topic Re: Changing User Log In Error Messages in Application Development and Automation Discussions

Changing User Log In Error Messages

Chris-Hall — Thu, 02 Jun 2011 18:12:31 GMT

We would like to align the error messages for the following:

1. User Out of Validity

2. Locked by System Administrator

3. Locked due to incorrect number of log in attempts

The reason behind this is we have just installed GRC 5.3 and would like to align the error messages with a specific category/ticket in CUP.

Can we change the message to be a pop up instead of the message appearing on the status bar? Can links/url be added? Has anyone else done something similar? What we are finding is that the error messages are too generic and not being aligned to GRC, many users are submitting the wrong request and the user experience needs to be flawless.

Thanks Everyone,

Chris

Re: Changing User Log In Error Messages

Former Member — Thu, 02 Jun 2011 18:40:14 GMT

Hi Chris

Sorry - I can't answer your question but this may be relevant for the GRC forum instead?

Kind regards

David

Re: Changing User Log In Error Messages

Chris-Hall — Thu, 02 Jun 2011 19:07:58 GMT

This really isn't a GRC question and thought it would get moved to this forum

Re: Changing User Log In Error Messages

mvoros — Thu, 02 Jun 2011 21:00:16 GMT

Hi,

it seems like all messages related to logon are in class RSEC. The issue is that it seems like all are raised from kernel, not from ABAP code. So there is no way how to start issuing multiple messages instead of one. It also does not feel right for me to start more info. It could be misused by attacker.

Cheers

Re: Changing User Log In Error Messages

Former Member — Sat, 04 Jun 2011 08:33:53 GMT

Hi Chris,

you have below three scenarios:

1. User Out of Validity

2. Locked by System Administrator

3. Locked due to incorrect number of log in attempts

for case 1: if a user is already end dated and if he tries to log in to the system, he will automatically receive message " user account not in validity date"

for case 2/3 : for a locked user if we check the change documents information, you can see that if a user is locked by administrator or it is due to incorrect login also in both cases the lock value is different and when user id is locked by admin user will get teh following message " locked by administrator" and for incorrect login's " incorrect login : user locked no further login contact system administrator"

hope this helps..

pls let me know if i answered your question.

Thanks.

Sandeep

Re: Changing User Log In Error Messages

Former Member — Sat, 04 Jun 2011 12:15:55 GMT

Hi Sandeep

I suspect the requirement is to make CUP give similar messages.

Regards

David

Re: Changing User Log In Error Messages

Former Member — Sun, 05 Jun 2011 13:36:51 GMT

If this is not GRC specific question, then the status of the user account via and even the password messages can easily be retrieved (see SAP note 899614 and the user BAPIs).

If it is GRC related then it is not easy at all and we need to move this to the GRC forum.

Cheers,

Julius

Re: Changing User Log In Error Messages

Chris-Hall — Sun, 05 Jun 2011 13:46:36 GMT

Yes, this is not really GRC related. We are looking to change the messages in our R/3 (4.6C) environments.

Maybe an example of our issue would help clarify. We have a standard job that adjusts the validity date of our users in R/3 when they have not logged in for 45 days. At this point a user is not locked and the error message is " User is not in validity ". To the average user this means very little and they assume they are locked and therefore submit a GRC request " Unlock ". When they get the completion notification back saying there account is still out of validity many escalations occur. The correct request would be a change ID to extend the validity date so we want to modify the existing error message to something like " User is not in validity, please submit GRC Change ID reqest ". We are hoping this will help our end users understand what type of request to submit in GRC.

Re: Changing User Log In Error Messages

Former Member — Sun, 05 Jun 2011 14:16:27 GMT

So you want to change the message texts to add your own custom instructions?

The logon program uses those messages so rather be carefull and change them in an expendable sandbox first.

Anyway, your users are being silly. Possibly they are playing a joke on you?

Cheers,

Julius

Re: Changing User Log In Error Messages

koehntopp — Sun, 05 Jun 2011 15:54:26 GMT

Has anybody thought of training the users before giving them access to the system...?

Frank.

Re: Changing User Log In Error Messages

Former Member — Sun, 05 Jun 2011 16:06:10 GMT

An idea for "online training" would be for them to chose the message themselves via the popup. If they chose the wrong one, then they are briefly electricuted via the SAPGui each time.

Dzzzt ... Dzzzzzzt ...

Re: Changing User Log In Error Messages

Chris-Hall — Sun, 05 Jun 2011 18:32:25 GMT

Frank, Trying to train 10,000 ++ users in multiple languages has not been the easiest

We also have a high turnover rate in certain regions of the world.

Edited by: Chris Hall on Jun 5, 2011 8:32 PM

Re: Changing User Log In Error Messages

Chris-Hall — Sun, 05 Jun 2011 18:34:11 GMT

hahahaha, I love the idea Julius; however, I doubt this would be very legal in many areas

Re: Changing User Log In Error Messages

Chris-Hall — Sun, 05 Jun 2011 18:37:08 GMT

Julius,

" So you want to change the message texts to add your own custom instructions?

The logon program uses those messages so rather be carefull and change them in an expendable sandbox first. "

So modifying the logon program would accomplish this? Anywhere I can readup on this?

Thanks,

Chris

Re: Changing User Log In Error Messages

Former Member — Sun, 05 Jun 2011 18:52:09 GMT

You cannot change the logon program SAPMSYST! Think of the implications if you did...

However changing the texts of the messages might work, even if a modification to the message class. You must test this in a sandbox because SAPMSYST makes several checks - so you couls easily cause a "lock-out"!!

Better options would be to include this question in the CUP request form or consider SSO instead of passwords?

Cheers,

Julius

Re: Changing User Log In Error Messages

Chris-Hall — Sun, 05 Jun 2011 20:23:49 GMT

Thanks Julius, yes I realize there are certain implications here. Tough to come up with a solution when we are running 40+ SAP clients (DEV/QA/PRD -> R/3 (2 different models), SolMan, XI, IPC, APO, CRM, BI and an instance of ECC6) and a SSO has not been proposed strictly for SAP, management is looking for a single ID/password for the 100+ applications we use.

Re: Changing User Log In Error Messages

Former Member — Sun, 05 Jun 2011 20:44:50 GMT

and a SSO has not been proposed strictly for SAP, management is looking for a single ID/password for the 100+ applications we use.

The plot thickens....

So... you are synchronizing the passwords at the hash level accross systems to mimic real SSO and this error message for validity is causing the password to be reset and then your "poor man's SSO" fails.

That is not the end user's fault. This is a "hack" in my books which is not sustainable for many reasons.

I cannot help you further if you do not disclose that you are using such "hacks" and these cause problems, because I do not believe in them. They are typically also very easily exploitable... (how well protected is the function which resets the password?).

Perhaps by assumptions are barking up the wrong tree here, but it seems to me that you are having to live with the consequences of a bad design.

Cheers,

Julius

Re: Changing User Log In Error Messages

Chris-Hall — Sun, 05 Jun 2011 21:42:09 GMT

HAHAHA, no Julius, there is no SSO Hack Job done "yet". We still use an individual ID and Password for each of our systems, I did say this is "Proposed"

I think even with a SSO solution I am still going to have the same issue. User is locked by admin, the user submits an unlock request in GRC which is all good. User is out of validity and submits an unlock request and is technically unlocked but is still out of validity. Maybe education is the only real solution here. I was really hoping that there was a quick easy way to modify the error message on log on.

Re: Changing User Log In Error Messages

Former Member — Sun, 05 Jun 2011 21:48:26 GMT

You can educate the admin (or the program) to check the validity, and react to it?

As you are are programmatically restricting the validity via a rule (not actuve password based logons), you can programmatically reactive it.

When using SSO, you can do the same for those who still have active passwords.

So it is an admin and program problem?

ps: When your custom program detects an inactive user, how does it select these users and how does it lock them (or their password)?

Please post your code....

Cheers,

Julius

Re: Changing User Log In Error Messages

Chris-Hall — Mon, 06 Jun 2011 14:10:07 GMT

Thanks for working through this with me. I'm not sure the coding will help with the issue. Our Corporate Policy states that for any of our production systems, inactive users have their validity date changed to the current day so they can no longer log in. We do not initiate an administrative lock or scramble their password, just simply change the valid to on the ID. We don't want to create a solution to automatically change the validity period back to the original valid to date, we want to ensure that these users go through an approval process to get back their access.

Each month we then run reports and any inactive user for 6 months is removed from the system, this part is manual.