Fire fighter logon and rfc/reject_expired_passwd=1

[jbm-sceis]

We just implemented parameter rfc/reject_expired_passwd=1 on our ECC system, and now we are not able to logon with a FFID. We use ID based fire fighters. I know that GRC sets a new password each time you get a EAM session going, and the password shows as initial each time. Has anybody run into this issue before?

Regards,

James

[amontella96]

Hi jbm-sceis

I post this as a comment bcz your question is "Has anybody run into this issue before?" and I didn't ..yet 😉

I'm passionate of sap security and my point is that parameter is particularly restrictive and perhaps time consuming... If the sap security is paramount in your installation I would rather make a frequent check on productive passwords in the RFCs (which means, not expired or initial passwords). instead of activating the value 1 for this parameter as described in 2579165

if this comment answer your question then I'll convert it to an answer otherwise do let me know your ideas

Thanks for posting this! A

[jbm-sceis]

Sorry, I'm answering my own question. Note 1702439 says you have to be a Service user in the plug-in. Now that I think of it, we used to have these FFIDs as service users, but then switched to Dialog due to a security recommendation we got from someone. Service users never have their passwords expire - somewhat of a security risk, but since GRC changes the password at each logon I think we can exempt FFIDs from that practice of no Service type users.

Aren't Mondays great?

Best Regards,

James