Login using SU05 functions

[kimmo_sirpoma]

I read some of the questions in this BSP forum regarding login functionality.

Is it too oldfashioned to use SU05 (internet user) functionalities in BSP?

Of course I must myself write the appropriate BAPI calls for checking, creating interner users. I think with SU05's BAPIs users could self-register themselves.

It would be nice if somebody could summarize the technologigal logon possibities in BSP scenarios. I have special interest in scenarios where no named SAP user is used in application login ( of course in the application service definition there is a dummy SAP named user ).

[Former Member]

Hi,

I don't think it is old fashioned.

is it old fashioned to use simple ABAP code?

it all depends on your needs.

Using SU05 if great if you want to save some licenses.

When I was working in SAP Labs it was permitted to use this as a regular entry to the ITS.

I do not know what is SAP policy regarding this today.

I think it will be acceptable to use it for small application with the companies employees but not as a general rule. you have to check it with SAP.

now lets talk about the important stuff:

1. SU05 has several types of users. each of these users have all the BAPIS related so there is nothing you have to right unless you want to extend the functionality.

if you look at BAPI under CUSTOMER you will see all the change password, check password and more. you can just use that.

2. you have to logon using a specific user for the BSP with a fixed password and appropriate authorizations. once you are in, you have to set up a second logon that will take the user's name and password and will verify it against the BAPIs and then continu on.

3. for security you have to pass that user name between pages and to check that it is filed each time. A sophisticated user might be able to go directly to the second page so you have to put some protections in place.

regards,

Itay