Changing Login Parameters

[Former Member]

Hi All,

We are planning to implement the Password Policy for SAP users in our organization...

we want to change next parameters

Login/no_automatic_user_sapstar

Login/fails_to_session_end

Login/password_expiration_time

Login/min_password digit

Login/min_password_letters

Login/min_password_special

Login/min_password_diff

so I have some questions,

first of all this change will be applied in our productive system SAP CRM  ABAP 7.0 with MSSQL

• what will be the impact when this change will be applied?, I mean the policies is inmediatly or for example it will be reflect until one user ask to be reset or until the expiration time defined will be get,
• what will happen with comunication users?, I have seen some documentation when mentiion that just communication users of certain type will be affected,  I can't understand it,, someone has experience doing that?

so I'm worried about communication users because we have some importants users that communicate BPM(JAVA SAP) or ESB (JAVA IBM),

thank you..

Alfred

[Former Member]

Hello,

Q-1 These parameters will be effective after system restart. It will not ask immediately to change the password but when password will be expired, it will ask to change it.

Q-2 Only system and service users are exempted and they will not ask to change passwords. In case of communication users, it will check whether password is expired or not and based on call whether it is interactive or non-interactive, it will ask to change the password.

Please refer to SAP note 327917 for more information.

Thanks,

Sunny

[Former Member]

full thanks for your answer,

but I have read the sap note 327917,

and Now I have one more question,

in that documentation says

Communication user 'C'

Individual system access (personalized)

• Logon with SAPGUI is not possible. The user is therefore not
  interaction-capable with the SAPGUI.

• Expired or initial passwords are checked but the conversion of the password
  change requirement that applies in principle to all users depends on the caller
  (interactive/not interactive). (*)

(*) With all non-interactive system accesses (that is, not using the SAPGUI),

the password change rule (which exists for all users except for system and

service users when passwords are initial or have expired) is not enforced by the

system if there is no interaction option. However, provided that you can execute

a password update dialog with the user (=> middleware, such as SAP ITS, for

example,),

!!it says that communication users with an interactive mode must to respect the rules and non interactive the rules ara not enforced :S

But communication users logon with SAPGUI is not possible , so I'm confused,,

What does mean this: !!!!(

caller (interactive/not interactive).

[Former Member]

Hello,

Non-interactive communication would be RFC calls where RFC should work even after password is expired. But is you will set parameter rfc/reject_expired_passwd to 1 then your RFC call will also not work as it will check for expired password.

Interactive communication will be there in systems like PI. Last line of SAP note 327917 states that "The user interaction (including handling error and exceptional situations) is provided here with the middleware (= RFC client)."

Thanks,

Sunny

[Former Member]

so, My unique worry is my communication user,

for example we have two communication users that works trough RFC's,  we have BPM Portal and the user bpmcomm is used each time that one user click and a functionality calls a RFC's from CRM,

this isn't a interactive way with GUI, so this user never would change the password,

this is true?