program to lock users

[Former Member]

Dear Pros,

As a security admin. I would appreciate if someone could help me program to lock users vis following requiremnt:

1) Has logged onto the system in the past, but has not logged on in the last 90 days.

2) Has never logged onto the system in the past 30 days.

3) Does NOT belong to User Group “SUPER”.

4) Dialog Users ONLY.

Thanks for any help or suggestion

[Former Member]

Hi,

Try with this program or you can modify:

-

-

---

Selection Text

001 Program Parameter

002 User Lockeds

003 User Erased

004 Report of User Lokeds and Erased

005 User

006 Last Access Date

007 Creation Date

008 Result

009 Full Name

010 Exception (Not to erase these users)

-

-

---

CHECK_T Test ejecution

CLASS Users Group

MESBL Months to Lock

MESBO Months to Delete

S_EXCEP Users

-

-

---

REPORT ZBAR0009 NO STANDARD PAGE HEADING LINE-SIZE 155 LINE-COUNT 60.

TABLES: USR02, "Datos logon

USR21, "Asignación nombre usuario - clave dirección

ADRP. "Personas (gestión de direcciones central)

DATA: BEGIN OF IT_USBOR OCCURS 0,

BNAME LIKE USR02-BNAME, "Nombre de usuario según maestro de us

ERDAT LIKE USR02-ERDAT, "Fecha de creación del maestro de usua

TRDAT LIKE USR02-TRDAT. "Fecha del último acceso al sistema

DATA END OF IT_USBOR.

DATA: BEGIN OF IT_USBLO OCCURS 0,

BNAME LIKE USR02-BNAME, "Nombre de usuario según maestro de us

ERDAT LIKE USR02-ERDAT, "Fecha de creación del maestro de usua

TRDAT LIKE USR02-TRDAT. "Fecha del último acceso al sistema

DATA END OF IT_USBLO.

DATA: BEGIN OF BDCDATAC OCCURS 5.

INCLUDE STRUCTURE BDCDATA.

DATA: END OF BDCDATAC. "Estructura Batch Input

• Tablas de mensajes generados por el batch input de modificación.

DATA: BEGIN OF BDCMSGCOLLM OCCURS 5.

INCLUDE STRUCTURE BDCMSGCOLL.

DATA: END OF BDCMSGCOLLM.

DATA: FECHA1 LIKE USR02-TRDAT,

FECHA2 LIKE USR02-TRDAT,

FECHA3 LIKE USR02-TRDAT,

TR_MS(30),

I TYPE I,

P TYPE I,

CONT TYPE I.

SELECTION-SCREEN: BEGIN OF BLOCK B1 WITH FRAME TITLE TEXT-001.

PARAMETERS: MESBL(2) DEFAULT '03',

MESBO(2) DEFAULT '06',

CLASS LIKE USR02-CLASS DEFAULT 'UPSTREAM',

CHECK_T AS CHECKBOX DEFAULT 'X'.

SELECTION-SCREEN END OF BLOCK B1.

SELECTION-SCREEN: BEGIN OF BLOCK C1 WITH FRAME TITLE TEXT-010.

SELECT-OPTIONS: S_EXCEP FOR USR02-BNAME.

SELECTION-SCREEN END OF BLOCK C1.

START-OF-SELECTION.

• Armado de Fechas

MOVE SY-DATUM TO FECHA1.

FECHA2 = FECHA1 - ( 30 * MESBL ).

FECHA3 = FECHA1 - ( 30 * MESBO ).

PERFORM EXTRACCIÓN_US_BLOQUEAR.

PERFORM EXTRACCIÓN_US_BORRAR.

PERFORM VALIDAR_EXCEPCIONES.

PERFORM EJECUTAR_TRANS.

TOP-OF-PAGE.

FORMAT COLOR 4 ON.

SKIP.

WRITE: /57 TEXT-004, 134 'Fecha: ', SY-DATUM.

WRITE: /134 'Página: ', SY-PAGNO, 151 ' '.

SKIP.

END-OF-PAGE.

*&----

---

*

*& Form EXTRACCIÓN_US_BORRAR

*&----

---

*

• text

*----

---

*

• --> p1 text

• <-- p2 text

*----

---

*

FORM EXTRACCIÓN_US_BORRAR.

• Selección de los Usuarios a Borrar que han entrado alguna vez

SELECT BNAME ERDAT TRDAT APPENDING CORRESPONDING FIELDS OF TABLE

IT_USBOR FROM USR02 WHERE TRDAT LT FECHA3 AND

TRDAT NE '00000000' AND

CLASS EQ CLASS.

• Selección de los Usuarios a Borrar que aún no han entrado

SELECT BNAME ERDAT TRDAT APPENDING CORRESPONDING FIELDS OF TABLE

IT_USBOR FROM USR02 WHERE ERDAT LT FECHA3 AND

TRDAT EQ '00000000' AND

CLASS EQ CLASS.

ENDFORM. " EXTRACCIÓN_US_BORRAR

*&----

---

*

*& Form EXTRACCIÓN_US_BLOQUEAR

*&----

---

*

• text

*----

---

*

• --> p1 text

• <-- p2 text

*----

---

*

FORM EXTRACCIÓN_US_BLOQUEAR.

• Selección de los Usuarios a Bloquear que han entrado alguna vez

SELECT BNAME ERDAT TRDAT APPENDING CORRESPONDING FIELDS OF TABLE

IT_USBLO FROM USR02 WHERE TRDAT LT FECHA2 AND

TRDAT GE FECHA3 AND

CLASS EQ CLASS.

• Selección de los Usuarios a Bloquear que aún no han entrado

SELECT BNAME ERDAT TRDAT APPENDING CORRESPONDING FIELDS OF TABLE

IT_USBLO FROM USR02 WHERE ERDAT LT FECHA2 AND

ERDAT GE FECHA3 AND

TRDAT EQ '00000000' AND

CLASS EQ CLASS.

ENDFORM. " EXTRACCIÓN_US_BLOQUEAR

*&----

---

*

*& Form VALIDAR_EXCEPCIONES

*&----

---

*

• text

*----

---

*

• --> p1 text

• <-- p2 text

*----

---

*

FORM VALIDAR_EXCEPCIONES.

IF S_EXCEP NE SPACE.

DELETE IT_USBLO WHERE BNAME EQ 'SAP*' OR

BNAME EQ 'DDIC' OR

BNAME EQ 'MAILADM' OR

BNAME EQ 'SAPGUEST' OR

BNAME EQ 'WF-BATCH' OR

BNAME IN S_EXCEP.

DELETE IT_USBOR WHERE BNAME EQ 'SAP*' OR

BNAME EQ 'DDIC' OR

BNAME EQ 'MAILADM' OR

BNAME EQ 'SAPGUEST' OR

BNAME EQ 'WF-BATCH' OR

BNAME IN S_EXCEP.

ELSE.

DELETE IT_USBLO WHERE BNAME EQ 'SAP*' OR

BNAME EQ 'DDIC' OR

BNAME EQ 'MAILADM' OR

BNAME EQ 'SAPGUEST' OR

BNAME EQ 'WF-BATCH'.

DELETE IT_USBOR WHERE BNAME EQ 'SAP*' OR

BNAME EQ 'DDIC' OR

BNAME EQ 'MAILADM' OR

BNAME EQ 'SAPGUEST' OR

BNAME EQ 'WF-BATCH'.

ENDIF.

ENDFORM. " VALIDAR_EXCEPCIONES

*&----

---

*

*& Form EJECUTAR_TRANS

*&----

---

*

• text

*----

---

*

• --> p1 text

• <-- p2 text

*----

---

*

FORM EJECUTAR_TRANS.

DATA: L TYPE I.

DESCRIBE TABLE IT_USBLO LINES L.

IF L GT 0.

LOOP AT IT_USBLO.

ADD 1 TO CONT.

IF CHECK_T EQ SPACE.

PERFORM EJECUTAR_US01 USING 'LOCK' IT_USBLO-BNAME.

ENDIF.

PERFORM LISTAR USING IT_USBLO-BNAME IT_USBLO-ERDAT

IT_USBLO-TRDAT TR_MS 'LOCK'.

AT LAST.

ULINE /1(152).

ENDAT.

ENDLOOP.

ENDIF.

DESCRIBE TABLE IT_USBOR LINES L.

IF L GT 0.

CLEAR CONT.

LOOP AT IT_USBOR.

ADD 1 TO CONT.

IF CHECK_T EQ SPACE.

PERFORM EJECUTAR_US01 USING 'DELE' IT_USBOR-BNAME.

ENDIF.

PERFORM LISTAR USING IT_USBOR-BNAME IT_USBOR-ERDAT

IT_USBOR-TRDAT TR_MS 'DELE'.

AT LAST.

ULINE /1(152).

ENDAT.

ENDLOOP.

ENDIF.

ENDFORM. " EJECUTAR_TRANS

*&----

---

*

*& Form EJECUTAR_US01

*&----

---

*

• text

*----

---

*

• -->P_0154 text *

*----

---

*

FORM EJECUTAR_US01 USING VALCODE USUARIO.

REFRESH BDCDATAC.

MOVE: 'SAPLSUU5' TO BDCDATAC-PROGRAM,

'0050' TO BDCDATAC-DYNPRO,

'X' TO BDCDATAC-DYNBEGIN.

APPEND BDCDATAC.

CLEAR BDCDATAC.

MOVE: 'USR02-BNAME' TO BDCDATAC-FNAM, "Usuario SAP

USUARIO TO BDCDATAC-FVAL.

APPEND BDCDATAC.

CLEAR BDCDATAC.

IF VALCODE EQ 'LOCK'.

MOVE: 'BDC_OKCODE' TO BDCDATAC-FNAM, "OK_CODE

'=LOCK' TO BDCDATAC-FVAL.

APPEND BDCDATAC.

CLEAR BDCDATAC.

MOVE: 'SAPLSUU5' TO BDCDATAC-PROGRAM,

'0500' TO BDCDATAC-DYNPRO,

'X' TO BDCDATAC-DYNBEGIN.

APPEND BDCDATAC.

CLEAR BDCDATAC.

MOVE: 'BDC_OKCODE' TO BDCDATAC-FNAM, "OK_CODE

'=LOCK' TO BDCDATAC-FVAL.

APPEND BDCDATAC.

CLEAR BDCDATAC.

ELSEIF VALCODE EQ 'DELE'.

MOVE: 'BDC_OKCODE' TO BDCDATAC-FNAM, "OK_CODE

'=DELE' TO BDCDATAC-FVAL.

APPEND BDCDATAC.

CLEAR BDCDATAC.

MOVE: 'SAPLSPO1' TO BDCDATAC-PROGRAM,

'0300' TO BDCDATAC-DYNPRO,

'X' TO BDCDATAC-DYNBEGIN.

APPEND BDCDATAC.

CLEAR BDCDATAC.

MOVE: 'BDC_OKCODE' TO BDCDATAC-FNAM, "OK_CODE

'=YES' TO BDCDATAC-FVAL.

APPEND BDCDATAC.

CLEAR BDCDATAC.

ENDIF.

CALL TRANSACTION 'SU01' USING BDCDATAC

MODE 'N'

UPDATE 'S'

MESSAGES INTO BDCMSGCOLLM.

REFRESH BDCDATAC.

MOVE BDCMSGCOLLM-MSGV1(30) TO TR_MS.

CLEAR BDCMSGCOLLM.

REFRESH BDCMSGCOLLM.

ENDFORM. " EJECUTAR_US01

*&----

---

*

*& Form LISTAR

*&----

---

*

• text

*----

---

*

• -->P_IT_USBLO_USUARIO text *

*----

---

*

FORM LISTAR USING CODUS FECHA1 FECHA2 MENSAGE ACC.

DATA: NOMBRE(50), LOCKSTATE LIKE USLOCK . "RM 06-04-05

• Búsqueda del Nombre Completo del Usuario

CLEAR NOMBRE.

SELECT PERSNUMBER INTO USR21-PERSNUMBER FROM USR21

WHERE BNAME EQ CODUS.

ENDSELECT.

SELECT NAME_FIRST NAME_LAST INTO (ADRP-NAME_FIRST, ADRP-NAME_LAST)

FROM ADRP

WHERE PERSNUMBER EQ USR21-PERSNUMBER.

ENDSELECT.

CONCATENATE ADRP-NAME_FIRST ADRP-NAME_LAST INTO NOMBRE

SEPARATED BY SPACE.

IF ACC EQ 'LOCK'.

ADD 1 TO I.

IF I EQ 1.

ULINE /1(30).

WRITE: / SY-VLINE, 2 TEXT-002, 30 SY-VLINE.

ULINE /1(152).

WRITE: / SY-VLINE, 2 TEXT-005, 15 SY-VLINE, 17 TEXT-009,

68 SY-VLINE, 70 TEXT-007, 93 SY-VLINE, 95 TEXT-006,

118 SY-VLINE, 120 TEXT-008, 152 SY-VLINE.

ULINE /1(152).

ENDIF.

IF CONT EQ 1.

FORMAT COLOR 2 INTENSIFIED ON.

ELSEIF CONT EQ 2.

CLEAR CONT.

FORMAT COLOR 2 INTENSIFIED OFF.

ENDIF.

• Búsqueda del Status de Bloqueo del Usuario

CALL FUNCTION 'SUSR_USER_LOCKSTATE_GET'

EXPORTING

USER_NAME = CODUS

IMPORTING

LOCKSTATE = LOCKSTATE

EXCEPTIONS

USER_NAME_NOT_EXIST = 1

OTHERS = 2.

IF LOCKSTATE-LOCAL_LOCK EQ 'X'. "RM 06-04-05

MOVE 'BLOQUEADO' TO MENSAGE.

ELSE.

CLEAR MENSAGE.

ENDIF.

WRITE: / SY-VLINE, 2 CODUS, 15 SY-VLINE, 17 NOMBRE,

68 SY-VLINE, 70 FECHA1, 93 SY-VLINE, 95 FECHA2,

118 SY-VLINE, 120 MENSAGE, 152 SY-VLINE.

ELSEIF ACC EQ 'DELE'.

ADD 1 TO P.

IF P EQ 1.

ULINE /1(30).

WRITE: / SY-VLINE, 2 TEXT-003, 30 SY-VLINE.

ULINE /1(152).

WRITE: / SY-VLINE, 2 TEXT-005, 15 SY-VLINE, 17 TEXT-009,

68 SY-VLINE, 70 TEXT-007, 93 SY-VLINE, 95 TEXT-006,

118 SY-VLINE, 120 TEXT-008, 152 SY-VLINE.

ULINE /1(152).

ENDIF.

IF CONT EQ 1.

FORMAT COLOR 2 INTENSIFIED ON.

ELSEIF CONT EQ 2.

CLEAR CONT.

FORMAT COLOR 2 INTENSIFIED OFF.

ENDIF.

WRITE: / SY-VLINE, 2 CODUS, 15 SY-VLINE, 17 NOMBRE,

68 SY-VLINE, 70 FECHA1, 93 SY-VLINE, 95 FECHA2,

118 SY-VLINE, 120 MENSAGE, 152 SY-VLINE.

ENDIF.

ENDFORM. " LISTAR

[Former Member]

Hi,

This is how you proceed:

DATA: LV_ERDAT TYPE D,

LAST_DATE TYPE D,

LV_RELEASE LIKE sy-saprl,

LV_RELEASE1 LIKE sy-saprl,

lv_tabix like sy-tabix,

lv_lines like sy-dbcnt.

LAST_DATE = SY-DATUM.

LAST_DATE = LAST_DATE - DAYS.

LV_ERDAT = SY-DATUM - 30.

SELECT BNAME

ERDAT

TRDAT

UFLAG

into (w_usr02-bname,w_usr02-erdat,w_usr02-trdat,w_usr02-uflag)

from usr02

WHERE USTYP = 'A'

AND BNAME IN S_UNAME

AND ERDAT LT LV_ERDAT.

IF w_USR02-TRDAT < LAST_DATE.

IF w_USR02-TRDAT = '00000000' AND cb_nlog = 'X'.

IF w_USR02-ERDAT < LAST_DATE.

APPEND w_usr02 to i_usr02.

ENDIF.

ENDIF.

IF w_USR02-TRDAT <> '00000000' AND cb_llog = 'X'.

APPEND w_usr02 to i_usr02.

ENDIF.

ENDIF.

ENDSELECT.

describe table i_usr02 lines lv_lines.

if lv_lines gt 0.

if rb_lock eq 'X'.

delete i_usr02 where uflag ne 0.

endif.

This is the FM to lock users:

Try it out.

CALL FUNCTION 'BAPI_USER_LOCK'

EXPORTING

username = w_usr02-bname

TABLES

return = i_RET.

Read table i_ret with key type = 'S'. " Lock successfull

if sy-subrc = 0.

endif.

I have done 1 & 2 of ur requirements.

Hope the above gives u some tips to start off.

Regards,

Anjali.

[Former Member]

thanks ron and anjali.

[Former Member]

Hi Guys,

Your input has helped me a lot and solve the problem as well!. There is one more twist to the program. If i want to delete the "locked users" I know i have to use FM "BAPI_USER_DELETE" in the reqd. program. Is there a FM

like "BAPI_USER_UNDELETE" just to be on the safe side.

I used "BAPI_USER_UNLOCK" along with "BAPI_USER_LOCK" to play it safe. But for user deletion I can't find "UNDELETE".

Thanks

[athavanraja]

you wont find UNDELETE

you need to use

BAPI_TRANSACTION_COMMIT to commit the changes or

BAPI_TRANSACTION_ROLLBACK to roll back the changes.

Regards

Raja