Changing Login Parameters

[#1]

Hi All,

We are planning to implement the Password Policy for SAP users in our organization...

we want to change next parameters

Login/no_automatic_user_sapstar

Login/fails_to_session_end

Login/password_expiration_time

Login/min_password digit

Login/min_password_letters

Login/min_password_special

Login/min_password_diff

so I have some questions,

first of all this change will be applied in our productive system SAP CRM  ABAP 7.0 with MSSQL

• what will be the impact when this change will be applied?, I mean the policies is inmediatly or for example it will be reflect until one user ask to be reset or until the expiration time defined will be get,
• what will happen with comunication users?, I have seen some documentation when mentiion that just communication users of certain type will be affected,  I can't understand it,, someone has experience doing that?

so I'm worried about communication users because we have some importants users that communicate BPM(JAVA SAP) or ESB (JAVA IBM),

thank you..

Alfred

[Matt_Fraser]

Alfredo,

To expand a bit on the answer to your first question, about when it will take effect, the answer is it depends.  It's true that the parameters don't take effect for the system until a restart, but as for when, after that, they impact the users depends on several factors.  Users will not be required to change their password until the expiration time has passed, but chances are that many of your users, if they've had accounts longer than the expiration time, will already be past that expiration time.  In that case, they will be asked to change their password with their next logons following the restart.  The exceptions will be people who have recently changed their password already or who have new user accounts.

As for the other parameters mandating password complexity, by default they will be applied the next time the user changes their password (which, for many, will be right away, as just described), but if the current password is not yet expired, it will be allowed to stand even if it doesn't meet the complexity rules until it does expire.  You can change this, however, with another parameter:  login/password_compliance_current_policy.  By default this parameter is inactive, but if you set it to 1, then users with passwords that don't meet the current complexity requirement will be forced to change right away, even if they are not expired.

With regard to your second question, about the impact of the new policy on your Communication users, here is the basic layout of impacts:

User Type	GUI Logon	Password Rules
Dialog	Yes	Yes
System	No	No
Communications	No	Yes*
Service	Yes	No

So yes, Communications users are subject to the password rules, but as Sunny was saying, generally the rules only impact interactive logons, and Communications users don't logon interactively (GUI Logon).  Still, if you want to be sure, you can change their type to System, and they still will not be able to logon interactively, and they will not be subject to password expiration.  Either way, they also will not be counted during license measurement.

Best regards,

Matt

[ClaudioBignamini]

I have a question, if I have the parameter login/password_compliance_current_policy set to 1 does it affect even the system and service users when I change the other password parameters?