Authorizations 
To use ICF to call services in other systems, you require two basic types of authorizations:
· Authorization for using ICF or individual services
· Authorization for calling application function modules or BSP applications (with the relevant ICF handler) that you want to be executed by a service. (These authorizations are defined by the relevant application in the target system.)
Note the following points:
Assigning ICF Authorizations
Take the following into account when you assign ICF authorizations to users in SAP systems:
The ABAP authorization object required for using ICF is S_ICF.
The user in the target system must have this object in his or her authorization profile to be able to use ICF to connect to the target system.
Assigning Authorizations for Using Individual Services
...
1. Use transaction SICF to maintain the security options under Service Data for each ICF service (or a service node or virtual host).
2. To define the authorization of a user for accessing a specific service, you can enter a check value in the SAP Authorization field under Service Data. Also read the F1 help for this field.
The security options that you use in transaction SICF are passed on to other services. For example, if you make settings for a top level service node, these settings also apply to all services under this node. You can also make settings for a complete virtual host.
The settings are not passed on if specific values have been entered for a lower level node or service. These settings overwrite any values from the top level node or service.
Further Information
· Determining Authorizations in the Target System