Customer exit SUSR0001 to log off invalid user

[bharath_padmanabhan]

Experts,

I have 2 shifts of employees(first and second shift). I created 2 TPARA parameters(ZSHIFT1 and ZSHIFT2 and assigned it to user profile in SU01. I have maintained the working hours for these 2 shifts. In exit SUSR0001, I have written code to check if the current login time of the employee is within his shift hours or not. If its outside his shift hours, I am using popup TH_POPUP to show a message which says "You can't login outside your shift hours" and then using FM SYST_LOGOFF, I am logging off the user. 

        CALL FUNCTION 'TH_POPUP'
          EXPORTING
            client         = sy-mandt
            user           = sy-uname
            message        = lv_message
          EXCEPTIONS
            user_not_found = 1
            OTHERS         = 2.
        WAIT UP TO 10 SECONDS.
        IF sy-subrc EQ 0.
          CALL 'SYST_LOGOFF'.
        ENDIF.

This works fine. But there are a few smart users, who click the top left corner in the SAP screen and choose stop transaction. So the wait step for 10 seconds (which we added to allow the users to read the pop up message) gets cancelled and the user instantly gets access to the system. 

In our forum, I could see similar requirements like restricting an user to only login for a single terminal. I see that everyone has suggested the exit name but don't find how we can bypass this backdoor entry using stop transaction trick.

Can you please share your inputs if its feasible to kind of freeze or prevent users from clicking anywhere while the popup is displayed so that they will get logged off in 10 seconds?

Thanks

Bharath

[Sandra_Rossi]

Why not just removing WAIT UP TO 10 SECONDS? The Windows popup remains displayed.

[Ryan-Crosby]

The main GUI screen or the popup screen?

[bharath_padmanabhan]

Hi Sandra,

I removed the wait step and replaced FM TH_POPUP with POPUP_TO_INFORM. As you said, its showing the message and if the user clicks the green checkmark in the popup, he is logged off as I am calling the FM SYST_LOGOFF if sy-subrc eq 0.

But I see that the user still has the option to click the top left corner in the popup to open a new session and still login to SAP outside his shift hours as seen in the below image. 

Kindly let me know if its possible not to allow the user to take any backdoor entry like this to login to SAP.

Thanks

Bharath

[bharath_padmanabhan]

Hi Ryan

[bharath_padmanabhan]

Hi Ryan, Thanks a lot for your reply. Top left corner of popup screen.

[bharath_padmanabhan]

Please note that if I click the X mark in the popup or click the green checkmark in the popup, in both cases, it works as expected and the user gets logged off from the system.

[Sandra_Rossi]

Why did you replace TH_POPUP? If you remove WAIT, the popup remains displayed in my system.

[bharath_padmanabhan]

Hi Sandra, With TH_POPUP, I see that if I add the statement if sy-subrc eq 0 then call FM SYST_LOGOFF, in this case, the popup displays for a quick second and instantly logs off the user. Basically, TH_POPUP does not wait for a user response and immediately calls the statement following it. So I changed it to POPUP_TO_INFORM where I can check if the sy-subrc eq 0, only then call the FM to log off the user. In this case, only if the user clicks the X mark or the green check mark in the popup, this user action will set the subrc as zero and then log off the user. In this case, user can see the popup, take his time to read the message and then click the green check mark which will log him off.

[bharath_padmanabhan]

I want the user to be able to read the popup message, understand that he is logging in outside the shift hours and then log him out. Otherwise, too many users will start calling the help desk complaining they are not able to login to SAP even though they enter the correct id and password.

[Sandra_Rossi]

I don't know why there's a different behavior between your system and mine, as the TH_POPUP popup remains displayed after logoff, till the user presses the button OK. A possible solution is to make your ABAP code call a non-ABAP program on the user's laptop to display the popup (script, .exe, .ocx or whatever). The popup must not be part of SAP GUI of course, as you could experience.

[bharath_padmanabhan]

Hi Sandra, Thanks a lot for your reply. Can you please let me know the keyword I should search for when you say script? I see SAP GUI scripting. Is this the same you are referring to?

[bharath_padmanabhan]

Regarding TH_POPUP behavior, I was thinking why the previous developer has added wait step in code after the FM call? Atleast in my system, since the popup does not stay on the screen longer without the wait, I guess the developer added it. 1 advantage with this FM call is that, unlike POPUP_TO_INFORM, this does not have the option in the left corner of the screen where the user can open a new session and simply continue his work. But the downside is, the user still can click on the top left corner of the SAP GUI screen(extreme top left where we type the tcode) and this is how few users managed to sneak into the system.

[Sandra_Rossi]

SAP GUI Scripting for instance. I was referring to script in a general way, just a few lines in any programming language to display a popup.

[bharath_padmanabhan]

Ok Sandra. Thank you so much.

[bharath_padmanabhan]

Hi Sandra,

[bharath_padmanabhan]

Hi Sandra, Initially, the requirement came up that we have to validate the user login based on shift hours in SAP side. Later we finalized that the user will login in CRM and whenever he tries to access SAP ISU Tcode from within CRM, this validation should happen. Inside CRM, we won't get the top left corner button where the user can click and choose stop transaction. So the current solution to perform the validation using customer exit meets my requirement. Thank you so much.