SAP Library - Find your answers

Suppress Multi Login / Set Minimum Password Length

Suppress SAP Multi Login Message

You can suppress the multi login message by setting the parameter in the instance profile.

It is necessary if your company allows a single users to have multiple login and there tends to be cases where users will choose Options 1 which terminates the rest with the same user IDs. This can result in loss of data as the users may have not click the save button.

Use transaction code 'RZ10'.

Parameter name : login/multi_login_users

In this parameter, enter the name of all the users separated by "," comma for which you want to suppress the message while multi login with the same user IDs.

Take note that the multi login counter still counts even though you have suppress the message.

Currently to login into SAP, minimum password length = 3 characters.
How to define/change the minimum password to be 8 characters?

by: Rajdeep

To change parameter:

To avoid this problem, populate Table USR40 with forbidden or illegal passwords
combinations. Also, as of Web AS 6.10, instance profile parameter
"login/min_password_digits" can be set to a value >= 1 to force users enter at least one
digit in their password.

When an administrator creates a user account he assigns an initial password that has to be changed immediately when used for the first time.

When an administrator creates a user account (of type DIALOG or COMMUNICATION, see note 622464) he assigns an initial password that has to be changed immediately when used for the first time.
Note: The lifetime of initial passwords can be restricted (see notes 379081 and 450452).

Passwords reset by the administrator also need to be changed by the user on the next subsequent (interactive) logon.
Note: The lifetime of reset passwords can be restricted (see notes 379081 and 450452).

The default minimum length for passwords is 3. You can change this value with the profile parameter login/min_password_lng.
The maximum length is 8.
Passwords cannot have the symbols ""?"" or ""!"" as the first character.
The first 3 characters cannot occur in the same order in the user ID.
Note: As of Release 6. 10 (Web Application Server) this rule has been removed. It will only be checked in all releases up to 4.6D.

The first 3 characters cannot be identical.
The first three characters cannot contain space characters.
Note: As of Release 6. 10 (Web Application Server) this rule has been removed. It will only be checked in all releases up to 4.6D.

The password cannot be ""PASS"" or ""SAP*"".
The administrator can define patterns of ""illegal passwords"" (USR40).
You can use all characters from the syntactical character set, that is, all letters, figures, and some special characters.
Note: As of Release 6. 10 (Web Application Server) the password rules have been enhanced. It is then possible to define the minimal numbers of digits / characters / special characters that have to occur in new passwords:

login/min_password_digits

login/min_password_letters

login/min_password_specials

The system does not distinguish between upper and lower case.
The password can only be changed by the user after entering the correct old one.
Note: Prior to Release 6. 20 (Web Application Server) the password can only be changed during the course of logging on. As of Release 6.20 the password can be changed using the menu path ""System > User Profile > Own Data"" (SU3).

The new password must differ from the old password by at least one character (i.e. they cannot be identical).
Note: As of Release 6. 10 (Web Application Server) the minimum number of characters which differ between old and new password can be customized (login/min_password_diff).

The last 5 passwords that have been chosen by the user are stored in a user-specific password history and cannot be reused.
Note: The size of the password history is static (5) and cannot be customized.

The password can be changed by the user at most once a day. This rule prevents users from bypassing the password history rule.
Note: The administrator can reset user passwords at any time.

Changed password rules do not affect old passwords; password rules will only be evaluated at the moment the password change takes place.

As of Release 6.10 function module PASSWORD_FORMAL_CHECK can be used to determine whether a given string is compliant to the current password rules.

Overview of the improvements and changes in password rules or logon procedures that are delivered with Web AS ABAP 7.00 or NetWeaver 2004s

Passwords: Differentiation between upper and lower case; maximum length increased from eight to forty characters
For new passwords, the system distinguishes between upper and lower case ; in addition, passwords can now consist of up to forty characters (up until now, the maximum has been eight characters). In newly-installed systems, this applies immediately to all users; in systems that have been upgraded to Web AS ABAP 7.00 or NetWeaver 2004s from an earlier release, we have ensured that all users can continue to log on using their old password. Information that tells the system whether a user has a new password or a password of the old type is stored in the user master record; this information is analyzed when the system checks the password: if the user has a password of the old type, the system converts the first eight characters of the password into upper case; the remaining thirty-two characters must be spaces. Otherwise, the password is analyzed in its entirety and without being converted into upper case. In Unicode systems, you can use Unicode characters in passwords.

Relevant (new) profile parameters:
login/min_password_lowercase
login/min_password_uppercase
login/password_downwards_compatibility
Password history: size can now be defined as required (it used to be limited to five entries)
The passwords that the user has assigned in the course of a password change are stored in the password history (passwords set by the user administrator are not stored in the password history). The system prevents the user from reusing previously-used passwords. The password history used to be limited to five entries; you can now define the size of the password history (maximum value: 100 entries) using a profile parameter (login/password_history_size).
Lock period for password change can be selected (it used to be limited to one day)
To prevent the password history from being bypassed, a user may only change his or her password again after the lock period has passed (exception: the user is asked to change the password by the system). You can now select this lock period using the profile parameter login/password_change_waittime (maximum value: 1000 days).
(Advance) password change with stricter password rules
You can now set the system so that it asks only users whose current password no longer satisfies the current (stricter) password rules to change their password (in advance). To do this, set the profile parameter login/password_compliance_to_current_policy = 1.
Validity period of unused passwords can be restricted
Passwords that are not used by the authorized user are a security risk. For this reason, you are now able to restrict the validity period of these passwords; here, the system distinguishes between initial passwords (that is, passwords that are assigned by the user administrator and that are to be changed by the user at the next opportunity) and non-initial passwords (that is, passwords that have been set by the user). (Technical) users of the type SERVICE and SYSTEM are exempt from this regulation.

Relevant (new) profile parameters:
login/password_max_idle_initial
login/password_max_idle_productive
Logon: Compromising error messages are avoided
If you attempt to log on using incorrect logon data, the system now only issues the generic error message "Name or password is incorrect" as a rule; further reasons for failed logons (for example, locked user accounts, user account is outside validity period, and so on) are only given in detail when valid logon data has been passed. Error scenarios in which the system could not check the logon data, or where no further check is allowed are the exceptions to this rule:
"User has no password - logon using password is not possible"
"Password logon no longer possible - too many failed attempts"
The default values of certain profile parameters that are relevant to security have been changed:
login/failed_user_auto_unlock : 0 (instead of 1)
Locks for failed logon attempts remain valid for an unlimited period.
login/fails_to_user_lock : 5 (instead of 12)
The lock for failed logon attempts is set after five failed passwordlogon attempts.
login/no_automatic_user_sapstar : 1 (instead of 0)
The emergency user must be activated explicitly.
login/min_password_lng : 6 (instead of 3)
Passwords must consist of at least six characters.
login/ticket_expiration_time : 8 (instead of 60)
Logon tickets are only valid for eight hours.
The profile parameters login/password_max_new_valid and login/password_max_reset_valid have been replaced by the profile parameter login/password_max_idle_initial, which means that the system no longer distinguishes between the first and the subsequent setting of a password by the user administrator regarding the restriction of the validity of the resulting initial passwords.

Goto transaction SU01. Enter the user name and click on change icon.

Next goto logon data tab and press the deactivate button .The password will be deactivated.

List of useful Parameters for the Logon Password:

login/min_password_lng : This parameter defines the minimum length of the password.
Default value: 3; permissible values: 3 -8

login/min_password_digits: Defines the minimum number of digits (0-9) in passwords.
Default value: 0; permissible values: 0 -8

login/min_password_letters: Defines the minimum number of letters in passwords.
login/min_password_specials: Defines the minimum number of special Chars in passwords.

login/password_expiration_time: Defines the validity period of passwords in days.
Default value: 0; permissible values: any numerical value

A user account must have a password in order to be able to connect to the SAP system. When a user is created in SAP, an initial password is assigned to the user account. The initial password can be explicitly specified or system generated. The user is prompted to change the password on first logon attempt.

It is important to ensure that both the initial and new passwords must not be trivial.

A number of parameters can be used to manage password in SAP.

These include:
Login/password_expiration_time: This parameter defines the number of days after which a password must be changed.

Login/min_password_lng: This parameter defines the minimum password length.

Login/min_password digit: This parameter defines the minimum number of digits (0-9) in a password.

Login/min_password_letters: This parameter defines the minimum number of letters or alphabets (A-Z) in a password.

Login/min_password_special: This parameter defines the number of special characters in a password. These special characters include (), !, \, $ , %,:,’, “, ;, =, &, #, },],{,[, >, <.

Login/min_password_diff: This parameter defines the number of differing characters from previous password.

In order to enforce password complexity and ensure that passwords that can be easily guessed are not specified in the system, SAP provides table USR40, which is used to define prohibited passwords.
This table houses words that cannot be used as password in the SAP system.

? and * are two wild characters that can be used in conjunction with words defined in the USR40 table. While ? addresses single character, * addresses sequence of any combination of characters of any length.

For example, 123* forbids password that begins with 123; *123* forbids any password that contains the sequence 123 and XY? Forbid password that begin with XY and have additional characters such as XYX, XYY and XYZ.
Source Kehinde Eseyin