Password Parameters Setting (RZ10)

[Former Member]

Hi guys,

I need t find out about the Parameter name and the values for the "Password parameters" so all the users can use either 1 characters (symbol) or Capital letter in the password. Our current setup is to use 1 capital letter and 1 character symbol with 1 number

Below is our current DEV setting in RZ10 but we need to make it consistent with our active Directory password setting which is only use either 1 character or capital letter.

ogin/min_password_uppercase 1

ogin/min_password_specials 1

ogin/min_password_lowercase 1

ogin/min_password_lng 7

ogin/min_password_letters 1

ogin/min_password_digits 1

Is there any body know specific profile parameter that can apply in the parameter setting so we can meet our above requirement

Thanks

Faisal

[Former Member]

Hi Faisal,

You can check the required information sap help portal. All parameter along with values are defined there.

Link :http://help.sap.com/saphelp_nw04/Helpdata/EN/22/41c43ac23cef2fe10000000a114084/content.htm

Based on your requirement you can set the parameters.

Edited by: connecpk on Jan 27, 2010 7:28 PM

[Former Member]

> ... use either 1 characters (symbol) or Capital letter in the password.

Not possible.

Rather go for 1 special character, depending on which release you are on?? (edit: I see that you have this already)

Cheers,

Julius

Edited by: Julius Bussche on Jan 27, 2010 7:43 PM

[Former Member]

Have u implemented and tested the password status as suggested.

[Former Member]

There is nothing to test. It is not possible.

[Former Member]

Why not Julius, may be I'm not explaining you right. I thought about it last night and I think we can give it a shot and tested, here is my thought

Basically they want user to use Shift button once either for number or special characters, so we can define the following as 0 because it is permissible

login/min_password_specials 0 (permissible values: 0 u2013 😎

and define following as 1

login/min_password_digits 1 (permissible values: 0 u2013 😎

In the above implementation they can only use shift button once for inserting numbers, but special characters I defined 0 that means they don't have to put any special character at all in the password

Please correct me if I'm wrong

Thanks for your feedback

Faisal

[Former Member]

Hi Faisal,

In ECC6 you can restrict the password to both 1 special character , digit and one capital letter. This I have tested in past. On whic release you are that you have to check as suggested by julius.

Julius correct me in case you feel in ECC6...as we have used the password setting for 1 capital letter, 1 special character and 1 numeric and it was working. We were not able to change the password leaving any one of them.

Edited by: connecpk on Jan 28, 2010 4:12 PM

[Former Member]

Hi Faisal,

You said:

> use either 1 characters (symbol) or Capital letter in the password.

That is either one or the other, not both -> not possible.

You can enter a number without using Shift. You can also enter a special character without using Shift.

What is the idea behind the password rules? Normally it is to exclude the complete password from a dictionary attack or "guess work".

I would go for 1 special character somewhere in an 8 or voluntarily more character password. Adding 1 uppercase character would be usefull against a dictionary attack as well, although it would be likely to be the first character.

But there is no "either one or the other". At least there is none which I am aware of and will eat my hat if there is...

Cheers,

Julius

ps: You should do this without forcing the user to use a password which they cannot remember, otherwise the write it down. Alternately operative rules would be an additional source of confusion - also for the system itself if you use the login/password_compliance_to_current_policy option.

[Former Member]

I'm using ECC6

as we have used the password setting for 1 capital letter, 1 special character and 1 numeric and it was working. We were not able to change the password leaving any one of them.

This is the exact setting I have and they want me to find out if we can eliminate the setting so they can use 1 capital letter or 1 special character either one of them so they don't have to use both other than that everything would be same.

Julius, I'm sorry I wrote it wrong again, I should have written following in my pervious message

login/min_password_specials = 0

and

Capital (I can't find the parameter to enforce the Capital letter) If we have the parameter then we can set up = 1

We can avoid one and they can use only capital letter since I have setup as 1 and they don't have to use specials character because I set up as 0

Please give your feedback

Thanks

Faisal

[Former Member]

Hi Faisal,

Parameter for capital letter is login/min_password_uppercase .

[Former Member]

> login/min_password_specials = 0

>

> and

>

> Capital (I can't find the parameter to enforce the Capital letter) If we have the parameter then we can set up = 1

The parameter is login/min_password_uppercase.

> We can avoid one and they can use only capital letter since I have setup as 1 and they don't have to use specials character because I set up as 0

That would require the system to recognize a special character as an UPPERCASE alphabetical character, which it is not.

So that would be a bug if it worked -> not possible.

Cheers,

Julius

[Former Member]

> ... and will eat my hat if there is.

I'll add my shorts to that bet now as well...

Another thing to be carefull of is keeping password policies exactly the same, so that users are "encouraged" to use exactly the same password!

I implemented an internet facing application once where there were concerns about the password used from public or "foreign" terminals (key loggers, cameras, etc). We forced the password to be digits and special characters only for it's minimum length, so that it could not be the same as the MS AD password which required a lowercase and UPPERCASE character!

In SAP there are also rules which do not exist in MS AD. For example, in the above case you need to consider the password history size, the parameter login/min_password_diff as well as how many characters you make available to the password change UI. You could in a worst-case lock the user out by setting the rules too strict.

Cheers,

Julius

[Wolfgang_Janzen]

The ABAP password rules only allow to specify AND conditions, thus it's not possible to implement the MS ADS password rules (... either ... OR ...).

Anyway: you cannot expect that every system does provide the same set of supported password rules.

Quite often it even depends on the version of a given product (usually the set of supported rules / features will increase with newer releases).

Kind regards,

Wolfgang

Edited by: Wolfgang Janzen on Jan 28, 2010 5:20 PM