Change Password restriction

Hi All,
I would like to a list of forbidden passwords in the portal.
Because I think that this is not possible out of the box, I did some custom development.
First I located the class where the check is done:
com.sap.security.core.sapmimp.logon.SAPMLogonLogic. I changed the object in such a way that is read the forbidden passwords from a xml file and then compares the new password with the forbidden password list. So far so good.
Now I have 2problems:
- How can I deploy this in a clean way? This class is a standaard part of the J2EE engine, how can I overrule the original one with mine ... .
- I already tried it the dirty way: replacing the org class file in the directory \usr\sap\EPD\JC00\j2ee\cluster\server0\apps\sap.com\com.sap.security.core.admin\servlet_jsp\logon\root\WEB-INF\classes\com\sap\security\core\sapmimp\logon
But this does not seem to be enough for letting the portal use the new class.
Can anyone help me with this deployment issue or can any-one tell me another way to check for forbidden passwords.
Thanks
Geert

Hi,
I assume you know what you are doing (it might be broken with any J2EE upgrade, SAP will not be to happy about support etc.)
In EP6 SP2 at least you need to replace the class file for SAPMLogonLogic in the jar file
c:\usr\sap\<epsid>\j2ee\j2ee_01\cluster\server\services\servlet_jsp\work\jspTemp\irj\root\WEB-INF\portal\portalapps\com.sap.portal.runtime.logon\lib\umelogonbase.jar
do this using the jar tool provide by sun for java (and remeber that the path must be the same as the package).
Cheers
Dagfinn

Similar Messages

How to restrict changing password for user ?

Hi All experts ,
We have created users . Users should not change their password without permission of Administrator . How to restrict them by setting Permissions / Authorizations ?
Thanks.
KISHORE SATPUTE

Hi,
In "USER MAINTENANCE- SU01" --> in the "logon tab" there are 5 different "user type"
1. dialog
2. system
3. communication
4. service
5. reference
Kindly mention the function and role of all the above mentioned user types specifically and hows is one user type different from another.
These are as follows:-
1. Dialogue:-
For this kind of users:-
GUI login is possible.
Initial password and expiration of passowrd are checked.
Multi GUI logins are checked.
Usage:- These are used for GUI logins.
2. System
For this kind of users:-
GUI login is not possible.
Initial password and expiration of passowrd are not checked.
Usage:- These are used for internal use in system like background jobs.
3. Communication
For this kind of users:-
GUI login is not possible.
Users are allowed to change password through some software in middle tier.
Usage:- These are used for login to system through external systems like web application
4. Service
For this kind of users:-
GUI login is possible.
Initial password and expiration of passowrd are not checked.
Multiple logins are allowed.
Users are not allowed to change the password. Only admin can change the password
Usage:- These are used for anonymous users. This type of users should be given minimum authorization.
5. Reference
For this kind of users:-
GUI login is not ible.
Initial password and expiration of passowrd are not checked.
Usage:- These are special kind of users which are used to give authorization to other users.
Rewads point if helpful
Thanks
Pankaj Kumar

How to Restrict users to change password

Hi All,
I would like to restrict user to change password only defined number of times in a day, Is it possible to do it through group policies.
Please note i am already aware of "Minimum Password age" feature, however i do not want to use it as the minimum value that i can set here is 1 day. I would like to restrict users based on password reset threshold e.g. User can reset his password
in a day only twice or thrice.
Thanx & Regards,
Wasim Parkar

If you want to limit the user to have his/her password changed for a specific number of time every day, I have to say
NO thats not possible. PSO's as other mentioned,can be used to have different password policies. Maybe you can set the msDS-MinimumPasswordAge
to 00:04:00:00 which is equal to 4 hours. It means every 4 hours a user will be able to change his/her password. So in each day a user can change the password 6 times, since a day is 24 hours.
Do not forget a day start from 00:00 AM up to 11:59 PM. So in a 9 to 5 job, a user may change the password 2-3 times.
Hope it helps.
Mahdi Tehrani Loves Powershell
Please kindly click on Propose As Answer or to mark this post as
and helpfull to other poeple.

I put parental controls on my sons computer and now he is unable to get onto many needed sites. I would like to change the restrictions but unfortunately I can not remember my passwords. How can I find my passwords?

I put parental controls on my sons mac book air and now he is unable to get onto many needed sites. I would like to change the restrictions but unfortunately I can not remember my passwords. How can I find my passwords?

That is stealing. Your friend has no right/licence to give the songs to you. It violates copyright law.

Restrict users from changing password on first login?

Hi,
I am doing mass user upload into UME using script import. How should I use the below functionality to restrict the users from changing password on first login?
IUserAccount uacc =UMFactory.getUserAccountFactory().newUserAccount(uid,newUser.getUniqueID());
uacc.setPassword("saras");
uacc.setPasswordChangeRequired(false);
How to implement above functionality with mass upload from script import?
Thanks
Srinivas
Edited by: srinivas M on Jan 20, 2009 9:05 PM

hi srinivas,
try this api
http://help.sap.com/javadocs/NW04S/current/se/com/sap/security/api/IUserAccount.html#isPasswordChangeRequired()
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/40d562b7-1405-2a10-dfa3-b03148a9bd19
this document able to retrive the password.. same positon u can disable the field
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/10649c90-24af-2b10-1086-ea0667ec3655
thanks

ISE 1.1 'Change password on next logon' fails on iPhone / iPad

Hello -
We're in the process of implementing an ISE 1.1 server for Guest Wireless Access / BYOD at our company and ran into an issue with authenticating from iPhones / iPads when the account is set with 'change password on next logon' (it's a local account created on the ISE server - not AD). It fails and displays 'unable to join network' on the iPhone. The ISE log shows a '5411: No response received in 120 seconds'. We're able to authenticate from Windows devices and are prompted to change the password during the authentication process. Has anyone else encountered this? If we uncheck the 'change password' box we can authenticate from iPhones & iPads without any issue but we need to have a way for users to set their own password.
Thanks!
Bill

Hi,
I am encountering the exact same issue in our lab environment, but with AD accounts (We would like customers to be able and connect to the dot1x network with their AD credentials, and based on machine authentication they will or will not get restricted access).
Just to be clear: the change password functionality works perfect on laptops, but on ipad/android we just cannot connect to the dot1x (PEAP) network when the "change password on next login" checkbox is on.
Anyone else who can shed some light on this?
Thanks
Tom

Change password at first login

Hi all,
In my JSF web app, if a user has his password reset by an admin, the new password is emailled to him, and as soon as he logs with the new password in he MUST change his password, before being allowed to use any other part of the site.
How can I force the "change password" screen to appear?
My current "hack" is to add this code to the beginning of every single JSF page:
<%
     final boolean userMustChangePasswordAtNextLogin = ((Boolean) MyAbstractView.evaluateValueBinding("#{loggedInUser.userBean.mustChangePasswordAtNextLogin}")).booleanValue();
     if(userMustChangePasswordAtNextLogin) {
%>
     <html>
          <head>
               <META HTTP-EQUIV="Refresh" CONTENT="0; URL=ChangePassword.jsp">
          </head>
     </html>
<% } else { %>
     [Regular JSP/JSF page content...]
<% } %>Is there a graceful JSF way of doing this? I've investigated the NavigationHandler, but it doesn't get invoked until the user clicks on a CommandButton or such like. I've investigated ViewHandler as well, but cannot see how this would help.
Any advice appreciated & many thanks in advance...
- Adam.

Thanks a lot SirG ....
This is what I have done so far:
package com.abc.send.controller.security;
import javax.faces.component.UIViewRoot;
import javax.faces.context.FacesContext;
import javax.faces.event.PhaseEvent;
import javax.faces.event.PhaseId;
import javax.faces.event.PhaseListener;
public class LoginPasswordPhaseListener implements PhaseListener
     public void afterPhase(final PhaseEvent phaseEvent)
          // Nothing to do
     public void beforePhase(final PhaseEvent phaseEvent)
          if(phaseEvent.getPhaseId().equals(PhaseId.RENDER_RESPONSE))
               final FacesContext facesContext = phaseEvent.getFacesContext();
               final String viewId = facesContext.getViewRoot().getViewId();
               final boolean userMustChangePasswordAtNextLogin = true;
               if((!viewId.equals("/logout.jsp")) && userMustChangePasswordAtNextLogin)
                    final UIViewRoot newRoot = facesContext.getApplication().getViewHandler().createView(facesContext,
                         "/restricted/changePassword.jsp");
                    facesContext.setViewRoot(newRoot);
     public PhaseId getPhaseId()
          // Seems that returning PhaseId.RESTORE_VIEW here doesn't work, so we
          // have to use an if expression in beforePhase(..)
          return PhaseId.ANY_PHASE;
}Then in the faces-config.xml:
<lifecycle>
    <phase-listener>com.abc.common.jsf.view.ViewScopePhaseListener</phase-listener>
    <phase-listener>com.abc.common.jsf.filter.secureserver.SecureServerPhaseListener</phase-listener>
    <phase-listener>com.abc.common.jsf.filter.browservalidation.BrowserValidationPhaseListener</phase-listener>
    <phase-listener>com.abc.common.jsf.filter.security.SecurityPhaseListener</phase-listener>
    <phase-listener>com.abc.common.jsf.filter.postback.PostBackValidationPhaseListener</phase-listener>
<phase-listener>com.abc.send.controller.security.LoginPasswordPhaseListener</phase-listener>
</lifecycle>So if final boolean userMustChangePasswordAtNextLogin = true; then on a successfull login currently I should be taken to the changePassword.jsp right ?

OIM AD Integration - 'User must change password at next logon'

Hi,
These are the issues in OIM AD integration that we are stuck up on:
Issue:
1. When OIM Admin resets the password for User1 in OIM, the password is propagated to AD but the ‘User must change password at next logon’ attribute is not updated in AD. As a result, if the User1 logs into AD account (i.e. computer), there is no prompt to change the password.
2. When AD Admin resets the password for User1 in AD and checks the ‘User must change password at next logon’ flag, the password is propagated to OIM but the ‘obpasswordchangeflag’ attribute (of oblixPersonPwdPolicy class) is not updated in OID. As a result, if the User1 logs into OIM account, there is no prompt to change the password.
Research:
1. For case 1 above: When OIM Admin resets the password for User1, the ‘User must change password at next logon’ attribute on the AD process form itself is not getting updated. So the AD Connector doesn’t propagate the attribute to AD.
2. For case 2 above: When the AD Admin resets the password for User1 in AD, the AD Password Sync connector only sends the password to OIM and not other attribute. So, there is no way to fetch the ‘User must change password at next logon’ attribute and then copy it into ‘obpasswordchangeflag’ attribute in OID.
Environment Details:
1. OIM-OAM-OAAM 11.1.1.5 BP02 integrated using OVD-OID 11.1.1.5
2. AD on WIN 2008 R2.
3. OIM AD Connector 9.1.1.7.2
4. AD Password Sync Connector 9.1.1.5
Any help would be highly appreciated!
Thanks,
Kulesh...

Thanks for your reply again.
I did not get you completely here. Can you please elaborate on the "process task on the AD Process which passes along the USR_PWD_MUST_CHANGE and immediately sets it to 0 this should work". How many total additional tasks would be needed here?
what all targets are you provisioning the password to?
- AD and OID (through LDAPSYNC)
where are end users allowed to change their passwords on (OIM,AD....??)
- Both OIM and AD.
Where can admins change the passwords?
- Currently they use ARS for such purposes but this is something we need to clearly define. The thing is, they use ARS for whole lot of purposes and we can't dictate/restrict them to use OIM only for password resets. So they may use ARS or OIM.
What do you suggest?
Edited by: Kulesh Kane on Nov 8, 2012 11:43 AM

Is there any way to change the restrictions passcode?

Is there any way to change the restrictions passcode short of erasing all content and starting over?

Remove restriction password
1. Restore to Factory Default
2. You can also restore from a backup before you enable the Restriction Code

How to open password restrictions? forgotten password you set

how to open password restrictions? forgotten password you set

If you've been backing up your iPhone with iTunes the following guide can help you extract the files from that backup and get the restrictions passcode - but Apple made a change that prevents this from working but it still works on older backups if you have one:
http://www.simonblog.com/2011/03/16/how-to-recover-forgotten-iphone-restrictions -passcode/
If you are running windows check the comments as well.

Password restrictions

I need to change the password restrictions of portal. How can I do this? I'm currently doing a migration and the users from the old application do not have any restrictions. I need to migrate all the users into OID with their passwords. I'm currently having errors saying that they need to have a numer in their passwords. Also, they do not need to have an expiration in their password.
Thanks

Hi Marcleo,
You may change the Password Syntax using the Password Policy Management facility in the Oracle Internet Directory. You can try this :-
1. Start the Oracle Directory Manager from the home of the iAS Infrastructure
2. Login as the OID administrator, i.e. orcladmin
3. Click on the + on the left of Password Policy Management
4. Click on your password policy ( the realm password policy ) to change the settings on the right pane
5. Click on the Password Syntax tab.
6. Change the " Minimum Number of Characters of Password " or/and the " Number of Numeric Characters in Password " to the values you need.
7. Click on the "Apply" button to save the changes.
You can also get more information about " Password Policy Management " in the OID Admin Guide here :-
http://download-west.oracle.com/docs/cd/B14099_18/idmanage.1012/b14082/pwdpolicies.htm#sthref2123
Regards,
Sandeep

If someone has wiped my ipad and changed passwords on icloud how do i get my data back

if someone has wiped my ipad and changed passwords on icloud how do i get my data back? please could someone help me out thanks

How did they wipe it? By using Find My iPad and performing a wipe? If so, that means they have your icloud ID and password, not a good thing.
You could try connecting it to iTunes and performing a restore from iCloud. But if they changed password, then you are out of the loop. How did they get your password in order to change it?

How to Enforce User Change Password First Time User in Release 2?

Hi...
We discovered in Oracle Directory Manager(in unix is oidadmin), there actualy
column to expiry date.(the default is 60).
We follow this notes in metalink..
Note:176470.1 Subject: How To Pre-Expire Portal Passwords
Even though the note is for Portal30(release1), we just wangt to try it in our Release 2...
Extract from the note
"3. Set the value of the column LAST_PASSWD_CHANGE_TIME in the table WWSEC_PERSON$ in SSO schema to a value older than the password expiration period (default is 90 days) before the current time (e.g. sysdate - 100) for the appropriate user(s)
4. For example, if you have created a user called TEST
you would issue a command such as:
update wwsec_person$
set LAST_PASSWD_CHANGE_TIME =sysdate-70
where USER_NAME='TEST';
commit; "
But, when we try to login again in the portal, we can still login...
So, is the function still exist in Release 2?..
If not, why Oracle Portal throw that function away?
Why there still columns in WWSEC_PERSON$ that maybe linked to the password problem?
can anybody help/explain?
Thanks....

Rather than rehash what has already been thoroughly discussed, check this thread. This should answer your question.
Can a user change his own password after admin has set it
The english version of Jose Troya's blog: http://obiee101.blogspot.com/2008/08/obiee-change-password.html
Edited by: LC143 on Aug 27, 2008 1:36 PM

In Portal Anonymous mode - Change password option not coming- login fails

Hi Experts,
We are having some application which requires login in anonymous mode. When we click the application and give the user id password, it loggs in properly, there is no problem in that.
But if the password is reset by administrator, then when entering the reset password given by admin it should ask to change the password. This is happening in normal scenario(/irj/portal), but when try the same in anonymous mode(irj/portal/anonymous) where the prompt is from the login required application, then it says login failed instead of giving the change password and confirm password screen.
Appreciate your help in solving this issue. I hope many would have faced similar situation.
Thanks
Yusuf

Hi Yusuf.
Do you use a standard or custom login module for your application?
More likely the used login module does not have a logic that handles such scenario as a change of user's password.
In this case you need to implement a custom module with a required functionality.
Best regards,
Aliaksandr Zhukau

User cannot change password option is automatically getting unchecked while giving domain admin rights

user cannot change password option is automatically getting unchecked while giving domain admin rights

Greetings!
"Domain Admins" falls into the category of protected groups and it is included in ADminSDHolder process. It is normal and was designed in order to prevent the modification to these privileged groups. More information on the link below:
AdminSDHolder, Protected Groups and SDPROP
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Change Password restriction

Similar Messages

Maybe you are looking for