topic Re: Hooks - Detect Password Change in Application Development and Automation Discussions

Hooks - Detect Password Change

Former Member — Tue, 15 Jun 2004 12:04:49 GMT

Hi,

I would like to be able to detect when ever a SAP user changes his password. I would also like to flow the new password to my application which is enforcing policies.

Can I do this sort of thing?

- Can the user change is password in any other manner other than through the password GUI?

- Can i write an ABAP function which gets called whenever the user clicks on new password? Can I intercept this password?

Can anyone help me here please?

An early answer will be highly appreciated.

Regards

~Rashmi

Re: Hooks - Detect Password Change

Former Member — Tue, 15 Jun 2004 12:30:27 GMT

Rashmi:

Just this a.m. on the SAPSearch newletter there was a section related specifically to passwords.

the link = http://searchsap.techtarget.com/featuredTopic/0,290042,sid21_gci969453,00.html?track=NL-136&ad=484645

Plug that into your i-net browser. Hope it helps you.

Linda

Re: Hooks - Detect Password Change

Former Member — Tue, 15 Jun 2004 12:43:39 GMT

It is my belief that this is not possible - at least not in realtime.

If you implement a single sign-on solution, such as integration with Windows authentication, then you can defer the checks to the authentication system. For example, it is possible to implement code that gets called by a Windows domain controller whenever a network user changes their password (also allows for prevention of the change, for example if new password is unacceptable).

Cheers,

Scott

Re: Hooks - Detect Password Change

Former Member — Tue, 15 Jun 2004 15:17:11 GMT

Thanks for answering so quickly. Thanks Indies for that link. Its going to help me for sure.

My application is an identity management solution which needs to know when the password of a user has changed and to what it has changed to. Scott, I am afraid that I don't understand your answer. Can you please elaborate.

Thanks in advance.

Regards

~Rashmi

Re: Hooks - Detect Password Change

Former Member — Tue, 15 Jun 2004 15:17:58 GMT

Sorry I meant: Thanks Linda for the link.

Re: Hooks - Detect Password Change

Former Member — Fri, 16 Jul 2004 10:09:07 GMT

I think it is not possible to easily intercept the password, simply due to security reason.

When user changes his password on Logon screen the password handling logic is implemented on the kernel level. The ABAP coding of Logon screen is hidden, and you can’t modify it. Also you can’t substitute the Logon Screen, again simply due to security reason.

If you want to know if the password is changed you can find the old and new passwords hashes and the dates of modification in table USR02. Of cause the passwords are not stored in plain text there. You can schedule batch-job, which will periodically check this information. Or you just can use (or adapt) report RSUSR100 to get the history of password changes.

If you want to apply additional security policy you can use profile parameters like

There are a lot of them!

All what I said is refer only to the classical authentication scenario with SAP Username and Password. Other things like Single Sign-On and Secure Network Communication is a little bit different story. Please see the post from Scott.

Re: Hooks - Detect Password Change

eli_gabay — Sun, 26 Sep 2004 13:04:35 GMT

Hi Rashmi,

Can you share with me your solution ?

Thank you & Regards from,

Eli

Re: Hooks - Detect Password Change

Former Member — Mon, 27 Sep 2004 08:29:44 GMT

There is also a userexit EXIT_SAPLSUSF_001 that is run each time the user logs on to the system.

Perhaps this can be used in some way.

Cheers

Colin.