SAP SM59

It maintains RFC destinations, the definitions of how SAP connects to other SAP and external systems for remote calls, and tests those connections.

• Destination name and connection type (ABAP, TCP/IP, HTTP).
• Target host/system and connection parameters.
• Logon: service user and credentials (or trusted).
• Connection and authorization test buttons.

• Use least-privilege service users, not broad dialog users.
• Test the connection (and authorization) after any change.
• After a system copy, correct destinations that point at the source.

• Connection failed (host/port/network).
• Logon failed (wrong credentials/user locked).
• Authorization missing in the target system.

• Testing the connection and not the authorisation. They are separate tests with separate answers, and a destination that connects can still be unable to do anything.
• Using a dialog user as the service user. It consumes a licence, it locks under the password policy, and the interface stops on a Sunday for a reason nobody associates with it.
• Destinations pointing at production from a copied system. After a system copy the non production system happily calls production until somebody notices.
• Storing a password where a trusted relationship would do. One more credential to rotate, and one more place it can leak.
• Deleting a destination without checking what calls it. The callers do not announce themselves until they fail.