Login/password_max_new_valid vs login/password_max_reset_valid

Can anyone tell me what is the best practice values in setting login/password_max_new_valid and login/password_max_reset_valid fields?

login/password_max_new_valid----
Number of days that passwords of new accounts remain valid. After an administrator creates a new account and password it is the no. of days the password is valid for even though the user has not changed it or to be more specific not logged in yet. After the specified amount of days the password is deactivated.
This is only for the new accounts.
login/password_max_reset_valid------Number of days reset passwords remain valid.
This is the no of days the user can go without resetting or changing his password after it has been reset by the administrator.

Similar Messages

User is locked in R/3 but still access the application through portal

We are currently on NW2004s SP10 .
We locked the User A in R/3 SRM backend system and from Enterprise Portal the same User A login and try to access the SRM application in backend . The system is allowing to access which we want to prevent .
The authentication ticket type is "SAP Logon Ticket" . The User A is trying to access ITS services through Portal.
Do we have specific SSO parameter which needs to set in backend SRM application .
Thanks
Chandrashekhar K

Hi
We have maintained the following profile parameter for SSO in our SRM system . From portal we are accessing the SRM system
login/accept_sso2_ticket          1
login/certificate_request_ca_url     https://tcs.mySAP.com/invoke/tc/usercert
login/certificate_request_subject     CN=&UNAME, OU=&WPOU, O=mySAP.com User, C=DE
login/create_sso2_ticket          0
login/disable_cpic               0
login/disable_multi_gui_login          0
login/disable_multi_rfc_login          0
login/disable_password_logon          0
login/failed_user_auto_unlock          0
login/fails_to_session_end          3
login/fails_to_user_lock          3
login/isolate_rfc_system_calls          0
login/min_password_diff               1
login/min_password_digits          0
login/min_password_letters          0
login/min_password_lng               6
login/min_password_specials          0
login/multi_login_users               HP
login/no_automatic_user_sapstar          1
login/password_change_for_SSO          0
login/password_charset               1
login/password_expiration_time          60
login/password_logon_usergroup
login/password_max_new_valid          0
login/password_max_reset_valid          0
login/system_client               400
login/ticket_expiration_time          60
login/ticket_only_by_https          0
login/ticket_only_to_host          0
login/ticketcache_entries_max          1000
login/ticketcache_off               0
login/update_logon_timestamp          m
Please suggest as to change any parameter value . We want to restrict the user to access SRM system from portal if he is locked int e SRM system.
Thanks

CUP MSMP Work flow in GRC 10.0

Hi GRC Experts,
I am working on a MSMP Work flow requirement in GRC 10.0 and would appreciate any guidance/inputs on this.
As per my requirement we would have to design a CUP Work flow in GRC 10.0 to decommission a user in 24-hours if the user has not activated his/her new user account. After a user account is provisioned, system should wait for 24 hours to have user login/activate the account, otherwise decommission/disable the account. I have never heard of this functionality in GRC 5.3, so was not sure if this is something that can be designed and configured in 10.0. Would really appreciate if you can please guide us with requirement and advise if this can be implemented in GRC 10.0.
I know outside GRC , this requirement can be designed using a background job, which can monitor the provisioning and activation for a user account , however i am wondering if this can be designed and implemented with MSMP Work flow in GRC 10.0
Thanks every one for your valuable and precious time.
Cheers .. Vikas

Hi Vikas,
You doesn't require customized ABAP programs to achive this and neither GRC 10 and can be achived with the below login parameters:
login/password_max_idle_initial
login/password_max_new_valid
login/password_max_reset_valid
The login/password_max_idle_initial will make the initial password invalid if the user is not logged in, which means you are making the system secure if the user doesn't login to the system in specific number of days.
However, this will not decomission the user IDs. You may need to look at custom options to identify the users from USR02 table and lock them using standard BAPIs.
I am not sure on why Multi Stage/Multi Path is required for this??
Regards,
Raghu

TMSADM: Initial password expired

Dear community,
I've a urgent question, because the SAP support hasn't answered yet and I have got to fix the problem.
Because of security reasons we changed the following instance Parameters:
login/password_max_new_valid = 1 (The initial password of new users is only valid on the day of creation)
login/password_max_reset_valid = 1 (The initial password of an reseted user account is only valid on the day of change)
Now we have an problem with our Transport Management System (STMS) and the used communication user TMSADM. One day after the change of the parmters we always got an login prompt when we wanted to see the import queue of the systems in transaction STMS. When I start a authority-check in transaction SM59 for the RFC [email protected]_SID Iget the error "The initial password has expired; request a new one".
Now comes my question. Does anyone know how to fix the problem? I havn't found any solution in the SAP Service Marketplace and the SAP Support only wrote me that I should check the note 761637 and 713622, which don't fit exactly to my problem.
I'm searching now for an possibility to set an password for an communication or CPIC user. When I set an password in SU01 I can only set an initial password. So does anyone knows how to do? E.g.: when I have an dialog user i can change the password at startup, but how can I change it at an communication user?
Another posibilty is to run the check of the initialpassword not for the user TMSADM. Is this possible and if yes who can me tell how?
Please help me, I'm in urgent trouble, because me colleagues are angry about this result of changement.
Many thanks in advance.
Michael

I don't think that it is an good idea to change the password on the database. The values are only saved as hash-values and so it is not possible.
Further I found a solution on my own to fix the problem. I changed the user type from communiction to dialog and so I set the password in the dialog screen at login.
After that I changed the user type to communication aggain.
It works. I've just tested it and the next days I will take the change for our productive system.
Bye

Replace/Remove functionality in GRC 10

HI All
Would somebody be able to tell me what authorization objects and values are required for a user role to allow the user to perform remove or replacement in GRC 10.
The only way I can the user to see the list of assignments to replace or remove is to assign GRFN_USER with 02 value to the role.
Is this the only way?

Hi Vikas,
You doesn't require customized ABAP programs to achive this and neither GRC 10 and can be achived with the below login parameters:
login/password_max_idle_initial
login/password_max_new_valid
login/password_max_reset_valid
The login/password_max_idle_initial will make the initial password invalid if the user is not logged in, which means you are making the system secure if the user doesn't login to the system in specific number of days.
However, this will not decomission the user IDs. You may need to look at custom options to identify the users from USR02 table and lock them using standard BAPIs.
I am not sure on why Multi Stage/Multi Path is required for this??
Regards,
Raghu

TSV_TNEW_PAGE_ALLOC_FAILED at SEM BCS

Hey SAP-Admins !
I have a Problem with this shortdump TSV_TNEW_PAGE_ALLOC_FAILED at TA: UCWB_INT
We're running Windows 64 Bit / SAP + DB with 24 GB RAM and 30 GB swap space.
I don't understand why we got this dump cause cause we have ZAMM aktiv and only the
memory parameter 
Phys_memsize = 8192
abap/use_paging = 0 
abap/heaplimit = 408944640 
abap/swap_reserve = 20971520 
em/blocksize_KB = 1024 
abap/shared_objects_size_MB = 600 
rdisp/max_wprun_time = 3600 
aktiv.
memorystate on the OS-System at the Dump
http://i53.tinypic.com/zlexjc.jpg
output memlimits
D:\usr\sap\B07\SYS\exe\nuc\NTAMD64>memlimits -v off
SAP R/3 address space configuration test tool V3.2 (98/01/14)
=========================================================================
Verbose mode off
Check the maximum data size per process (malloc)
Maximum process heap size = 4096MB
----
| Result |
----
Maximum heap size per process........: 4096 MB
measurement limited to 4096 MB
this value is probably limited by swap space
Total available swap space...........: 4096 MB
measurement limited to 4096 MB
main memory size x 3 recommended , minimum 1 GB
swap space probably even bigger, but cannot be
totally allocated by only one process
output sappfpar
D:\usr\sap\B07\SYS\exe\nuc\NTAMD64>sappfpar check pf=D:\usr\sap\B07
\SYS\profile\
B07_DVEBMGS00_SAPBON1S22
================================================================================
== Checking profile: D:\usr\sap\B07
\SYS\profile\B07_DVEBMGS00_SAPBON1S22
================================================================================
***WARNING: Unexpected parameter: login/password_max_new_valid =0
***WARNING: Unexpected parameter: login/password_max_reset_valid =0
Shared memory disposition overview
================================================================
Key: 1 Size: 2500 ( 0.0 MB) System administration
Key: 2 Size: 5503580 ( 5.2 MB) Disp. administration
tables
Key: 3 Size: 13714400 ( 13.1 MB) Disp. communication areas
Key: 4 Size: 519448 ( 0.5 MB) statistic area
Key: 5 Size: 4096 ( 0.0 MB) SCSA area
Key: 6 Size: 362086400 ( 345.3 MB) ABAP program buffer
Key: 7 Size: 14838 ( 0.0 MB) Update task administration Key: 8 Size: 134217828 ( 128.0 MB) Paging buffer
Key: 9 Size: 268435556 ( 256.0 MB) Roll buffer
Key: 11 Size: 500000 ( 0.5 MB) Factory calender buffer
Key: 12 Size: 6000000 ( 5.7 MB) TemSe Char-Code convert
Buf.
Key: 13 Size: 40500000 ( 38.6 MB) Alert Area
Key: 14 Size: 4400128 ( 4.2 MB) Presentation buffer
Key: 16 Size: 22400 ( 0.0 MB) Semaphore activity
monitoring
Key: 17 Size: 2747780 ( 2.6 MB) Roll administration
Key: 18 Size: 917604 ( 0.9 MB) Paging adminitration
Key: 19 Size: 100000000 ( 95.4 MB) Table-buffer
Key: 30 Size: 30720 ( 0.0 MB) Taskhandler runtime admin. Key: 31 Size: 4806000 ( 4.6 MB) Dispatcher request queue
Key: 33 Size: 51200000 ( 48.8 MB) Table buffer,
part.buffering
Key: 34 Size: 16777216 ( 16.0 MB) Enqueue table
Key: 41 Size: 25010000 ( 23.9 MB) DB statistics buffer
Key: 42 Size: 7056992 ( 6.7 MB) DB TTAB buffer
Key: 43 Size: 32504728 ( 31.0 MB) DB FTAB buffer
Key: 44 Size: 7914392 ( 7.5 MB) DB IREC buffer
Key: 45 Size: 4842392 ( 4.6 MB) DB short nametab buffer
Key: 46 Size: 20480 ( 0.0 MB) DB sync table
Key: 47 Size: 4097024 ( 3.9 MB) DB CUA buffer
Key: 48 Size: 300000 ( 0.3 MB) Number range buffer
Key: 49 Size: 2769392 ( 2.6 MB) Spool admin
(SpoolWP+DiaWP)
Key: 51 Size: 3200000 ( 3.1 MB) Extended memory admin.
Key: 52 Size: 40000 ( 0.0 MB) Message Server buffer
Key: 54 Size: 4202496 ( 4.0 MB) Export/Import buffer
Key: 55 Size: 8192 ( 0.0 MB) Spool local
printer+joblist
Key: 57 Size: 1048576 ( 1.0 MB) Profilparameter in shared
mem
Key: 58 Size: 4096 ( 0.0 MB) Enqueue ID for reset
Key: 62 Size: 85983232 ( 82.0 MB) Memory pipes
Key: 63 Size: 409600 ( 0.4 MB) ICMAN shared memory
Key: 64 Size: 4202496 ( 4.0 MB) Online Text Repository
Buf.
Key: 65 Size: 41951232 ( 40.0 MB) Export/Import Shared
Memory
Key: 1002 Size: 400000 ( 0.4 MB) Performance monitoring
V01.0
Nr of operating system shared memory segments: 41
Shared memory resource requirements estimated
================================================================
Total Nr of shared segments required.....: 41
Shared memory segment size required min..: 362086400 ( 345.3 MB)
Swap space requirements estimated
================================================
Shared memory....................: 1181.0 MB
Processes........................: 247.4 MB
Extended Memory .................: 4096.0 MB

Total, minimum requirement.......: 5524.4 MB
Process local heaps, worst case..: 8192.0 MB
Total, worst case requirement....: 13716.4 MB
Errors detected..................: 0
Warnings detected................: 2
D:\usr\sap\B07\SYS\exe\nuc\NTAMD64>
thank you a lot !
Darius

Hey Mercedes, 
thank you for your answer! 
but this system are running with ZAMM configuration
1. The basis for zero administration memory management on Windows is the dynamically self-extending extended memory. An "infinitely" large memory resource is made available with this method. The extended memory is initially set to the size of the profile parameter PHYS_MEMSIZE ([PM]). If more memory is required by the user, the extended memory extends itself in steps of "[PM] / 2" up to the set limit of the profile parameter em/max_size_MB (64 Bit 100000) or until the address space in the Windows page file is used up.
In this case this DUMP is very strange cause there are no limits beside the PHYS_MEMSIZE parameter 
Roll area...................... 2417280 
Extended memory (EM)........... 2000358240 
Assigned memory (HEAP)......... 2000047808 
Short area..................... " " 
Paging area.................... 942080 
Maximum address space.......... " " 
best regards
Darius

Password Profile Parameter

Dear All,
Kindly advice,
We have recently changed the instance profile parameters for enabling
the password policy. The parameters that we changed are
login/password_expiration_time 60
login/min_password_specials 1
login/min_password_lng 8
login/min_password_letters 2
login/min_password_digits 1
login/password_max_new_valid 45
login/password_max_reset_valid 45
We are using ECC 4.7
After we have restarted the system, all users were prompted
automatically to change the passwords except three users which we had
created recently.. Although we have given the "login/min_password_lng"
as 8, it still taking 4 letters as password without any special
characters in it.
Kindly advice us in this regard and if u need any more information
please let us know.
Regards
GAURAV

Hi,
As said by António Barrote, might be you are having more application servers and parameters are set in one server only. If that is the case then if those 3 users are logging in to other server then it will not prompt. Also, if you say that, no we have only one server and all the parameters are set correctly and working fine for other 240 users. Then yes you are right.
As per my understanding, it has not asked for password change for these 3 users because this users are created recently and after creating them you have set the parameters. Hence after the parameters came in to effect it will not ask for password change for these 3 users because the password expiration is 60 days as per value you have set above. Hence after 60 days form the date when you have created those users and set password it will prompt them to change password and at that time it will not allow them to set password for length 4 letters, but will set as per the parameters.
Since for these 3 users password was set before enabling parameters those will apply only after expiration period. Otherwise what you can do is reset the password for them now and ask them to change it and now it will make them change password as per the parameters.
Hope clarified.
Thanks & Regards,
Sharath Babu M

How to disable password change for you logon first time.

hi,
When i change the password of any user or when i create new user and login with the same user it ask to change the password again can sap have provided to disable this feature where in user won't be ask to change password again.
thanks,
- John

Hi,
I'm not quite sure, but you can try with some of these profile parameters.
Initial Password: Limited Validity
login/password_max_new_valid - Validity period for the passwords of newly created users
login/password_max_reset_valid - Validity period for reset passwords
Svetlin

JCO RFC error

Hi Gurus,
I have created two JCO Destinitation for my RFC, when i am trying to ping the connection it says "ping successful" but when i test i am getting the following error.
com.sap.mw.jco.JCO$Exception: (103) RFC_ERROR_LOGON_FAILURE: The initial password has expired; request a new one
Can anyone please help me on this , this was not coming in my pervious system for which i have created the conection.
Is someting wrong on the ABAP system ?
points will be rewarded for quick solutions.
Rakesh

Hello Rakesh,
Change the user type of the communication user that UME uses in Transaction SU01 to "System" (B) in the ABAP end.
FYI
Due to an error in the installation program (SAPInst) for NetWeaver 2004 and due to an incorrect documentation, the communication user used by the UME has the type "Communication" (C).This type is incorrect because it is subject to the mandatory password change and the initial password ageing just like type "Dialog" (A) (see Note 622464).
The following profile parameters affect the system's response:
o rfc/reject_expired_passwd
o login/password_max_reset_valid (ABAP 6.20 / 6.40) or
login/password_max_idle_initial (ABAP 7.00) and
login/password_max_idle_productive (ABAP 7.00)
In delivery status, these profile parameters are set in such a way that the RFC logon is not affected.
This information is at SAP note 959242.
Thanks
Pankaj
PS:- /thread/727533 [original link is broken]
Same post .

JCO Exception

Hi Gurus,
I have created two JCO Destinitation for my RFC, when i am trying to ping the connection it says "ping successful" but when i test i am getting the following error.
com.sap.mw.jco.JCO$Exception: (103) RFC_ERROR_LOGON_FAILURE: The initial password has expired; request a new one
Can anyone please help me on this , this was not coming in my pervious system for which i have created the conection.
Is someting wrong on the ABAP system ?
points will be rewarded for quick solutions.
Rakesh

Hello Rakesh,
Change the user type of the communication user that UME uses in Transaction SU01 to "System" (B) in the ABAP end.
FYI
Due to an error in the installation program (SAPInst) for NetWeaver 2004 and due to an incorrect documentation, the communication user used by the UME has the type "Communication" (C).This type is incorrect because it is subject to the mandatory password change and the initial password ageing just like type "Dialog" (A) (see Note 622464).
The following profile parameters affect the system's response:
o rfc/reject_expired_passwd
o login/password_max_reset_valid (ABAP 6.20 / 6.40) or
login/password_max_idle_initial (ABAP 7.00) and
login/password_max_idle_productive (ABAP 7.00)
In delivery status, these profile parameters are set in such a way that the RFC logon is not affected.
This information is at SAP note 959242.
Thanks
Pankaj

Password Control

We have a concern that what if the basis user administrator uses the user id, which he has just created, for sometime and then communicates it to the actual user. The user promptly changes his password and starts using it. But some damage has already been done which may come to light after some time (if at all).
Is there a facility in SAP which helps in this case? Any body who faced same questions? Any solution - technical or administrative?

Hi Ralf,
you are referring to the problem of "remote function calls with SAPGUI usage" (option -GUI when using external RFC clients).
Yes, indeed this is a (general) problem - not limited to just the function module you have mentioned. Actually an "RFC connection with attached SAPGUI" is functionally similiar to an ordinary "SAPGUI connection". Consequently, the ability to interact with the user should be used to perform a (mandatory) password change dialog (when required). The fact that this is currently not done (although technically possible) could be considered a "functional deficit" (=> feature request) or "functional defect" (=> bug report).
Well, you can set profile parameter rfc/reject_expired_passwd = 1 (see <a href="http://service.sap.com/~iron/fm/011000358700000431401997E/161146">SAP note 161146</a>) but it impacts the entire system.
A more decent way to limit the impacts is to restrict the lifetime of initial passwords. This is possible as of ABAP 6.20 (see <a href="http://service.sap.com/iron/fm/011000358700000431401997E/450452">SAP note 450452</a>: profile parameter login/password_max_reset_valid and was refined with ABAP 7.00 (see <a href="http://service.sap.com/iron/fm/011000358700000431401997E/862989">SAP note 862989</a>: profile parameter login/password_max_idle_initial and login/password_max_idle_productive).
(Don't get confused: all those profile parameters are referring to initial/reset/expired passwords, except login/password_max_idle_productive, of course).
On the other hand:
under certain circumstances it might be desired to ignore password change requirements (e.g. when accessing backend systems through an Enterprise Portal), see <a href="http://service.sap.com/~iron/fm/011000358700000431401997E/869218">SAP note 869218</a>.
In general it is not possible for an ABAP backend to interact with the user in order to enforce a password change. In that case it is the responsibility of the RFC client to determine whether a password change is required and to react accordingly, resulting in password change requests (using RFC function module SUSR_USER_CHANGE_PASSWORD_RFC). <a href="http://service.sap.com/~iron/fm/011000358700000431401997E/899614">SAP note 899614</a> contains some corrections which enable the external RFC client to display detailed error messages (in case of rejected password change requests).
Regards, Wolfgang

No password sent in GRC10 notification for new users

Hi,
I have a strange problem in our GRC10 system.
We send email notifications to users on completion of user access requests after provisioning is complete. The notification contains the PROVISIONING variable, so new users should be notified of their initial password in the message. This works fine on tests against our development system. The email contains the user ID, the roles assigned, and the password information.
However when the same process is followed in our Production system, the notification only contains the user ID and roles provisioned - no sign of any password information.
We're currently running GRC 10.0 SP13. The plugins are all updated to the same level. We have the global provisioning configuration set OK, and all SAP Notes that appear to be related to the problem have been applied - but I still can't get emails to be displayed in the email notifications to new users.
Can anyone offer any hints or suggestions to try? I have even looked at password-related startup profile parameters as a last desperate straw. I found 4 differences in settings between our Dev and Prod systems. would theses cause an issue? the parameters were:
                                                                   Dev             Prod
login/min_password_digits                               0                  1
login/min_password_letters                              0                  1
login/password_downwards_compatibility          1                  3
login/password_max_reset_valid                     N/A                30
That 4th parameter doesn't exist in our Dev profile.
please help - I'm desperate on this one...

Hi Ian
I'm starting to run out of suggestions for you.I would probably put a trace on the RFC back to the GRC to see what the system user does. AS well as that check ST22, SM21 and SLG1 logs to see if any error. Already you've confirmed configuration and system match each other so it's down to data and security or program issue.
In using the trace, may be able to identify the function module/RFC and then do a consistency check on the code to make sure nothing out of the ordinary there. Depending on your background grabbing an ABAPer would help her.
Also, as it's your production system do you have multiple app servers and load balancing in play? It's one area where your DEV and PROD may vary. Possibly the password is "leaving" the plug-in but getting lost in the nether as it goes to your GRC. I'm taking a complete stab here and showing my deficiency in Basis and System Admin.
Otherwise, unless Marketplace has another correction not you probably need to raise an Incident.
Regards
Colleen

It hangs when I login DB

It has no response when I try to login database. I cancel the login since I don't have any choices
SQL> connect apps/apps
^CERROR:
ORA-00604: error occurred at recursive SQL level 1
ORA-01013: user requested cancel of current operation
But it is ok if I login as dba role like"/ as sysdba"
Please advice,
Amy

When did it last work for application users?
What changed?
Identify the faulty trigger & either fix or DROP it.
SQL> desc dba_objects
Name                            Null?    Type
OWNER                                  VARCHAR2(30)
OBJECT_NAME                             VARCHAR2(128)
SUBOBJECT_NAME                         VARCHAR2(30)
OBJECT_ID                             NUMBER
DATA_OBJECT_ID                         NUMBER
OBJECT_TYPE                             VARCHAR2(19)
CREATED                             DATE
LAST_DDL_TIME                             DATE
TIMESTAMP                             VARCHAR2(19)
STATUS                              VARCHAR2(7)
TEMPORARY                             VARCHAR2(1)
GENERATED                             VARCHAR2(1)
SECONDARY                             VARCHAR2(1)SELECT .... WHERE OBJECT_TYPE = 'TRIGGER' ....

SSO requires double login for partner application

I'm having some trouble with SSO partner applications, when I login to a SSO protected application, the login works fine, but when I try to navigate to another application I'm presented with the login page again, the sso cookie seems to be working since clicking on the login button without entering the user credentials works. For example, I log in to portal and from there I navigate to a forms application that is on the same server and the same port (portal: https://apps.mydomain.com:4444/pls/portal --> forms: https://apps.mydomain.com/forms/frmservlet?config=app) I am presented with the login page and after clicking on the login button without entering any information everything works fine. This is happening for all the middle tiers that are connected to the same OID. Any ideas on what can be wrong on my configuration?

Hi Andrey,
The problem sounds really wierd.
Can you check your SSO settings for your Portal ECC system? I mean, please check the User Management/Administration properties in your System Adminstration of Portal System that points to ECC.
Regards
Raja Sekhar

Partner application configuration is missing error on SSO login page

We have APEX 3.1.2 setup as a partner application and an application within APEX setup to use SSO for authentication. Following a link to the APEX application redirects to the Single Sign-On page, as it should, but it also shows "Error: The partner application configuration is missing or expired." I type in my password and username, click the Login button, and (if I entered my username and password correctly, of course!) then the APEX application is shown. So, I cannot figure out why we're getting the no_papp_err error and I have not found any solutions to that issue on Metalink or anywhere else on the Internet. Any ideas? I'm concerned that we have a misconfiguration somewhere that is causing this error and will affect any other partner application we setup in the future.
We're on Oracle Portal 10.1.4, SSO 10.1.2, and SSL is setup on both infra and mid tiers.

Did you try checking the partner application entries on the SSO-login server page?
please login as orcladmin or some other user with membership in, i beleive, iasadmins group. verify that for this partner application, what you see here corresponds to the application URL. it looks like your login page call may have issues. so check for login url too.
also check the ORASSO.WWSSO_LS_CONFIGURATION_INFO$ for entries corresponding to Apex application.

Login/password_max_new_valid vs login/password_max_reset_valid

Similar Messages

Maybe you are looking for