topic Re: Password Question Interesting -- in Application Development and Automation Discussions

Password Question Interesting --

Former Member — Tue, 11 Dec 2007 16:20:37 GMT

Here is a requirement;

1.Normally when a user is created , when he logs in first time there is a prompt for a new password.

2. Is it possible to take off this prompt ? Ie to say the user need to use the same password as he is created with.

Th ereason is , Ihave created a sequenc eof abut10 users who comes inat various shifts and wil need to use the pwds so want to use it that way with one pwd, never to change !

Thanks

Re: Password Question Interesting --

Wolfgang_Janzen — Tue, 11 Dec 2007 16:28:49 GMT

Thanks for disclosing your motivation for that requirement (but anyway: I'd have assumed it - there are typically only two reasons for such a requirement: 1. account sharing, 2. password synchronization / poor-man's SSO).

Well, aside of license reasons there are other good reasons why you should not perform such account sharing. One good reason is the loss of auditibility: you'll be unable to tell which data was changed by which user - and you'll not be able to hold anyone accountable for any action taken. That sort of thing is what auditors are looking for ...

Re: Password Question Interesting --

Former Member — Tue, 11 Dec 2007 16:34:32 GMT

This does nto answer howitcan beaccomplished ! i agree however theirroles ar every minimal and has internal controls in place.

so do I create a service user ? hw can this be accomplished ?

Re: Password Question Interesting --

Wolfgang_Janzen — Tue, 11 Dec 2007 16:37:23 GMT

Still remains the license issue ...

PS: I am a SAP employee ...

Re: Password Question Interesting --

Former Member — Tue, 11 Dec 2007 16:40:52 GMT

To elaborate a bit on the issue of accountability:

All SAP data are seen as part of financial data for which a lot of Laws exist in every country i have worked for.

So if acount sharing is to be allowed can ONLY be judged by the CFO of the company as he will be held responsible for misuse of the SAP system. So it is not a technical question to be compeletely answered in this forum! I have seen security administrators being sacked because they allowed this without the writen OK of the Finance manager/director.

second things i teh licence fee with SAP, but that can be discussed and solved between the company and SAP

Re: Password Question Interesting --

former_member74904 — Tue, 11 Dec 2007 16:47:13 GMT

you can change the user-type in one of the tabs in SU01. dialog user/background/service etc.

but I have to say I agree with Wolfgang's point of view regarding auditing.

Re: Password Question Interesting --

Wolfgang_Janzen — Tue, 11 Dec 2007 16:52:37 GMT

... and it needs to be mentioned that a SERVICE user has some functional restrictions (see <a href="https://service.sap.com/sap/support/notes/622464">SAP Note 622464</a>).

Re: Password Question Interesting --

Former Member — Tue, 11 Dec 2007 16:59:02 GMT

We are deviating frm the question.BTW Active users should ring a bell!!

Re: Password Question Interesting --

Former Member — Tue, 11 Dec 2007 17:01:39 GMT

exactoy like we do for firefighter id !!

Re: Password Question Interesting --

Wolfgang_Janzen — Tue, 11 Dec 2007 17:02:51 GMT

Well, you got statements from three differrent persons.

Are you looking for more persons trying to tell you that you are on the wrong track?!

Re: Password Question Interesting --

Former Member — Tue, 11 Dec 2007 17:16:58 GMT

In fact I was the first to say so !! that its not the practice !! We need to delve deep in reasons for the term ' active user ' and service ids.

Thanks

Re: Password Question Interesting --

Former Member — Tue, 11 Dec 2007 20:01:45 GMT

Hi George,

Please do not with a new thread.

Kind regards,

Julius

PS: <self_moderated>

Re: Password Question Interesting --

Former Member — Tue, 11 Dec 2007 20:30:39 GMT

Juluis I dont want to reply to your statement of recreation. One is a question other is a thought for knowledge share.

Also, "PS: <removed_by_moderator>

Re: Password Question Interesting --

Former Member — Tue, 11 Dec 2007 20:34:38 GMT

Also,I was closing my open questions..which were just 6( SIX) and not50 As you pointed !!

Re: Password Question Interesting --

Wolfgang_Janzen — Tue, 11 Dec 2007 20:52:01 GMT

> One is a question other is a thought for knowledge share.

I agree (sorry Julius).

Regarding :

1. each user account should be assigned to individual credentials (e.g. userID and password)

2. multiple user accounts might be assigned to the same authorizations (e.g. using the "reference user" concept, introduced with SAP R/3 4.6C)

Re: Password Question Interesting --

Former Member — Tue, 11 Dec 2007 21:10:49 GMT

>> Th ereason is , Ihave created a sequenc eof abut10 users who comes inat

>> various shifts and wil need to use the pwds so want to use it that way with

>> one pwd, never to change !

It sounds unmistakenly the same "topic" to me.

Due to popular demand, the other thread is now open to thoughts again.

Kind regards,

Julius

Re: Password Question Interesting --

Former Member — Sat, 15 Dec 2007 09:17:05 GMT

Folks,

I need to put the record straight here.

1.The points raised and mentioned by my learned members of the forum was discussed at length with the External Auditors- :

--There is and continues to be no breaches there is already processes for this and is established verified and corroborated. I cannot give the specifics.

--Licensing issue: Absolutely no violation. Again I cannot give the specifics. But suffice to say its not a poor mans SSO implementation. Our thoughts are limited by our knowledge..this is not to cast a doubt on the knowledge of the members who contributed (and cried wolf !) but the technology supporting the engineering is so wide that one is unable to see all the corners of its application.

One final statement ..majority need not be always right ..its thundering voice can at times be blown away by whisper of truth.

Thanks!!

--George

Re: Password Question Interesting --

Former Member — Sat, 15 Dec 2007 10:03:31 GMT

Hi George, a few points in response to your post

External Auditors are 90% of the time not SAP security experts. What they say and agree is not necessarily bet practice from an SAP point of view.

There are always exceptions to this rule though as a few posters on here demonstrate!

The majority are not always right - I agree, but when that majority represent a cross section of respected practitioners with considerable amassed experience, then the likelyhood of consensus being accrate is reasonably high based on the original facts they were given.

Re: Password Question Interesting --

Former Member — Sat, 15 Dec 2007 13:49:47 GMT

Alex,

I dealt this at the highest level..as personaly I am very strict with these matters, included SAP experts from one of the top audit firms.

All I wanted to share was as you pointed here was ..." There are exceptions".

Any way it was indeed an Interesting .and wide area discussion!!

Thanks Again !

Re: Password Question Interesting --

Former Member — Sat, 15 Dec 2007 18:09:46 GMT

George, though not relevant to this topic any more, I am very glad you are comfortable with your solution or findings for your situation. Without knowing more about the situation (which for understandable reasons you have not submitted) it is difficult to judge the advice in the exact context in which it was applied to.

From experience of the industry the knowledge of "SAP experts" provided by the Big4 can range from dire to excellent. I hope you had one of the latter