Hi Fabian,
thanks, but all these points are fine:
A) the permissions can easily be seen on the DB server:
% ls -al brconnect
-rwsrwsr-- 1 oracle oinstall 14489040 Apr 8 11:50 brconnect
B) Yes, it is connecting to SSFS from the AS system, as the string you mentioned is present in trans.log, this is a check, mentioned in note 1639578.
Probably I need to make it use SSFS also from the DB server...
C)
SQL> select grantee, granted_role, default_role from dba_role_privs where grantee = 'SAPSR3';
GRANTEE GRANTED_ROLE DEF
------------------------------ ------------------------------ ---
SAPSR3 SAPCONN YES