logon without logging on again. When a security session is ended, the system also ends all applications that are linked to this security session.
Use the transaction SICF\_SESSIONS to specify the following parameter values shown in the table below in your AS ABAP system:
Session Security Protection Profile Parameters
| Profile Parameter                 |   Recommended Value | Comment              |
|-----------------------------------|---------------------|----------------------|
| icf/ set_HTTPonly_flag_on_cookies |                   0 | Client-Dependent     |
| login/ticket_only_by_https        |                   1 | Not Client-Dependent |
For more information, a list of the relevant profile parameters, and detailed instructions, see Activating HTTP Security Session Management on AS ABAP in the AS ABAP security documentation.
## 13.3.4.3.4.4  Network and Communication Security
Your network infrastructure is extremely important in protecting your system. Your network needs to support the communication necessary for your business needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system level and application level) or network attacks such as eavesdropping. If users cannot log on to your application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the back-end system's database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit well-known bugs and security holes in network services on the server machines.
The network topology for Employee Self-Service is based on the topology used by the ABAP Platform. Therefore, the security guidelines and recommendations described in the ABAP Platform Security Guide also
apply to Employee Self-Service. Details that specifically apply to Employee Self-Service are described in the following sections:
## · Communication Channel Security
This topic provides an overview of the communication channels used by Employee Self-Service, the protocol used for the connection, and the type of data transferred.
## · Network Security
This topic describes the recommended network topology for Employee Self-Service. It shows the appropriate network segments for the various client and server components and where to use firewalls for access protection. It also includes a list of the ports needed to operate Employee Self-Service.
- Communication Destinations
This topic describes the information needed for the various communication paths, for example, which users are used for which communications.
For more information, see the following sections in the ABAP Platform Security Guide:
- Network and Communication Security
- Security Guides for Connectivity and Interoperability Technologies
## 13.3.4.3.4.4.1  Communication Channel Security
## Use
DIAG and RFC connections can be protected using Secure Network Communications (SNC). HTTP connections are protected using the Secure Sockets Layer (SSL) protocol.
For more information, see Transport Layer Security in the ABAP Platform Security Guide.
##  Recommendation
We strongly recommend using secure protocols (SSL, SNC) whenever possible.
## SSL connections for Adobe Document Services
For ESS applications to perform security-related functions such as digitally signing PDF documents or launching of PDF forms, you must set up an SSL connection to the Web service. To achieve this, follow the instructions under Configuration of the Web Service SSL Connection in the Adobe Document Services Configuration Guide.
## 13.3.4.3.4.4.2  Network Security
## Ports
The Employee Self-Service runs on SAP NetWeaver and uses the port from the AS ABAP (for Employee Self-Service (WDA) ).
For more information, see the topics for AS ABAP Ports in the corresponding ABAP Platform Security Guide.
For other components, for example, SAPinst, SAProuter, or the SAP Web Dispatcher, see https:/ /help.sap.com/ viewer/ports.
## 13.3.4.3.4.6  Leave Request-Specific Virus Scan Profile (ABAP)
Attackers can abuse a file upload to modify displayed application content or to obtain authentication information from a legitimate user. Usually, virus scanners are not able to detect files designed for this kind of attack.
For this reason, the standard SAP Virus Scan Interface includes an enhancement option to protect the user and/or the SAP system from potential attacks.
For more information about the behavior of the virus scanner when default virus scan profiles (VSP) are activated, see SAP note 1693981 (Unauthorized modification of displayed content).
SAP Leave Request Application ( HRESS\_A\_PTARQ\_LEAVREQ\_APPL ) changes this behavior so that the file types ( EXE, RAR, DLL ) are blocked.
When you have created and activated the application-specific virus scan profile ( SIHTTP/HTTP\_UPLOAD ), this profile produces the following impact: The MIME sniffing check is activated, and the MIME type APPLICATION/ OCTET-STREAM will be blocked.
## 13.3.4.3.4.7  Security-Relevant Logging and Tracing
Employee Self-Service relies on the logging and tracing mechanisms from ABAP Platform.
For more information, see the following topics:
- For the AS ABAP (relevant for Employee Self-Service (WDA) ): Auditing and Logging
## 13.3.4.3.5.1  User Administration and Authentication
User management for Manager Self-Service uses the mechanisms provided with the Application Server ABAP.
The security recommendations and guidelines for user administration and authentication as described in the Application Server ABAP apply for Manager Self-Service in SAP Business Client .
In addition to these guidelines, information about user administration and authentication that specifically applies to Manager Self-Service is included in the following sections:
- User Management
- Integration into Single Sign-On Environments
## 13.3.4.3.5.1.1  User Management
## Use
User management for Manager Self-Service uses the mechanisms provided with the Application Server ABAP (for example, tools, user types, and password policies).
For an overview of how these mechanisms apply for Manager Self-Service, see the sections below.
## User Administration Tools
The table below shows the tools to use for user management and user administration with Manager SelfService.
User Management Tools
| Tool                                                          | Detailed Description                                                                                                                                              | Comment                             |
|---------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------|
| User maintenance for ABAP-based sys- tems (transaction SU01 ) | You use the user maintenance trans- action to generate users in the ABAP- based systems.                                                                          | Used for both MSSdeployment options |
| Role maintenance (transaction PFCG )                          | You use the role maintenance transac- tion to generate profiles for your self- service users. For more information, see User and Role Administration of AS ABAP . | Used for both MSSdeployment options |
<!-- image -->
For the Business Package for Manager Self-Service , it is necessary to perform user mapping for the users in the ABAP system and the Portal. For more information, see Assigning Portal Roles to Users .
## User Types
It is often necessary to specify different security policies for different types of users. For example, your policy may specify that individual users who perform tasks interactively must change their passwords on a regular basis, but not those users under which background processing jobs run.
The user types that are required for the Manager Self-Service are Individual users:
- Dialog users (Used for SAP GUI for Windows or RFC connections)
- Internet users (Same policies apply as for dialog users, but used for Internet connections).
For more information about these user types, see User Types in the AS ABAP Security Guide.
##  Recommendation
For the Business Package for Manager Self-Service , we recommend you set up the connection between the SAP Enterprise Portal and the connected systems (ECC system, J2EE Engine, BI system) so that each individual user has access. This does not apply to Manager Self-Service in SAP NWBC . .
## Standard Users
For Manager Self-Service, no standard users are delivered.
## 13.3.4.3.5.1.2  Integration into Single Sign-On Environments
## Use
Manager Self-Service supports the Single Sign-On (SSO) mechanisms provided by ABAP Platform. Therefore, the security recommendations and guidelines for user administration and authentication as described in the ABAP Platform Security Guide also apply to Manager Self-Service.
For more information about the available authentication mechanisms, see User Authentication and Single Sign-On and Integration into Single Sign-On Environments [page 13].
## Configuration of Web Services with Client Certificates
For MSS applications of the Business Package for Manager Self-Service , the use of client certificates should be configured for authentication when users access the J2EE Engine using an end-to-end connection. To achieve this, follow the instructions under Configuring the Use of Client Certificates for Authentication .
## 13.3.4.3.5.3  Session Security Protection
## Use
To increase security and prevent access to the SAP logon ticket and security session cookie(s), we recommend activating secure session management.
We also highly recommend using SSL to protect the network communications where these security-relevant cookies are transferred.
## Session Security Protection on the AS ABAP
The following section is relevant for Manager Self-Service in SAP Business Client :
To prevent access in javascript or plug-ins to the SAP logon ticket and security session cookies ( SAP\_SESSIONID\_&lt;sid&gt;\_&lt;client&gt; ), activate secure session management. With an existing security session, users can then start applications that require a user logon without logging on again. When a security session is ended, the system also ends all applications that are linked to this security session.
Use the transaction SICF\_SESSIONS to specify the following parameter values shown in the table below in your AS ABAP system:
Session Security Protection Profile Parameters
| Profile Parameter                 |   Recommended Value | Comment              |
|-----------------------------------|---------------------|----------------------|
| icf/ set_HTTPonly_flag_on_cookies |                   0 | Client-Dependent     |
| login/ticket_only_by_https        |                   1 | Not Client-Dependent |
For more information, including a list of the relevant profile parameters and detailed instructions, see Activating HTTP Security Session Management on AS ABAP in the AS ABAP security documentation.
## 13.3.4.3.5.4  Network and Communication Security
Your network infrastructure is extremely important in protecting your system. Your network needs to support the communication necessary for your business needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system level and application level) or network attacks such as eavesdropping. If users cannot log on to your
application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the back-end system's database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit well-known bugs and security holes in network services on the server machines.
The network topology for Manager Self-Service is based on the topology used by the ABAP Platform. Therefore, the security guidelines and recommendations described in the ABAP Platform Security Guide also apply to Manager Self-Service. Details that specifically apply to Manager Self-Service are described in the following topics:
## · Network Security
This topic describes the recommended network topology for Manager Self-Service. It shows the appropriate network segments for the various client and server components and where to use fire walls for access protection. It also includes a list of the ports needed to operate Manager Self-Service.
## · Communication Destinations
This topic describes the information needed for the various communication paths, for example, which users are used for which communications.
For more information, see the following sections in the ABAP Platform Security Guide:
- Network and Communication Security
- Security Guides for Connectivity and Interoperability Technologies
## 13.3.4.3.5.4.1  Network Security
## Ports
Manager Self-Service runs on SAP NetWeaver and uses the ports from the AS ABAP (for Manager Self-Service in SAP NWBC ).
For more information, see the topic for AS ABAP Ports in the corresponding ABAP Platform Security Guides.
For other components, for example, SAPinst, SAProuter, or the SAP Web Dispatcher, see https:/ /help.sap.com/ viewer/ports.
## 13.3.4.3.5.4.2  Communication Destinations
The tables below provide an overview of the communication destinations required for the MSS deployment options.
## Manager Self-Service in SAP Business Client
For this deployment option, you have to maintain RFC connections using the transaction SM59 , see also the following table 1.
Table 1: Connection Destinations for Manager Self-Service in SAP Business Client
| Destination                     | Delivered   | Type            | Recommended User Authorizations   | Description                                                      |
|---------------------------------|-------------|-----------------|-----------------------------------|------------------------------------------------------------------|
| SAP_ECC_HumanReso urces         | No          | ABAP connection | n/a                               | System alias for the ECC HCMsystem                               |
| SAP_ECC_HumanReso urces_HTTP    | No          | HTTP connection | n/a                               | System alias for the ECC HCMsystem                               |
| SAP_ECC_FINANCIAL S             | No          | ABAP connection | n/a                               | System alias for the ECC FI system for Fi- nancials applications |
| SAP_ECC_FINANCIAL S_HTTP        | No          | HTTP connection | n/a                               | System alias for the ECC FI system for Fi- nancials applications |
| SAP_EREC_TalentMa nagement      | No          | ABAP connection | n/a                               | System alias for the SAP E-Recruiting sys- tem                   |
| SAP_EREC_TalentMa nagement_HTTP | No          | HTTP connection | n/a                               | System alias for the SAP E-Recruiting sys- tem                   |
## 13.3.4.3.5.5  Internet Communication Framework Security
## Use
You should only activate the services needed for the applications running in your system. For Manager Self-Service in SAP Business Client, the following services are needed which you can find under the path default\_host/sap/bc/webdynpro/sap/ :
For applications from the Suite Inbox (CA-EPT-IBO):
- IBO\_WDA\_INBOX
For applications from HCM Processes and Forms (PA-AS):
- asr\_form\_display
- asr\_mass\_start\_process
- asr\_pa\_pd\_processes\_display
- asr\_processes\_display
- ASR\_PROCESS\_EXECUTE\_FPM
- asr\_process\_select
- asr\_srch\_pd\_process
For applications from Cross-Application Time Sheet (CA-TS) and Personal Time Management (PT):
- HRMSS\_A\_CATS\_APPROVAL
- HRESS\_A\_PTARQ\_LEAVREQ\_APPL
- HRESS\_A\_LEA\_TEAM\_CALENDAR
For applications from Talent Management and Talent Development (PA-TM):
- HRTMC\_EMPLOYEE\_PROFILE
- HRTMC\_LONG\_PROFILE
- hrtmc\_side\_by\_side
- HRTMC\_TA\_ASSESSMENT
- HRTMC\_TA\_DASHBOARD
- HRTMC\_TA\_DEV\_PLAN
- hrtmc\_teamviewer
For applications from Performance Management (PA-PD-PM):
- HAP\_MAIN\_DOCUMENT
- HAP\_START\_PAGE\_POWL\_UI\_MSS
- HAP\_A\_PMP\_PIE\_CHART
- HAP\_A\_PMP\_GOALS
- HAP\_A\_PMP\_OVERVIEW
- HAP\_A\_PMP\_MAIN
For applications from Enterprise Compensation Management (PA-ECM):
- HCM\_ECM\_PLANNING\_OVERVIEW\_OIF
- HCM\_ECM\_PLANNING\_UI\_GAF
- HCM\_ECM\_PROFILE\_OIF
- HCM\_ECM\_SIDEBYSIDE\_OIF
- HCM\_ECM\_TEAMVIEWER\_OIF
For applications from Personnel Cost Planning (PA-CP):
- WDA\_HCP\_DET\_PLAN
For applications from SAP Learning Solution (PE-LSO):
- LSO\_MANAGE\_PARTICIPANTS
- LSO\_MANAGE\_MANDATORY\_ASSIGN
For applications from SAP E-Recruiting (PA-ER):
- default\_host/sap/bc/erecruiting/dataoverview
- hrrcf\_a\_dataoverview
- hrrcf\_a\_requi\_monitor
- hrrcf\_a\_req\_assess
- hrrcf\_a\_tp\_assess
- hrrcf\_a\_qa\_mss
- hrrcf\_a\_substitution\_manager
- hrrcf\_a\_substitution\_admin
<!-- image -->
For applications from Travel Management (FI-TV):
- FITV\_POWL\_APPROVER
- FITV\_TRIP\_FORM
- FITV\_POWL\_PERSONALIZATION
For applications from the Financials (FI) application area:
- QISR\_UI\_STATUSOVERVIEW
- QISR\_UI\_STATUSOVERVIEW
- QISR\_UI\_STATUSOVERVIEW
- FPB\_EXP\_OVERVIEW
- FCOM\_PBC\_MONITOR
- FCOM\_PBC\_MONITOR
- FPB\_VARIANCE\_MONITOR\_OVERVIEW
- FCOM\_EQM\_MONITOR
- FPB\_LINEITEM\_MONITOR\_OVERVIEW
- FPB\_VARIANCE\_MONITOR\_OVERVIEW
- FPB\_LINEITEM\_MONITOR\_OVERVIEW
- FCOM\_EQM\_MONITOR
- FCOM\_PBC\_MONITOR
- FCOM\_PBC\_MONITOR
- FPB\_LINEITEM\_MONITOR\_OVERVIEW
- FPB\_VARIANCE\_MONITOR\_OVERVIEW
## Activities
Use the transaction SICF to activate these services.
If your firewalls use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.
## More Information
For more information, see Activating and Deactivating ICF Services in the SAP NetWeaver Library documentation.
For more information about ICF security, see the RFC/ICF Security Guide .
## 13.3.4.3.5.6  Security-Relevant Logging and Tracing
Manager Self-Service relies on the logging and tracing mechanisms from ABAP Platform.
For more information, see the following topics:
- For the AS ABAP (relevant for Manager Self-Service in SAP Business Client ):
- Auditing and Logging
- Tracing and Logging (for NWBC)
## 13.3.5  Talent Management
## 13.3.5.1   SAP E-Recruiting
## 13.3.5.1.1  Security Aspects of Data Flow and Processes
The following section provides an overview of the data flows in the security-relevant scenarios for SAP ERecruiting.
## 13.3.5.1.1.1  Data Entry by External Candidate in Distributed System
The figure below provides an overview of the data flow for the following scenario: Data entry by the external candidate in the distributed system
<!-- image -->
The table below lists the security aspect that has to be taken into account for the process step and the security action that is taken.
|   Step | Description                                                    | Security Measure                                                                      |
|--------|----------------------------------------------------------------|---------------------------------------------------------------------------------------|
|      1 | External candidate transfers profile data and application data | External candidate has to confirm the data privacy statement.                         |
|      2 | Data transfer                                                  | Access authorization using RFC user                                                   |
|      3 | Save data to database                                          | Not relevant                                                                          |
|      4 | External candidate uploads attach- ments                       | Not relevant                                                                          |
|      5 | Virus check (WD ABAP)                                          | Standard virus check provided by SAP NetWeaver Application Server (front- end server) |
|      6 | Data transfer                                                  | Not relevant                                                                          |
|   Step | Description           | Security Measure                                                                                                               |
|--------|-----------------------|--------------------------------------------------------------------------------------------------------------------------------|
|      7 | Virus check (BAdI)    | Additional virus check using the BAdI HRRCF00_ DOC_UPLOAD (back- end server) (see Customizing activity BAdI:Upload Documents ) |
|      8 | Save data to database | Not relevant                                                                                                                   |
## 13.3.5.1.1.2  Data Entry in Nondistributed System
The figure below provides an overview of the data flow for the following scenario: Data entry in nondistributed system.
The data flow is relevant within the framework of the following scenarios:
- The internal or external candidate maintains his or her profile and application.
- The recruiter maintains a candidate's profile.
- The recruiter or data entry clerk enters an application in the system.
<!-- image -->
The table below lists the security aspect that has to be taken into account for the process step and the security action that is taken.
|   Step | Description           | Security Measure                                              |
|--------|-----------------------|---------------------------------------------------------------|
|      1 | Transfer of data      | External candidate has to confirm the data privacy statement. |
|      2 | Save data to database | Not relevant                                                  |
|   Step | Description             | Security Measure                                                                                                               |
|--------|-------------------------|--------------------------------------------------------------------------------------------------------------------------------|
|      3 | Transfer of attachments | Not relevant                                                                                                                   |
|      4 | Virus check (WD ABAP)   | Standard virus check provided by SAP NetWeaver Application Server (front- end server)                                          |
|      5 | Virus check (BAdI)      | Additional virus check using the BAdI HRRCF00_ DOC_UPLOAD (back- end server) (see Customizing activity BAdI:Upload Documents ) |
|      6 | Save data to database   | Not relevant                                                                                                                   |
## 13.3.5.1.1.3  Integration of Org. Mgmt/E-Recruiting in Distributed System
The figure below provides an overview of the data flow for the following scenario: Integration of Organizational Management in SAP E-Recruiting in a distributed system.
<!-- image -->
The table below lists the security aspect that has to be taken into account for the process step and the security action that is taken.
|   Step | Description                                                                         | Security Measure   |
|--------|-------------------------------------------------------------------------------------|--------------------|
|      1 | The recruiter requests data overviews for organizational units, positions, or jobs. | Not Relevant       |
|   Step | Description                                                                                                             | Security Measure                    |
|--------|-------------------------------------------------------------------------------------------------------------------------|-------------------------------------|
|      2 | The SAP NetWeaver Application Server requests the Organizational Manage- ment data using RFC in the connected HRsystem. | Access authorization using RFC user |
|      3 | The HRsystem transfers the data using XMLto the SAP NetWeaver Application Server.                                       | XMLencryption                       |
## 13.3.5.1.1.4  Integration of Org. Mgmt/E-Recruiting in Integrated System
The figure below provides an overview of the data flow for the following scenario: Integration of Organizational Management in SAP E-Recruiting in an integrated system.
<!-- image -->
The table below lists the security aspect that has to be taken into account for the process step and the security action that is taken.
|   Step | Description                                                                         | Security Measure   |
|--------|-------------------------------------------------------------------------------------|--------------------|
|      1 | The recruiter requests data overviews for organizational units, positions, or jobs. | Not Relevant       |
|   Step | Description                                                                                                    | Security Measure   |
|--------|----------------------------------------------------------------------------------------------------------------|--------------------|
|      2 | The SAP NetWeaver Application Server requests the Organizational Manage- ment data in the integrated HRsystem. | Not relevant       |
|      3 | The integrated HRsystem transfers the data using XMLto the SAP NetWeaver Application Server.                   | XMLencryption      |
## 13.3.5.1.1.5  Recommendation of Job Posting (Tell a Friend)
The figure below provides an overview of the data flow for the following scenario: The candidate uses the Tell A Friend function to inform another person about an employment opportunity.
The process runs as described below if you enter the value MAILTO or MAILTO\_REGONLY for the parameter TF\_SEND\_METHOD in Customizing for SAP E-Recruiting under Technical Settings → User Interfaces → Candidate → Backend Candidate → Assign Values to Interface Parameters (Web Dynpro ABAP) .
We recommend that you do not use the default delivery TF\_SEND\_METHOD = ' ' as this means that the e-mails with the recommendation letter are sent using your e-mail server. As the candidate is responsible for specifying the recipient and content of the e-mail message to be sent, undesirable content could be sent from the sender address of your e-mail server.
For more information, see the documentation for the Customizing activity Assign Values to Interface Parameters (Web Dynpro ABAP) and SAP Note 1390162 .
<!-- image -->
The table below lists the security aspect that has to be taken into account for the process step and the security action that is taken.
|   Step | Name                           | Security Measure   |
|--------|--------------------------------|--------------------|
|      1 | Trigger Tell a Friend function | Not relevant       |
|   Step | Name                     | Security Measure                                                                                                                                                                                                                                                                                                                |
|--------|--------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|      2 | Open local e-mail client | The e-mail client (for example, Micro- soft Outlook) is opened locally on the candidate's computer. This client (and not the central e-mail client) then sends the e-mail. You activate this process us- ing the parameter TF_SEND_METHOD in the Customizing activity Assign Values to Interface Parameters (Web Dynpro ABAP) . |
|      3 | Send e-mail              | Not relevant                                                                                                                                                                                                                                                                                                                    |
## 13.3.5.1.1.8  Resume Parsing (Recruiter)
The figure below provides an overview of the data flow for the following scenario:
The recruiter uploads a candidate's resume as an attachment and then sends it to a third-party vendor for parsing. The data is then transferred to the corresponding fields of the form for the Entry of External Applications application.
<!-- image -->
The table below lists the security aspect that has to be taken into account for the process step and the security action that is taken.
|   Step | Name                               | Security Action                                                                       |
|--------|------------------------------------|---------------------------------------------------------------------------------------|
|      1 | Upload resume as attachment        | Not relevant                                                                          |
|      2 | Virus checkWDABAP                  | Standard virus check provided by SAP Netweaver Application Server (front- end server) |
|      3 | Trigger Resume Parsing             | Not relevant                                                                          |
|      4 | Transfer resume as attachment      | Not relevant                                                                          |
|      5 | Parse resume                       | For XI-relevant security topics, see SAP Process Integration (PI) Security Guides .   |
|      6 | Transfer HRXMLdata                 | HRXMLcoding                                                                           |
|      7 | Save structured data to buffer     | Not relevant                                                                          |
|      8 | Trigger profile upload             | Not relevant                                                                          |
|      9 | Save structured data in profile    | Not relevant                                                                          |
|     10 | Save attachment 'Resume'           | Not relevant                                                                          |
|     11 | Virus checkWDABAP                  | Standard virus check provided by SAP Netweaver Application Server (front- end server) |
|     12 | Save contents                      | Not relevant                                                                          |
|     13 | Save attachment 'Formatted resume' | Not relevant                                                                          |
|     14 | Virus checkWDABAP                  | Standard virus check provided by SAP Netweaver Application Server (front- end server) |
|     15 | Save contents                      | Not relevant                                                                          |
## 13.3.5.1.1.9  Background Check
The figure below provides an overview of the data flow for the following scenario: The recruiter forwards data regarding a candidate's education, work experience, or qualifications to an external provider, who then checks that this data is correct.
<!-- image -->
The table below lists the security aspect that has to be taken into account for the process step and the security action that is taken.
|   Step | Name                                     | Security Measure                                                             |
|--------|------------------------------------------|------------------------------------------------------------------------------|
|      1 | Initialize background check              | Not Relevant                                                                 |
|      2 | Summarize profile data                   | Not Relevant                                                                 |
|      3 | Transfer profile data                    | Not Relevant                                                                 |
|      4 | Request background check                 | For XI-relevant security topics, see: SAP Process Integration Security Guide |
|      5 | Return order ID                          | Not Relevant                                                                 |
|      6 | Initialize request for processing status | Not Relevant                                                                 |
|      7 | Transfer request                         | Not Relevant                                                                 |
|   Step | Name                                                                                            | Security Measure                                                             |
|--------|-------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------|
|      8 | Request processing status                                                                       | For XI-relevant security topics, see: SAP Process Integration Security Guide |
|      9 | Return processing status                                                                        | Not Relevant                                                                 |
|     10 | Initialize request for access URL                                                               | Not Relevant                                                                 |
|     11 | Transfer request                                                                                | Not Relevant                                                                 |
|     12 | Request URL                                                                                     | For XI-relevant security topics, see: SAP Process Integration Security Guide |
|     13 | Access to URL that the third-party ven- dor uses to display the report for the background check | Not Relevant                                                                 |
## 13.3.5.1.1.12   Sending E-Mails Using the Workflow
SAP E-Recruiting uses workflows that send various documents by e-mail.
The table below shows the workflows and lists the e-mails that are sent using the relevant workflows.
E-Mails Using Workflows
| Workflow Template   | Description   | E-Mail Recipient   | E-Mail Content                         | How E-Mail Is Sent   |
|---------------------|---------------|--------------------|----------------------------------------|----------------------|
| WS51800042          | ERCAdjEntry   | -                  | -                                      | -                    |
| WS51900003          | ERCSendPwd    | Candidate          | Send password                          | Method               |
| WS51900005          | ERCStatusChg  | Candidate          | Confirmation of receipt of application | Method               |
| Workflow Template   | Description   | E-Mail Recipient   | E-Mail Content                                        | How E-Mail Is Sent   |
|---------------------|---------------|--------------------|-------------------------------------------------------|----------------------|
|                     |               | Candidate          | Correspondence: Re- jection                           | Method               |
|                     |               | Recruiter          | Notification that appli- cation is withdrawn          | WFE-Mail             |
| WS51900006          | ERCCandDerig  | Candidate          | Confirmation that can- didate has been dereg- istered | Method               |
| WS51900007          | ERCApprReqWD  | Approver           | Notification to the ap- prover                        | WFE-Mail             |
|                     |               | Requester          | Notification of the de- cision                        | WFE-Mail             |
| WS51900008          | ERCObjCreate  | Candidate          | Acknowledge Candi- date                               | Method               |
|                     |               | Candidate          | Verification mail                                     | Method               |
| WS51900009          | ERCActCreate  | -                  | -                                                     | -                    |
| WS51900010          | ERCStatChg_2  | Candidate          | Confirmation of receipt of application                | Method               |
|                     |               | Candidate          | Correspondence: Re- jection                           | Method               |
|                     |               | Recruiter          | Notification that appli- cation is withdrawn          | WFE-Mail             |
| WS51900011          | ERCActCrea_2  | -                  | -                                                     | -                    |
| WS51900018          | ERCSendVerif  | Candidate          | Confirmation mail                                     | Method               |
## 13.3.5.1.2  User Administration and Authentication
SAP E-Recruiting uses the user management and authentication mechanisms provided with ABAP Platform, in particular the Application Server ABAP. Therefore, the security recommendations and guidelines for user administration and authentication as described in the Application Server ABAP Security Guide also apply to SAP E-Recruiting.
In addition to these guidelines, we include information about user administration and authentication that specifically applies to SAP E-Recruiting in the following topics:
- User Management This topic lists the tools to use for user management, the types of users required, and the standard users
that are delivered with SAP E-Recruiting.
- Integration into Single-Sign-On Environments This topic describes how SAP E-Recruiting supports Single Sign-On mechanisms.
## 13.3.5.1.2.2  Integration into Single Sign-On Environments
The most widely-used supported mechanisms are listed below. For a complete list, see the link provided below.
- Secure Network Communications (SNC) SNC is available for user authentication and provides for an SSO environment when using the SAP GUI for
Windows or Remote Function Calls.
- SAP logon tickets
SAP E-Recruiting supports the use of logon tickets for SSO when using a Web browser as the frontend client. In this case, users can be issued a logon ticket after they have authenticated themselves with the initial SAP system. The ticket can then be submitted to other systems (SAP or external systems) as an authentication token. The user does not need to enter a user ID or password for authentication but can access the system directly after the system has checked the logon ticket.
- Client certificates
As an alternative to user authentication using a user ID and passwords, users using a Web browser as a frontend client can also provide X.509 client certificates to use for authentication. In this case, user authentication is performed on the Web server using the Secure Sockets Layer Protocol (SSL Protocol) and no passwords have to be transferred. User authorizations are valid in accordance with the authorization concept in the SAP system.
- Security Assertion Markup Language (SAML) 2.0 SAML 2.0 provides a standards-based mechanism for SSO. The primary reason to use SAML 2.0 is to enable SSO across domains.
SAP E-Recruiting supports the Single Sign-On (SSO) mechanisms provided by SAP NetWeaver. Therefore, the security recommendations and guidelines for user administration and authentication as described in the SAP NetWeaver Security Guide also apply to SAP E-Recruiting.
For more information about the available authentication mechanisms, see User Authentication and Single Sign-On in the SAP NetWeaver Library.
## 13.3.5.1.3  Authorizations
SAP E-Recruiting uses the authorization concept provided by AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply to SAP E-Recruiting .
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on theSAP Web AS ABAP .
##  Note
For more information about how to create roles, see section Role Administration under Identity Management in the SAP Library for SAP S/4HANA.
The following section shows the standard roles and the relevant authorization objects that SAP E-Recruiting uses. These are:
- Background User for Workflow
- Recruiter, Administrator, and Data Entry Clerk
- Manager
- Candidate
## Authorization Object S\_ICF
We strongly recommend that you use the authorization object S\_ICF to safeguard the Web Dynpro applications in SAP E-Recruiting. For the relevant applications, see the ICF service tree (transaction SICF ) under / default\_host/sap/bc/webdynpro/sap . The names of the applications in SAP E-Recruiting start with ERC for the recruiter and the administrator, and with HRRCF for the candidate.
You can safeguard each application by entering a character string for it in the SAP Authorization field under Service Data and using this character string in the field ICF\_VALUE of the authorization object S\_ICF in the corresponding user roles. For more information, see the documentation for Authorization Object S\_ICF .
For information about services relevant for SAP E-Recruiting in the ICF service tree, see Internet Communication Framework Security of SAP E-Recruiting .
## 13.3.5.1.4  Session Security Protection
## Definition
To prevent access in JavaScript or plug-ins to the SAP logon ticket and security session cookies, we recommend activating secure session management.
We also highly recommend using SSL to protect the network communications where these security-relevant cookies are transferred.
## Session Security Protection on the AS ABAP
To prevent access in JavaScript or plug-ins to the SAP logon ticket and security session cookies (SAP\_SESSIONID\_&lt;sid&gt;\_&lt;client&gt;), activate Secure Session Management . With an existing security session, users can then start applications that require a user logon without logging on again. When a security session is ended, the system also ends all applications that are linked to this security session.
Use the transaction SICF\_SESSIONS to specify the following parameter values shown in the table below in your AB ABAP system:
Session Security Protection Profile Parameters
| Profile Parameter                |   Recommended Value | Comment              |
|----------------------------------|---------------------|----------------------|
| icf/set_HTTPonly_flag_on_cookies |                   0 | Client-dependent     |
| login/ticket_only_by_https       |                   1 | Not client-dependent |
For more information and detailed instructions, see section Activating HTTP Security Session Management on AS ABAP in the AS ABAP security documentation.